Play interactive tour

Edit tour

Windows Analysis Report BESTPREIS-ANFRAGE.exe

Overview

General Information

Sample Name:	BESTPREIS-ANFRAGE.exe
Analysis ID:	490033
MD5:	8d3b546ad98991973c7e6711e41a89ad
SHA1:	c14f4afa5d0c5b29087d5d43a6c9f1b9c2393c19
SHA256:	5fdae1f887f2b5fd73bd94b5bf0f4168600c285238114fb016afe88da811312c
Tags:	DEUexegeoGuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to call native functions

Program does not show much activity (idle)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

BESTPREIS-ANFRAGE.exe (PID: 6828 cmdline: 'C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe' MD5: 8D3B546AD98991973C7E6711E41A89AD)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1rXtK"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1rXtK"}

Multi AV Scanner detection for submitted file

Show sources

Source: BESTPREIS-ANFRAGE.exe

ReversingLabs: Detection: 28%

Source: BESTPREIS-ANFRAGE.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1rXtK

Source: BESTPREIS-ANFRAGE.exe, 00000000.00000002.856430845.000000000074A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: BESTPREIS-ANFRAGE.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: BESTPREIS-ANFRAGE.exe, 00000000.00000002.856347893.0000000000416000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameVENALIZE.exe vs BESTPREIS-ANFRAGE.exe
Source: BESTPREIS-ANFRAGE.exe	Binary or memory string: OriginalFilenameVENALIZE.exe vs BESTPREIS-ANFRAGE.exe

Source: BESTPREIS-ANFRAGE.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_0226C61F	0_2_0226C61F
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02266672	0_2_02266672
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02260775	0_2_02260775
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_022677B2	0_2_022677B2
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_022657B0	0_2_022657B0
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02260780	0_2_02260780
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_0226544D	0_2_0226544D
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_0226557A	0_2_0226557A
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_022665A3	0_2_022665A3

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02267B4F NtAllocateVirtualMemory,		0_2_02267B4F
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02267C4A NtAllocateVirtualMemory,		0_2_02267C4A

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe

Process Stats: CPU usage > 98%

Source: BESTPREIS-ANFRAGE.exe

ReversingLabs: Detection: 28%

Source: BESTPREIS-ANFRAGE.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe

File created: C:\Users\user\AppData\Local\Temp\~DFEC32C876104529D6.TMP

Jump to behavior

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_00409087 push ss; ret	0_2_004090BD
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_00408917 pushfd ; retf	0_2_00408918
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_004059D8 push edx; retf	0_2_00405A0E
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_00408A48 push ecx; ret	0_2_00408A56
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_00402A69 push es; iretd	0_2_00402A6F
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_00405218 push ebx; iretd	0_2_00405229
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_00409B16 pushad ; retf	0_2_00409B19
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02264B33 push es; iretd	0_2_02264B4D
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02260B6A push ebp; iretd	0_2_02260B77
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02264EFD push esp; iretd	0_2_02264F00
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02261C0A push cs; ret	0_2_02261C47
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_0226A410 pushad ; iretd	0_2_0226A414
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02268CB0 push 2E9BB4ECh; iretd	0_2_02268CB5
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02261D1D push ecx; retf	0_2_02261D1E
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02264DEE push eax; iretd	0_2_02264DF5

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	RDTSC instruction interceptor: First address: 000000000040E830 second address: 000000000040E830 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 popfd 0x00000004 mfence 0x00000007 popad 0x00000008 nop 0x00000009 mfence 0x0000000c dec edi 0x0000000d cmp eax, 000000D2h 0x00000012 pushfd 0x00000013 popfd 0x00000014 cmp edi, 00000000h 0x00000017 jne 00007F682498CB8Eh 0x00000019 nop 0x0000001a pushfd 0x0000001b popfd 0x0000001c pushad 0x0000001d wait 0x0000001e cmp ecx, 00000084h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	RDTSC instruction interceptor: First address: 0000000002267298 second address: 0000000002267298 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 1185650Fh 0x00000007 xor eax, 7B4D8634h 0x0000000c xor eax, 869DF991h 0x00000011 add eax, 13AAE557h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F6824AEA438h 0x0000001e lfence 0x00000021 mov edx, AEB5F928h 0x00000026 xor edx, 1B41005Dh 0x0000002c add edx, 46E6D0EDh 0x00000032 xor edx, 8325CA76h 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 pop ecx 0x00000042 add edi, edx 0x00000044 dec ecx 0x00000045 mov dword ptr [ebp+000001E9h], eax 0x0000004b mov eax, BC0FD70Dh 0x00000050 xor eax, CB05B517h 0x00000055 xor eax, 98705113h 0x0000005a xor eax, EF7A3309h 0x0000005f cmp ecx, eax 0x00000061 mov eax, dword ptr [ebp+000001E9h] 0x00000067 jne 00007F6824AEA3F2h 0x00000069 mov dword ptr [ebp+000001BBh], esi 0x0000006f mov esi, ecx 0x00000071 push esi 0x00000072 cmp bh, ch 0x00000074 mov esi, dword ptr [ebp+000001BBh] 0x0000007a test dl, cl 0x0000007c call 00007F6824AEA4F1h 0x00000081 call 00007F6824AEA459h 0x00000086 lfence 0x00000089 mov edx, AEB5F928h 0x0000008e xor edx, 1B41005Dh 0x00000094 add edx, 46E6D0EDh 0x0000009a xor edx, 8325CA76h 0x000000a0 mov edx, dword ptr [edx] 0x000000a2 lfence 0x000000a5 ret 0x000000a6 mov esi, edx 0x000000a8 pushad 0x000000a9 rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe

Code function: 0_2_02267290 rdtsc

0_2_02267290

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_022670AD mov eax, dword ptr fs:[00000030h]	0_2_022670AD
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_0226A1B6 mov eax, dword ptr fs:[00000030h]	0_2_0226A1B6
Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe	Code function: 0_2_02269C63 mov eax, dword ptr fs:[00000030h]	0_2_02269C63

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe

Code function: 0_2_02267290 rdtsc

0_2_02267290

Source: BESTPREIS-ANFRAGE.exe, 00000000.00000002.856524305.0000000000DD0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: BESTPREIS-ANFRAGE.exe, 00000000.00000002.856524305.0000000000DD0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: BESTPREIS-ANFRAGE.exe, 00000000.00000002.856524305.0000000000DD0000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: BESTPREIS-ANFRAGE.exe, 00000000.00000002.856524305.0000000000DD0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	Input Capture1	Security Software Discovery21	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
BESTPREIS-ANFRAGE.exe	29%	ReversingLabs	Win32.Trojan.Tnega

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	490033
Start date:	24.09.2021
Start time:	21:31:39
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	BESTPREIS-ANFRAGE.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 17.5% (good quality ratio 9%) Quality average: 24.3% Quality standard deviation: 27.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.82.209.104, 173.222.108.226, 173.222.108.210, 20.54.110.249, 40.112.88.60, 80.67.82.211, 80.67.82.235, 23.211.4.86, 20.82.210.154 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, iris-de-ppe-azsc-neu.northeurope.cloudapp.azure.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information VT rate limit hit for: /opt/package/joesandbox/database/analysis/490033/sample/BESTPREIS-ANFRAGE.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.878253229279087
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	BESTPREIS-ANFRAGE.exe
File size:	94208
MD5:	8d3b546ad98991973c7e6711e41a89ad
SHA1:	c14f4afa5d0c5b29087d5d43a6c9f1b9c2393c19
SHA256:	5fdae1f887f2b5fd73bd94b5bf0f4168600c285238114fb016afe88da811312c
SHA512:	16cc8e029d88c1b493cea50223255c9cf11e36cf0aed844ff7d47000271f050fd2130e327749102f33759826555a7ded1e343bb903bee6fcb9853e50b801de69
SSDEEP:	1536:t2vhBmgBSh31zof8pbckOzNENFrM3Qz1hV:tgm+YZckJFhH
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L....vBK.................@... ......8........P....@........

File Icon


Icon Hash:	8218a48e8e8c8c00

Static PE Info

General
Entrypoint:	0x401438
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4B4276ED [Mon Jan 4 23:17:01 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	347652fa39e149f868cae330a1e78c77

Entrypoint Preview

Instruction
push 0040FC54h
call 00007F68247ACCC3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx-2Ch], cl
adc eax, 69D4C6DEh
dec edx
cmpsb
inc edx
rcr dword ptr [ebx], FFFFFF96h
in eax, dx
or eax, 00000000h
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push ebx
imul esp, dword ptr [ebp+73h], 6Ch
jnc 00007F68247ACD37h
jnc 00007F68247ACD46h
xor al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
or eax, CC61C041h
and al, 80h
mov eax, 3980A946h
xor eax, 0A52AC3Eh
je 00007F68247ACD2Eh
xchg eax, esp
cmp dword ptr [ebx+6Ah], esp
mov edx, 9BFCA643h
mov al, 72h
and edi, dword ptr [esi]
mov edx, 33AD4F3Ah
cdq
iretw
adc dword ptr [edi+00AA000Ch], esi
pushad
rcl dword ptr [ebx+00000000h], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ebx
in eax, 00h
add byte ptr [esi+00000001h], cl
or dword ptr [eax], eax
inc esi
inc ecx
push esp
push esp
inc ebp
dec esp
dec ecx
inc edi
push esp
add byte ptr [46000601h], cl
popad
jc 00007F68247ACD05h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13a04	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x530	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x168	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1300c	0x14000	False	0.511560058594	data	6.35127341059	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x15000	0xd28	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x530	0x1000	False	0.133544921875	data	1.40302746084	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x16408	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x163f4	0x14	data
RT_VERSION	0x160f0	0x304	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaLineInputStr, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaRecAnsiToUni, __vbaStrCat, __vbaSetSystemError, __vbaRecDestruct, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaStrBool, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, __vbaFileClose, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaI2I4, DllFunctionCall, _adj_fpatan, __vbaRecUniToAnsi, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, _CIlog, __vbaFileOpen, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaVarAdd, __vbaVarDup, __vbaStrToAnsi, __vbaFpI4, __vbaRecDestructAnsi, _CIatan, __vbaStrMove, __vbaCastObj, __vbaR8IntI4, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0404 0x04b0
LegalCopyright	Jumping
InternalName	VENALIZE
FileVersion	4.04.0001
CompanyName	Jumping
LegalTrademarks	Jumping
Comments	Jumping
ProductName	Jumping
ProductVersion	4.04.0001
FileDescription	Jumping
OriginalFilename	VENALIZE.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 24, 2021 21:32:29.211483955 CEST	61346	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:32:29.232497931 CEST	53	61346	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:01.960549116 CEST	51774	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:01.989617109 CEST	53	51774	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:21.075614929 CEST	56023	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:21.096746922 CEST	53	56023	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:30.029903889 CEST	58384	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:30.054291010 CEST	53	58384	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:31.275965929 CEST	60261	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:31.346388102 CEST	53	60261	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:31.893294096 CEST	56061	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:31.911842108 CEST	53	56061	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:32.486149073 CEST	58336	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:32.520251036 CEST	53	58336	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:33.017194033 CEST	53781	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:33.082062960 CEST	53	53781	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:34.033345938 CEST	54064	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:34.066973925 CEST	53	54064	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:34.114161015 CEST	52811	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:34.133371115 CEST	53	52811	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:34.594297886 CEST	55299	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:34.613703966 CEST	53	55299	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:35.620076895 CEST	63745	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:35.660789013 CEST	53	63745	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:37.544473886 CEST	50055	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:37.564284086 CEST	53	50055	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:38.020483017 CEST	61374	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:38.039999008 CEST	53	61374	8.8.8.8	192.168.2.6
Sep 24, 2021 21:33:47.412231922 CEST	50339	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:33:47.433073997 CEST	53	50339	8.8.8.8	192.168.2.6
Sep 24, 2021 21:34:02.355945110 CEST	63307	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:34:02.379090071 CEST	53	63307	8.8.8.8	192.168.2.6
Sep 24, 2021 21:34:16.977423906 CEST	49694	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:34:17.010113001 CEST	53	49694	8.8.8.8	192.168.2.6
Sep 24, 2021 21:34:18.836533070 CEST	54982	53	192.168.2.6	8.8.8.8
Sep 24, 2021 21:34:18.869667053 CEST	53	54982	8.8.8.8	192.168.2.6

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: BESTPREIS-ANFRAGE.exe PID: 6828 Parent PID: 6468

General

Start time:	21:32:33
Start date:	24/09/2021
Path:	C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\BESTPREIS-ANFRAGE.exe'
Imagebase:	0x400000
File size:	94208 bytes
MD5 hash:	8D3B546AD98991973C7E6711E41A89AD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: BESTPREIS-ANFRAGE.exe PID: 6828 Parent PID: 6468 BESTPREIS-ANFRAGE.exeCOMMON

Executed Functions

Function 02267B4F, Relevance: 1.6, APIs: 1, Instructions: 88memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 02267C5E

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: f2291b6aadd62555e8a11333876f61cb19f1ceb85a6fc6f14a0b25bbcb90eee9
Instruction ID: 1de1696c040949333edfbea621133a57b72410bf2c05f322d212e24dc5728fdc
Opcode Fuzzy Hash: f2291b6aadd62555e8a11333876f61cb19f1ceb85a6fc6f14a0b25bbcb90eee9
Instruction Fuzzy Hash: CB310371604348CFEB30CF68D841BEAB7A2EF49304F14402DDD885B365D3359A46CB52

Uniqueness

Uniqueness Score: -1.00%

Function 02267C4A, Relevance: 1.6, APIs: 1, Instructions: 55memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 02267C5E

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 5d4412329fd1a17bcf4b4fa3b187c734d4058755c49ff654df1583099fae460c
Instruction ID: 5199d3d5504afd509c3923f2704c4f78b9b93e938ee0a21138b6fcf6fa34649e
Opcode Fuzzy Hash: 5d4412329fd1a17bcf4b4fa3b187c734d4058755c49ff654df1583099fae460c
Instruction Fuzzy Hash: 1311E372215245CFDB31CF68D8406D87BA3AF0A318F14052DEC488F3A5D7319242CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00412410, Relevance: 323.3, APIs: 156, Strings: 28, Instructions: 1278COMMON

Download Yara Rule

APIs

#592.MSVBVM60(?), ref: 00412586
__vbaFreeVar.MSVBVM60 ref: 0041259E
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 004125BF
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 004125E7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,000000F0), ref: 00412617
__vbaStrMove.MSVBVM60 ref: 00412635
__vb.MSVBVM60 ref: 0041263D
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412655
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 0041267D
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000060), ref: 004126A7
__vbaStrMove.MSVBVM60 ref: 004126BF
__vb.MSVBVM60 ref: 004126C7
#568.MSVBVM60(000000F0), ref: 004126D2
#677.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,40100000,00000002,?), ref: 00412720
__vbaFpR8.MSVBVM60 ref: 00412726
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00412752
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412778
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 004127A0
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,000000D8), ref: 004127CC
__vbaStrMove.MSVBVM60 ref: 004127E0
__vb.MSVBVM60 ref: 004127EC
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412804
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 0041282C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000138), ref: 00412858
__vb.MSVBVM60 ref: 00412860
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412878
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,0000001C), ref: 004128A0
__vbaCastObj.MSVBVM60(?,00411194), ref: 004128E5
__vbaObjSet.MSVBVM60(?,00000000), ref: 004128F3
__vbaHresultCheckObj.MSVBVM60(00000000,?,004111A4,00000058), ref: 00412913
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041292D
#610.MSVBVM60(00000002), ref: 00412943
#610.MSVBVM60(?), ref: 0041294C
__vbaVarAdd.MSVBVM60(?,?,?,00000001,00000001), ref: 0041297A
#662.MSVBVM60(?,004111B8,00000002,00000000), ref: 00412994
__vbaVarTstNe.MSVBVM60(?,?), ref: 004129B8
__vbaFreeVarList.MSVBVM60(00000004,?,00000002,?,?), ref: 004129DF
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412A03
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 00412A2B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,000000D0), ref: 00412A57
__vbaStrMove.MSVBVM60 ref: 00412A6B
__vb.MSVBVM60 ref: 00412A77
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412A8F
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 00412AB7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000078), ref: 00412ADD
__vb.MSVBVM60 ref: 00412AE5
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412AFD
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000048), ref: 00412B2A
__vbaStrMove.MSVBVM60 ref: 00412B3E
__vbaVarDup.MSVBVM60 ref: 00412B64
#645.MSVBVM60(00000002,00000000), ref: 00412B72
__vbaStrMove.MSVBVM60 ref: 00412B80
__vbaFreeVar.MSVBVM60 ref: 00412B8C
__vbaSetSystemError.MSVBVM60(?), ref: 00412BA4
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412BCC
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 00412BF4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,0000013C), ref: 00412C56
__vb.MSVBVM60 ref: 00412C6C
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412C81
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 00412CA9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,000000C0), ref: 00412CD5
__vb.MSVBVM60 ref: 00412CDD
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412CF2
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,0000001C), ref: 00412D1A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004111A4,00000060), ref: 00412D72
__vb.MSVBVM60 ref: 00412D7E
__vbaStrToAnsi.MSVBVM60(?,SLIPCOVER), ref: 00412D99
__vbaSetSystemError.MSVBVM60(00000000), ref: 00412DA7
__vbaFreeStr.MSVBVM60 ref: 00412DCD
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412DF2
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 00412E1A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,0000013C), ref: 00412E7C
__vb.MSVBVM60 ref: 00412E88
#680.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,40490000,00000002,?,?), ref: 00412EE3
__vbaFreeVarList.MSVBVM60(00000003,00000002,?,?), ref: 00412F02
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412F1E
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,0000004C), ref: 00412F46
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410B30,0000001C,?,?,?,?), ref: 00412FAC
__vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 00412FC6
__vb.MSVBVM60(?,?,?,?), ref: 00412FD2
__vbaStrCopy.MSVBVM60(?,?,?,?), ref: 00412FF6
__vbaHresultCheckObj.MSVBVM60(00000000,004011F0,00410AB8,00000700), ref: 0041302D
__vbaFreeStr.MSVBVM60 ref: 00413039
__vbaHresultCheckObj.MSVBVM60(00000000,004011F0,00410A88,000002B4), ref: 0041305A
__vbaRecUniToAnsi.MSVBVM60(00410C68,?,?,00858F22), ref: 00413084
__vbaStrToAnsi.MSVBVM60(?,Brandfarligste,000BCFBB,00000000), ref: 0041309C
__vbaSetSystemError.MSVBVM60(00000000), ref: 004130AA
__vbaRecAnsiToUni.MSVBVM60(00410C68,?,?), ref: 004130C3
__vbaFreeStr.MSVBVM60 ref: 004130E4
__vbaRecDestructAnsi.MSVBVM60(00410C68,?), ref: 004130F6
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00413117
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 0041313F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000110), ref: 0041316F
__vbaStrMove.MSVBVM60 ref: 0041318D
__vb.MSVBVM60 ref: 00413195
#612.MSVBVM60(00000002), ref: 004131A2
__vbaStrVarMove.MSVBVM60(00000002), ref: 004131AF
__vbaStrMove.MSVBVM60 ref: 004131BD
__vbaFreeVar.MSVBVM60 ref: 004131C5
__vbaStrToAnsi.MSVBVM60(?,Cirkumpolar5), ref: 004131D7
__vbaStrToAnsi.MSVBVM60(?,Europerne8,00000000), ref: 004131E6
__vbaStrToAnsi.MSVBVM60(?,telefonopkald,00000000), ref: 004131F5
__vbaStrToAnsi.MSVBVM60(?,Greencoat5,00000000), ref: 00413204
__vbaStrToAnsi.MSVBVM60(?,dialysate,006AB190,00000000), ref: 00413218
__vbaSetSystemError.MSVBVM60(00032D01,00000000), ref: 0041322B
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 0041326C
#546.MSVBVM60(00000002), ref: 00413285
__vbaVarMove.MSVBVM60 ref: 00413297
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 004132AF
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 004132D7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,000000F0), ref: 00413307
__vbaStrMove.MSVBVM60 ref: 0041331F
__vb.MSVBVM60 ref: 0041332B
__vbaVarDup.MSVBVM60 ref: 00413351
#529.MSVBVM60(00000002), ref: 0041335E
__vbaFreeVar.MSVBVM60 ref: 0041336A
__vbaStrToAnsi.MSVBVM60(?,Compregnate8,0008F262), ref: 00413381
__vbaStrToAnsi.MSVBVM60(?,Belysningstidens8,00000000), ref: 00413390
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041339E
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 004133CA
#680.MSVBVM60(00000000,3FF00000,00000000,3FF00000,00000000,40490000,00000002,?,?), ref: 00413431
__vbaFreeVarList.MSVBVM60(00000003,00000002,?,?), ref: 00413450
#690.MSVBVM60(neguses,Dispute,ENJAIL,undeniably), ref: 0041346D
__vbaInStr.MSVBVM60(00000000,syntaksprincippernes,UNIDEALISTICALLY,FF8500B2), ref: 00413483
__vbaStrCopy.MSVBVM60 ref: 00413494
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 004134A2
__vbaStrToAnsi.MSVBVM60(?,Biajaiba,?,?), ref: 004134B8
__vbaStrToAnsi.MSVBVM60(?,mitten,?,?,004D5566,00065A58,?,00000000), ref: 004134E6
__vbaStrToAnsi.MSVBVM60(?,CAFETERIAERNE,00000000), ref: 004134F5
__vbaSetSystemError.MSVBVM60(00000000), ref: 00413503
__vbaFreeStrList.MSVBVM60(00000005,?,?,?,?,?), ref: 00413544
#704.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 00413575
__vbaStrMove.MSVBVM60 ref: 00413589
__vbaFreeVar.MSVBVM60 ref: 00413597
#536.MSVBVM60(00000002), ref: 004135B1
__vbaStrMove.MSVBVM60 ref: 004135BC
__vbaFreeVar.MSVBVM60 ref: 004135C4
_adj_fdiv_m64.MSVBVM60 ref: 004135E9
__vbaFpI4.MSVBVM60(43020000,?,40A00000), ref: 0041361D
__vbaHresultCheckObj.MSVBVM60(00000000,004011F0,00410A88,000002C0,?,40A00000), ref: 00413651
__vbaRecDestructAnsi.MSVBVM60(00410C68,?,00413774), ref: 004136DE
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 004136ED
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 004136F5
__vb.MSVBVM60(?,40A00000), ref: 00413703
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 0041370B
__vbaRecDestruct.MSVBVM60(00410C68,?), ref: 00413719
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413725
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 0041372D
__vbaFreeVar.MSVBVM60(?,40A00000), ref: 00413735
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413741
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413749
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413751
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413759
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413761
__vb.MSVBVM60(?,40A00000), ref: 00413769
__vbaFreeStr.MSVBVM60(?,40A00000), ref: 00413771

Strings

Europerne8, xrefs: 004131E0
Tainan9, xrefs: 00413489
TOUPEERNES, xrefs: 00412B50
SLIPCOVER, xrefs: 00412D93
Vanskelighed7, xrefs: 00412836
neguses, xrefs: 00413468
dialysate, xrefs: 00413212
Vulgrsprogenes, xrefs: 00412D4A
Brandfarligste, xrefs: 00413096
Greencoat5, xrefs: 004131FE
undeniably, xrefs: 00413459
telefonopkald, xrefs: 004131EF
Cirkumpolar5, xrefs: 004131D1
Dispute, xrefs: 00413463
Cynthias, xrefs: 00412E4E
RINDA, xrefs: 0041333D
enfeebler, xrefs: 00412C24
syntaksprincippernes, xrefs: 0041347D
mitten, xrefs: 004134E0
UNIDEALISTICALLY, xrefs: 00413478
Compregnate8, xrefs: 0041337B
Folkebaaden, xrefs: 00412FE1
ENJAIL, xrefs: 0041345E
Biajaiba, xrefs: 004134B2
<-W, xrefs: 00412DB5
Belysningstidens8, xrefs: 0041338A
CAFETERIAERNE, xrefs: 004134EF
SUNDER, xrefs: 00413010

Memory Dump Source

Source File: 00000000.00000002.856321922.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.856314083.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.856339629.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.856347893.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$Ansi$New2__vb$Move$List$ErrorSystem$Destruct$#610#680Copy$#529#536#546#568#592#612#645#662#677#690#704Cast_adj_fdiv_m64
String ID: <-W$Belysningstidens8$Biajaiba$Brandfarligste$CAFETERIAERNE$Cirkumpolar5$Compregnate8$Cynthias$Dispute$ENJAIL$Europerne8$Folkebaaden$Greencoat5$RINDA$SLIPCOVER$SUNDER$TOUPEERNES$Tainan9$UNIDEALISTICALLY$Vanskelighed7$Vulgrsprogenes$dialysate$enfeebler$mitten$neguses$syntaksprincippernes$telefonopkald$undeniably
API String ID: 1309616090-4200294729
Opcode ID: 9e15bfaf58429a031375110bfdf84e63956a78483b5691735b7a67a329bd2370
Instruction ID: 1bc2a9e507c05e6236f34f90819465460e7b605f82994c9615d714525123a14e
Opcode Fuzzy Hash: 9e15bfaf58429a031375110bfdf84e63956a78483b5691735b7a67a329bd2370
Instruction Fuzzy Hash: E4B26F70900219EFDB24DF54DD88BDAB7B9FF48305F1081AAE509B72A0DA746AC5CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00401438, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 40%

			_entry_() {
				signed char _t28;
				signed char _t30;
				signed int _t32;
				void* _t37;
				intOrPtr* _t38;
				intOrPtr* _t53;
				void* _t55;
				signed char* _t57;
				signed int _t59;
				signed int* _t66;
				signed int _t67;
				void* _t68;
				signed int _t70;
				signed int _t73;
				intOrPtr _t74;

				_push("VB5!6!*"); // executed
				L00401430(); // executed
				 *_t28 =  *_t28 + _t28;
				 *_t28 =  *_t28 + _t28;
				 *_t28 =  *_t28 + _t28;
				 *_t28 =  *_t28 ^ _t28;
				 *_t28 =  *_t28 + _t28;
				_t29 = _t28 + 1;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *((intOrPtr*)(_t37 - 0x2c)) =  *((intOrPtr*)(_t37 - 0x2c)) + _t53;
				_t38 = _t37 - 1;
				asm("aam 0x15");
				asm("faddp st6, st0");
				asm("aam 0x69");
				asm("cmpsb");
				_t57 = _t55 - 1 + 1;
				asm("rcr dword [ebx], 0x96");
				asm("in eax, dx");
				asm("lock or eax, 0x0");
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				_push(_t38);
				_t70 =  *(_t68 + 0x73) * 0x6c;
				_t73 = _t70;
				if(_t73 >= 0) {
					L5:
					_pop(_t38);
					asm("in eax, 0x0");
					_t66[0] = _t66[0] + _t53;
					 *_t29 =  *_t29 | _t29;
					_t66 =  &(_t66[0]);
					_t53 = _t53 + 1;
					_push(_t70);
					_push(_t70);
					_t70 = _t70 - 1;
					goto L6;
				} else {
					if(_t73 >= 0) {
						L6:
						_t53 = _t53 - 1;
						_t59 = _t59 + 1;
						_push(_t70);
						 *0x46000601 =  *0x46000601 + _t53;
						_t74 =  *0x46000601;
						L7:
						asm("popad");
						if(_t74 >= 0) {
							 *_t53 =  *_t53 + _t38;
							 *_t29 =  *_t29 + _t29;
							_t57 =  &(_t57[1]);
							 *_t57 =  *_t57 + _t29;
							_t70 = _t70 +  *_t38;
							_t67 =  &(_t66[0]);
							 *_t29 =  *_t29 + _t29;
							 *((intOrPtr*)(_t70 + _t67 * 2)) =  *((intOrPtr*)(_t70 + _t67 * 2)) + _t53;
							 *_t67 =  *_t67 + _t38;
							 *_t29 =  *_t29 + _t29;
							 *_t29 =  *_t29 + _t29;
							 *_t53 =  *_t53 + _t29;
							 *_t53 =  *_t53 + _t29;
							 *_t29 =  &(_t57[ *_t29]);
							asm("adc [eax], dl");
							 *_t29 =  *_t29 + _t29;
							 *_t29 =  *_t29 + _t29;
							 *_t29 =  *_t29 + _t53;
							 *_t29 =  *_t29 + _t29;
							 *_t67 =  *_t67 + _t57;
							 *_t29 =  *_t29 + _t29;
							 *_t29 =  *_t29 + _t53;
							 *_t29 =  *_t29 + _t29;
							 *_t29 =  &(_t57[ *_t29]);
							 *_t29 =  *_t29 + _t29;
						}
						 *_t29 =  *_t29 + _t29;
						 *_t29 =  *_t29 & _t29;
						 *_t29 =  *_t29 + _t29;
						 *_t29 =  *_t29 + _t29;
						_t30 = _t29;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t57;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *((intOrPtr*)(_t30 + 0x800000)) =  *((intOrPtr*)(_t30 + 0x800000)) + _t30;
						 *_t30 =  *_t30 + _t30;
						 *((char*)(_t30 + 0x8000)) =  *((char*)(_t30 + 0x8000));
						 *_t30 =  *_t30 + 0x80;
						 *((intOrPtr*)(_t59 + 0x1a000080)) =  *((intOrPtr*)(_t59 + 0x1a000080)) + _t53;
						 *_t57 =  *_t57 << 0;
						 *((char*)(_t30 + 0x80)) =  *((char*)(_t30 + 0x80)) + 0xff;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + 1;
						 *_t30 =  *_t30 + _t30;
						asm("invalid");
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						asm("invalid");
						asm("lahf");
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						asm("sti");
						asm("sti");
						asm("sti");
						asm("sti");
						asm("sti");
						asm("sti");
						asm("lock add [edi-0x40b04041], bh");
						asm("sti");
						asm("lock add [edi-0x40bb4b41], bh");
						asm("hlt");
						asm("popad");
						asm("sti");
						asm("lock add [edi-0x40bb4b41], bh");
						asm("sti");
						asm("lock add [edi-0x40b04041], bh");
						asm("sti");
						asm("sti");
						asm("lock add [eax], al");
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						_push(_t30);
						asm("sti");
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						 *_t30 =  *_t30 + _t30;
						asm("invalid");
						asm("invalid");
						 *_t30 =  *_t30 + 0xff;
						 *((intOrPtr*)(_t30 - 0x7f000100)) =  *((intOrPtr*)(_t30 - 0x7f000100)) + 1;
						 *((intOrPtr*)(_t30 - 0x7f000100)) =  *((intOrPtr*)(_t30 - 0x7f000100)) + 1;
						 *_t30 =  *_t30 - 1;
						asm("invalid");
						 *_t30 =  *_t30 + 0xff;
						 *((intOrPtr*)(_t30 - 0x7f000100)) =  *((intOrPtr*)(_t30 - 0x7f000100)) + 1;
						 *((intOrPtr*)(_t30 - 0x7f000100)) =  *((intOrPtr*)(_t30 - 0x7f000100)) + 1;
						if (_t30 + 1 > 0) goto L10;
						goto L10;
						goto __eax;
						L10:
						asm("invalid");
					}
					_t32 = _t29 ^  *_t29;
					 *_t32 =  *_t32 + _t32;
					 *_t32 =  *_t32 + _t32;
					 *_t32 =  *_t32 + _t32;
					 *_t32 =  *_t32 + _t32;
					_t70 = _t70 - 1;
					 *_t32 =  *_t32 ^ _t32;
					_t29 = 0x33d20578;
					_t74 = 0x3980a946;
					if(0x3980a946 == 0) {
						goto L7;
					}
					_t70 = 0x33d20578;
					_t29 = 0x72;
					_t59 = _t59 &  *_t66;
					_t57 = 0x33ad4f3a;
					asm("cdq");
					asm("iretw");
					asm("adc [edi+0xaa000c], esi");
					asm("pushad");
					asm("rcl dword [ebx], cl");
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					 *0x72 =  *0x72 + 0x72;
					goto L5;
				}
			}

0x00401438
0x0040143d
0x00401442
0x00401444
0x00401446
0x00401448
0x0040144a
0x0040144c
0x0040144d
0x0040144f
0x00401451
0x00401453
0x00401454
0x00401455
0x00401457
0x00401459
0x0040145c
0x0040145d
0x0040145e
0x00401461
0x00401462
0x00401468
0x0040146a
0x0040146c
0x0040146e
0x00401470
0x00401472
0x00401474
0x00401475
0x00401475
0x0040147a
0x004014e1
0x004014e1
0x004014e2
0x004014e4
0x004014ea
0x004014ec
0x004014ed
0x004014ee
0x004014ef
0x004014f1
0x00000000
0x0040147c
0x0040147c
0x004014f2
0x004014f2
0x004014f3
0x004014f4
0x004014f5
0x004014f5
0x004014fb
0x004014fb
0x004014fc
0x00401500
0x00401502
0x00401504
0x00401505
0x00401507
0x00401509
0x0040150a
0x0040150c
0x00401510
0x00401512
0x00401514
0x00401516
0x00401518
0x0040151a
0x0040151c
0x0040151e
0x00401520
0x00401522
0x00401524
0x00401526
0x00401528
0x0040152a
0x0040152c
0x0040152e
0x00401530
0x00401530
0x00401531
0x00401533
0x00401535
0x00401537
0x00401539
0x0040153b
0x0040153d
0x0040153f
0x00401542
0x00401544
0x00401546
0x00401548
0x0040154a
0x0040154c
0x0040154e
0x00401550
0x00401552
0x00401554
0x00401556
0x00401558
0x0040155e
0x00401560
0x00401567
0x0040156a
0x00401570
0x00401573
0x0040157a
0x0040157c
0x0040157e
0x00401580
0x00401584
0x0040158d
0x0040158f
0x00401591
0x00401592
0x00401594
0x00401596
0x00401598
0x0040159a
0x0040159c
0x0040159e
0x004015a0
0x004015a2
0x004015a4
0x004015a5
0x004015a6
0x004015a7
0x004015a8
0x004015a9
0x004015aa
0x004015b9
0x004015ba
0x004015c7
0x004015c8
0x004015c9
0x004015ca
0x004015d9
0x004015da
0x004015e8
0x004015e9
0x004015ea
0x004015ed
0x004015ef
0x004015f1
0x004015f3
0x004015f6
0x004015f7
0x004015f9
0x004015fb
0x004015fd
0x004015ff
0x00401601
0x00401603
0x00401605
0x00401607
0x00401609
0x0040160b
0x0040160d
0x0040160f
0x00401611
0x00401613
0x00401615
0x00401617
0x0040161a
0x00401622
0x0040162a
0x0040162d
0x0040162f
0x00401632
0x0040163a
0x00401644
0x00401644
0x00401646
0x00401645
0x00401645
0x00401645
0x0040147e
0x00401480
0x00401482
0x00401484
0x00401486
0x00401488
0x0040148a
0x00401498
0x00401498
0x0040149d
0x00000000
0x00000000
0x0040149f
0x004014a8
0x004014aa
0x004014ac
0x004014b1
0x004014b2
0x004014b4
0x004014ba
0x004014bb
0x004014c1
0x004014c3
0x004014c5
0x004014c7
0x004014c9
0x004014cb
0x004014cd
0x004014cf
0x004014d1
0x004014d3
0x004014d5
0x004014d7
0x004014d9
0x004014db
0x004014dd
0x004014df
0x00000000
0x004014df

APIs

#100.MSVBVM60(VB5!6!*), ref: 0040143D

Strings

VB5!6!*, xrefs: 00401438

Memory Dump Source

Source File: 00000000.00000002.856321922.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.856314083.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.856339629.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.856347893.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6!*
API String ID: 1341478452-2574520878
Opcode ID: c12f08231035c626be8bdf6533e6c7868b33eb2f9f831a1966e3d68df5e7e9cf
Instruction ID: 7114bd8c20bcc6ecb26d63608a41fb9e7e45e1c01762b622149a885cea69d896
Opcode Fuzzy Hash: c12f08231035c626be8bdf6533e6c7868b33eb2f9f831a1966e3d68df5e7e9cf
Instruction Fuzzy Hash: 3E4173A284E7C14FC7038B705C656913FB0AE23224B1A45EBC0C1CF0F3E268184ADB63

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 022665A3, Relevance: 3.9, Strings: 3, Instructions: 179COMMON

Download Yara Rule

Strings

p?D, xrefs: 02266A47
2, xrefs: 02266806
-:j, xrefs: 0226671D

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 2$-:j$p?D
API String ID: 0-3771744233
Opcode ID: ebaa93a1e95930937f9f049f527131c047e1b08685696cb9df942aadf6aa9b67
Instruction ID: a261f7d2469efdac73682b8dbb250d07cfadfb7671f4faa3ac4cf05fcf16c0de
Opcode Fuzzy Hash: ebaa93a1e95930937f9f049f527131c047e1b08685696cb9df942aadf6aa9b67
Instruction Fuzzy Hash: C981BD72610288DFDF799F64CDA5BEA7BA2FF54304F404029ED8D9A224C7319A95CF01

Uniqueness

Uniqueness Score: -1.00%

Function 022657B0, Relevance: 3.1, Strings: 2, Instructions: 560COMMON

Download Yara Rule

Strings

p?D, xrefs: 02266A47
`{fq, xrefs: 02265E5C

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID:
String ID: `{fq$p?D
API String ID: 0-2793949732
Opcode ID: b901f1d7542d474fa96d58bd68f68334f56b59a7052fd4fff790eb063b255788
Instruction ID: 76a263fc073fabb115745c6580e98884e3e2b820d21e06bfcfdfffca4c5f8cfe
Opcode Fuzzy Hash: b901f1d7542d474fa96d58bd68f68334f56b59a7052fd4fff790eb063b255788
Instruction Fuzzy Hash: AD3201B261434A9FDB748F79CD49BEABBB6BF84300F448219DC899B654C3349A81CF45

Uniqueness

Uniqueness Score: -1.00%

Function 02266672, Relevance: 2.6, Strings: 2, Instructions: 117COMMON

Download Yara Rule

Strings

2, xrefs: 02266806
-:j, xrefs: 0226671D

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 2$-:j
API String ID: 0-3154032063
Opcode ID: c5355db92deede4e1ebb4358952984362a540ab4c604dd30ac283e6a2e1807c1
Instruction ID: b97dd10c81edef369d3b8f56f4262bde28662e502a87ba3c841bfc13dba0fe87
Opcode Fuzzy Hash: c5355db92deede4e1ebb4358952984362a540ab4c604dd30ac283e6a2e1807c1
Instruction Fuzzy Hash: 2D51AC72204249DFCF799F64CCA5BE97BB2FF54344F04402AED8D9A224CB369A95CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0226544D, Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

=0r, xrefs: 022654F2

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID:
String ID: =0r
API String ID: 0-1249439922
Opcode ID: 91033e3fa73f3dd2f174d8d8c938e40cd0f12353ef97336a2e2926bc999431fb
Instruction ID: c041cfc06b0700049684348bbaf53e676d6be27bbb15ff39fa2d3fec1eda56c5
Opcode Fuzzy Hash: 91033e3fa73f3dd2f174d8d8c938e40cd0f12353ef97336a2e2926bc999431fb
Instruction Fuzzy Hash: 9741A576224385CFD775CE65D9D8BEB33E3AF88700F90852AC84E8B608D731A690CB15

Uniqueness

Uniqueness Score: -1.00%

Function 022677B2, Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

C@}(, xrefs: 022678B1

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID:
String ID: C@}(
API String ID: 0-2002455118
Opcode ID: 07f2289b1f0a8073d10a17557f7fc5861e31d6650ff1f9f6c29ededc1a52a435
Instruction ID: 63f15a1ddcc30b82b15c9ce484be5f02d5a6ff49edf39efeaf21d0f91d01f0be
Opcode Fuzzy Hash: 07f2289b1f0a8073d10a17557f7fc5861e31d6650ff1f9f6c29ededc1a52a435
Instruction Fuzzy Hash: A521E7739542498FEB70CE3DCD84BCFB2E6AFA8310F95002A9C4CE7214D6719A428A21

Uniqueness

Uniqueness Score: -1.00%

Function 02260780, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a937499bd7c74aa8594dd5213faf26773772438e5661a80d3581804236f116d6
Instruction ID: 3ec8c5d51f105332ae051bb1b55e26a0a5edc6f05feeeb70adf0396bc772ed07
Opcode Fuzzy Hash: a937499bd7c74aa8594dd5213faf26773772438e5661a80d3581804236f116d6
Instruction Fuzzy Hash: 8741ABB251524ACFEB158E74C8856EE7BA2EF99300F60051DDD4A8F796C7318941CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02260775, Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89635234268a95ef23dda286567b14da144e4a4525c27c1967e3cd025d87446
Instruction ID: 43a9fdaea8346675574ceb233cdbe39a43af69c4a86fc5218826d7137822696c
Opcode Fuzzy Hash: a89635234268a95ef23dda286567b14da144e4a4525c27c1967e3cd025d87446
Instruction Fuzzy Hash: 0941CBB2511246CFE7158E74C8896EE7BE2EF99300F64055DDD4A4F396C7328942CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0226C61F, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d68f209999d213d28edfdb235fedff2028b7667e7ddb8f8f6ec0ef645e844b3
Instruction ID: afbd4a9e984b8069578a879e4c7ef2c10afb20883ac0e0bbc68795ff6354de6d
Opcode Fuzzy Hash: 3d68f209999d213d28edfdb235fedff2028b7667e7ddb8f8f6ec0ef645e844b3
Instruction Fuzzy Hash: DB41E072A24355CFCF70AFA88C88BEE77F2AF15350F14416ADC499B258D7319A81CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0226A1B6, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1d0d157bbed1f9a86df9bfad1cfb261180ac463324a7778a278888153986862
Instruction ID: e82777ad99026170d62a35e749165d9827cf2157357fe764356c860c625e88a5
Opcode Fuzzy Hash: a1d0d157bbed1f9a86df9bfad1cfb261180ac463324a7778a278888153986862
Instruction Fuzzy Hash: 33419076A25749CFCB30DFA9C8887EA33B2BF19310F10802ADD099B259D7719A81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0226557A, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42c09896b51d79ddc7f8fa61c0c14e8edcbbc9d5dcc284fb3ad3139ac8b27214
Instruction ID: e2351f0e6a1b7015e7f97b4f74e09de43c8fe24ccabfaffd5c16e2bae335c1a1
Opcode Fuzzy Hash: 42c09896b51d79ddc7f8fa61c0c14e8edcbbc9d5dcc284fb3ad3139ac8b27214
Instruction Fuzzy Hash: 9421E7B6224785CBC770CE69D999BEB33E2AF98700F904629CC4DCB608D731E591CB49

Uniqueness

Uniqueness Score: -1.00%

Function 02267290, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd38a1bf1099504e5f8f5a7e4e6f1a75dfb97732d5f58b32b243864c22a6e581
Instruction ID: 6c8135da66e42e56dcedd27a05640d5f3636cfd00bf4cd23f5eccfbac654aea8
Opcode Fuzzy Hash: cd38a1bf1099504e5f8f5a7e4e6f1a75dfb97732d5f58b32b243864c22a6e581
Instruction Fuzzy Hash: 75C02B93835123DA49E114FC324C03F8503EAB067C355D51034C98630EFCD1CEC404B1

Uniqueness

Uniqueness Score: -1.00%

Function 022670AD, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36fea026d8b1b120106946733ba74e8b29e913430fe1d1085c6fcca963e00da6
Instruction ID: a74e1b73d97e6971193d5395655c6dbccebb77d08ac40644646a7d741d145747
Opcode Fuzzy Hash: 36fea026d8b1b120106946733ba74e8b29e913430fe1d1085c6fcca963e00da6
Instruction Fuzzy Hash: DCB092B6201580CFEF02CB08C4A1B4073A4FB18648F8804D0E402CF712C224ED00CB00

Uniqueness

Uniqueness Score: -1.00%

Function 02269C63, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.856631658.0000000002260000.00000040.00000001.sdmp, Offset: 02260000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f06d49daab643fcf8822b3136ecc7973c4749a680056015bfea26223b44d3b8c
Instruction ID: f2bd4685f866de4337c99f43126baafa0cb2efa12ebb18eca5d8d205a2687879
Opcode Fuzzy Hash: f06d49daab643fcf8822b3136ecc7973c4749a680056015bfea26223b44d3b8c
Instruction Fuzzy Hash: 65B092342115808FC341CE09C180F8073A3FB00F50FC14480E0018BA91C32EEE40CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00411E80, Relevance: 94.8, APIs: 46, Strings: 8, Instructions: 330COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00411EF6
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 00411F1B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000058), ref: 00411F3F
#689.MSVBVM60(?,Options,Show Tips at Startup), ref: 00411F73
__vbaStrMove.MSVBVM60 ref: 00411F84
__vbaI4Str.MSVBVM60(00000000), ref: 00411F87
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00411F99
__vb.MSVBVM60 ref: 00411FA5
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00411FC2
__vbaObjSetAddref.MSVBVM60(?,004011B0), ref: 00411FD5
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000010), ref: 00411FF3
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041200C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411008,000000DC), ref: 00412031
__vb.MSVBVM60 ref: 0041203A
#594.MSVBVM60(?), ref: 00412052
__vbaFreeVar.MSVBVM60 ref: 0041205B
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00412074
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 00412099
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000050), ref: 004120BD
__vbaStrCat.MSVBVM60(0041101C,?), ref: 004120D2
__vbaStrMove.MSVBVM60 ref: 004120D9
__vbaStrCat.MSVBVM60(TIPOFDAY.TXT,00000000), ref: 004120E1
__vbaStrMove.MSVBVM60 ref: 004120E8
__vbaHresultCheckObj.MSVBVM60(00000000,004011B0,00410AB8,000006F8), ref: 0041210B
__vbaFreeStrList.MSVBVM60(00000003,?,?,?), ref: 0041212D
__vb.MSVBVM60 ref: 00412139
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412158
__vbaStrCat.MSVBVM60(TIPOFDAY.TXT,That the ), ref: 0041216D
__vbaStrMove.MSVBVM60 ref: 00412174
__vbaStrCat.MSVBVM60( file was not found? ,00000000), ref: 0041217C
__vbaStrMove.MSVBVM60 ref: 00412183
__vbaStrCat.MSVBVM60(0041106C,00000000), ref: 0041218B
__vbaStrMove.MSVBVM60 ref: 00412192
__vbaStrCat.MSVBVM60(0041106C,00000000), ref: 0041219A
__vbaStrMove.MSVBVM60 ref: 004121A1
__vbaStrCat.MSVBVM60(Create a text file named ,00000000), ref: 004121A9
__vbaStrMove.MSVBVM60 ref: 004121B0
__vbaStrCat.MSVBVM60(TIPOFDAY.TXT,00000000), ref: 004121B8
__vbaStrMove.MSVBVM60 ref: 004121BF
__vbaStrCat.MSVBVM60( using NotePad with 1 tip per line. ,00000000), ref: 004121C7
__vbaStrMove.MSVBVM60 ref: 004121CE
__vbaStrCat.MSVBVM60(Then place it in the same directory as the application. ,00000000), ref: 004121D6
__vbaStrMove.MSVBVM60 ref: 004121DD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411008,00000054), ref: 004121F6
__vbaFreeStrList.MSVBVM60(00000008,?,?,?,?,?,?,?,?), ref: 0041221E
__vb.MSVBVM60 ref: 0041222A

Strings

Show Tips at Startup, xrefs: 00411F54
That the , xrefs: 00412160
Then place it in the same directory as the application. , xrefs: 004121D1
TIPOFDAY.TXT, xrefs: 004120DC, 00412165, 004121B3
file was not found? , xrefs: 00412177
using NotePad with 1 tip per line. , xrefs: 004121C2
Options, xrefs: 00411F59
Create a text file named , xrefs: 004121A4

Memory Dump Source

Source File: 00000000.00000002.856321922.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.856314083.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.856339629.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.856347893.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Move$CheckHresult$Free__vb$ListNew2$#594#689Addref
String ID: file was not found? $ using NotePad with 1 tip per line. $Create a text file named $Options$Show Tips at Startup$TIPOFDAY.TXT$That the $Then place it in the same directory as the application.
API String ID: 2098970117-206723237
Opcode ID: 6cac56f6551929c7bcfcb4bb5237208f99a0b392e43346547add5761eadc36fa
Instruction ID: 8267473a8d48a574cc3d738e2e478c4a7307275d6b15535ed8969a4f14090928
Opcode Fuzzy Hash: 6cac56f6551929c7bcfcb4bb5237208f99a0b392e43346547add5761eadc36fa
Instruction Fuzzy Hash: 9DC14E71E00209AFDB14DFA5DD49EEEBBB9FF58700B10812AF502F71A0DAB45985CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00411A30, Relevance: 22.6, APIs: 15, Instructions: 142COMMON

Download Yara Rule

APIs

#648.MSVBVM60(?), ref: 00411A91
__vbaFreeVar.MSVBVM60 ref: 00411A9D
__vbaStrCmp.MSVBVM60(00410F80,00000000), ref: 00411AB4
#645.MSVBVM60(?,00000000), ref: 00411AD1
__vbaStrMove.MSVBVM60 ref: 00411ADC
__vbaStrCmp.MSVBVM60(00410F80,00000000), ref: 00411AE8
__vbaFreeStr.MSVBVM60 ref: 00411AF6
__vbaFreeStr.MSVBVM60(00411C0B), ref: 00411C04

Memory Dump Source

Source File: 00000000.00000002.856321922.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.856314083.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.856339629.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.856347893.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#645#648Move
String ID:
API String ID: 2957232524-0
Opcode ID: 51166b5d8338636e716e8e35dbeffbdd41d72402cede181a0344096cf7278fca
Instruction ID: 7a580bb1fe7ff3c1af33a1fec216ee3af550135793ff1041a805abefbad1257d
Opcode Fuzzy Hash: 51166b5d8338636e716e8e35dbeffbdd41d72402cede181a0344096cf7278fca
Instruction Fuzzy Hash: 6D511EB5D00249EFCB10DF95DA44ADDBBB4FF48704F20812AE64AB7260D7746A45CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411C40, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00411C8D
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 00411CB8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000058), ref: 00411CE0
__vbaObjSet.MSVBVM60(?,00000000), ref: 00411CF3
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411008,000000D8), ref: 00411D1A
__vbaStrBool.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00411D20
__vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00401226), ref: 00411D2B
#690.MSVBVM60(?,Options,Show Tips at Startup,00000000), ref: 00411D40
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00411D50
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00411D60

Strings

Show Tips at Startup, xrefs: 00411D35
Options, xrefs: 00411D3A

Memory Dump Source

Source File: 00000000.00000002.856321922.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.856314083.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.856339629.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.856347893.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeList$#690BoolMoveNew2
String ID: Options$Show Tips at Startup
API String ID: 1362621338-2759323971
Opcode ID: 6fd1e130956d4585ec60f254f6964bd558cd2cdeb0d10dd47953db044f729d7b
Instruction ID: 00f4ca430a519825a53f974d87bb9ccc77ced744450ef51c06993030807e3630
Opcode Fuzzy Hash: 6fd1e130956d4585ec60f254f6964bd558cd2cdeb0d10dd47953db044f729d7b
Instruction Fuzzy Hash: 43315571940209EFCB00DF94CD89EEFBBB9FB58705F20452AF605F71A0D6B469858BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004137A0, Relevance: 19.6, APIs: 13, Instructions: 109COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 004137E9
__vbaAryConstruct2.MSVBVM60(?,0041145C,00000005), ref: 004137FA
#684.MSVBVM60(00000000,3FF00000,?), ref: 0041382F
__vbaFpR8.MSVBVM60 ref: 00413835
__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 0041385E
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000014), ref: 00413883
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410FB4,00000118), ref: 004138AD
__vbaI2I4.MSVBVM60 ref: 004138B6
__vb.MSVBVM60 ref: 004138BF
#593.MSVBVM60(?), ref: 004138D7
__vbaFreeVar.MSVBVM60 ref: 004138E2
__vbaFreeStr.MSVBVM60(0041391F), ref: 00413906
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 00413918

Memory Dump Source

Source File: 00000000.00000002.856321922.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.856314083.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.856339629.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.856347893.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$#593#684Construct2CopyDestructNew2__vb
String ID:
API String ID: 3328420742-0
Opcode ID: d6b8ea9125135da27599d38d0d9ff3b51286bf7d7b1101c9b38af8c92243541a
Instruction ID: 06c38d564d47697c94f33a75136b950f1c21a5f7023a8f444361fe9af295b993
Opcode Fuzzy Hash: d6b8ea9125135da27599d38d0d9ff3b51286bf7d7b1101c9b38af8c92243541a
Instruction Fuzzy Hash: 35412770900209EFCB04DFA4DE49ADEBBB8FF58705F10812AE506B72A4D7B45985CF98

Uniqueness

Uniqueness Score: -1.00%

Function 004122A0, Relevance: 15.1, APIs: 10, Instructions: 107COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410F6C,004011F8), ref: 004122F6
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410F5C,00000024), ref: 00412317
__vbaObjSet.MSVBVM60(?,00000000), ref: 00412336
__vbaNew2.MSVBVM60(00410F6C,004011F8), ref: 0041234A
__vbaHresultCheckObj.MSVBVM60(00000000,004136D2,00410F5C,0000001C), ref: 0041237C
__vbaStrVarVal.MSVBVM60(?,?), ref: 0041238C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00411008,00000054), ref: 004123A6
__vbaFreeStr.MSVBVM60 ref: 004123AF
__vb.MSVBVM60 ref: 004123B8
__vbaFreeVar.MSVBVM60 ref: 004123C1

Memory Dump Source

Source File: 00000000.00000002.856321922.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.856314083.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.856339629.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.856347893.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2$__vb
String ID:
API String ID: 618864218-0
Opcode ID: 66fafa3553b6dc02d49b35ef1f70947596300c5b6335a2cdebb62eacb132c26e
Instruction ID: 8041b95c7bfbfe5c08b8751fa60602bc2b714df86a939d71152fbf25544d034c
Opcode Fuzzy Hash: 66fafa3553b6dc02d49b35ef1f70947596300c5b6335a2cdebb62eacb132c26e
Instruction Fuzzy Hash: D5412D70900209AFDB109FA5CD89E9EBBBCFF58744B10801AF951E7260D7B89985CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00411950, Relevance: 7.6, APIs: 5, Instructions: 59COMMON

Download Yara Rule

APIs

#593.MSVBVM60(?), ref: 00411992
__vbaNew2.MSVBVM60(00410F6C,?), ref: 004119AE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410F5C,00000024), ref: 004119CF
__vbaR8IntI4.MSVBVM60 ref: 004119ED
__vbaFreeVar.MSVBVM60 ref: 004119F9

Memory Dump Source

Source File: 00000000.00000002.856321922.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.856314083.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.856339629.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.856347893.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#593CheckFreeHresultNew2
String ID:
API String ID: 1021104686-0
Opcode ID: a31e7fe92488d0d4e3c0bbc438fb8011e8e49ccea0b87644fb891ecae699a56d
Instruction ID: 8a0dac526a19ec54456e5a704c1015326846aa2ba248783efc6bedadbcb1b198
Opcode Fuzzy Hash: a31e7fe92488d0d4e3c0bbc438fb8011e8e49ccea0b87644fb891ecae699a56d
Instruction Fuzzy Hash: E9117F70901219FBCB109F91EA49BDEBFB8FF09744F10441AF542B25A0C3789495CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411DD0, Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410FA4,004155E4), ref: 00411E13
__vbaObjSetAddref.MSVBVM60(00000000,?), ref: 00411E29
__vbaHresultCheckObj.MSVBVM60(00000000,0231004C,00410F94,00000010), ref: 00411E43
__vb.MSVBVM60 ref: 00411E4C

Memory Dump Source

Source File: 00000000.00000002.856321922.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.856314083.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.856339629.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.856347893.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$AddrefCheckHresultNew2__vb
String ID:
API String ID: 2040920825-0
Opcode ID: bc6c828025d12a4b11acc4c1c5bcba1226b981f9acf9d0079100ed59d7e2aeab
Instruction ID: 1ac0ac69284bca608e7ba8ee6eb26025642a20ff350be5f1e6a9f6a5dc400a3b
Opcode Fuzzy Hash: bc6c828025d12a4b11acc4c1c5bcba1226b981f9acf9d0079100ed59d7e2aeab
Instruction Fuzzy Hash: 32019E70600304FBC7009BA4CE09BDABBBCEB08704F104026B941B31A0D7B869818AA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report BESTPREIS-ANFRAGE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: BESTPREIS-ANFRAGE.exe PID: 6828 Parent PID: 6468

General

Chronological Activities

Disassembly

Code Analysis

Function 00401438, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123
COMMON