Play interactive tour

Edit tour

Windows Analysis Report usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Overview

General Information

Sample Name:	usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe
Analysis ID:	482656
MD5:	257e1f881863b023fcddaedb2ac22e68
SHA1:	9cff8e3a2a2cb5ad3acba8d4260b2581e0098ac9
SHA256:	856d455d07bff404e39b422f1ad0bbff9397707c86670dbc1134729b44a8c868
Tags:	exeguloader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Potential malicious icon found

Yara detected GuLoader

Initial sample is a PE file and has a suspicious name

Executable has a suspicious name (potential lure to open the executable)

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to call native functions

Program does not show much activity (idle)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe (PID: 4488 cmdline: 'C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe' MD5: 257E1F881863B023FCDDAEDB2AC22E68)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=10smU8Pga"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=10smU8Pga"}

Machine Learning detection for sample

Show sources

Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Joe Sandbox ML: detected

Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=10smU8Pga

Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

String found in binary or memory: http://creativecommons.org/licenses/by-nc-sa/3.0/

Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe, 00000001.00000002.775792747.000000000070A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Static file information: Suspicious name

Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe, 00000001.00000000.250160600.000000000041E000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDoorstep2.exe vs usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe
Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Binary or memory string: OriginalFilenameDoorstep2.exe vs usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02216F8F	1_2_02216F8F
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02212AE6	1_2_02212AE6
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02212AD8	1_2_02212AD8
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_0221279D	1_2_0221279D
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_022127F0	1_2_022127F0
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02216FC8	1_2_02216FC8
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02217023	1_2_02217023
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02216C33	1_2_02216C33
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_0221A848	1_2_0221A848
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02213C97	1_2_02213C97
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02213C9B	1_2_02213C9B
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_022150F5	1_2_022150F5
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02213D33	1_2_02213D33
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02215100	1_2_02215100
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_022151AB	1_2_022151AB
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_022195AE	1_2_022195AE
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_0221518E	1_2_0221518E
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02213DE8	1_2_02213DE8

Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02216F8F NtAllocateVirtualMemory,	1_2_02216F8F
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02216FC8 NtAllocateVirtualMemory,	1_2_02216FC8
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02217023 NtAllocateVirtualMemory,	1_2_02217023
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_022170A6 NtAllocateVirtualMemory,	1_2_022170A6
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_022170DB NtAllocateVirtualMemory,	1_2_022170DB

Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Process Stats: CPU usage > 98%

Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: classification engine

Classification label: mal84.rans.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_00417BB0 push dword ptr [edi+000000BCh]; ret	1_2_004185BC
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_00406E76 push 31716A05h; retf	1_2_00406E7B
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_00405A07 push ebx; iretd	1_2_00405A09
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_00404430 pushfd ; retf	1_2_00404432
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_004064DA push esi; ret	1_2_004064E5
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_0040708F push ebx; iretd	1_2_00407091
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_004052A7 push ebx; iretd	1_2_004052A9
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_00404F7C push es; iretd	1_2_00404F7D
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_00405F08 push es; iretd	1_2_00405F09
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_0040392D push esi; ret	1_2_00403934
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_004063CF push ebx; iretd	1_2_004063D1
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_00406FD7 push ebx; iretd	1_2_00406FD9
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_004039AE push ds; iretd	1_2_004039DF
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_004069B4 push es; iretd	1_2_004069B5
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_022106C4 push ecx; retf	1_2_022106C5
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02216B90 push 84000039h; ret	1_2_02216B95
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02213921 push esi; retf	1_2_02213922

Source: initial sample

Static PE information: section name: .text entropy: 7.12774451895

Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Code function: 1_2_02219CE4 rdtsc

1_2_02219CE4

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02216AA7 mov eax, dword ptr fs:[00000030h]	1_2_02216AA7
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02219781 mov eax, dword ptr fs:[00000030h]	1_2_02219781
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02214390 mov eax, dword ptr fs:[00000030h]	1_2_02214390
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02219069 mov eax, dword ptr fs:[00000030h]	1_2_02219069
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_0221A848 mov eax, dword ptr fs:[00000030h]	1_2_0221A848
Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	Code function: 1_2_02213C97 mov eax, dword ptr fs:[00000030h]	1_2_02213C97

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Code function: 1_2_02219CE4 rdtsc

1_2_02219CE4

Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe, 00000001.00000002.776406971.0000000000C90000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe, 00000001.00000002.776406971.0000000000C90000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe, 00000001.00000002.776406971.0000000000C90000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe, 00000001.00000002.776406971.0000000000C90000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe, 00000001.00000002.776406971.0000000000C90000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	Input Capture1	Security Software Discovery11	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Software Packing1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	System Information Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	10%	ReversingLabs
usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://creativecommons.org/licenses/by-nc-sa/3.0/	usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe	false		high

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	482656
Start date:	14.09.2021
Start time:	00:53:03
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 45s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	31
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.rans.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 28.7% (good quality ratio 11.4%) Quality average: 21.1% Quality standard deviation: 29.4%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Not all processes where analyzed, report is missing behavior information VT rate limit hit for: /opt/package/joesandbox/database/analysis/482656/sample/usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.872419363708927
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe
File size:	131072
MD5:	257e1f881863b023fcddaedb2ac22e68
SHA1:	9cff8e3a2a2cb5ad3acba8d4260b2581e0098ac9
SHA256:	856d455d07bff404e39b422f1ad0bbff9397707c86670dbc1134729b44a8c868
SHA512:	a3bdd1a69f697a1fe2f806f2e4cdb821bbbb837fe251151473c2af56b3785ecd4ad0902f099d83063da3f122fdd25cf781299e96c9ea035b6c90e72695166dda
SSDEEP:	3072:qywIsPNymxmfHABX/QzheEmIFVw7qdImz:qwsY4MABX/QHmEw8Im
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......O.......................D.......=.......Rich............PE..L.....BW.....................P......t.............@................

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x401574
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5742A6F8 [Mon May 23 06:45:12 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	44cde914d1969d7de2a52adae7c22460

Entrypoint Preview

Instruction
push 0040184Ch
call 00007FF67CC0D143h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+esi*8-72h], cl
retn E163h
sti
dec ecx
wait
sbb al, byte ptr [edx-5Dh]
mov esp, 002FE763h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
inc esp
imul esp, dword ptr [esi+65h], 746E6572h
imul esp, dword ptr [ecx+6Ch], 73726F66h
je 00007FF67CC0D1C4h
imul esp, dword ptr [ebp+72h], 65h
outsb
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
or al, 7Fh
hlt
movsb
or eax, 4730E031h
mov ecx, B0704388h
out 83h, al
dec ebx
mov ecx, A1BFB775h
fcom qword ptr [0C5DF7B1h+eax*2]
cmp ebx, dword ptr [esi+4F3A2C6Eh]
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 48000002h
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
push eax
dec ecx
push ebx
dec eax
add byte ptr [52000B01h], cl
popad

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1b864	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1e000	0x297b	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x130	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1ad84	0x1b000	False	0.591182002315	data	7.12774451895	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x1c000	0x1910	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1e000	0x297b	0x3000	False	0.703776041667	data	6.62716963651	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
1	0x1e994	0x102d	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States
1	0x1f9c1	0xfba	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x1e864	0x130	data
RT_ICON	0x1e57c	0x2e8	data
RT_ICON	0x1e454	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x1e424	0x30	data
RT_VERSION	0x1e1d0	0x254	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaHresultCheck, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, __vbaEnd, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaErrorOverflow, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaVarAdd, __vbaVarDup, __vbaStrToAnsi, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
InternalName	Doorstep2
FileVersion	1.04
CompanyName	CLubbing
ProductName	CLubbing
ProductVersion	1.04
FileDescription	CLubbing
OriginalFilename	Doorstep2.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe PID: 4488 Parent PID: 5160

General

Start time:	00:54:04
Start date:	14/09/2021
Path:	C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe'
Imagebase:	0x400000
File size:	131072 bytes
MD5 hash:	257E1F881863B023FCDDAEDB2AC22E68
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe PID: 4488 Parent PID: 5160 usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exeCOMMON

Executed Functions

Function 02216F8F, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(04CF8703,?,AD40CD1A), ref: 02217171

Strings

#Gf, xrefs: 02216F8F

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: #Gf
API String ID: 2167126740-1871556281
Opcode ID: c753b6661ab566a7f28a0b2c67b5e0de1a515cf8b71f4f7d1acaf66ffece111e
Instruction ID: 0f3db658dc1a83e22bda637c215d06e65c4a07eafec14bb4414ddaa23d3c91f5
Opcode Fuzzy Hash: c753b6661ab566a7f28a0b2c67b5e0de1a515cf8b71f4f7d1acaf66ffece111e
Instruction Fuzzy Hash: FA5148755143498FDB249E78D890BDF77F1AF69380F41452DCCCA9B255D3318681CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02216FC8, Relevance: 1.6, APIs: 1, Instructions: 134memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(04CF8703,?,AD40CD1A), ref: 02217171

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 46efdc78a980e84f65c370041d604cfc7e69fda0d93e6df8fd0ca46a38613c54
Instruction ID: c0278cc27da3d3e26ac935a7eb85f1b7f6fee24948c4e6f62f3decc7756f5062
Opcode Fuzzy Hash: 46efdc78a980e84f65c370041d604cfc7e69fda0d93e6df8fd0ca46a38613c54
Instruction Fuzzy Hash: 395124745143898FEB24AE74C890BDF7BF1AF69380F41452CCC89AB216D3318680CB82

Uniqueness

Uniqueness Score: -1.00%

Function 02217023, Relevance: 1.6, APIs: 1, Instructions: 127memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(04CF8703,?,AD40CD1A), ref: 02217171

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b07b57857fec29b42c20a3bbfa7f8dbe73aeb380a0d6b1465c18b4f939478f41
Instruction ID: accbc5c1c07a9145d3d575cd1018d9da4d88ce1672af64a012d623d86f46c1df
Opcode Fuzzy Hash: b07b57857fec29b42c20a3bbfa7f8dbe73aeb380a0d6b1465c18b4f939478f41
Instruction Fuzzy Hash: 9B4187351143958FDB209F78C894BEB7BF4AF6A354F85422CDCC99B252D3318A80CB81

Uniqueness

Uniqueness Score: -1.00%

Function 022170A6, Relevance: 1.6, APIs: 1, Instructions: 111memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(04CF8703,?,AD40CD1A), ref: 02217171

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e8539b0cbb63a9359fab7a26f4ffa62b3456e1e62c537e9ea220d84bfb7b46f6
Instruction ID: 855519ba3a9713a5237e2ae32e4e5f3f10d0440612af84ef9636b9c796b0b4c3
Opcode Fuzzy Hash: e8539b0cbb63a9359fab7a26f4ffa62b3456e1e62c537e9ea220d84bfb7b46f6
Instruction Fuzzy Hash: 1F4125341153898FDB309F78D895BDA7BF5EF6A354F484628DC8A9F252D7318A80CB80

Uniqueness

Uniqueness Score: -1.00%

Function 022170DB, Relevance: 1.6, APIs: 1, Instructions: 95memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(04CF8703,?,AD40CD1A), ref: 02217171

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 3c11d9f8d667caca77b5c5b7352eccf22b87b0aaa841f0119b83c76432955460
Instruction ID: 0bba1d21934536a6fe3f90a20f56dcde5da2ed0032887c7dca083a3eb9e9637a
Opcode Fuzzy Hash: 3c11d9f8d667caca77b5c5b7352eccf22b87b0aaa841f0119b83c76432955460
Instruction Fuzzy Hash: D13107345113998FDB209F798894BDB7BF9AF5A348F944628DC8A9F252D3318680CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00417BB0, Relevance: 249.2, APIs: 130, Strings: 12, Instructions: 728COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,00402B94,00000002), ref: 00417C69
__vbaAryConstruct2.MSVBVM60(?,00402BB0,00000011), ref: 00417C76
__vbaNew2.MSVBVM60(00402A08,0041C3C8), ref: 00417C8A
__vbaHresultCheckObj.MSVBVM60(00000000,0223EA7C,004029F8,00000014), ref: 00417CB2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A18,00000138), ref: 00417CE2
__vbaFreeObj.MSVBVM60 ref: 00417CEE
__vbaNew2.MSVBVM60(00402A08,0041C3C8), ref: 00417D06
__vbaHresultCheckObj.MSVBVM60(00000000,0223EA7C,004029F8,00000014), ref: 00417D34
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A18,00000068), ref: 00417D6C
__vbaFreeObj.MSVBVM60 ref: 00417D74
__vbaVarDup.MSVBVM60 ref: 00417D9A
#564.MSVBVM60(?,?), ref: 00417DAE
__vbaHresultCheck.MSVBVM60(00000000), ref: 00417DB9
__vbaVarTstNe.MSVBVM60(?,?), ref: 00417DE1
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00417DFE
#690.MSVBVM60(UNABSOLVABLE,KOMMANDOSEKVENS,epiplasmic,troen), ref: 00417E28
__vbaUI1I2.MSVBVM60 ref: 00417E39
__vbaUI1I2.MSVBVM60 ref: 00417E45
__vbaUI1I2.MSVBVM60 ref: 00417E52
__vbaUI1I2.MSVBVM60 ref: 00417E5F
__vbaUI1I2.MSVBVM60 ref: 00417E6C
__vbaUI1I2.MSVBVM60 ref: 00417E79
__vbaUI1I2.MSVBVM60 ref: 00417E86
__vbaUI1I2.MSVBVM60 ref: 00417E93
__vbaUI1I2.MSVBVM60 ref: 00417EA0
__vbaUI1I2.MSVBVM60 ref: 00417EAD
__vbaUI1I2.MSVBVM60 ref: 00417EBA
__vbaUI1I2.MSVBVM60 ref: 00417EC7
__vbaUI1I2.MSVBVM60 ref: 00417ED4
__vbaUI1I2.MSVBVM60 ref: 00417EE1
__vbaUI1I2.MSVBVM60 ref: 00417EEE
__vbaUI1I2.MSVBVM60 ref: 00417EFB
__vbaUI1I2.MSVBVM60 ref: 00417F08
__vbaUI1I2.MSVBVM60 ref: 00417F15
__vbaUI1I2.MSVBVM60 ref: 00417F22
__vbaUI1I2.MSVBVM60 ref: 00417F2F
__vbaUI1I2.MSVBVM60 ref: 00417F3C
__vbaUI1I2.MSVBVM60 ref: 00417F49
__vbaUI1I2.MSVBVM60 ref: 00417F56
__vbaUI1I2.MSVBVM60 ref: 00417F63
__vbaUI1I2.MSVBVM60 ref: 00417F70
__vbaUI1I2.MSVBVM60 ref: 00417F7D
__vbaUI1I2.MSVBVM60 ref: 00417F8A
__vbaUI1I2.MSVBVM60 ref: 00417F97
__vbaUI1I2.MSVBVM60 ref: 00417FA4
__vbaUI1I2.MSVBVM60 ref: 00417FB1
__vbaUI1I2.MSVBVM60 ref: 00417FBE
__vbaUI1I2.MSVBVM60 ref: 00417FCB
__vbaUI1I2.MSVBVM60 ref: 00417FD8
__vbaUI1I2.MSVBVM60 ref: 00417FE5
__vbaUI1I2.MSVBVM60 ref: 00417FF2
__vbaUI1I2.MSVBVM60 ref: 00417FFF
__vbaUI1I2.MSVBVM60 ref: 0041800C
__vbaUI1I2.MSVBVM60 ref: 00418019
__vbaUI1I2.MSVBVM60 ref: 00418026
__vbaUI1I2.MSVBVM60 ref: 00418033
__vbaUI1I2.MSVBVM60 ref: 0041803D
__vbaUI1I2.MSVBVM60 ref: 0041804A
__vbaUI1I2.MSVBVM60 ref: 00418057
__vbaUI1I2.MSVBVM60 ref: 00418064
__vbaUI1I2.MSVBVM60 ref: 00418071
__vbaUI1I2.MSVBVM60 ref: 0041807E
__vbaUI1I2.MSVBVM60 ref: 0041808B
__vbaUI1I2.MSVBVM60 ref: 00418098
__vbaUI1I2.MSVBVM60 ref: 004180A5
__vbaUI1I2.MSVBVM60 ref: 004180B2
__vbaUI1I2.MSVBVM60 ref: 004180BF
__vbaUI1I2.MSVBVM60 ref: 004180CC
__vbaUI1I2.MSVBVM60 ref: 004180D9
__vbaUI1I2.MSVBVM60 ref: 004180E6
__vbaUI1I2.MSVBVM60 ref: 004180F3
__vbaUI1I2.MSVBVM60 ref: 00418100
__vbaUI1I2.MSVBVM60 ref: 0041810D
__vbaUI1I2.MSVBVM60 ref: 0041811A
__vbaUI1I2.MSVBVM60 ref: 00418127
__vbaUI1I2.MSVBVM60 ref: 00418134
__vbaUI1I2.MSVBVM60 ref: 00418141
__vbaUI1I2.MSVBVM60 ref: 0041814E
__vbaUI1I2.MSVBVM60 ref: 0041815B
__vbaUI1I2.MSVBVM60 ref: 00418168
__vbaUI1I2.MSVBVM60 ref: 00418175
__vbaUI1I2.MSVBVM60 ref: 00418182
__vbaUI1I2.MSVBVM60 ref: 0041818F
__vbaUI1I2.MSVBVM60 ref: 0041819C
__vbaUI1I2.MSVBVM60 ref: 004181A9
__vbaUI1I2.MSVBVM60 ref: 004181B6
__vbaUI1I2.MSVBVM60 ref: 004181C3
__vbaUI1I2.MSVBVM60 ref: 004181D0
__vbaUI1I2.MSVBVM60 ref: 004181DD
__vbaUI1I2.MSVBVM60 ref: 004181EA
__vbaUI1I2.MSVBVM60 ref: 004181F7
__vbaUI1I2.MSVBVM60 ref: 00418204
__vbaUI1I2.MSVBVM60 ref: 00418211
__vbaUI1I2.MSVBVM60 ref: 0041821E
__vbaUI1I2.MSVBVM60 ref: 0041822B
__vbaUI1I2.MSVBVM60 ref: 00418238
__vbaUI1I2.MSVBVM60 ref: 00418245
__vbaUI1I2.MSVBVM60 ref: 00418252
__vbaUI1I2.MSVBVM60 ref: 0041825F
__vbaUI1I2.MSVBVM60 ref: 0041826C
__vbaUI1I2.MSVBVM60 ref: 00418279
__vbaUI1I2.MSVBVM60 ref: 00418286
__vbaUI1I2.MSVBVM60 ref: 00418293
__vbaUI1I2.MSVBVM60 ref: 004182A0
__vbaUI1I2.MSVBVM60 ref: 004182AD
__vbaUI1I2.MSVBVM60 ref: 004182BA
__vbaUI1I2.MSVBVM60 ref: 004182C7
__vbaUI1I2.MSVBVM60 ref: 004182D4
__vbaUI1I2.MSVBVM60 ref: 004182E1
__vbaUI1I2.MSVBVM60 ref: 004182EE
__vbaUI1I2.MSVBVM60 ref: 004182FB
__vbaUI1I2.MSVBVM60 ref: 00418308
__vbaUI1I2.MSVBVM60 ref: 00418315
__vbaUI1I2.MSVBVM60 ref: 00418322
__vbaNew2.MSVBVM60(00402A08,0041C3C8), ref: 0041833C
__vbaHresultCheckObj.MSVBVM60(00000000,0223EA7C,004029F8,0000001C), ref: 00418364
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402AA0,00000050), ref: 00418387
__vbaFreeObj.MSVBVM60 ref: 00418393
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,0040271C,000006F8), ref: 004183D5
__vbaStrCopy.MSVBVM60 ref: 004183F6
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,0040271C,000006FC), ref: 00418443
__vbaFreeStr.MSVBVM60 ref: 0041844B
__vbaStrCopy.MSVBVM60 ref: 00418484
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,0040271C,00000700), ref: 004184D0
__vbaFreeStr.MSVBVM60 ref: 004184D8
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,0040271C,00000704), ref: 00418520
__vbaHresultCheckObj.MSVBVM60(00000000,00401130,004026EC,000002B4), ref: 0041853D
__vbaVarAdd.MSVBVM60(?,00000008,?), ref: 00418577
__vbaVarMove.MSVBVM60 ref: 0041857E
__vbaVarTstLt.MSVBVM60(00000003,?), ref: 0041859F

Strings

Ths, xrefs: 00417CC2
KVINDESAGERS, xrefs: 004183A8
9E,, xrefs: 004183EC
UNABSOLVABLE, xrefs: 00417E23
Toatoa, xrefs: 00418451
Carboxylate9, xrefs: 00418493
`Eg9E,, xrefs: 004183FE, 00418404
troen, xrefs: 00417E14
epiplasmic, xrefs: 00417E19
c(, xrefs: 004183B5
KOMMANDOSEKVENS, xrefs: 00417E1E
ELIMINERINGERNES, xrefs: 004183D7

Memory Dump Source

Source File: 00000001.00000002.775112964.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.775070424.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.775318568.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.775330448.000000000041E000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$New2$Construct2Copy$#564#690ListMove
String ID: 9E,$Carboxylate9$ELIMINERINGERNES$KOMMANDOSEKVENS$KVINDESAGERS$Ths$Toatoa$UNABSOLVABLE$`Eg9E,$c($epiplasmic$troen
API String ID: 3808567424-1709419087
Opcode ID: 9e6487d76a17b21badf7060d16a33cfda1a3f6b0192c732e20f42937448c60af
Instruction ID: 62ab11980d2d214c7a38a79bfc4b2336bfd53bb39555a09b9e823723eccd0946
Opcode Fuzzy Hash: 9e6487d76a17b21badf7060d16a33cfda1a3f6b0192c732e20f42937448c60af
Instruction Fuzzy Hash: A1629330E013989FDB04DBA4C850BADFFBAAF99300F14809FD5596B382CA759945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00401574, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 90%

			_entry_(signed int __eax, void* __ecx, signed int __esi) {
				intOrPtr* _t8;

				_push("VB5!6&*"); // executed
				L0040156C(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t8 = __eax - 1;
				 *_t8 =  *_t8 + _t8;
				 *_t8 =  *_t8 + _t8;
				 *_t8 =  *_t8 + _t8;
				 *((intOrPtr*)(_t8 + __esi * 8 - 0x72)) =  *((intOrPtr*)(_t8 + __esi * 8 - 0x72)) + __ecx;
				return _t8;
			}

0x00401574
0x00401579
0x0040157e
0x00401580
0x00401582
0x00401584
0x00401586
0x00401588
0x00401589
0x0040158b
0x0040158d
0x0040158f
0x00401593

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401579

Strings

VB5!6&*, xrefs: 00401574

Memory Dump Source

Source File: 00000001.00000002.775112964.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.775070424.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.775318568.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.775330448.000000000041E000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 04dc402a509141f32f05d9ed3e1a979a22d05f2c2a605c903ede5597dff8ded7
Instruction ID: a9a64f0a8d0577a74fc374ace10a6a053e3a91dd41e7d38ba6a0c7280d282337
Opcode Fuzzy Hash: 04dc402a509141f32f05d9ed3e1a979a22d05f2c2a605c903ede5597dff8ded7
Instruction Fuzzy Hash: 39D0A42614E3C02EC303A3B009A280A2F300C932A031B44EB8082DF0F3886C4A4DC32A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0221A848, Relevance: 5.8, Strings: 4, Instructions: 836COMMON

Download Yara Rule

Strings

K%, xrefs: 0221AE6E
tII:, xrefs: 02210DA6
#X(Y, xrefs: 0221B2BB
x^, xrefs: 02210C44

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID: K%$#X(Y$tII:$x^
API String ID: 0-3787030115
Opcode ID: 1beb859bb189e8113e27b866d70fbccce81619accf1c2370bda8f5dff8da1137
Instruction ID: 01c8b2d92abf3bacb66992d19bdb47db1f6c0774106faad5742261c9b8bfe283
Opcode Fuzzy Hash: 1beb859bb189e8113e27b866d70fbccce81619accf1c2370bda8f5dff8da1137
Instruction Fuzzy Hash: 41625A715183868FDB359F78C898BDB7BE2AF62350F49826ECC898F299D3748545C702

Uniqueness

Uniqueness Score: -1.00%

Function 02213C97, Relevance: 1.9, Strings: 1, Instructions: 606COMMON

Download Yara Rule

Strings

O\x, xrefs: 02213E80

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O\x
API String ID: 0-407445725
Opcode ID: ed6ba3d757bdd33758868d3e6a0c0e8057e779fe66541afa222803f0e0515bae
Instruction ID: 5afed1468d4fc9dd73c83b73da359ea17b6cb59ff78e3fcba13a9fbb8f522ce7
Opcode Fuzzy Hash: ed6ba3d757bdd33758868d3e6a0c0e8057e779fe66541afa222803f0e0515bae
Instruction Fuzzy Hash: 4522F07171034ADFDB34DE68CCA4BEA73E2BF69350F55422ADC899B248D7709982CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02213C9B, Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

O\x, xrefs: 02213E80

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O\x
API String ID: 0-407445725
Opcode ID: bd02e4ab5afb0e004939338d4d5ff893d59047c88a43a3ada42d5a4cbcbd387a
Instruction ID: 5a4ff5cb563b5ab8f1b26bd30a1b24e33f1e2a41dbe0ca93ea7668e899b89d02
Opcode Fuzzy Hash: bd02e4ab5afb0e004939338d4d5ff893d59047c88a43a3ada42d5a4cbcbd387a
Instruction Fuzzy Hash: 81C11F712103869FDB34DE68CCA0BEA77E6BF69390F54422ADC4CDB244DB719942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02213D33, Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

O\x, xrefs: 02213E80

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O\x
API String ID: 0-407445725
Opcode ID: 092cf996bcbe4e2f0f8b2d0b6293034ee6a3bcabc3f508c08558ca9b28edb2af
Instruction ID: a97cca59c947f70dddbfa881f12f30545df4a1a3eb5e8e384c1d1124f90b3d36
Opcode Fuzzy Hash: 092cf996bcbe4e2f0f8b2d0b6293034ee6a3bcabc3f508c08558ca9b28edb2af
Instruction Fuzzy Hash: EFB10071210346DFDB38DE68CCA0BEA77E2BF65390F44422DDC499B284DB719951CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02213DE8, Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

O\x, xrefs: 02213E80

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID: O\x
API String ID: 0-407445725
Opcode ID: 7b9fe9df6bb2f354034ea45ec86374b825f2b632a92b5b5ea6e5af61d45c0a95
Instruction ID: eeddbe86672f4e61c2e8b8bc1cd657c384ef194700fdc86c3e279b27422f0f1d
Opcode Fuzzy Hash: 7b9fe9df6bb2f354034ea45ec86374b825f2b632a92b5b5ea6e5af61d45c0a95
Instruction Fuzzy Hash: CEA11171610386DFDB38DE68C8A0BEA77E2BF25390F14422EDC4D9B284D7719951CB91

Uniqueness

Uniqueness Score: -1.00%

Function 022150F5, Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

:C>, xrefs: 0221517D

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :C>
API String ID: 0-1874313912
Opcode ID: 674d878aac23ff60f3339ed5c909f369a98c63611ea15c58eec4ae6878d221df
Instruction ID: 2a37bfdce73ad52b8fb45df9041255b61c2797172688942d4f765367b5a63cf0
Opcode Fuzzy Hash: 674d878aac23ff60f3339ed5c909f369a98c63611ea15c58eec4ae6878d221df
Instruction Fuzzy Hash: 0D51E0312647498FCB30CEA5CAD1BEB73E2AFA8645FD0426ACD4D9B209D3756950CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02215100, Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

:C>, xrefs: 0221517D

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :C>
API String ID: 0-1874313912
Opcode ID: 8c7c08bdae0a9d036c447c7f2cf75aa6c483ddee3df7cf8f139446e2e1678f7d
Instruction ID: f41417c971f6327debd20843abc160c464285842739a7dc76a6494457b6a33ff
Opcode Fuzzy Hash: 8c7c08bdae0a9d036c447c7f2cf75aa6c483ddee3df7cf8f139446e2e1678f7d
Instruction Fuzzy Hash: 5251F0311243499FCB30CE65C9D1FEB37E6AFA9744F90426ACD4E9B209D3316950CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0221518E, Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

:C>, xrefs: 0221517D

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID: :C>
API String ID: 0-1874313912
Opcode ID: 64cc33d6d3f0461f72ddebb71e7a0902539d83fa862d694a9f5cf5f2993034ce
Instruction ID: 3d3e7d40888cfe0f99a558dd410d362b450d8d513f50c0be31127f467bc8bff9
Opcode Fuzzy Hash: 64cc33d6d3f0461f72ddebb71e7a0902539d83fa862d694a9f5cf5f2993034ce
Instruction Fuzzy Hash: 1D51DF322247499FCB30CE65CAD1BEB77F2AFA9744F90426ACD4E9B209D3316950CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0221279D, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aead36487baf4824d980cf713b600894996c6ac1457c5ce540a947f097a3e2de
Instruction ID: 6ee5352adf2e21a3e4358bc8489d57bdf0e13aa7413a47cb9eb370eff890fe3d
Opcode Fuzzy Hash: aead36487baf4824d980cf713b600894996c6ac1457c5ce540a947f097a3e2de
Instruction Fuzzy Hash: 9091F671A1035A8FCF349E699D68BEA37F3AFA5390F44412DDC8DCB248D7308A81CA11

Uniqueness

Uniqueness Score: -1.00%

Function 02214390, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7022542fb58f60505b105f6396001b9f2b900f798a5777822fe7f20a63476ce8
Instruction ID: 88fe3b8dcf52a641510faf71886302cbbe3820acd7fb9bd27494c35db965b8e5
Opcode Fuzzy Hash: 7022542fb58f60505b105f6396001b9f2b900f798a5777822fe7f20a63476ce8
Instruction Fuzzy Hash: 9661F271714249DFDB249E68CC64BEA73E2BFA9310F954129EC8D8B254C731D985CB41

Uniqueness

Uniqueness Score: -1.00%

Function 022127F0, Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccd837e1503370e55309f68af3156a5a193e088f9e59ab97e2a37238a1b653a0
Instruction ID: f9e9e4ac5c48a0b38ea2dc77a3e0299ea5d6b3826c6bdf5e66f54a36589c8a59
Opcode Fuzzy Hash: ccd837e1503370e55309f68af3156a5a193e088f9e59ab97e2a37238a1b653a0
Instruction Fuzzy Hash: 22510571A1434A8FDF349E69DC64BEB37E7AFA5380F45412DEC8D8B244D7318A81CA52

Uniqueness

Uniqueness Score: -1.00%

Function 02212AE6, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da3b8787b0fdb1d2db17728be454f3b69b3001caa633d7d0bb750f516a431dd3
Instruction ID: 001be3c3aa2a27b4a38486d92f5bb8954a79b14a1b3ececd3f1bc5008f2396c0
Opcode Fuzzy Hash: da3b8787b0fdb1d2db17728be454f3b69b3001caa633d7d0bb750f516a431dd3
Instruction Fuzzy Hash: CF4164756243858FDB209E28CC59BFB3BFAAF65394F56421DAC89C7250D3358A84CB42

Uniqueness

Uniqueness Score: -1.00%

Function 022151AB, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c47347cf4fd85c7f961d6040ce3c4771ae658357ef287fb3b0863f4b2f369642
Instruction ID: b846b2bc0a0142f361e3efef7539e42ed163eaba069222c74e48ec6bb2a8c1f4
Opcode Fuzzy Hash: c47347cf4fd85c7f961d6040ce3c4771ae658357ef287fb3b0863f4b2f369642
Instruction Fuzzy Hash: A641F13126034ADFCB30CE65CAD1BEB77F2AFA9644FD0426ACD499B209D335A940CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02212AD8, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ddcf3e21b64d9b5bd284680b9a15610b8f485f5c407afc92c80f9dc87574857c
Instruction ID: efedc498da57ca819dacfd51029a5656ac73b07525a7c2686f4ffefd1a7100b9
Opcode Fuzzy Hash: ddcf3e21b64d9b5bd284680b9a15610b8f485f5c407afc92c80f9dc87574857c
Instruction Fuzzy Hash: 774132756243858FDB209E68CC55BFB7BFAAF65390F46062DACC9C7250D3348A84CB42

Uniqueness

Uniqueness Score: -1.00%

Function 022195AE, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0542ca8462cc6a658dea83a4ac9e743f6818144caebc8b513a9ffbf5d9a48c4
Instruction ID: 6b417e74d681d4fa11c2b1eccadb033ea39542db36d1ecaa46ce743200fdb74e
Opcode Fuzzy Hash: e0542ca8462cc6a658dea83a4ac9e743f6818144caebc8b513a9ffbf5d9a48c4
Instruction Fuzzy Hash: 89315D7A6143878BCF248DF885E07E763D2EF7A790F85826EDC8797649D3604886C241

Uniqueness

Uniqueness Score: -1.00%

Function 02219781, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa369a475702b22b062ae03a66d87a990792b243e04bfa310b9111e0e7a90f6c
Instruction ID: ef752b090ace526d34d11f3a9312468ffa410d938bb76e696a0e9eea7e3b35ec
Opcode Fuzzy Hash: fa369a475702b22b062ae03a66d87a990792b243e04bfa310b9111e0e7a90f6c
Instruction Fuzzy Hash: 6621AE74B253468FDB34CDA98AE4BDA73E2BF68B90F55802EDC49CB209D731DA408601

Uniqueness

Uniqueness Score: -1.00%

Function 02216C33, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57afeb37e65171b13d846ebe25498a70085cadbe62ed2fb407a35a2623fe3b38
Instruction ID: d199842fc4c027ecea6e162833b1075ca6719a1451fb32a01301f88a6619d804
Opcode Fuzzy Hash: 57afeb37e65171b13d846ebe25498a70085cadbe62ed2fb407a35a2623fe3b38
Instruction Fuzzy Hash: 45210870598346CFEB64AE29C951BFEB3E6EF61380F42452DDCCA86518D3344982CB06

Uniqueness

Uniqueness Score: -1.00%

Function 02219CE4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea314c754cc1d1300de3b501e951b3abaafc2cb7594cb4293ecc787b34527e82
Instruction ID: 6e440ebfda1cacb75bbe45e909225c69131b2a91c814b3145de93836d918b13c
Opcode Fuzzy Hash: ea314c754cc1d1300de3b501e951b3abaafc2cb7594cb4293ecc787b34527e82
Instruction Fuzzy Hash: BDC080C65341170959513DFA632846709558FE15E0B5447113C458D50CED41DF855455

Uniqueness

Uniqueness Score: -1.00%

Function 02216AA7, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d522460b912078d5ee7dcee46340dd44af19c4a150417766d9bfb0cea860d2b6
Instruction ID: 4b8dfac8b4cac835e1bae24a7f84a18b868ba7804292193ea1288721b0ff2b07
Opcode Fuzzy Hash: d522460b912078d5ee7dcee46340dd44af19c4a150417766d9bfb0cea860d2b6
Instruction Fuzzy Hash: 3DC092BB6016C09FFF86CE08E895B4173B4FBA9A88B0944D4EC02CF755E324FA00CA04

Uniqueness

Uniqueness Score: -1.00%

Function 02219069, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.777526639.0000000002210000.00000040.00000001.sdmp, Offset: 02210000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d28c77b0db6e6cd6a6dbc7000b6e85b71a4fb7704178ed937162487a0b81315d
Instruction ID: d76e649fd07ef3d0d8751e0228423dd6316194b0615e95c75db1fc1412d0f54a
Opcode Fuzzy Hash: d28c77b0db6e6cd6a6dbc7000b6e85b71a4fb7704178ed937162487a0b81315d
Instruction Fuzzy Hash: F2B09234211684CFCA41CA08C190F8073B4B704740F010480E9008BB11D228E800CA00

Uniqueness

Uniqueness Score: -1.00%

Function 0041B010, Relevance: 142.1, APIs: 80, Strings: 1, Instructions: 351COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0041B05F
__vbaAryConstruct2.MSVBVM60(?,00402C90,00000011), ref: 0041B070
__vbaVarDup.MSVBVM60 ref: 0041B08A
#558.MSVBVM60(?), ref: 0041B094
__vbaFreeVar.MSVBVM60 ref: 0041B0AB
__vbaOnError.MSVBVM60(00000000), ref: 0041B0BB
__vbaUI1I2.MSVBVM60 ref: 0041B0CC
__vbaUI1I2.MSVBVM60 ref: 0041B0D8
__vbaUI1I2.MSVBVM60 ref: 0041B0E5
__vbaUI1I2.MSVBVM60 ref: 0041B0F2
__vbaUI1I2.MSVBVM60 ref: 0041B0FF
__vbaUI1I2.MSVBVM60 ref: 0041B10C
__vbaUI1I2.MSVBVM60 ref: 0041B119
__vbaUI1I2.MSVBVM60 ref: 0041B126
__vbaUI1I2.MSVBVM60 ref: 0041B133
__vbaUI1I2.MSVBVM60 ref: 0041B140
__vbaUI1I2.MSVBVM60 ref: 0041B14D
__vbaUI1I2.MSVBVM60 ref: 0041B15A
__vbaUI1I2.MSVBVM60 ref: 0041B167
__vbaUI1I2.MSVBVM60 ref: 0041B174
__vbaUI1I2.MSVBVM60 ref: 0041B181
__vbaUI1I2.MSVBVM60 ref: 0041B18E
__vbaUI1I2.MSVBVM60 ref: 0041B19B
__vbaUI1I2.MSVBVM60 ref: 0041B1A8
__vbaUI1I2.MSVBVM60 ref: 0041B1B5
__vbaUI1I2.MSVBVM60 ref: 0041B1C2
__vbaUI1I2.MSVBVM60 ref: 0041B1CF
__vbaUI1I2.MSVBVM60 ref: 0041B1DC
__vbaUI1I2.MSVBVM60 ref: 0041B1E9
__vbaUI1I2.MSVBVM60 ref: 0041B1F6
__vbaUI1I2.MSVBVM60 ref: 0041B203
__vbaUI1I2.MSVBVM60 ref: 0041B210
__vbaUI1I2.MSVBVM60 ref: 0041B21D
__vbaUI1I2.MSVBVM60 ref: 0041B22A
__vbaUI1I2.MSVBVM60 ref: 0041B237
__vbaUI1I2.MSVBVM60 ref: 0041B244
__vbaUI1I2.MSVBVM60 ref: 0041B251
__vbaUI1I2.MSVBVM60 ref: 0041B25E
__vbaUI1I2.MSVBVM60 ref: 0041B26B
__vbaUI1I2.MSVBVM60 ref: 0041B278
__vbaUI1I2.MSVBVM60 ref: 0041B285
__vbaUI1I2.MSVBVM60 ref: 0041B292
__vbaUI1I2.MSVBVM60 ref: 0041B29F
__vbaUI1I2.MSVBVM60 ref: 0041B2AC
__vbaUI1I2.MSVBVM60 ref: 0041B2B9
__vbaUI1I2.MSVBVM60 ref: 0041B2C6
__vbaUI1I2.MSVBVM60 ref: 0041B2D3
__vbaUI1I2.MSVBVM60 ref: 0041B2E0
__vbaUI1I2.MSVBVM60 ref: 0041B2ED
__vbaUI1I2.MSVBVM60 ref: 0041B2FA
__vbaUI1I2.MSVBVM60 ref: 0041B307
__vbaUI1I2.MSVBVM60 ref: 0041B314
__vbaUI1I2.MSVBVM60 ref: 0041B321
__vbaUI1I2.MSVBVM60 ref: 0041B32E
__vbaUI1I2.MSVBVM60 ref: 0041B33B
__vbaUI1I2.MSVBVM60 ref: 0041B348
__vbaUI1I2.MSVBVM60 ref: 0041B355
__vbaUI1I2.MSVBVM60 ref: 0041B362
__vbaUI1I2.MSVBVM60 ref: 0041B36F
__vbaUI1I2.MSVBVM60 ref: 0041B37C
__vbaUI1I2.MSVBVM60 ref: 0041B389
__vbaUI1I2.MSVBVM60 ref: 0041B396
__vbaUI1I2.MSVBVM60 ref: 0041B3A3
__vbaUI1I2.MSVBVM60 ref: 0041B3B0
__vbaUI1I2.MSVBVM60 ref: 0041B3BD
__vbaUI1I2.MSVBVM60 ref: 0041B3CA
__vbaUI1I2.MSVBVM60 ref: 0041B3D7
__vbaUI1I2.MSVBVM60 ref: 0041B3E4
__vbaUI1I2.MSVBVM60 ref: 0041B3F1
__vbaUI1I2.MSVBVM60 ref: 0041B3FE
__vbaUI1I2.MSVBVM60 ref: 0041B40B
__vbaUI1I2.MSVBVM60 ref: 0041B418
__vbaUI1I2.MSVBVM60 ref: 0041B425
__vbaUI1I2.MSVBVM60 ref: 0041B432
__vbaUI1I2.MSVBVM60 ref: 0041B43F
__vbaUI1I2.MSVBVM60 ref: 0041B44C
__vbaUI1I2.MSVBVM60 ref: 0041B459
__vbaEnd.MSVBVM60 ref: 0041B461
__vbaAryDestruct.MSVBVM60(00000000,?,0041B49B), ref: 0041B48B
__vbaFreeStr.MSVBVM60 ref: 0041B494

Strings

enakteres, xrefs: 0041B076

Memory Dump Source

Source File: 00000001.00000002.775112964.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.775070424.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.775318568.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.775330448.000000000041E000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#558Construct2CopyDestructError
String ID: enakteres
API String ID: 3426752192-4231501920
Opcode ID: 1821cf15ed71f4c791172340d4a13dc4e6b98ab68bce64955f98547b9698ded6
Instruction ID: 45a1cffc3c398bab4a9dd0cba403ad159500d74d35cc320a1ed307ee6fe74fea
Opcode Fuzzy Hash: 1821cf15ed71f4c791172340d4a13dc4e6b98ab68bce64955f98547b9698ded6
Instruction Fuzzy Hash: 5FE12835A051988FD709DBE8C5506ECBFF6AFAD200F24419FC54167383CA669E46CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0041B4D0, Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 144COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 0041B527
#618.MSVBVM60(?,00000001), ref: 0041B533
__vbaStrMove.MSVBVM60 ref: 0041B53E
__vbaStrCmp.MSVBVM60(00402CB8,00000000), ref: 0041B54A
__vbaFreeStr.MSVBVM60 ref: 0041B55D
__vbaNew2.MSVBVM60(00402A08,0041C3C8), ref: 0041B57E
__vbaHresultCheckObj.MSVBVM60(00000000,0223EA7C,004029F8,00000014), ref: 0041B5A9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A18,00000138), ref: 0041B5DA
__vbaFreeObj.MSVBVM60 ref: 0041B5DF
__vbaNew2.MSVBVM60(00402A08,0041C3C8), ref: 0041B5F7
__vbaHresultCheckObj.MSVBVM60(00000000,0223EA7C,004029F8,00000014), ref: 0041B61C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402A18,00000068), ref: 0041B63C
__vbaFreeObj.MSVBVM60 ref: 0041B641
__vbaVarDup.MSVBVM60 ref: 0041B65B
#600.MSVBVM60(?,00000002), ref: 0041B667
__vbaFreeVar.MSVBVM60 ref: 0041B672
__vbaFreeStr.MSVBVM60(0041B6B4), ref: 0041B6AD

Strings

Kalkgravs, xrefs: 0041B5BA
Hyperhilariously, xrefs: 0041B64D
var, xrefs: 0041B507

Memory Dump Source

Source File: 00000001.00000002.775112964.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.775070424.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.775318568.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.775330448.000000000041E000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$#600#618CopyMove
String ID: Hyperhilariously$Kalkgravs$var
API String ID: 1542644099-1014535997
Opcode ID: 75b49307b5bd115d379a4fb918bbddd1f413b4d37166dea96f10d6a4f0f0bb71
Instruction ID: e524e37eb1f3a6f41f4d25a0e971b9e3763872e1b9832c2c8c75129bee148811
Opcode Fuzzy Hash: 75b49307b5bd115d379a4fb918bbddd1f413b4d37166dea96f10d6a4f0f0bb71
Instruction Fuzzy Hash: 55518E71940208AFCB10DF94DE89EDDBBB5FB18704F20412AF501B72A0DB785A85CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 00418DA0, Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00418DF5
#714.MSVBVM60(?,?,00000000), ref: 00418E19
__vbaVarTstNe.MSVBVM60(?,?), ref: 00418E35
__vbaFreeVarList.MSVBVM60(00000002,00000005,?), ref: 00418E4B
#648.MSVBVM60(00000005), ref: 00418E6B
__vbaFreeVar.MSVBVM60 ref: 00418E7A
#536.MSVBVM60(0000000A), ref: 00418E86
__vbaStrMove.MSVBVM60 ref: 00418E91
__vbaFreeVar.MSVBVM60 ref: 00418E9A
#532.MSVBVM60(AWKWARDNESS), ref: 00418EA1
#536.MSVBVM60(00000005), ref: 00418EB9
__vbaStrMove.MSVBVM60 ref: 00418EC4
__vbaFreeVar.MSVBVM60 ref: 00418ECD
__vbaFreeStr.MSVBVM60(00418F0C), ref: 00418EFF
__vbaFreeStr.MSVBVM60 ref: 00418F04
__vbaFreeStr.MSVBVM60 ref: 00418F09

Strings

AWKWARDNESS, xrefs: 00418E9C

Memory Dump Source

Source File: 00000001.00000002.775112964.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.775070424.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.775318568.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.775330448.000000000041E000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#536Move$#532#648#714CopyList
String ID: AWKWARDNESS
API String ID: 1150874924-1149946547
Opcode ID: 522703188cc78a0c4727e46b10f9d9cf69b7e07fc1076ea3d540e260a170975f
Instruction ID: f4cc4e8f0969f7116d3afab972cf356932b3d00f3d98994b1bc57935b8535447
Opcode Fuzzy Hash: 522703188cc78a0c4727e46b10f9d9cf69b7e07fc1076ea3d540e260a170975f
Instruction Fuzzy Hash: D141B4B1C10259ABCB04DFA4ED849DDBFB8FF48705F10412AE506B7260DB741989CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0041B6F0, Relevance: 16.6, APIs: 11, Instructions: 97COMMON

Download Yara Rule

APIs

#632.MSVBVM60(?,?,00000000,?), ref: 0041B762
__vbaStrVarVal.MSVBVM60(?,?), ref: 0041B770
#516.MSVBVM60(00000000), ref: 0041B777
__vbaFreeStr.MSVBVM60 ref: 0041B78D
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 0041B79D
#617.MSVBVM60(00000002,?,000000FF), ref: 0041B7BE
#617.MSVBVM60(00000002,?,00000000), ref: 0041B7DC
__vbaStrVarMove.MSVBVM60(00000002), ref: 0041B7E6
__vbaStrMove.MSVBVM60 ref: 0041B7F1
__vbaFreeVar.MSVBVM60 ref: 0041B7FA
__vbaFreeStr.MSVBVM60(0041B82E), ref: 0041B827

Memory Dump Source

Source File: 00000001.00000002.775112964.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.775070424.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.775318568.000000000041C000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.775330448.000000000041E000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#617Move$#516#632List
String ID:
API String ID: 3155365896-0
Opcode ID: 2ba102f566834a886e146638be37f32a5b5136e73ec2abdec04d00af493cc49e
Instruction ID: 7fa3ba9ba936bb90ac0ebe2186f1c5452957c7a6b6a8c671753ba5050f33a766
Opcode Fuzzy Hash: 2ba102f566834a886e146638be37f32a5b5136e73ec2abdec04d00af493cc49e
Instruction Fuzzy Hash: 904109B1C01249ABCB04DFE5DA849DEFBB8EF58704F20811AE512B7264D7785A09CF94

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe PID: 4488 Parent PID: 5160

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exe PID: 4488 Parent PID: 5160 usd15.030 payment copy & signed invoice SEPTEMBER 2021 shipment.exeCOMMON

Function 00401574, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
COMMON