Play interactive tour

Edit tour

Windows Analysis Report DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Overview

General Information

Sample Name:	DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe
Analysis ID:	491287
MD5:	8e2b177d2ab29c95f067559a029cf5e8
SHA1:	f347fa229d51836344ab5bf89fa531e19aa5e324
SHA256:	b9fdde7d748e27a130c509a589a2c8b92aad279604d3e4ee7ac28187fc5660be
Tags:	DHLexeGuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Potential malicious icon found

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Found potential dummy code loops (likely to delay analysis)

Uses 32bit PE files

Contains functionality to call native functions

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Program does not show much activity (idle)

Uses code obfuscation techniques (call, push, ret)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Detected potential crypto function

Classification

Process Tree

System is w10x64

DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe (PID: 6996 cmdline: 'C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe' MD5: 8E2B177D2AB29C95F067559A029CF5E8)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Virustotal: Detection: 31%			Perma Link
Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	ReversingLabs: Detection: 17%

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Code function: 0_2_02BEC119 NtAllocateVirtualMemory,

0_2_02BEC119

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe, 00000000.00000002.871466300.0000000000419000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameVOLDFRELSERS.exe vs DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe
Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Binary or memory string: OriginalFilenameVOLDFRELSERS.exe vs DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_00403DD6	0_2_00403DD6
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_0040415B	0_2_0040415B
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BEC119	0_2_02BEC119
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE42B5	0_2_02BE42B5
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE4484	0_2_02BE4484
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BECED6	0_2_02BECED6
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE303C	0_2_02BE303C
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE4419	0_2_02BE4419
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE4245	0_2_02BE4245
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE3BBE	0_2_02BE3BBE
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE3BBC	0_2_02BE3BBC
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE2F9B	0_2_02BE2F9B
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE4195	0_2_02BE4195
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE2F90	0_2_02BE2F90
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE4184	0_2_02BE4184
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE452C	0_2_02BE452C
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE3700	0_2_02BE3700
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE4358	0_2_02BE4358

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Virustotal: Detection: 31%
Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	ReversingLabs: Detection: 17%

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: classification engine

Classification label: mal76.rans.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_00409455 push es; iretd	0_2_00409456
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_00407E31 push ds; retf	0_2_00407E32
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_004072C1 push edx; retf	0_2_004072C2
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_00406294 push edx; retf	0_2_00406297
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_00406D73 push es; retf	0_2_00406D76
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_004099EF push esp; iretd	0_2_004099F2
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_00407BFF push FFFFFFA7h; iretd	0_2_00407C53
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE0390 push BDC367A8h; ret	0_2_02BE0383
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE4F84 push esi; iretd	0_2_02BE4F87

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Code function: 0_2_02BE3B3F rdtsc

0_2_02BE3B3F

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE58BF mov eax, dword ptr fs:[00000030h]	0_2_02BE58BF
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE88B4 mov eax, dword ptr fs:[00000030h]	0_2_02BE88B4
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BECED6 mov eax, dword ptr fs:[00000030h]	0_2_02BECED6
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE5833 mov eax, dword ptr fs:[00000030h]	0_2_02BE5833
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE5859 mov eax, dword ptr fs:[00000030h]	0_2_02BE5859
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BEB5AE mov eax, dword ptr fs:[00000030h]	0_2_02BEB5AE
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BE599C mov eax, dword ptr fs:[00000030h]	0_2_02BE599C
Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	Code function: 0_2_02BEBDCB mov eax, dword ptr fs:[00000030h]	0_2_02BEBDCB

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Code function: 0_2_02BE3B3F rdtsc

0_2_02BE3B3F

Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe, 00000000.00000002.871715764.0000000000DF0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe, 00000000.00000002.871715764.0000000000DF0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe, 00000000.00000002.871715764.0000000000DF0000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe, 00000000.00000002.871715764.0000000000DF0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery11	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	32%	Virustotal		Browse
DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	18%	ReversingLabs	Win32.Trojan.Mucc
DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe	100%	Avira	HEUR/AGEN.1141869

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141869		Download File
0.0.DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1141869		Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491287
Start date:	27.09.2021
Start time:	12:40:43
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.rans.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 1.5% (good quality ratio 1.2%) Quality average: 50.8% Quality standard deviation: 27.1%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.82.210.154, 20.54.110.249, 40.112.88.60, 23.10.249.43, 23.10.249.26, 95.100.54.203, 20.50.102.62 Excluded domains from analysis (whitelisted): fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, arc.msn.com, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.804544485598051
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe
File size:	98304
MD5:	8e2b177d2ab29c95f067559a029cf5e8
SHA1:	f347fa229d51836344ab5bf89fa531e19aa5e324
SHA256:	b9fdde7d748e27a130c509a589a2c8b92aad279604d3e4ee7ac28187fc5660be
SHA512:	29493bc83ab2348c5f3f707079e968302e03256acd3801d9c5e47c13a87cb9ec70145208bb25a4127e30cbe2cd7edca1a6cd82a23ca7a5e5a8a0bb0a19e1aa00
SSDEEP:	768:37nneTCCOKskAtEcDpHR0QWNTsO85zCoLi/0Fqt1fgg9ZPxt/ZbwKbdU5p0:TnWAT4sO87LFIl3Ph2c
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........,..SM..SM..SM...Q..RM...o..uM..ek..RM..RichSM..................PE..L......I.................P...@...............`....@........

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x4012f0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x49E892D2 [Fri Apr 17 14:31:46 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	508f324e8f3f3b33e0170cdca30d1edb

Entrypoint Preview

Instruction
push 00401E1Ch
call 00007FD288AA1465h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
dec eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], dh
fistp word ptr [eax+7B83299Ch]
dec ebx
mov ah, 62h
or bh, ch
movsd
xor al, cl
inc edx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
inc edx
jnc 00007FD288AA14DEh
jns 00007FD288AA14E6h
je 00007FD288AA14D7h
insb
jnc 00007FD288AA14D7h
jnc 00007FD288AA14E1h
bound ebp, dword ptr [edx+65h]
imul esi, dword ptr [ebp+72h], 73h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
add eax, CFE82B41h
inc esi
inc ebx
sub byte ptr [ebp-44h], al
in al, dx
push ecx
hlt
imul ecx, eax, 24h
cld
and dh, FFFFFF8Eh
jmp 00007FD288AA14D6h
fcmovnb st(0), st(1)
inc ebx
mov byte ptr [edx+56BAFCB5h], al
aam 89h
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
add dword ptr [eax], eax
add byte ptr [eax+eax+00h], dl
add byte ptr [eax], al
adc al, 00h
push ebx
insb
popad
je 00007FD288AA14D8h
imul esi, dword ptr [esi+67h], 73h
insd

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14d54	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x19000	0x8e4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x104	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x141f0	0x15000	False	0.50043015253	data	6.21499607809	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x16000	0x205c	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x19000	0x8e4	0x1000	False	0.169921875	data	1.92865182643	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x197b4	0x130	data
RT_ICON	0x194cc	0x2e8	data
RT_ICON	0x193a4	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x19374	0x30	data
RT_VERSION	0x19150	0x224	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaExitProc, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, __vbaRedim, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaErrorOverflow, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarDup, __vbaStrToAnsi, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0404 0x04b0
InternalName	VOLDFRELSERS
FileVersion	1.00
CompanyName	Seismic
ProductName	Barkerne8
ProductVersion	1.00
OriginalFilename	VOLDFRELSERS.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 12:42:10.468285084 CEST	54513	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:42:10.497733116 CEST	53	54513	8.8.8.8	192.168.2.6
Sep 27, 2021 12:42:37.047013998 CEST	62044	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:42:37.060929060 CEST	53	62044	8.8.8.8	192.168.2.6
Sep 27, 2021 12:42:38.087419033 CEST	63791	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:42:38.100395918 CEST	53	63791	8.8.8.8	192.168.2.6
Sep 27, 2021 12:42:38.518654108 CEST	64267	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:42:38.532080889 CEST	53	64267	8.8.8.8	192.168.2.6
Sep 27, 2021 12:42:38.879477024 CEST	49448	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:42:38.892986059 CEST	53	49448	8.8.8.8	192.168.2.6
Sep 27, 2021 12:42:39.388113022 CEST	60342	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:42:39.401752949 CEST	53	60342	8.8.8.8	192.168.2.6
Sep 27, 2021 12:42:39.925144911 CEST	61346	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:42:39.938443899 CEST	53	61346	8.8.8.8	192.168.2.6
Sep 27, 2021 12:42:40.319777012 CEST	51774	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:42:40.333481073 CEST	53	51774	8.8.8.8	192.168.2.6
Sep 27, 2021 12:42:40.694052935 CEST	56023	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:42:40.708707094 CEST	53	56023	8.8.8.8	192.168.2.6
Sep 27, 2021 12:42:41.488224983 CEST	58384	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:42:41.501471996 CEST	53	58384	8.8.8.8	192.168.2.6
Sep 27, 2021 12:42:42.205091000 CEST	60261	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:42:42.218260050 CEST	53	60261	8.8.8.8	192.168.2.6
Sep 27, 2021 12:42:43.017203093 CEST	56061	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:42:43.030813932 CEST	53	56061	8.8.8.8	192.168.2.6
Sep 27, 2021 12:42:52.978539944 CEST	58336	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:42:52.999460936 CEST	53	58336	8.8.8.8	192.168.2.6
Sep 27, 2021 12:43:07.377031088 CEST	53781	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:43:07.409293890 CEST	53	53781	8.8.8.8	192.168.2.6
Sep 27, 2021 12:43:29.351830959 CEST	54064	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:43:29.394613028 CEST	53	54064	8.8.8.8	192.168.2.6
Sep 27, 2021 12:43:30.982852936 CEST	52811	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:43:31.010282040 CEST	53	52811	8.8.8.8	192.168.2.6
Sep 27, 2021 12:44:06.711647034 CEST	55299	53	192.168.2.6	8.8.8.8
Sep 27, 2021 12:44:06.738811016 CEST	53	55299	8.8.8.8	192.168.2.6

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe PID: 6996 Parent PID: 4688

General

Start time:	12:41:43
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	8E2B177D2AB29C95F067559A029CF5E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe PID: 6996 Parent PID: 4688 DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exeCOMMON

Executed Functions

Function 00403DD6, Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 263
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E00403DD6() {
				void* _t373;
				void* _t374;
				intOrPtr* _t381;
				signed int _t382;
				signed int _t391;
				void* _t393;
				intOrPtr _t401;
				void* _t408;
				signed int _t411;
				void* _t412;
				void* _t413;

				_t374 = _t373 + 0xff;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t411 + _t411 * 8)) =  *((intOrPtr*)(_t411 + _t411 * 8)) + _t374;
				 *((intOrPtr*)(_t413 + 0x59)) =  *((intOrPtr*)(_t413 + 0x59)) + _t393;
				_t381 =  *((intOrPtr*)(0x40100c));
				_t408 = 0x905a4d;
				do {
					_t381 = _t381 + 0xffffffff;
					asm("pushfd");
					asm("popfd");
				} while ( *_t381 != 0x27df367f);
				_t401 =  *((intOrPtr*)(_t381 + 0x10cc));
				_t382 = 0x74b2b3d3;
				while(1) {
					L3:
					asm("sti");
					asm("cdq");
					 *_t382 =  *_t382 + _t382;
					 *0xff195cfb =  *0xff195cfb + _t382;
					_push((_t382 ^ 0xffffffffd2c8f6ee) + 0x5efb1a20);
					_t391 = 0x70407224;
					while(1) {
						L4:
						_t382 = _t391 ^ 0x40622435;
						if(_t382 < 0) {
							goto L3;
						}
						asm("cli");
						_t411 = _t411 - 1;
						_push(_t382);
						_push(0x14000);
						while(1) {
							 *((intOrPtr*)(_t382 + 1)) =  *((intOrPtr*)(_t382 + 1)) + _t382 + 1;
							_t391 = 0;
							_push(0);
							L7:
							asm("rcl dword [eax-0x41c6077d], cl");
							asm("arpl [ecx+0x40], ax");
							_t364 = _t401 - 0x47cda08;
							 *_t364 =  *((intOrPtr*)(_t401 - 0x47cda08));
							if( *_t364 < 0) {
								goto L4;
							}
							asm("clc");
							asm("repne add [eax], al");
							_t411 = 0xca729805;
							do {
								 *(_t391 + _t408) =  *(_t391 + _t408) | 0 ^  *(_t412 + _t408);
								 *(_t391 + _t408) =  *(_t391 + _t408) ^ _t411;
								_t408 = _t408 - 0x242;
								_t371 = _t401 - 0x57c9c06;
								 *_t371 =  *((intOrPtr*)(_t401 - 0x57c9c06)) + _t391;
								if( *_t371 < 0) {
									 *((intOrPtr*)(_t382 + 1)) =  *((intOrPtr*)(_t382 + 1)) + _t382 + 1;
									_t391 = 0;
									_push(0);
									goto L7;
								}
								 *0x83000002 =  *0x83000002 >> 0xf9;
								_pop(ss);
								_t408 = _t408 + 1;
							} while (_t408 >= 0);
							goto __eax;
						}
					}
				}
			}

0x00403dd6
0x00403dd8
0x00403ddb
0x00403dde
0x00403de1
0x00403de4
0x00403de7
0x00403dea
0x00403ded
0x00403df0
0x00403df3
0x00403df6
0x00403df9
0x00403dfc
0x00403dff
0x00403e02
0x00403e05
0x00403e08
0x00403e0b
0x00403e0e
0x00403e11
0x00403e14
0x00403e17
0x00403e1a
0x00403e1d
0x00403e20
0x00403e23
0x00403e26
0x00403e29
0x00403e2c
0x00403e2f
0x00403e32
0x00403e35
0x00403e38
0x00403e3b
0x00403e3e
0x00403e41
0x00403e44
0x00403e47
0x00403e4a
0x00403e4d
0x00403e50
0x00403e53
0x00403e56
0x00403e59
0x00403e5c
0x00403e5f
0x00403e62
0x00403e65
0x00403e68
0x00403e6b
0x00403e6e
0x00403e71
0x00403e74
0x00403e77
0x00403e7a
0x00403e7d
0x00403e80
0x00403e83
0x00403e86
0x00403e89
0x00403e8c
0x00403e8f
0x00403e92
0x00403e95
0x00403e98
0x00403e9b
0x00403e9e
0x00403ea1
0x00403ea4
0x00403ea7
0x00403eaa
0x00403ead
0x00403eb0
0x00403eb3
0x00403eb6
0x00403eb9
0x00403ebc
0x00403ebf
0x00403ec2
0x00403ec5
0x00403ec8
0x00403ecb
0x00403ece
0x00403ed1
0x00403ed4
0x00403ed7
0x00403eda
0x00403edd
0x00403ee0
0x00403ee3
0x00403ee6
0x00403f45
0x00403f91
0x00403fa9
0x00403faf
0x00403fbd
0x00403fbe
0x00403fbe
0x00404020
0x0040402c
0x00404035
0x00404035
0x00404035
0x00404036
0x00404037
0x00404039
0x0040406f
0x004040a1
0x004040ab
0x004040ab
0x004040ab
0x004040b0
0x00000000
0x00000000
0x004040b2
0x004040b3
0x004040bf
0x004040c2
0x004040c4
0x004040c5
0x004040d0
0x004040d6
0x004040df
0x004040e1
0x004040e7
0x004040ea
0x004040ea
0x004040f0
0x00000000
0x00000000
0x004040f2
0x004040f3
0x00404102
0x00404107
0x00404125
0x00404131
0x00404136
0x0040413b
0x0040413b
0x00404141
0x004040c5
0x004040d0
0x004040d6
0x00000000
0x004040dd
0x00404143
0x0040414a
0x0040414c
0x0040414c
0x00404158
0x00404158
0x004040c4
0x004040ab

APIs

VirtualAlloc.KERNELBASE(00000000,00014000,59E82F3C,-00000001E961C348), ref: 004040E0

Strings

#, xrefs: 00403F11
4, xrefs: 00403F6D
</Y, xrefs: 00404074
t, xrefs: 00403FA6
C, xrefs: 00403F04

Memory Dump Source

Source File: 00000000.00000002.871419261.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.871409402.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.871446331.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.871466300.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: #$4$</Y$C$t
API String ID: 4275171209-4177666475
Opcode ID: b957a90be555ff310691938cbbb8b888b6f535d539cd36b71514d004f3fbed23
Instruction ID: d8f2e64fffe10ff016cfeae2d0abe72d9a08336ff8e66d231467780935cbf419
Opcode Fuzzy Hash: b957a90be555ff310691938cbbb8b888b6f535d539cd36b71514d004f3fbed23
Instruction Fuzzy Hash: E84110916A634649FF740034C6E073E2547DB9B300F70AE3BD942EAECADA2EC5C11217

Uniqueness

Uniqueness Score: -1.00%

Function 0040415B, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 122COMMON

Download Yara Rule

Strings

</Y, xrefs: 00404074
EIJ2, xrefs: 0040416D

Memory Dump Source

Source File: 00000000.00000002.871419261.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.871409402.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.871446331.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.871466300.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: </Y$EIJ2
API String ID: 0-1381674127
Opcode ID: 63fc1223908d28ff51972a8561d08ca45a3dde88ac0ba9f5e84cd8dac2e41815
Instruction ID: 4fdcd5157eb28bd92e17da4bbb9c0a987152b77e108edbeaf4ecd54b6f860e43
Opcode Fuzzy Hash: 63fc1223908d28ff51972a8561d08ca45a3dde88ac0ba9f5e84cd8dac2e41815
Instruction Fuzzy Hash: EE3127606593420AEF3415708AD132E26A6ABD7300F74E87BC982EF9DBD63DC4C64347

Uniqueness

Uniqueness Score: -1.00%

Function 02BEC119, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(3C652EF8,?,2273F526), ref: 02BEC3B7

Strings

\A, xrefs: 02BEC198

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: \A
API String ID: 2167126740-949662370
Opcode ID: 85046b7dd2dcbeae1cca44bbb8cdc6fdd470290ea3cbf64fdc6e9775741ad6d7
Instruction ID: b62f9851b2df872773f15b569e157e89adfcb947653a3a235b8bb869e77477f0
Opcode Fuzzy Hash: 85046b7dd2dcbeae1cca44bbb8cdc6fdd470290ea3cbf64fdc6e9775741ad6d7
Instruction Fuzzy Hash: F35138B6A00245CFDF709E68CC947EE3BE6FF99360F59416ADC4A9B321D7308A418B51

Uniqueness

Uniqueness Score: -1.00%

Function 004145C4, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E004145C4(void* __ebx, void* __edi, void* __esi, signed int _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v36;
				intOrPtr _v44;
				char _v52;
				intOrPtr _v60;
				char _v68;
				intOrPtr _v76;
				char _v84;
				intOrPtr _v92;
				char _v100;
				intOrPtr _v108;
				signed int _v116;
				intOrPtr _v124;
				char _v132;
				char _v168;
				char _v172;
				char* _t68;
				void* _t78;
				char _t79;
				char* _t90;
				signed int _t107;
				signed int _t108;
				void* _t109;
				void* _t111;
				intOrPtr _t112;

				_t112 = _t111 - 0xc;
				 *[fs:0x0] = _t112;
				_v16 = _t112 - 0xa0;
				_v12 = 0x401110;
				_t107 = _a4;
				_v8 = _t107 & 0x00000001;
				_t108 = _t107 & 0xfffffffe;
				_a4 = _t108;
				 *((intOrPtr*)( *_t108 + 4))(_t108, __edi, __esi, __ebx,  *[fs:0x0], 0x401176, _t109);
				_v116 = 0;
				_v36 = 0;
				_v52 = 0;
				_v68 = 0;
				_v84 = 0;
				_v100 = 0;
				_v132 = 0;
				_v168 = 0;
				_v172 = 0;
				_v108 = 0x4034a8;
				_v116 = 8;
				L00401284();
				_push( &_v52);
				_push( &_v68);
				L0040128A();
				_v124 = 0x4034b0;
				_push( &_v68);
				_t68 =  &_v132;
				_push(_t68);
				_v132 = 0x8008;
				L00401290();
				_push( &_v68);
				_push( &_v52);
				_push(2);
				L0040127E();
				if(_t68 != 0) {
					_push(1);
					_push(L"BRDMASKINERNES");
					L00401278();
				}
				L00401272();
				 *((intOrPtr*)( *_t108 + 0x6fc))(_t108);
				_v172 =  *0x40110c;
				L0040126C();
				 *((intOrPtr*)( *_t108 + 0x700))(_t108,  &_v36, 0x5d020a,  &_v172,  &_v168);
				L00401266();
				_v172 =  *0x401108;
				 *((intOrPtr*)( *_t108 + 0x708))(_t108,  &_v172, 0x53239, 0x45ef);
				_t78 =  *((intOrPtr*)( *_t108 + 0x2b4))(_t108);
				asm("fclex");
				if(_t78 < 0) {
					_push(0x2b4);
					_push(0x4030f0);
					_push(_t108);
					_push(_t78);
					L00401260();
				}
				_v92 = 0x80020004;
				_t79 = 0xa;
				_v76 = 0x80020004;
				_v60 = 0x80020004;
				_v100 = _t79;
				_v84 = _t79;
				_v68 = _t79;
				 *((intOrPtr*)( *_t108 + 0x70c))(_t108,  &_v172);
				_v52 = 3;
				_v44 = _v172;
				_push( &_v100);
				_push( &_v84);
				_push( &_v68);
				_push(0);
				_push( &_v52);
				L0040125A();
				_push( &_v100);
				_push( &_v84);
				_push( &_v68);
				_t90 =  &_v52;
				_push(_t90);
				_push(4);
				L0040127E();
				_v8 = 0;
				asm("wait");
				_push(0x4147bf);
				return _t90;
			}

0x004145c7
0x004145d6
0x004145e6
0x004145e9
0x004145f0
0x004145f8
0x004145fb
0x004145ff
0x00414604
0x0041460c
0x00414612
0x00414615
0x00414618
0x0041461b
0x0041461e
0x00414621
0x00414624
0x0041462a
0x00414630
0x00414637
0x0041463e
0x00414646
0x0041464a
0x0041464b
0x00414653
0x0041465a
0x0041465b
0x0041465e
0x0041465f
0x00414666
0x00414671
0x00414675
0x00414676
0x00414678
0x00414683
0x00414685
0x00414687
0x0041468c
0x0041468c
0x00414691
0x00414699
0x004146ad
0x004146b3
0x004146d2
0x004146db
0x004146ed
0x00414700
0x00414709
0x00414711
0x00414713
0x00414715
0x0041471a
0x0041471f
0x00414720
0x00414721
0x00414721
0x0041472d
0x00414730
0x00414731
0x00414734
0x0041473d
0x00414740
0x00414743
0x0041474a
0x00414756
0x0041475d
0x00414763
0x00414767
0x0041476b
0x0041476f
0x00414770
0x00414771
0x00414779
0x0041477d
0x00414781
0x00414782
0x00414785
0x00414786
0x00414788
0x00414790
0x00414793
0x00414794
0x00000000

APIs

__vbaVarDup.MSVBVM60 ref: 0041463E
#518.MSVBVM60(?,?), ref: 0041464B
__vbaVarTstNe.MSVBVM60(?,?,?,?), ref: 00414666
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?,?), ref: 00414678
#580.MSVBVM60(BRDMASKINERNES,00000001), ref: 0041468C
#534.MSVBVM60(BRDMASKINERNES,00000001), ref: 00414691
__vbaStrCopy.MSVBVM60 ref: 004146B3
__vbaFreeStr.MSVBVM60 ref: 004146DB
__vbaHresultCheckObj.MSVBVM60(00000000,00401110,004030F0,000002B4), ref: 00414721
#595.MSVBVM60(00000003,00000000,?,?,?), ref: 00414771
__vbaFreeVarList.MSVBVM60(00000004,00000003,?,?,?,00000003,00000000,?,?,?), ref: 00414788

Strings

Java5, xrefs: 004146A5
BRDMASKINERNES, xrefs: 00414687

Memory Dump Source

Source File: 00000000.00000002.871419261.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.871409402.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.871446331.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.871466300.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$List$#518#534#580#595CheckCopyHresult
String ID: BRDMASKINERNES$Java5
API String ID: 1094122113-3738844850
Opcode ID: 46ba9868485f77c3508854d956b4106acf3b20ab9fcd47e2e96cab5edbc387c7
Instruction ID: f8af2a707588264a37dda516b17c29d342dd02d676a00eed33b31a932f1a9f33
Opcode Fuzzy Hash: 46ba9868485f77c3508854d956b4106acf3b20ab9fcd47e2e96cab5edbc387c7
Instruction Fuzzy Hash: 2F51F6B1900228AFCB11DF94CC85EDEBBB8BF49304F1441AFE545B7291DB7856488B55

Uniqueness

Uniqueness Score: -1.00%

Function 004012F0, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 285COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 004012F5

Strings

VB5!6&*, xrefs: 004012F0

Memory Dump Source

Source File: 00000000.00000002.871419261.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.871409402.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.871446331.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.871466300.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 4222714fd7c3f6b412446563863e0df81962509911b21dac2a8bfc1f81506585
Instruction ID: 6c86336c90af4b9bceaeba3a1c7f3800c4129304c87cbb85cd5bd432d9590e56
Opcode Fuzzy Hash: 4222714fd7c3f6b412446563863e0df81962509911b21dac2a8bfc1f81506585
Instruction Fuzzy Hash: 7D9133A548E3C15FD7138B748DA66A13FB0AE1331871E05EBC8C2DA5F3E12D595AC326

Uniqueness

Uniqueness Score: -1.00%

Function 00404191, Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.871419261.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.871409402.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.871446331.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.871466300.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07d0c4fd1165f47115750d9fe789a7c68dfafa52a956889c99f2d090ec788364
Instruction ID: 9e4beb959f78603f2525f38e8f82cb262021e4db3fcee7f6a445e0eb62b7f567
Opcode Fuzzy Hash: 07d0c4fd1165f47115750d9fe789a7c68dfafa52a956889c99f2d090ec788364
Instruction Fuzzy Hash: A31136702092418DEB785531C5D477D3BA2DB96300F3495BFC582CB8EAC93D84C25203

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02BECED6, Relevance: 3.1, Strings: 2, Instructions: 570COMMON

Download Yara Rule

Strings

,J, xrefs: 02BED638
T\4, xrefs: 02BED8A5

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ,J$T\4
API String ID: 0-1611949997
Opcode ID: fda27220e4442791e33b495d7bf0878072fb83eb6bb6dcf92a5534000e724e40
Instruction ID: fd523667955af728d0cd30665a3168a52f2aadb2c87e0656ab65454801edeaf0
Opcode Fuzzy Hash: fda27220e4442791e33b495d7bf0878072fb83eb6bb6dcf92a5534000e724e40
Instruction Fuzzy Hash: AF32F3715083C68FDF35DF38C8997DA7BA2AF56310F4881DAC89A8F296D3748641CB12

Uniqueness

Uniqueness Score: -1.00%

Function 02BE3BBE, Relevance: 1.4, Strings: 1, Instructions: 139COMMON

Download Yara Rule

Strings

`, xrefs: 02BE3D85

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: `
API String ID: 0-1850852036
Opcode ID: 5ad88c7f6e3b67407808a23e4cc20f2388fef3e13bff91bee69131c75a9762a7
Instruction ID: 93924e2d296310b45aa74f8453f906796cbaa2c8f44011fd5cbec86ee5a76e3e
Opcode Fuzzy Hash: 5ad88c7f6e3b67407808a23e4cc20f2388fef3e13bff91bee69131c75a9762a7
Instruction Fuzzy Hash: 04414773A0060A8BEF34DF25A9867E937E2BFDA329F554994CC4B5B218D331C5478610

Uniqueness

Uniqueness Score: -1.00%

Function 02BE3BBC, Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

`, xrefs: 02BE3D85

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: `
API String ID: 0-1850852036
Opcode ID: af317e60efc737e09437c8cfba6f4cc53cf28c067bef5f1c83eed4ffc6288077
Instruction ID: 48d14660a8bf118f781817821fdd57fd540cf5076b689fd8e86b5ae4340c8e72
Opcode Fuzzy Hash: af317e60efc737e09437c8cfba6f4cc53cf28c067bef5f1c83eed4ffc6288077
Instruction Fuzzy Hash: 0E310A729007498BEF34DE2A9E553EE36E3AFE4754F568099CC4F9B204D7348686CA11

Uniqueness

Uniqueness Score: -1.00%

Function 02BE4184, Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c776af1a79ddd377a3e4e842faa9bdb94acc880e53bca63104f6082de4cb03
Instruction ID: 5fdeeb34e8c6631915b881f23e7a5dbac0273132daaa0132946c9cbeb876ed22
Opcode Fuzzy Hash: d3c776af1a79ddd377a3e4e842faa9bdb94acc880e53bca63104f6082de4cb03
Instruction Fuzzy Hash: FCB1CC72604288DFDF749E29C9857DE7BB2FF55360F49845ADC8A9B210D7308A81CF52

Uniqueness

Uniqueness Score: -1.00%

Function 02BE4195, Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf928037a7137e92f411bf1ae64e9ce0b28b7195388c158a2ff0cb16a50933ec
Instruction ID: ea85d8fc73a6a88f13a79d61e635a8a5768337d843c5d57e73307cc2caf84363
Opcode Fuzzy Hash: bf928037a7137e92f411bf1ae64e9ce0b28b7195388c158a2ff0cb16a50933ec
Instruction Fuzzy Hash: 4891EB726043899FCF349E29CD85BEA7BB2BF49360F494559DC8A9B214D3308A81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 02BE42B5, Relevance: .2, Instructions: 202COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0330560b5561837cf430cedbea39911d26a0e4ba3b04a1297e1c110253daa378
Instruction ID: 50cba54637a17e77c94368703c219d583fc37eacb038fcdea4004c395ea9785a
Opcode Fuzzy Hash: 0330560b5561837cf430cedbea39911d26a0e4ba3b04a1297e1c110253daa378
Instruction Fuzzy Hash: F781DB726083899FDF34DE24C885AEA7BA1BF4A320F49455DDC8A9B254C3309A85CF52

Uniqueness

Uniqueness Score: -1.00%

Function 02BE4358, Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f47a34356b5fa721ad07fb2aba0fe38b94058f52cfa6f207b00b05a7c70b1b6
Instruction ID: 1bb27cd48be36e21caf89cb359bac93ed0bc7a3930aed70182d16b030fa298c7
Opcode Fuzzy Hash: 7f47a34356b5fa721ad07fb2aba0fe38b94058f52cfa6f207b00b05a7c70b1b6
Instruction Fuzzy Hash: 5871E0316443899FCF749F248885ADA7BB1FF4A320F498599DC8A8B254D7318A86CF12

Uniqueness

Uniqueness Score: -1.00%

Function 02BE4245, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4191cdc9af466bb2cd638db60723d05b7c2d128c54af93394251cdf818e328
Instruction ID: 38e00fdbbafd59ed10a5235d62063ff1238e2353d547255e36e71b3f4088d758
Opcode Fuzzy Hash: 9f4191cdc9af466bb2cd638db60723d05b7c2d128c54af93394251cdf818e328
Instruction Fuzzy Hash: 7771CA31608388DFDB349E29CD85BEA77A2BF49360F45456ADC8A9B254D7308A80CF52

Uniqueness

Uniqueness Score: -1.00%

Function 02BE3700, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0a2f241047e0ec3ea5d942a8774fbef510030e7f72c4740fbdec9f32c19d95
Instruction ID: 74da60ecb02ec63a8bbb71af2f2f9ac372884b047de2b1a168f924f016185124
Opcode Fuzzy Hash: 0f0a2f241047e0ec3ea5d942a8774fbef510030e7f72c4740fbdec9f32c19d95
Instruction Fuzzy Hash: A361DDB2A04298DFDF709E68CC89BDE3BA6BF94350F954159DC0E9B204D7348B458B91

Uniqueness

Uniqueness Score: -1.00%

Function 02BE2F9B, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bf2465cb90502b995f5e01a41fd89f05bd278bd5eb73161a011614a44892194
Instruction ID: 47b1cacc5935e93b1af3b3ae76f250b2fb425535ac466651caf58c2f13ae7e8d
Opcode Fuzzy Hash: 0bf2465cb90502b995f5e01a41fd89f05bd278bd5eb73161a011614a44892194
Instruction Fuzzy Hash: 1F510372A042858FDF649F28DC85BEA7BB2FF49310F15456DDC8E9B214D3319A82CB52

Uniqueness

Uniqueness Score: -1.00%

Function 02BE303C, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bc2f0f141cfe63769f09bc7f83475810a0c395dcee9332d6d084135b7f9741
Instruction ID: fa4bcdfe242f1704465fc2ce289a09257f26b5db807e0a496f8d3971a37b625c
Opcode Fuzzy Hash: 64bc2f0f141cfe63769f09bc7f83475810a0c395dcee9332d6d084135b7f9741
Instruction Fuzzy Hash: 0B51E2B2A042458FDF74DF24DC8ABEA7BF2BF49310F05499DDC8A9B224C37195828B51

Uniqueness

Uniqueness Score: -1.00%

Function 02BE2F90, Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a18b9b1f9e16f6d25d5524d928864f7346e6bd71ea650fb0d3361f7d435d6f54
Instruction ID: 1adfcd55a6c7c216ad81d4df2c49916ee9028b974d6cdcd9d3e6dfd50d7e80b4
Opcode Fuzzy Hash: a18b9b1f9e16f6d25d5524d928864f7346e6bd71ea650fb0d3361f7d435d6f54
Instruction Fuzzy Hash: 6F519A726082849FDF699F68CC45BEE7BA6FF88340F15446DEC89DB214C7719A82CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02BE4484, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 703fc841169679cb13c06feeabf3eae4a71e8a3b12ebf64ac5265d694dea4e0f
Instruction ID: 84120449cd8a120307e9bf6a613b58a6fe757494fb76f62138f37691871f1219
Opcode Fuzzy Hash: 703fc841169679cb13c06feeabf3eae4a71e8a3b12ebf64ac5265d694dea4e0f
Instruction Fuzzy Hash: 6741DE72604389DFDF74DF248885BAA77B1BF49310F4A4999DC8A8B254D7308682CF12

Uniqueness

Uniqueness Score: -1.00%

Function 02BE4419, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 048eae98a83e353b2c7b132d056b6c98fdcb5681890ea672608cdcd6eeeca69c
Instruction ID: 56e084bce2ffe794dd084cbee029df64080337101fcba7d2048e5bb57d06a5d3
Opcode Fuzzy Hash: 048eae98a83e353b2c7b132d056b6c98fdcb5681890ea672608cdcd6eeeca69c
Instruction Fuzzy Hash: 5041AA31604388EFCB74DF25C8856DAB7B2BF49310F85496DDC8A8B254D7308A81CF12

Uniqueness

Uniqueness Score: -1.00%

Function 02BE5833, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da0bda13b1eb7662655fe62dd0f78e620b435a743a17290c7e0c5281e36730f4
Instruction ID: 99a87e0a56d3971ab5014545ff16d76a2b0998ac5db1d83d8fe6515881c7ed54
Opcode Fuzzy Hash: da0bda13b1eb7662655fe62dd0f78e620b435a743a17290c7e0c5281e36730f4
Instruction Fuzzy Hash: 0D318BB2505B468BCB3A8B74C8856A17B60BF57338B584BDDC0B64F6AAC334A003C741

Uniqueness

Uniqueness Score: -1.00%

Function 02BE452C, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1f82bd562c7f296408b8bd6512557556092952c0b0efe23ccedb02bb6724960
Instruction ID: 187a3c1e84a29b9de8f3f49011e9f113b3b0b2146160145b092fdfbd1d828c81
Opcode Fuzzy Hash: b1f82bd562c7f296408b8bd6512557556092952c0b0efe23ccedb02bb6724960
Instruction Fuzzy Hash: 9F31F472618345CFCF649B609886AA67BF0AF46224F4A0A9DDCC68B159D3718186CF13

Uniqueness

Uniqueness Score: -1.00%

Function 02BE58BF, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24cd38b294a973450dc8f6a4fa97939951bdff18effa0f293d2da904a914f1bf
Instruction ID: 08f9563113f18537f588052d0808d713ed9429575d1044d19dc49ceaf3b7d2d6
Opcode Fuzzy Hash: 24cd38b294a973450dc8f6a4fa97939951bdff18effa0f293d2da904a914f1bf
Instruction Fuzzy Hash: 23213BB651160A8BCF29CB64D8C69A17B70BF4B3397584BC4C0674F629D331E0439751

Uniqueness

Uniqueness Score: -1.00%

Function 02BE599C, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04570e649de4e3a3f8c4365443f6c0e329cd7d338e3c0959530a52ac30bfc511
Instruction ID: 58a9c728d0620aa5301a9adac92c25324417b4a0e65e4250c1804c45be2fa61e
Opcode Fuzzy Hash: 04570e649de4e3a3f8c4365443f6c0e329cd7d338e3c0959530a52ac30bfc511
Instruction Fuzzy Hash: B92145762046068FCF28DB60C8C6DD27B72FF5B228BA94AC0C1468FA26D375D043C791

Uniqueness

Uniqueness Score: -1.00%

Function 02BE5859, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07198fd7657d7e17e8721267dab755e89d20023366598a66299796205c35095c
Instruction ID: f206f10dbea0440116826084209dcf11ea32bc78c48c844dd47577477d4f56f1
Opcode Fuzzy Hash: 07198fd7657d7e17e8721267dab755e89d20023366598a66299796205c35095c
Instruction Fuzzy Hash: 8C21A07151574697C72A8F78CC851A6BB71EF87334B284BEDC1954F965C3359047C381

Uniqueness

Uniqueness Score: -1.00%

Function 02BEBDCB, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09310cde7cf0398f49c8d733fd8f2ff99b3c80836489205be8af204d42ffecfd
Instruction ID: c0b180a1b7741b9c6ddb3b1deefce02c75fb0c0f3a390394e6d202431479b360
Opcode Fuzzy Hash: 09310cde7cf0398f49c8d733fd8f2ff99b3c80836489205be8af204d42ffecfd
Instruction Fuzzy Hash: 351165352416488FCB35EF24C991AEAB3F2BFA1300F21844ACA4A8F221C330EA40CF11

Uniqueness

Uniqueness Score: -1.00%

Function 02BE3B3F, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f8ea7db8b3ee99bf8808ceefb32f2f8216390b90dd29ca80f681b80e263aefa
Instruction ID: dc0f1a8d415af9e269735d6bcc20bada2e62b5948dc73fd8fc9e434d5ad9c0c8
Opcode Fuzzy Hash: 7f8ea7db8b3ee99bf8808ceefb32f2f8216390b90dd29ca80f681b80e263aefa
Instruction Fuzzy Hash: 5FC02BCBE1802D3E0FD17634794C13700430380B343018EC0102FEB50DDC81CD4A086B

Uniqueness

Uniqueness Score: -1.00%

Function 02BE88B4, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50cfec0245e5ccc62ae96391f0977d9b62c955d6709da5f737efcc2a9c58f70a
Instruction ID: acc5bbaf8b54696d7dab85bb2a2a033972eccd470bef5a106a5c3289c5085165
Opcode Fuzzy Hash: 50cfec0245e5ccc62ae96391f0977d9b62c955d6709da5f737efcc2a9c58f70a
Instruction Fuzzy Hash: 75C04CFB5115818BEE46CA18E452B4073A4F754A48B0508D0E005DF711C115ED048510

Uniqueness

Uniqueness Score: -1.00%

Function 02BEB5AE, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.872323022.0000000002BE0000.00000040.00000001.sdmp, Offset: 02BE0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7c787452fe63bc5650f9692732879a21aadf59cb7134ecaec7fe9d9749c030b
Instruction ID: dd420ef26a1f3e20cb5f08afea9a23d86a103982b78616ea6e4e29e4367b0f4f
Opcode Fuzzy Hash: c7c787452fe63bc5650f9692732879a21aadf59cb7134ecaec7fe9d9749c030b
Instruction Fuzzy Hash: 54B092B0624540CFCE95CA09C1A0F4073B0B700B04F4114C1F1028BA62C36AEE00CA00

Uniqueness

Uniqueness Score: -1.00%

Function 00414A37, Relevance: 65.0, APIs: 30, Strings: 7, Instructions: 227
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00414A37(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __fp0, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v56;
				intOrPtr _v60;
				intOrPtr _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v96;
				char* _v104;
				char _v112;
				char _v120;
				char _v124;
				char* _t67;
				char* _t68;
				signed int _t73;
				char* _t75;
				char* _t81;
				char* _t82;
				char* _t83;
				char* _t88;
				void* _t90;
				char* _t93;
				void* _t94;
				char _t97;
				intOrPtr* _t115;
				intOrPtr* _t122;
				void* _t124;
				intOrPtr _t126;
				intOrPtr _t127;
				void* _t132;
				void* _t142;

				_t142 = __fp0;
				 *[fs:0x0] = _t126;
				_t127 = _t126 - 0x78;
				_v12 = _t127;
				_v8 = 0x401160;
				_t97 = 0;
				_v68 = 0x1c28;
				_v68 = 0x403eeb;
				_v68( &_v56, __esi, 0, 7, __edi, __esi, __ebx,  *[fs:0x0], 0x401176, __ecx, __ecx, _t124);
				_v96 = 0;
				_v112 = 0;
				_v120 = 0;
				_v124 = 0;
				E004032C8();
				_v120 = 0;
				L0040123C();
				if(_v120 == 0x33064c) {
					_push(0);
					_push(L"Ichthyosaurian");
					_push( &_v96);
					L0040121E();
					_t127 = _t127 - 0x10;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0);
					_push(_v60);
					asm("movsd");
					L00401224();
					L0040124E();
				}
				_v124 = 0x4c8498;
				_push( &_v124);
				_t67 =  &_v120;
				_push(_t67);
				_push(0x38e45c);
				_v120 = 0x4f4735;
				E00403310();
				L0040123C();
				if(_t67 != 0x36aeb1) {
					_t115 = _a4;
				} else {
					_t132 =  *0x4171a8 - _t97; // 0x2d0e99c
					if(_t132 == 0) {
						_push(0x4171a8);
						_push(0x403528);
						L00401248();
					}
					_t115 = _a4;
					_t122 =  *0x4171a8; // 0x2d0e99c
					_t93 =  &_v80;
					L00401218();
					_t94 =  *((intOrPtr*)( *_t122 + 0x10))(_t122, _t93, _t93, _t115);
					_t97 = 0;
					asm("fclex");
					if(_t94 < 0) {
						_push(0x10);
						_push(0x403518);
						_push(_t122);
						_push(_t94);
						L00401260();
					}
					L00401242();
				}
				_t68 =  &_v72;
				_push(L"actinologue");
				_push(_t68);
				L00401212();
				_push(_t68);
				_push(0x768003);
				E00403378();
				L0040123C();
				L00401266();
				asm("sbb eax, eax");
				_t73 =  ~( ~(_t68 - 0x23ca2d) + 1);
				if(_t73 != 0) {
					_t73 =  *((intOrPtr*)( *_t115 + 0x15c))(_t115, 0x6975);
					asm("fclex");
					if(_t73 < _t97) {
						_push(0x15c);
						_push(0x4030f0);
						_push(_t115);
						_push(_t73);
						L00401260();
					}
				}
				L0040126C();
				_push(_t73);
				_push( &_v76);
				L00401212();
				_t75 =  &_v76;
				_push(_t75);
				_push(0x17b19c);
				_push(0x6a35ad);
				E004033BC();
				_v120 = _t75;
				L0040123C();
				_push( &_v76);
				_push( &_v72);
				_push(2);
				L0040120C();
				if( ~(0 | _v120 == 0x00452982) != _t97) {
					_v104 = L"Ossifiers1";
					_v112 = 8;
					L00401284();
					_push(2);
					_push( &_v96);
					L00401236();
					st0 = _t142;
					L0040124E();
				}
				_t81 =  &_v56;
				_push(0x5d2c9b);
				_push(_t81);
				_push(0x4ee518);
				E00403410();
				_v120 = _t81;
				L0040123C();
				if(_v120 == 0x2c064e) {
					_t90 =  *((intOrPtr*)( *_t115 + 0x254))(_t115, 0x74b9);
					asm("fclex");
					if(_t90 < _t97) {
						_push(0x254);
						_push(0x4030f0);
						_push(_t115);
						_push(_t90);
						L00401260();
					}
				}
				_t82 =  &_v76;
				_push(L"Snackbaren");
				_push(_t82);
				L00401212();
				_push(_t82);
				_push(0x1a1689);
				_t83 =  &_v72;
				_push(L"AZEOTROPY");
				_push(_t83);
				L00401212();
				_push(_t83);
				E0040347C();
				_v120 = _t83;
				L0040123C();
				_push( &_v76);
				_t88 =  &_v72;
				_push(_t88);
				_push(2);
				L0040120C();
				if( ~(0 | _v120 == 0x00205b99) != _t97) {
					_v104 = 0x403618;
					_v112 = 8;
					L00401284();
					_t88 =  &_v96;
					_push(_t88);
					L00401206();
					L0040124E();
				}
				asm("wait");
				_push(0x414d35);
				L00401242();
				return _t88;
			}

0x00414a37
0x00414a48
0x00414a4f
0x00414a55
0x00414a58
0x00414a67
0x00414a69
0x00414a70
0x00414a7b
0x00414a7e
0x00414a81
0x00414a84
0x00414a87
0x00414a8a
0x00414a8f
0x00414a92
0x00414a9e
0x00414aa0
0x00414aa4
0x00414aa9
0x00414aaa
0x00414aaf
0x00414ab7
0x00414ab8
0x00414ab9
0x00414aba
0x00414abb
0x00414abe
0x00414abf
0x00414ac7
0x00414ac7
0x00414acf
0x00414ad6
0x00414ad7
0x00414ada
0x00414adb
0x00414ae0
0x00414ae7
0x00414aee
0x00414af9
0x00414b4c
0x00414afb
0x00414afb
0x00414b01
0x00414b03
0x00414b08
0x00414b0d
0x00414b0d
0x00414b12
0x00414b15
0x00414b1b
0x00414b22
0x00414b29
0x00414b2c
0x00414b30
0x00414b32
0x00414b34
0x00414b36
0x00414b3b
0x00414b3c
0x00414b3d
0x00414b3d
0x00414b45
0x00414b45
0x00414b4f
0x00414b52
0x00414b57
0x00414b58
0x00414b5d
0x00414b5e
0x00414b63
0x00414b6a
0x00414b72
0x00414b81
0x00414b84
0x00414b89
0x00414b93
0x00414b9b
0x00414b9d
0x00414b9f
0x00414ba4
0x00414ba9
0x00414baa
0x00414bab
0x00414bab
0x00414b9d
0x00414bb8
0x00414bbd
0x00414bc1
0x00414bc2
0x00414bc7
0x00414bca
0x00414bcb
0x00414bd0
0x00414bd5
0x00414bda
0x00414bdd
0x00414bf5
0x00414bf9
0x00414bfa
0x00414bfc
0x00414c07
0x00414c0f
0x00414c16
0x00414c1d
0x00414c25
0x00414c27
0x00414c28
0x00414c30
0x00414c32
0x00414c32
0x00414c37
0x00414c3a
0x00414c3f
0x00414c40
0x00414c45
0x00414c4a
0x00414c4d
0x00414c59
0x00414c63
0x00414c6b
0x00414c6d
0x00414c6f
0x00414c74
0x00414c79
0x00414c7a
0x00414c7b
0x00414c7b
0x00414c6d
0x00414c80
0x00414c83
0x00414c88
0x00414c89
0x00414c8e
0x00414c8f
0x00414c94
0x00414c97
0x00414c9c
0x00414c9d
0x00414ca2
0x00414ca3
0x00414ca8
0x00414cab
0x00414cc3
0x00414cc4
0x00414cc7
0x00414cc8
0x00414cca
0x00414cd5
0x00414cdd
0x00414ce4
0x00414ceb
0x00414cf0
0x00414cf3
0x00414cf4
0x00414cfc
0x00414cfc
0x00414d01
0x00414d02
0x00414d2f
0x00414d34

APIs

__vbaSetSystemError.MSVBVM60(?,00000000), ref: 00414A92
#716.MSVBVM60(?,Ichthyosaurian,00000000,?,00000000), ref: 00414AAA
__vbaLateIdSt.MSVBVM60(?,00000000,00000000), ref: 00414ABF
__vbaFreeVar.MSVBVM60(?,00000000,00000000), ref: 00414AC7
__vbaSetSystemError.MSVBVM60(0038E45C,0033064C,?,?,00000000), ref: 00414AEE
__vbaNew2.MSVBVM60(00403528,004171A8,0038E45C,0033064C,?,?,00000000), ref: 00414B0D
__vbaObjSetAddref.MSVBVM60(?,?,0038E45C,0033064C,?,?,00000000), ref: 00414B22
__vbaHresultCheckObj.MSVBVM60(00000000,02D0E99C,00403518,00000010,?,00000000), ref: 00414B3D
__vbaFreeObj.MSVBVM60(?,00000000), ref: 00414B45
__vbaStrToAnsi.MSVBVM60(?,actinologue,0038E45C,0033064C,?,?,00000000), ref: 00414B58
__vbaSetSystemError.MSVBVM60(00768003,00000000,?,actinologue,0038E45C,0033064C,?,?,00000000), ref: 00414B6A
__vbaFreeStr.MSVBVM60(00768003,00000000,?,actinologue,0038E45C,0033064C,?,?,00000000), ref: 00414B72
__vbaHresultCheckObj.MSVBVM60(00000000,?,004030F0,0000015C,?,00000000), ref: 00414BAB
__vbaStrCopy.MSVBVM60(00768003,00000000,?,actinologue,0038E45C,0033064C,?,?,00000000), ref: 00414BB8
__vbaStrToAnsi.MSVBVM60(?,00000000,00768003,00000000,?,actinologue,0038E45C,0033064C,?,?,00000000), ref: 00414BC2
__vbaSetSystemError.MSVBVM60(006A35AD,0017B19C,?,?,00000000,00768003,00000000,?,actinologue,0038E45C,0033064C,?,?,00000000), ref: 00414BDD
__vbaFreeStrList.MSVBVM60(00000002,?,?,006A35AD,0017B19C,?,?,00000000,00768003,00000000,?,actinologue,0038E45C,0033064C,?), ref: 00414BFC
__vbaVarDup.MSVBVM60 ref: 00414C1D
#600.MSVBVM60(?,00000002), ref: 00414C28
__vbaFreeVar.MSVBVM60(?,00000002), ref: 00414C32
__vbaSetSystemError.MSVBVM60(004EE518,?,005D2C9B), ref: 00414C4D
__vbaHresultCheckObj.MSVBVM60(00000000,?,004030F0,00000254), ref: 00414C7B
__vbaStrToAnsi.MSVBVM60(?,Snackbaren,004EE518,?,005D2C9B), ref: 00414C89
__vbaStrToAnsi.MSVBVM60(?,AZEOTROPY,001A1689,00000000,?,Snackbaren,004EE518,?,005D2C9B), ref: 00414C9D
__vbaSetSystemError.MSVBVM60(00000000,?,AZEOTROPY,001A1689,00000000,?,Snackbaren,004EE518,?,005D2C9B), ref: 00414CAB
__vbaFreeStrList.MSVBVM60(00000002,?,?,00000000,?,AZEOTROPY,001A1689,00000000,?,Snackbaren,004EE518,?,005D2C9B), ref: 00414CCA
__vbaVarDup.MSVBVM60(004EE518,?,005D2C9B), ref: 00414CEB
#529.MSVBVM60(?,004EE518,?,005D2C9B), ref: 00414CF4
__vbaFreeVar.MSVBVM60(?,004EE518,?,005D2C9B), ref: 00414CFC
__vbaFreeObj.MSVBVM60(00414D35,004EE518,?,005D2C9B), ref: 00414D2F

Strings

actinologue, xrefs: 00414B52
Ossifiers1, xrefs: 00414C0F
AZEOTROPY, xrefs: 00414C97
5GO, xrefs: 00414AD7
Snackbaren, xrefs: 00414C83
SUPERIMPENDING, xrefs: 00414BB0
Ichthyosaurian, xrefs: 00414AA4

Memory Dump Source

Source File: 00000000.00000002.871419261.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.871409402.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.871446331.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.871466300.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$ErrorSystem$Ansi$CheckHresult$List$#529#600#716AddrefCopyLateNew2
String ID: 5GO$AZEOTROPY$Ichthyosaurian$Ossifiers1$SUPERIMPENDING$Snackbaren$actinologue
API String ID: 601719216-3463406768
Opcode ID: 97720039c6e9707af5c4ababeef6bf5ed38e4ebe0d531fb435aa299280c2e54e
Instruction ID: e7fbeced02998110f903cad3b4d2ba1fe3a458397f525936550412189d05ea61
Opcode Fuzzy Hash: 97720039c6e9707af5c4ababeef6bf5ed38e4ebe0d531fb435aa299280c2e54e
Instruction Fuzzy Hash: 65714FB1D40208AADB10EFE1C846ADEBBBCAF44705F60457FB501F71D2DB785A498A58

Uniqueness

Uniqueness Score: -1.00%

Function 0041484A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0041484A(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				signed int _v28;
				void* _t13;
				signed int _t14;
				void* _t15;
				intOrPtr* _t23;
				signed int _t24;
				intOrPtr _t27;

				_push(0x401176);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t27;
				_v12 = _t27 - 0x1c;
				_v8 = 0x401130;
				_v28 = _v28 & 0x00000000;
				if( *0x4171a8 == 0) {
					_push(0x4171a8);
					_push(0x403528);
					L00401248();
				}
				_t23 =  *0x4171a8; // 0x2d0e99c
				_t13 =  *((intOrPtr*)( *_t23 + 0x14))(_t23,  &_v28);
				asm("fclex");
				if(_t13 < 0) {
					_push(0x14);
					_push(0x403518);
					_push(_t23);
					_push(_t13);
					L00401260();
				}
				_t14 = _v28;
				_t24 = _t14;
				_t15 =  *((intOrPtr*)( *_t14 + 0x138))(_t14, L"KOMPROMITTERINGERNES", 1);
				asm("fclex");
				if(_t15 < 0) {
					_push(0x138);
					_push(0x403538);
					_push(_t24);
					_push(_t15);
					L00401260();
				}
				L00401242();
				_v24 = 0x150b;
				_push(0x4148fe);
				return _t15;
			}

0x0041484f
0x0041485a
0x0041485b
0x00414868
0x0041486b
0x00414872
0x0041487d
0x0041487f
0x00414884
0x00414889
0x00414889
0x0041488e
0x0041489b
0x004148a0
0x004148a2
0x004148a4
0x004148a6
0x004148ab
0x004148ac
0x004148ad
0x004148ad
0x004148b2
0x004148bf
0x004148c1
0x004148c9
0x004148cb
0x004148cd
0x004148d2
0x004148d7
0x004148d8
0x004148d9
0x004148d9
0x004148e1
0x004148e6
0x004148ed
0x00000000

APIs

__vbaNew2.MSVBVM60(00403528,004171A8), ref: 00414889
__vbaHresultCheckObj.MSVBVM60(00000000,02D0E99C,00403518,00000014), ref: 004148AD
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00403538,00000138), ref: 004148D9
__vbaFreeObj.MSVBVM60(00000000,00000000,00403538,00000138), ref: 004148E1

Strings

KOMPROMITTERINGERNES, xrefs: 004148B7

Memory Dump Source

Source File: 00000000.00000002.871419261.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.871409402.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.871446331.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.871466300.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID: KOMPROMITTERINGERNES
API String ID: 4261391273-264330282
Opcode ID: 00e127226a097489f747f4e5bbe487aa8d8025a6e6205f8c14f008a24b78254d
Instruction ID: 91a96e9d06ff350200d1eba3150fe95f7c5d53d7e9db5e81d402b38113d6e13e
Opcode Fuzzy Hash: 00e127226a097489f747f4e5bbe487aa8d8025a6e6205f8c14f008a24b78254d
Instruction Fuzzy Hash: 09118270680344BFD710AFA5CD4AFEB7ABCEB15B55F10017EB101B71E1C6BC594586A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041491B, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__vbaSetSystemError.MSVBVM60(00000000,00000000,?), ref: 0041495B
__vbaVarDup.MSVBVM60(00000000,00000000,?), ref: 0041497C
#600.MSVBVM60(?,00000002,00000000,00000000,?), ref: 00414987
__vbaFreeVar.MSVBVM60(?,00000002,00000000,00000000,?), ref: 00414991

Strings

klverens, xrefs: 0041496E

Memory Dump Source

Source File: 00000000.00000002.871419261.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.871409402.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.871446331.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.871466300.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#600ErrorFreeSystem
String ID: klverens
API String ID: 3931331424-2504283271
Opcode ID: 3b55207510589b2e942b96ca55b947f9ba51a54677e94ba41c5d81c2be0a67b0
Instruction ID: 785ba9432acc8f4502ba7e6c44af6ff5bab72de40073f0206222d6020c2e4907
Opcode Fuzzy Hash: 3b55207510589b2e942b96ca55b947f9ba51a54677e94ba41c5d81c2be0a67b0
Instruction Fuzzy Hash: 310112B0C11209BADB14DFA5C846BEEBABCEB48704F50816EF915B6190E77859048F69

Uniqueness

Uniqueness Score: -1.00%

Function 004149BB, Relevance: 6.0, APIs: 4, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E004149BB(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v24;
				intOrPtr _v32;
				char _v40;
				char _t12;
				char* _t13;
				intOrPtr _t24;

				_push(0x401176);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t24;
				_v12 = _t24 - 0x28;
				_v8 = 0x401150;
				_v24 = _v24 & 0x00000000;
				_t12 = 2;
				_v32 = _t12;
				_v40 = _t12;
				_t13 =  &_v40;
				_push(_t13);
				L0040122A();
				L00401230();
				L0040124E();
				_push(0x414a24);
				L00401266();
				return _t13;
			}

0x004149c0
0x004149cb
0x004149cc
0x004149d9
0x004149dc
0x004149e3
0x004149e9
0x004149ea
0x004149ed
0x004149f0
0x004149f3
0x004149f4
0x004149fe
0x00414a06
0x00414a0b
0x00414a1e
0x00414a23

APIs

#536.MSVBVM60(?), ref: 004149F4
__vbaStrMove.MSVBVM60(?), ref: 004149FE
__vbaFreeVar.MSVBVM60(?), ref: 00414A06
__vbaFreeStr.MSVBVM60(00414A24,?), ref: 00414A1E

Memory Dump Source

Source File: 00000000.00000002.871419261.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.871409402.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.871446331.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.871466300.0000000000419000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#536Move
String ID:
API String ID: 2764857095-0
Opcode ID: 16800b94f94e13c2f52e92c2db50109ef6ea9bc903cf1771ad2379ac862c91ce
Instruction ID: 38bb64d32370a8bcc42eba7486e2c6a2be9ad4f77fcbc37a52c7d52853ddc88c
Opcode Fuzzy Hash: 16800b94f94e13c2f52e92c2db50109ef6ea9bc903cf1771ad2379ac862c91ce
Instruction Fuzzy Hash: 2DF01DB1950208ABD704EB95CA46FEEB7F8EB08744F60406EF001B25D1E7782E048A69

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe PID: 6996 Parent PID: 4688

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exe PID: 6996 Parent PID: 4688 DHL_Shipment_Notification_1231413385_Notification_1231413385_september2021.exeCOMMON

Executed Functions

Function 00403DD6, Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 263memoryCOMMONCrypto

Function 0040415B, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 122COMMON

Function 02BEC119, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 163memorynativeCOMMON

Function 00403DD6, Relevance: 9.3, APIs: 1, Strings: 5, Instructions: 263
memoryCOMMONCrypto

Function 004145C4, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 146
COMMON

Function 00414A37, Relevance: 65.0, APIs: 30, Strings: 7, Instructions: 227
COMMON

Function 0041484A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Function 004149BB, Relevance: 6.0, APIs: 4, Instructions: 32
COMMON