Play interactive tour

Edit tour

Windows Analysis Report Dokument VAT I - 85926 09 2021 MAG-8.exe

Overview

General Information

Sample Name:	Dokument VAT I - 85926 09 2021 MAG-8.exe
Analysis ID:	491309
MD5:	0a2f51e6d3650f115c1b5484afbdf3a7
SHA1:	6283d55e065802036f0e5da958bfd458a7999c09
SHA256:	e49ff3e9ecbbe320e8cd29470d13b72643674b66e75ab5a824dda36eef6bf05e
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to call native functions

Program does not show much activity (idle)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

Dokument VAT I - 85926 09 2021 MAG-8.exe (PID: 6420 cmdline: 'C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe' MD5: 0A2F51E6D3650F115C1B5484AFBDF3A7)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1nGJi"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1nGJi"}

Multi AV Scanner detection for submitted file

Show sources

Source: Dokument VAT I - 85926 09 2021 MAG-8.exe

Virustotal: Detection: 20%

Perma Link

Source: Dokument VAT I - 85926 09 2021 MAG-8.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1nGJi

Source: Dokument VAT I - 85926 09 2021 MAG-8.exe, 00000001.00000002.810461563.00000000006FA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: Dokument VAT I - 85926 09 2021 MAG-8.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: Dokument VAT I - 85926 09 2021 MAG-8.exe, 00000001.00000000.284587684.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameAfblomstrings8.exe vs Dokument VAT I - 85926 09 2021 MAG-8.exe
Source: Dokument VAT I - 85926 09 2021 MAG-8.exe	Binary or memory string: OriginalFilenameAfblomstrings8.exe vs Dokument VAT I - 85926 09 2021 MAG-8.exe

Source: Dokument VAT I - 85926 09 2021 MAG-8.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E7466	1_2_021E7466
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021EB95B	1_2_021EB95B
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E5E19	1_2_021E5E19
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E9416	1_2_021E9416
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E6014	1_2_021E6014
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E720B	1_2_021E720B
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E503A	1_2_021E503A
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E5838	1_2_021E5838
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E9638	1_2_021E9638
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E564E	1_2_021E564E
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021EA464	1_2_021EA464
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E7488	1_2_021E7488
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E5ABA	1_2_021E5ABA
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E5ED2	1_2_021E5ED2
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E54EB	1_2_021E54EB
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E5511	1_2_021E5511
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021EA92B	1_2_021EA92B
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E595E	1_2_021E595E
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E5776	1_2_021E5776
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E6166	1_2_021E6166
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E59B1	1_2_021E59B1
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E53AC	1_2_021E53AC
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E59A6	1_2_021E59A6
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E5BCA	1_2_021E5BCA

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E7466 NtAllocateVirtualMemory,		1_2_021E7466
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E7488 NtAllocateVirtualMemory,		1_2_021E7488

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe

Process Stats: CPU usage > 98%

Source: Dokument VAT I - 85926 09 2021 MAG-8.exe

Virustotal: Detection: 20%

Source: Dokument VAT I - 85926 09 2021 MAG-8.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe

File created: C:\Users\user\AppData\Local\Temp\~DFBDA2D233B6FDE700.TMP

Jump to behavior

Source: classification engine

Classification label: mal76.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_00403E4C push esp; iretd	1_2_00403E82
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_00404E5C push esp; ret	1_2_00404E5D
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_00405029 push FFFFFFFBh; ret	1_2_0040502D
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_0040769A push ebp; ret	1_2_0040769D
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_004040B4 push esp; ret	1_2_004040B5
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_00403F77 push esp; ret	1_2_00403FF9
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_00407304 push esp; ret	1_2_004072ED
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_0040713E push esp; ret	1_2_004072ED
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_004071F5 push esp; ret	1_2_004072ED
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_00408789 push esp; ret	1_2_00408795
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_00407D93 push esp; ret	1_2_00407D99
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E3EF5 pushad ; retf	1_2_021E3EF6
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E413D push edx; iretd	1_2_021E415C
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E4552 push ecx; ret	1_2_021E4575
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E858D push esi; ret	1_2_021E858E
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E73B9 push edi; iretd	1_2_021E73CD
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E3BB7 push edx; ret	1_2_021E3BBE
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E73CF pushad ; ret	1_2_021E73D1
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E73E2 push edi; iretd	1_2_021E73CD

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe

RDTSC instruction interceptor: First address: 000000000040E86D second address: 000000000040E86D instructions: 0x00000000 rdtsc 0x00000002 wait 0x00000003 nop 0x00000004 popad 0x00000005 mfence 0x00000008 mfence 0x0000000b dec edi 0x0000000c cmp eax, 63h 0x0000000f cmp eax, 04h 0x00000012 cmp edi, 00000000h 0x00000015 jne 00007F28FCD8F3C0h 0x00000017 cmp ecx, 06h 0x0000001a mfence 0x0000001d pushad 0x0000001e pushfd 0x0000001f popfd 0x00000020 pushfd 0x00000021 popfd 0x00000022 rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe

Code function: 1_2_021E70A2 rdtsc

1_2_021E70A2

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E9C00 mov eax, dword ptr fs:[00000030h]	1_2_021E9C00
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E9624 mov eax, dword ptr fs:[00000030h]	1_2_021E9624
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021EA92B mov eax, dword ptr fs:[00000030h]	1_2_021EA92B
Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe	Code function: 1_2_021E6BA5 mov eax, dword ptr fs:[00000030h]	1_2_021E6BA5

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe

Code function: 1_2_021E70A2 rdtsc

1_2_021E70A2

Source: C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe

Code function: 1_2_021EB95B RtlAddVectoredExceptionHandler,

1_2_021EB95B

Source: Dokument VAT I - 85926 09 2021 MAG-8.exe, 00000001.00000002.815103622.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: Dokument VAT I - 85926 09 2021 MAG-8.exe, 00000001.00000002.815103622.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Dokument VAT I - 85926 09 2021 MAG-8.exe, 00000001.00000002.815103622.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Dokument VAT I - 85926 09 2021 MAG-8.exe, 00000001.00000002.815103622.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	Input Capture1	Security Software Discovery21	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Dokument VAT I - 85926 09 2021 MAG-8.exe	21%	Virustotal		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491309
Start date:	27.09.2021
Start time:	13:06:56
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Dokument VAT I - 85926 09 2021 MAG-8.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 29.8% (good quality ratio 19.2%) Quality average: 35.3% Quality standard deviation: 33.4%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.54.113.53, 20.82.210.154, 209.197.3.8, 23.0.174.200, 23.0.174.185, 20.199.120.182, 20.54.110.249, 40.112.88.60, 23.10.249.26, 23.10.249.43, 20.82.209.183, 20.199.120.151 Excluded domains from analysis (whitelisted): client.wns.windows.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, cds.d2s7q6s2.hwcdn.net, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.702812730672399
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Dokument VAT I - 85926 09 2021 MAG-8.exe
File size:	90112
MD5:	0a2f51e6d3650f115c1b5484afbdf3a7
SHA1:	6283d55e065802036f0e5da958bfd458a7999c09
SHA256:	e49ff3e9ecbbe320e8cd29470d13b72643674b66e75ab5a824dda36eef6bf05e
SHA512:	4dbbba19dd4965cff3e7c9406dc37ce105beccab3cfd466eda57a734a15d3f7786b7a651f36df41a673ec53263d540de3a5aa8065a7a3e561b2d289828cf4ce7
SSDEEP:	1536:tDaUkPdjVa7kUSYdtAXrLHDLMAuP7I8ddUPrjr:t+TPdBaQUSB/3lm7oPrH
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L.....nR.................0... ...............@....@........

File Icon


Icon Hash:	821ca88c8e8c8c00

Static PE Info

General
Entrypoint:	0x4012c8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x526E8EE7 [Mon Oct 28 16:20:55 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e73b8c032c82c64991ebe487a7ffcd43

Entrypoint Preview

Instruction
push 0040FB88h
call 00007F28FCD303A3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov dword ptr [eax+317578DEh], 148B495Bh
dec ecx
push AC2C4F17h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
and byte ptr [eax], ah
and byte ptr [eax], ah
and byte ptr [eax], ah
push esp
pop ecx
push esi
inc ebp
push ebx
add byte ptr [eax], ah
and byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
cmp ch, cl
push edx
push esp
xchg eax, ecx
imul edx, dword ptr [esi+59A54D37h], 08511FC4h
xchg byte ptr [eax-51h], dh
mov dx, ss
inc ebx
scasd
or dword ptr [esi-1F926ABFh], eax
pop eax
clc
lodsd
sub edx, dword ptr [eax+33AD4F3Ah]
cdq
iretw
adc dword ptr [edi+00AA000Ch], esi
pushad
rcl dword ptr [ebx+00000000h], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ds
out 00h, al
add byte ptr [eax+00000001h], dl
or dword ptr [eax], eax
push ebx
jne 00007F28FCD30414h
jnc 00007F28FCD30426h
jc 00007F28FCD30413h
je 00007F28FCD30417h
add byte ptr [4D000701h], cl
imul esp, dword ptr fs:[ecx+ebp*2+69h], 00011900h
inc edx
add byte ptr [edx], ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13284	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0x560	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xe8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x126ec	0x13000	False	0.513324938322	data	6.19701564833	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x14000	0xcf4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0x560	0x1000	False	0.13232421875	data	1.43718241534	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x15438	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x15424	0x14	data
RT_VERSION	0x150f0	0x334	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaStrToAnsi, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0404 0x04b0
LegalCopyright	ChatSwipe
InternalName	Afblomstrings8
FileVersion	4.04.0001
CompanyName	ChatSwipe
LegalTrademarks	ChatSwipe
Comments	ChatSwipe
ProductName	ChatSwipe
ProductVersion	4.04.0001
FileDescription	ChatSwipe
OriginalFilename	Afblomstrings8.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 13:07:46.603626013 CEST	52806	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:07:46.621571064 CEST	53	52806	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:14.569097996 CEST	53910	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:14.586172104 CEST	53	53910	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:38.226521015 CEST	64021	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:38.241969109 CEST	53	64021	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:40.499269009 CEST	60784	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:40.512183905 CEST	53	60784	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:40.618129015 CEST	51143	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:40.635986090 CEST	53	51143	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:41.832432032 CEST	56009	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:41.848898888 CEST	53	56009	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:43.559161901 CEST	59026	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:43.652122021 CEST	53	59026	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:46.409320116 CEST	49572	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:46.423351049 CEST	53	49572	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:47.909018993 CEST	60823	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:47.985160112 CEST	53	60823	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:48.628412008 CEST	52130	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:48.642467976 CEST	53	52130	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:48.947379112 CEST	55102	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:49.023267984 CEST	53	55102	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:49.477947950 CEST	56236	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:49.490888119 CEST	53	56236	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:50.250430107 CEST	56527	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:50.263678074 CEST	53	56527	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:50.711786985 CEST	49559	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:50.724937916 CEST	53	49559	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:51.440062046 CEST	52650	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:51.453632116 CEST	53	52650	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:52.588150024 CEST	63297	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:52.601178885 CEST	53	63297	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:53.093781948 CEST	58361	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:53.107337952 CEST	53	58361	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:54.312901020 CEST	53615	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:54.346354961 CEST	53	53615	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:57.912180901 CEST	50728	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:57.933063030 CEST	53	50728	8.8.8.8	192.168.2.3
Sep 27, 2021 13:08:59.374279022 CEST	53777	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:08:59.389029980 CEST	53	53777	8.8.8.8	192.168.2.3
Sep 27, 2021 13:09:11.968785048 CEST	57106	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:09:11.981436968 CEST	53	57106	8.8.8.8	192.168.2.3
Sep 27, 2021 13:09:27.808500051 CEST	60352	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:09:27.824656963 CEST	53	60352	8.8.8.8	192.168.2.3
Sep 27, 2021 13:09:30.097163916 CEST	56773	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:09:30.105099916 CEST	60982	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:09:30.126770973 CEST	53	56773	8.8.8.8	192.168.2.3
Sep 27, 2021 13:09:30.139372110 CEST	53	60982	8.8.8.8	192.168.2.3
Sep 27, 2021 13:09:44.090898037 CEST	58058	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:09:44.106362104 CEST	53	58058	8.8.8.8	192.168.2.3
Sep 27, 2021 13:09:52.808073044 CEST	64367	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:09:52.821793079 CEST	53	64367	8.8.8.8	192.168.2.3
Sep 27, 2021 13:10:22.069334984 CEST	51539	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:10:22.082083941 CEST	53	51539	8.8.8.8	192.168.2.3
Sep 27, 2021 13:10:26.310173035 CEST	55393	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:10:26.323307991 CEST	53	55393	8.8.8.8	192.168.2.3
Sep 27, 2021 13:10:44.114243031 CEST	50585	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:10:44.147838116 CEST	53	50585	8.8.8.8	192.168.2.3
Sep 27, 2021 13:10:54.509507895 CEST	63456	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:10:54.522897005 CEST	53	63456	8.8.8.8	192.168.2.3
Sep 27, 2021 13:11:42.798686981 CEST	58540	53	192.168.2.3	8.8.8.8
Sep 27, 2021 13:11:42.826050043 CEST	53	58540	8.8.8.8	192.168.2.3

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: Dokument VAT I - 85926 09 2021 MAG-8.exe PID: 6420 Parent PID: 5044

General

Start time:	13:07:50
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Dokument VAT I - 85926 09 2021 MAG-8.exe'
Imagebase:	0x400000
File size:	90112 bytes
MD5 hash:	0A2F51E6D3650F115C1B5484AFBDF3A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Dokument VAT I - 85926 09 2021 MAG-8.exe PID: 6420 Parent PID: 5044 Dokument VAT I - 85926 09 2021 MAG-8.exeCOMMON

Executed Functions

Function 021EB95B, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 176COMMON

Download Yara Rule

Strings

n, xrefs: 021EB97B
T|3q, xrefs: 021EBC15

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: T|3q$n
API String ID: 0-4138737245
Opcode ID: 82cacf6c8d4bc358233d5222f4b1ed7922cf8d6d0b657807a1f350caebdbd384
Instruction ID: 1a216fc2ee0c40a28a9155964ab2d57374dbbc9c9fdd35efabe651792345742d
Opcode Fuzzy Hash: 82cacf6c8d4bc358233d5222f4b1ed7922cf8d6d0b657807a1f350caebdbd384
Instruction Fuzzy Hash: 4371DD31208A49CFDF39EE24CDA97EA77A2FF99354F664129CC0B8B254D7309685CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021E7488, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 169memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 021E7665

Strings

m1F, xrefs: 021E752B

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: m1F
API String ID: 2167126740-2119777713
Opcode ID: 8a57c62f93fd1e9ad6df6b32879793bc7efaff9889cbfafa2b4c7ef4c3046bde
Instruction ID: 2c9a37fdfcc9a85279c49fa761a5a5cb647c4f39dcd8802af2076d8b9289f581
Opcode Fuzzy Hash: 8a57c62f93fd1e9ad6df6b32879793bc7efaff9889cbfafa2b4c7ef4c3046bde
Instruction Fuzzy Hash: E1611CB2D093A68FD715DF20C895BD97BE2EF26B60F21480ED99591160EB715E00CFC2

Uniqueness

Uniqueness Score: -1.00%

Function 021E7466, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 143memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 021E7665

Strings

m1F, xrefs: 021E752B

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: m1F
API String ID: 2167126740-2119777713
Opcode ID: 13cd196828630a241c73c6edaddad829524181090fbaf50c548abb9bd0e55221
Instruction ID: 273e1bdeeab632c027a34326b699179f13be0fd0cbf311c31c63350432abf3a7
Opcode Fuzzy Hash: 13cd196828630a241c73c6edaddad829524181090fbaf50c548abb9bd0e55221
Instruction Fuzzy Hash: 4F512DB2908395CFE7249F24CC957DA7BE2EF16720F15441EDC8996260EB319A40CF82

Uniqueness

Uniqueness Score: -1.00%

Function 004128D0, Relevance: 75.6, APIs: 39, Strings: 4, Instructions: 329COMMON

Download Yara Rule

APIs

#612.MSVBVM60(?), ref: 00412952
__vbaStrVarMove.MSVBVM60(?), ref: 0041295C
__vbaStrMove.MSVBVM60 ref: 00412967
__vbaFreeVar.MSVBVM60 ref: 00412970
#575.MSVBVM60(?,?), ref: 0041298C
__vbaVarTstNe.MSVBVM60(?,?), ref: 004129AE
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 004129C1
__vbaNew2.MSVBVM60(00410630,004145C0), ref: 004129E1
__vbaHresultCheckObj.MSVBVM60(00000000,02AA004C,00410620,00000034,?,?,00000ACB,?), ref: 00412A2B
__vbaObjSet.MSVBVM60(?,?,?,?,00000ACB,?), ref: 00412A3C
__vbaStrToAnsi.MSVBVM60(?,snappishly,00000000), ref: 00412A4C
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 00412A5F
__vbaFreeStr.MSVBVM60(?,?,00000ACB,?), ref: 00412A7E
__vbaFpI4.MSVBVM60(?,?,00000ACB,?), ref: 00412A91
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,004100C0,000002C8), ref: 00412AC7
__vbaSetSystemError.MSVBVM60(00000000,00000002,00000002), ref: 00412ADD
__vbaNew2.MSVBVM60(00410630,004145C0), ref: 00412B05
__vbaHresultCheckObj.MSVBVM60(00000000,02AA004C,00410620,0000004C), ref: 00412B2A
__vbaHresultCheckObj.MSVBVM60(00000000,?,0041065C,0000001C,?,?,?,?), ref: 00412B7A
__vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 00412B8B
__vbaFreeObj.MSVBVM60(?,?,?,?), ref: 00412B94
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,004100F0,000006F8), ref: 00412BBC
__vbaStrCopy.MSVBVM60 ref: 00412BCA
__vbaFreeStr.MSVBVM60 ref: 00412C03
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,004100C0,000002B4), ref: 00412C30
__vbaStrToAnsi.MSVBVM60(?,SINGFEST,00267EEC), ref: 00412C4D
__vbaSetSystemError.MSVBVM60(000C5DB5,00000000), ref: 00412C64
__vbaFreeStr.MSVBVM60 ref: 00412C83
__vbaNew2.MSVBVM60(00410630,004145C0), ref: 00412C9C
__vbaLateMemCallLd.MSVBVM60(00000002,?,WkKauIFp5j1bv26pBJsl8jmR69NV785,00000000), ref: 00412CB8
__vbaObjVar.MSVBVM60(00000000), ref: 00412CC2
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 00412CCD
__vbaHresultCheckObj.MSVBVM60(00000000,02AA004C,00410620,0000000C), ref: 00412CE7
__vbaFreeObj.MSVBVM60 ref: 00412CF0
__vbaFreeVar.MSVBVM60 ref: 00412CF9
__vbaFreeObj.MSVBVM60(00412D5A), ref: 00412D44
__vbaFreeStr.MSVBVM60 ref: 00412D49
__vbaFreeObj.MSVBVM60 ref: 00412D52
__vbaFreeObj.MSVBVM60 ref: 00412D57

Strings

snappishly, xrefs: 00412A46
Palmira, xrefs: 00412BC2
WkKauIFp5j1bv26pBJsl8jmR69NV785, xrefs: 00412CAC
SINGFEST, xrefs: 00412C47

Memory Dump Source

Source File: 00000001.00000002.806579321.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.806558031.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.806660209.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.806697085.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$ErrorNew2System$AnsiMove$#575#612AddrefCallCopyLateList
String ID: Palmira$SINGFEST$WkKauIFp5j1bv26pBJsl8jmR69NV785$snappishly
API String ID: 1255662601-1278630523
Opcode ID: 7d4e86df7c5a6b890d5374a68cfa6d29f45e40129945daa628b8dc70b3710997
Instruction ID: e772db68deb6bc37e555693d15a49b67e3a0bf3f17fdc1b7d1e525fabe81c0cf
Opcode Fuzzy Hash: 7d4e86df7c5a6b890d5374a68cfa6d29f45e40129945daa628b8dc70b3710997
Instruction Fuzzy Hash: 91D16BB0900209EFDB10DFA4DE89ADEBBB9FF48700F10816AF545A72A0D7745985CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004012C8, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 71%

			_entry_() {
				signed int _t33;
				signed int _t34;
				signed int _t35;
				void* _t37;
				intOrPtr* _t39;
				signed int _t58;
				signed int _t59;
				void* _t64;
				intOrPtr* _t65;
				void* _t71;
				signed int _t72;
				void* _t81;

				_push("VB5!6!*"); // executed
				L004012C0(); // executed
				 *_t33 =  *_t33 + _t33;
				 *_t33 =  *_t33 + _t33;
				 *_t33 =  *_t33 + _t33;
				 *_t33 =  *_t33 ^ _t33;
				 *_t33 =  *_t33 + _t33;
				 *_t33 =  *_t33 + _t33;
				 *_t33 =  *_t33 + _t33;
				 *_t33 =  *_t33 + _t33;
				 *((intOrPtr*)(_t33 + 0x317578de)) = 0x148b495b;
				_push(0xac2c4f17);
				 *_t33 =  *_t33 + _t33;
				 *_t33 =  *_t33 + _t33;
				 *_t33 =  *_t33 + _t33;
				 *_t33 =  *_t33 + _t33;
				 *_t33 =  *_t33 + _t33;
				 *_t33 =  *_t33 & _t33;
				 *_t33 =  *_t33 & _t33;
				 *_t33 =  *_t33 & _t33;
				_t58 = _t75;
				_push(_t71);
				_push(_t37);
				 *_t33 =  *_t33 + _t33;
				 *_t33 =  *_t33 & _t33;
				 *_t33 =  *_t33 + _t33;
				asm("int3");
				 *_t33 =  *_t33 ^ _t33;
				_t34 = _t58;
				_t59 = _t33;
				 *(_t34 - 0x51) =  *(_t71 + 0x59a54d37) * 0x8511fc4;
				_t39 = _t37 + _t37 + 1;
				asm("scasd");
				 *(_t71 - 0x1f926abf) =  *(_t71 - 0x1f926abf) | _t34;
				_t35 = _t75;
				asm("clc");
				asm("lodsd");
				_t64 = ss -  *((intOrPtr*)(_t35 + 0x33ad4f3a));
				asm("cdq");
				asm("iretw");
				asm("adc [edi+0xaa000c], esi");
				asm("pushad");
				asm("rcl dword [ebx], cl");
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				_pop(ds);
				asm("out 0x0, al");
				 *((intOrPtr*)(_t35 + 1)) =  *((intOrPtr*)(_t35 + 1)) + _t64;
				 *_t35 =  *_t35 | _t35;
				_t81 =  *_t35;
				_push(_t39);
				if(_t81 != 0) {
					L5:
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					L6:
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					L7:
					 *_t35 =  *_t35;
					 *_t35 =  *_t35;
					 *((intOrPtr*)(_t35 + 0x800080)) =  *((intOrPtr*)(_t35 + 0x800080)) + _t35;
					L8:
					 *_t35 =  *_t35 + _t35;
					 *((intOrPtr*)(_t35 - 0x7fff8000)) =  *((intOrPtr*)(_t35 - 0x7fff8000)) + _t35;
					 *_t35 =  *_t35;
					asm("rol al, 0xc0");
					 *((intOrPtr*)(_t35 + 0x8080)) =  *((intOrPtr*)(_t35 + 0x8080)) + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + 1;
					 *_t35 =  *_t35 + _t35;
					asm("invalid");
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + 1;
					asm("invalid");
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					asm("sti");
					asm("sti");
					asm("sti");
					asm("sti");
					asm("sti");
					asm("sti");
					asm("lock add [edi-0x40b04041], bh");
					asm("sti");
					asm("lock add [edi-0x40bb4b41], bh");
					asm("hlt");
					asm("sti");
					asm("lock add [edi-0x40bb4b41], bh");
					asm("sti");
					asm("lock add [edi-0x40b04041], bh");
					asm("sti");
					asm("sti");
					asm("sti");
					asm("sti");
					asm("lock add [eax], al");
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *((intOrPtr*)(_t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 - 0xfffffffffffffffc)) =  *((intOrPtr*)(_t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 + _t39 - 0xfffffffffffffffc)) + _t59;
					asm("sti");
					asm("sti");
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					asm("invalid");
					asm("invalid");
					 *_t35 =  *_t35 + 0xff;
					 *((intOrPtr*)(_t35 - 0x7f000100)) =  *((intOrPtr*)(_t35 - 0x7f000100)) + 1;
					 *((intOrPtr*)(_t35 - 0x7f000100)) =  *((intOrPtr*)(_t35 - 0x7f000100)) + 1;
					 *((intOrPtr*)(_t35 - 0x7f000100)) =  *((intOrPtr*)(_t35 - 0x7f000100)) + 1;
					 *((intOrPtr*)(_t35 - 0x7f000100)) =  *((intOrPtr*)(_t35 - 0x7f000100)) + 1;
					 *((intOrPtr*)(_t35 - 0x7f000100)) =  *((intOrPtr*)(_t35 - 0x7f000100)) + 1;
					if (_t35 + 1 > 0) goto L9;
					goto L9;
					goto __eax;
					L9:
					asm("invalid");
				}
				if(_t81 >= 0) {
					goto L8;
				}
				if(_t81 < 0) {
					goto L6;
				}
				if(_t81 == 0) {
					goto L7;
				}
				 *0x4d000701 =  *0x4d000701 + _t59;
				_t65 = _t64 + 1;
				 *_t65 =  *_t65 + _t35;
				_t75 =  *[fs:ecx+ebp*2+0x69] * 0x11900 +  *_t39;
				_t72 = _t71 + 1;
				 *_t35 =  *_t35 + _t35;
				 *((intOrPtr*)( *[fs:ecx+ebp*2+0x69] * 0x11900 +  *_t39 + _t72 * 2)) =  *((intOrPtr*)( *[fs:ecx+ebp*2+0x69] * 0x11900 +  *_t39 + _t72 * 2)) + _t59;
				 *_t72 =  *_t72 + _t39;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t59 =  *_t59 + _t35;
				 *_t59 =  *_t59 + _t35;
				 *_t35 =  *_t35 + _t65;
				asm("adc [eax], dl");
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t59;
				 *_t35 =  *_t35 + _t35;
				 *_t72 =  *_t72 + _t65;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t59;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t65;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t59 =  *_t59 + _t35;
				 *((intOrPtr*)(_t35 + _t35)) =  *((intOrPtr*)(_t35 + _t35)) + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t65;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				goto L5;
			}

0x004012c8
0x004012cd
0x004012d2
0x004012d4
0x004012d6
0x004012d8
0x004012da
0x004012de
0x004012e0
0x004012e2
0x004012e4
0x004012ef
0x004012f4
0x004012f6
0x004012f8
0x004012fa
0x004012fc
0x004012fe
0x00401300
0x00401302
0x00401305
0x00401306
0x00401308
0x00401309
0x0040130b
0x0040130d
0x00401311
0x00401312
0x00401318
0x00401318
0x00401323
0x00401328
0x00401329
0x0040132a
0x00401330
0x00401331
0x00401332
0x00401333
0x00401339
0x0040133a
0x0040133c
0x00401342
0x00401343
0x00401349
0x0040134b
0x0040134d
0x0040134f
0x00401351
0x00401353
0x00401355
0x00401357
0x00401359
0x0040135b
0x0040135d
0x0040135f
0x00401361
0x00401363
0x00401365
0x00401367
0x00401369
0x0040136a
0x0040136c
0x00401372
0x00401372
0x00401374
0x00401375
0x004013d9
0x004013d9
0x004013db
0x004013dc
0x004013dc
0x004013de
0x004013e0
0x004013e2
0x004013e2
0x004013e5
0x004013e8
0x004013ed
0x004013ed
0x004013ef
0x004013f5
0x004013f8
0x004013fb
0x00401403
0x00401405
0x00401407
0x00401409
0x0040140d
0x00401415
0x00401419
0x0040141b
0x0040141d
0x0040141f
0x00401421
0x00401423
0x00401425
0x00401427
0x00401429
0x0040142b
0x0040142d
0x0040142e
0x0040142f
0x00401430
0x00401431
0x00401432
0x00401433
0x00401442
0x00401443
0x00401450
0x00401452
0x00401453
0x00401462
0x00401463
0x0040146f
0x00401470
0x00401471
0x00401472
0x00401473
0x00401476
0x00401478
0x0040147a
0x0040147c
0x0040147e
0x0040147f
0x00401480
0x00401482
0x00401484
0x00401486
0x00401488
0x0040148a
0x0040148c
0x0040148e
0x00401490
0x00401492
0x00401494
0x00401496
0x00401498
0x0040149a
0x0040149c
0x0040149e
0x004014a0
0x004014a3
0x004014ab
0x004014b3
0x004014bb
0x004014c3
0x004014cd
0x004014cd
0x004014cf
0x004014ce
0x004014ce
0x004014ce
0x00401377
0x00000000
0x00000000
0x00401379
0x00000000
0x00000000
0x0040137b
0x00000000
0x00000000
0x0040137d
0x0040138d
0x0040138e
0x00401390
0x00401392
0x00401393
0x00401395
0x00401399
0x0040139b
0x0040139d
0x0040139f
0x004013a1
0x004013a3
0x004013a5
0x004013a7
0x004013a9
0x004013ab
0x004013ad
0x004013af
0x004013b1
0x004013b3
0x004013b5
0x004013b7
0x004013b9
0x004013bb
0x004013bd
0x004013bf
0x004013c1
0x004013c4
0x004013c6
0x004013c8
0x004013cb
0x004013cd
0x004013cf
0x004013d1
0x004013d3
0x004013d5
0x004013d7
0x00000000

APIs

#100.MSVBVM60(VB5!6!*), ref: 004012CD

Strings

VB5!6!*, xrefs: 004012C8

Memory Dump Source

Source File: 00000001.00000002.806579321.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.806558031.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.806660209.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.806697085.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6!*
API String ID: 1341478452-2574520878
Opcode ID: 48e04687cefe2563647fc59172607653190becb0b7b108e5ab65391252cda67d
Instruction ID: 4af71358822e04c990a0339266f47eb1fa64111408def23e78d3bf576c01d302
Opcode Fuzzy Hash: 48e04687cefe2563647fc59172607653190becb0b7b108e5ab65391252cda67d
Instruction Fuzzy Hash: 1F01DC6269E3D09ED3079734882A8513FB49D5321435B45DBD0C2CF0B3D1A81C08CB72

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 021E9638, Relevance: 7.0, Strings: 5, Instructions: 748COMMON

Download Yara Rule

Strings

tDC, xrefs: 021E59D2
n//, xrefs: 021E5EAF
8RYV, xrefs: 021E5908
CU, xrefs: 021E640E
!=, xrefs: 021E58C0

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 8RYV$tDC$!=$CU$n//
API String ID: 0-2721210990
Opcode ID: 9af74d03f5f4d4c2f2620d9883939d1e3abf510490c8a639592c3929808dcdfd
Instruction ID: 5d67cda88330f146e109a806bd51a476b17e23d241961aa03078bda875b3bbbd
Opcode Fuzzy Hash: 9af74d03f5f4d4c2f2620d9883939d1e3abf510490c8a639592c3929808dcdfd
Instruction Fuzzy Hash: CC6213B26447899FDB748F29CC447DA7BB2FFA9310F56812ADC8A9B214D3709A41CF41

Uniqueness

Uniqueness Score: -1.00%

Function 021E54EB, Relevance: 6.9, Strings: 5, Instructions: 616COMMON

Download Yara Rule

Strings

tDC, xrefs: 021E59D2
n//, xrefs: 021E5EAF
8RYV, xrefs: 021E5908
CU, xrefs: 021E640E
!=, xrefs: 021E58C0

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 8RYV$tDC$!=$CU$n//
API String ID: 0-2721210990
Opcode ID: f1620ce9a362846328b391a9055afffbd58bcb15a3242f174a701d48256e4e60
Instruction ID: 1ca66f1dcebe221cf01ec8449883f2f72804e879b02e560514beea24e6faf410
Opcode Fuzzy Hash: f1620ce9a362846328b391a9055afffbd58bcb15a3242f174a701d48256e4e60
Instruction Fuzzy Hash: A14211B26447899FDB748F29CD447DABBB2FFA9310F46812ADC899B214D3309A41CF45

Uniqueness

Uniqueness Score: -1.00%

Function 021E5511, Relevance: 6.9, Strings: 5, Instructions: 616COMMON

Download Yara Rule

Strings

tDC, xrefs: 021E59D2
n//, xrefs: 021E5EAF
8RYV, xrefs: 021E5908
CU, xrefs: 021E640E
!=, xrefs: 021E58C0

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 8RYV$tDC$!=$CU$n//
API String ID: 0-2721210990
Opcode ID: 5a84f6d80253538ae18a2b38dae0b20838e3decbaf2957d8d5082ffc2a5b0f4e
Instruction ID: 9fb0e7c46e19d7053fcc43f469d77d8425be6020627904690cb5222bee1cdecd
Opcode Fuzzy Hash: 5a84f6d80253538ae18a2b38dae0b20838e3decbaf2957d8d5082ffc2a5b0f4e
Instruction Fuzzy Hash: 1E4223B264478A9FDB748F24CD847DA7BB2FFA9310F568129DC899B214D3309A41CF81

Uniqueness

Uniqueness Score: -1.00%

Function 021E564E, Relevance: 6.8, Strings: 5, Instructions: 569COMMON

Download Yara Rule

Strings

tDC, xrefs: 021E59D2
n//, xrefs: 021E5EAF
8RYV, xrefs: 021E5908
CU, xrefs: 021E640E
!=, xrefs: 021E58C0

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 8RYV$tDC$!=$CU$n//
API String ID: 0-2721210990
Opcode ID: fc70f1dc737865aa022a6c086cba01a001ee9927685c80d00d2d357c50440c9e
Instruction ID: 69e7c4ccef0f831e023fd76a137392bfd58c908a27059bbc2dc597c5c9763f77
Opcode Fuzzy Hash: fc70f1dc737865aa022a6c086cba01a001ee9927685c80d00d2d357c50440c9e
Instruction Fuzzy Hash: A34202B264478A9FDB748F24CD847DA7BB2FF69310F56812ADC899B214D3309A41CF85

Uniqueness

Uniqueness Score: -1.00%

Function 021E5776, Relevance: 6.8, Strings: 5, Instructions: 519COMMON

Download Yara Rule

Strings

tDC, xrefs: 021E59D2
n//, xrefs: 021E5EAF
8RYV, xrefs: 021E5908
CU, xrefs: 021E640E
!=, xrefs: 021E58C0

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 8RYV$tDC$!=$CU$n//
API String ID: 0-2721210990
Opcode ID: 662f2e671f3b1759a1816a895b597a2352bed8bb7553033d3cfa6601e527d322
Instruction ID: e1bbe32344f77063965303adbd4fdd51841e6b98ac347c65d2d24bbb39bff82b
Opcode Fuzzy Hash: 662f2e671f3b1759a1816a895b597a2352bed8bb7553033d3cfa6601e527d322
Instruction Fuzzy Hash: 803201B264438A9FDB74CF24CD857DA7BB2FF69310F56812ADC899B214D3309A41CB85

Uniqueness

Uniqueness Score: -1.00%

Function 021E5838, Relevance: 6.8, Strings: 5, Instructions: 508COMMON

Download Yara Rule

Strings

tDC, xrefs: 021E59D2
n//, xrefs: 021E5EAF
8RYV, xrefs: 021E5908
CU, xrefs: 021E640E
!=, xrefs: 021E58C0

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 8RYV$tDC$!=$CU$n//
API String ID: 0-2721210990
Opcode ID: 2c89a1cec8ad07bcb7646d9250bcea936f05246043a32e473d2bdb8a134255d9
Instruction ID: b199450c8810d5e084ed34c7d4c91f5aa3dd48bc04ca466cee2dfbf389409c91
Opcode Fuzzy Hash: 2c89a1cec8ad07bcb7646d9250bcea936f05246043a32e473d2bdb8a134255d9
Instruction Fuzzy Hash: 772202B2A0538A9FDB74CF24CD857DA7BB2FF69310F558129DC8A9B214D7309A41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 021E595E, Relevance: 4.2, Strings: 3, Instructions: 451COMMON

Download Yara Rule

Strings

n//, xrefs: 021E5EAF
tDC, xrefs: 021E59D2
CU, xrefs: 021E640E

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: tDC$CU$n//
API String ID: 0-921842128
Opcode ID: e771bb846dceb914d7a5538c06980a58898ee14123ceb79d587083f6dd0e93de
Instruction ID: 4c014cab6691e3744079565e42431a2e2eafea55a2b91de56b241ed007dc7a0e
Opcode Fuzzy Hash: e771bb846dceb914d7a5538c06980a58898ee14123ceb79d587083f6dd0e93de
Instruction Fuzzy Hash: A91213B2A443899FDF748F24CD847DA7BA6FFA9310F56412ADC8E9B214D7709A40CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021E59B1, Relevance: 4.2, Strings: 3, Instructions: 432COMMON

Download Yara Rule

Strings

n//, xrefs: 021E5EAF
tDC, xrefs: 021E59D2
CU, xrefs: 021E640E

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: tDC$CU$n//
API String ID: 0-921842128
Opcode ID: cb90540ea45a6f37f65fd595488ad06436bb5d6fdb66d797963644a57ef24ad2
Instruction ID: 38b78b445c084cfacdf8ab64e1c795fb29bdc459b831f1941ba67136b6ccf7ec
Opcode Fuzzy Hash: cb90540ea45a6f37f65fd595488ad06436bb5d6fdb66d797963644a57ef24ad2
Instruction Fuzzy Hash: DB0201B26407899FDF748F68CD847DA7BB6FFA8310F568129DC8D9B214D3309A818B45

Uniqueness

Uniqueness Score: -1.00%

Function 021EA92B, Relevance: 3.1, Strings: 2, Instructions: 584COMMON

Download Yara Rule

Strings

|o$l, xrefs: 021EA92E
ir, xrefs: 021EAB9D

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: |o$l$ir
API String ID: 0-1186631221
Opcode ID: ad23fd6a0168551ba6ba8b8f64d5c4a1bfba2793150ecdaa3aead58a435b7a7b
Instruction ID: f924fbd3ce84277552ba9a608966615403bb62686aaad7c7343a0859f8e938e7
Opcode Fuzzy Hash: ad23fd6a0168551ba6ba8b8f64d5c4a1bfba2793150ecdaa3aead58a435b7a7b
Instruction Fuzzy Hash: A332E6716487858FDF35CF38CC987DA7BE2AF52310F59829AC89A8F296D3708542C712

Uniqueness

Uniqueness Score: -1.00%

Function 021E59A6, Relevance: 2.9, Strings: 2, Instructions: 426COMMON

Download Yara Rule

Strings

n//, xrefs: 021E5EAF
CU, xrefs: 021E640E

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: CU$n//
API String ID: 0-1453149214
Opcode ID: 64f630a2f21fd86306e2c979bfee061bd0671156060b4dccbd4b78b62fd89d12
Instruction ID: 5c39d634cf362eefc5ea6ef8584112da251faa9b314c4e8d6c0b467135e2f799
Opcode Fuzzy Hash: 64f630a2f21fd86306e2c979bfee061bd0671156060b4dccbd4b78b62fd89d12
Instruction Fuzzy Hash: CA0202B26442899FDF748F68CD847DA7BA6FFA8310F56812ADC8D9B314D3308A45CB45

Uniqueness

Uniqueness Score: -1.00%

Function 021E5ABA, Relevance: 2.9, Strings: 2, Instructions: 416COMMON

Download Yara Rule

Strings

n//, xrefs: 021E5EAF
CU, xrefs: 021E640E

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: CU$n//
API String ID: 0-1453149214
Opcode ID: a98e5095c44efe464959261c3850a0192db970e201920ce18cd5030e957ba891
Instruction ID: 55166bef8e94862dd95d7341cd259aac3ee973431033fa7457483037db785408
Opcode Fuzzy Hash: a98e5095c44efe464959261c3850a0192db970e201920ce18cd5030e957ba891
Instruction Fuzzy Hash: 960234B2A443899FCF75CF24CD847DA7BA6FF69310F56802ADC8D9B214D7708A458B41

Uniqueness

Uniqueness Score: -1.00%

Function 021E5BCA, Relevance: 2.8, Strings: 2, Instructions: 350COMMON

Download Yara Rule

Strings

n//, xrefs: 021E5EAF
CU, xrefs: 021E640E

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: CU$n//
API String ID: 0-1453149214
Opcode ID: 5dd55d16d0801b0548d425c23304a5db798901a34f472351d786d78e041749fd
Instruction ID: 969ca7b3f0bf777a5af5d917a29a4e557af4c520826f96c8192ba70435730769
Opcode Fuzzy Hash: 5dd55d16d0801b0548d425c23304a5db798901a34f472351d786d78e041749fd
Instruction Fuzzy Hash: F6E111B2A403899FCF748F64CD847DA3BA6FF69310F56812ADC8D9B214D7309A418B45

Uniqueness

Uniqueness Score: -1.00%

Function 021E5E19, Relevance: 2.7, Strings: 2, Instructions: 245COMMON

Download Yara Rule

Strings

n//, xrefs: 021E5EAF
CU, xrefs: 021E640E

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: CU$n//
API String ID: 0-1453149214
Opcode ID: 2ecdf7ac5ed8022e85ea4121f2bd360fbe0e8498245a8c0a9d84bd80f9251a90
Instruction ID: e9f05774792a73b8bf380d3f618c8f1ee48f707fd05fd73250147e513b5f66d3
Opcode Fuzzy Hash: 2ecdf7ac5ed8022e85ea4121f2bd360fbe0e8498245a8c0a9d84bd80f9251a90
Instruction Fuzzy Hash: A2B1EEB26402899FDFB98F64CE847DA7BB2FF68300F564129DD8E9B214D3309A44CB45

Uniqueness

Uniqueness Score: -1.00%

Function 021E503A, Relevance: 2.6, Strings: 2, Instructions: 121COMMON

Download Yara Rule

Strings

H, xrefs: 021E50B5
+^, xrefs: 021E511F

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +^$H
API String ID: 0-1655969282
Opcode ID: 1e4cabf2c48428a45f8b3b0b3d64368447c828a3e9af2d8d48f6ffe6a36cc35d
Instruction ID: 249068807f0ee523b8c5b6732e370b95824ec90ed4dc20356b706e203365f01f
Opcode Fuzzy Hash: 1e4cabf2c48428a45f8b3b0b3d64368447c828a3e9af2d8d48f6ffe6a36cc35d
Instruction Fuzzy Hash: 50519F72940B89ABCF74CE29DDD47EB77E3AB49348F94062ACC4E4B601D7356A40CB15

Uniqueness

Uniqueness Score: -1.00%

Function 021E5ED2, Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

CU, xrefs: 021E640E

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: CU
API String ID: 0-610544929
Opcode ID: 98d7f33066d609d656ba23f9ce016ade135e660e7b386f129abc6e8b54c97fe2
Instruction ID: 5ea5eeba69397ab6de543f4f06e76c2f36de3807e8d2b155e9a1004088850ca6
Opcode Fuzzy Hash: 98d7f33066d609d656ba23f9ce016ade135e660e7b386f129abc6e8b54c97fe2
Instruction Fuzzy Hash: A2A10FB2A4439A9FCF759F64CD84BD93BA2FF68310F55442ADD8E9B214D7309A408F81

Uniqueness

Uniqueness Score: -1.00%

Function 021E6014, Relevance: 1.4, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

CU, xrefs: 021E640E

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: CU
API String ID: 0-610544929
Opcode ID: 46fc860e7c0552ff8ac16375924eb9cda36b33541a0034a0211a11436561edf4
Instruction ID: 4af6b667e8a4a1aae14a3109bebff06fa4a8f6fe166b16a1b846e1f0a76afcb4
Opcode Fuzzy Hash: 46fc860e7c0552ff8ac16375924eb9cda36b33541a0034a0211a11436561edf4
Instruction Fuzzy Hash: 448122B2A452998FCF758F24CD84BD93BA6FF69350F264029DD899B210D7715E40CF81

Uniqueness

Uniqueness Score: -1.00%

Function 021E6166, Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

CU, xrefs: 021E640E

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: CU
API String ID: 0-610544929
Opcode ID: 5df4b47174484f17e339830210913f791b0203af95c158c0fd2a6c3b1e44a7f8
Instruction ID: c81a6fb6d352a3ba2b231f78eb8191810459174a5ea84cf5b4006d8bb800e203
Opcode Fuzzy Hash: 5df4b47174484f17e339830210913f791b0203af95c158c0fd2a6c3b1e44a7f8
Instruction Fuzzy Hash: E2514672E452AA8FCB259F20CD84BC93BA2FF69750F66441ADD4997220DB315E008FC0

Uniqueness

Uniqueness Score: -1.00%

Function 021EA464, Relevance: 1.3, Strings: 1, Instructions: 84COMMON

Download Yara Rule

Strings

-k4S, xrefs: 021EA516

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: -k4S
API String ID: 0-2127986567
Opcode ID: 97fcb6a368f36a913c91962dde505eddf49f6ec8805d607c06fc3b81a3ab9010
Instruction ID: 3bc32105b64aa55efc71076e4130426154567e5577b2c1da5d447eac168c7b29
Opcode Fuzzy Hash: 97fcb6a368f36a913c91962dde505eddf49f6ec8805d607c06fc3b81a3ab9010
Instruction Fuzzy Hash: 1C3127736912889FDFB88E78CD953EA3BD1AFA9320F54003DE85BDB215C7308A858705

Uniqueness

Uniqueness Score: -1.00%

Function 021E53AC, Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 132c338b1a11d7c4b0f5bdabcadf097948e0da9cde38b6a1bed685ca57a6d587
Instruction ID: 94b8d59cef3dced3ddd99ce93bffc7cc616a5144da0fe265afa10ed0df6e91b1
Opcode Fuzzy Hash: 132c338b1a11d7c4b0f5bdabcadf097948e0da9cde38b6a1bed685ca57a6d587
Instruction Fuzzy Hash: B351EFB26047489FDBA48F2ACC14BEAB7A2BF95310F56821DDD8A87654D7305A42CF42

Uniqueness

Uniqueness Score: -1.00%

Function 021E9416, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5782d1b0977e725133316f707f126fd5af8818807580e0736b95b2ee37345330
Instruction ID: ab06bbdc6305bc2cbd44702ecff04fd39fc505b54186cd3b04b691f512d33635
Opcode Fuzzy Hash: 5782d1b0977e725133316f707f126fd5af8818807580e0736b95b2ee37345330
Instruction Fuzzy Hash: 0A41E1B1A44698DFDF71DF78CC84BCA77A2AF4A710F95412ADC1C9B211D3708A41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 021E720B, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92501d44317e56a7f554d6e5fb34d211d3faa7811e9f2d5cd7df3acc2c66dd92
Instruction ID: a3f6d9541eaa587647655ed2566e737b76642a6edf12a162729e5b622a6b667d
Opcode Fuzzy Hash: 92501d44317e56a7f554d6e5fb34d211d3faa7811e9f2d5cd7df3acc2c66dd92
Instruction Fuzzy Hash: D93145B1608744DFDBB88E78CC82BEAB7A2AF55310F41851EE48AC6255C7308881CB06

Uniqueness

Uniqueness Score: -1.00%

Function 021E9C00, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9d73342adb7fc7db15de4bd6038f6cf3274ad0dd898609028c24a971efd4b62
Instruction ID: a60606c2ee60f17a1e2cd2e5c71321cdd83d9396cc336fbb0da5b35056fca8e8
Opcode Fuzzy Hash: b9d73342adb7fc7db15de4bd6038f6cf3274ad0dd898609028c24a971efd4b62
Instruction Fuzzy Hash: B811D375691BAACFCB34DF14CDC5EDA77B2BB08704F51446ADD0A9B211C335AA44CB10

Uniqueness

Uniqueness Score: -1.00%

Function 021E70A2, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction ID: f1647c15dfe5582e2114d8b48c9dc7a79c4e1b76aa7bcc19d5d00c5bce2ac4c7
Opcode Fuzzy Hash: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 021E6BA5, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 021E9624, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.815595666.00000000021E0000.00000040.00000001.sdmp, Offset: 021E0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2bcd37ed16bdde474e09b90be2eb742475b75dd880e9025c4ce92a010d32029
Instruction ID: 963d80b5110ce4c47c3e7c4af1173ace74dfe6da505212adc2c24e92ccadbc37
Opcode Fuzzy Hash: f2bcd37ed16bdde474e09b90be2eb742475b75dd880e9025c4ce92a010d32029
Instruction Fuzzy Hash: B0B00275652645CFCE55DF49C191F4573B4F744750F9154D0F8528BB15C265E900CA14

Uniqueness

Uniqueness Score: -1.00%

Function 00413090, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

#672.MSVBVM60(00000000,40080000,00000000,3FF00000,00000000,3FF00000,00000000,3FF00000), ref: 004130DC
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 004130E2
__vbaNew2.MSVBVM60(00410630,004145C0,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413107
__vbaLateMemCallLd.MSVBVM60(?,?,qTu9tyktlIOgozvLrZMBbdZxTILvo43,00000000), ref: 00413123
__vbaObjVar.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 0041312D
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413138
__vbaHresultCheckObj.MSVBVM60(00000000,02AA004C,00410620,0000000C), ref: 00413152
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 0041315B
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413164
__vbaFreeObj.MSVBVM60(00413196), ref: 0041318F

Strings

qTu9tyktlIOgozvLrZMBbdZxTILvo43, xrefs: 00413117

Memory Dump Source

Source File: 00000001.00000002.806579321.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.806558031.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.806660209.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.806697085.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#672AddrefCallCheckHresultLateNew2
String ID: qTu9tyktlIOgozvLrZMBbdZxTILvo43
API String ID: 263512575-2009357870
Opcode ID: 599d967905f3debff101dfd31e421c186d0e05adc5710dbf5a2e61abbe946a30
Instruction ID: b07f201c11a54684e736353351f8617e7a49f4f38f720760cb291f12460c89b4
Opcode Fuzzy Hash: 599d967905f3debff101dfd31e421c186d0e05adc5710dbf5a2e61abbe946a30
Instruction Fuzzy Hash: F7216D70800245BBDB109F95DE49FAFBBB8FB85701F10402AF541B21A0C7781581CF6C

Uniqueness

Uniqueness Score: -1.00%

Function 00412D80, Relevance: 12.1, APIs: 8, Instructions: 99COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,004106DC,00000005), ref: 00412DBC
#682.MSVBVM60(?,?), ref: 00412DFD
__vbaFpR8.MSVBVM60 ref: 00412E03
__vbaFreeVar.MSVBVM60 ref: 00412E27
_adj_fdiv_m64.MSVBVM60 ref: 00412E59
__vbaFpI4.MSVBVM60(42FC0000,?,436E0000), ref: 00412E87
__vbaHresultCheckObj.MSVBVM60(00000000,?,004100C0,000002C0,?,436E0000), ref: 00412EBB
__vbaAryDestruct.MSVBVM60(00000000,?,00412EE6), ref: 00412EDF

Memory Dump Source

Source File: 00000001.00000002.806579321.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.806558031.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.806660209.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.806697085.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#682CheckConstruct2DestructFreeHresult_adj_fdiv_m64
String ID:
API String ID: 4111779564-0
Opcode ID: 088d5fe57b2dfd1d4bd1954b4f8682a70d225ed276e7219e12f2d29cf5ff599d
Instruction ID: c77609a281b9ef2190c10db7480410046749379e35d68c70bea3f19c506357ed
Opcode Fuzzy Hash: 088d5fe57b2dfd1d4bd1954b4f8682a70d225ed276e7219e12f2d29cf5ff599d
Instruction Fuzzy Hash: 6E315E74901249EBCB04DF90DE49BEEBBB4FB48701F00812AF541BA2A4C7B85895CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00412F00, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

__vbaVarTstNe.MSVBVM60(?,?), ref: 00412F64
__vbaInStr.MSVBVM60(00000000,Bebyrdelses9,Hvislendes8,FF96B5C0), ref: 00412F7F

Strings

Hvislendes8, xrefs: 00412F74
Bebyrdelses9, xrefs: 00412F79

Memory Dump Source

Source File: 00000001.00000002.806579321.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.806558031.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.806660209.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.806697085.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba
String ID: Bebyrdelses9$Hvislendes8
API String ID: 3524132090-1996639642
Opcode ID: f7c595c9ffdbd2324e6229ad8ecc928eb518b94588dd39b677e0a64f116ebbe2
Instruction ID: 4001eb0a4b26787be0798c2b4ba8994415e468d35ae1d898d48414bb6f36ec9e
Opcode Fuzzy Hash: f7c595c9ffdbd2324e6229ad8ecc928eb518b94588dd39b677e0a64f116ebbe2
Instruction Fuzzy Hash: FA011EB0900258AFCB10DF98C989BDEBFB8BF08B44F14811AF504B6291D7B81586CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412FC0, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410630,004145C0), ref: 00413003
__vbaHresultCheckObj.MSVBVM60(00000000,02AA004C,00410620,0000004C), ref: 00413028
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,0041065C,00000028), ref: 00413048
__vbaFreeObj.MSVBVM60 ref: 00413051

Memory Dump Source

Source File: 00000001.00000002.806579321.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.806558031.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.806660209.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.806697085.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID:
API String ID: 4261391273-0
Opcode ID: 46c9ac69a65fcfdcbe6682939ad11335ed7803ed5970bd1123cbb4b4df4fcbc3
Instruction ID: fd5af5a4d4ff4f9301af6ca1d91509ab23ef4c44589d2b654351a3f293738e9c
Opcode Fuzzy Hash: 46c9ac69a65fcfdcbe6682939ad11335ed7803ed5970bd1123cbb4b4df4fcbc3
Instruction Fuzzy Hash: 7C118C74640204ABD7109F69CE09FDA7FF8EB08B41F104126B644E32A5E2B859858AA8

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Dokument VAT I - 85926 09 2021 MAG-8.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Dokument VAT I - 85926 09 2021 MAG-8.exe PID: 6420 Parent PID: 5044

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Dokument VAT I - 85926 09 2021 MAG-8.exe PID: 6420 Parent PID: 5044 Dokument VAT I - 85926 09 2021 MAG-8.exeCOMMON

Executed Functions

Function 004012C8, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49
COMMON