Play interactive tour

Edit tour

Windows Analysis Report Payment_Advice.exe

Overview

General Information

Sample Name:	Payment_Advice.exe
Analysis ID:	491364
MD5:	3a27f66a430a3b54d24fb8f75e837175
SHA1:	4af41cd66669d3c2307c1b5af5c198778d174826
SHA256:	dd996392170826c47b9ab378464423e470a1bdfdff7bcd183c61e3e7896d4326
Tags:	exeguloader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Initial sample is a PE file and has a suspicious name

Tries to detect virtualization through RDTSC time measurements

Executable has a suspicious name (potential lure to open the executable)

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Uses 32bit PE files

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to call native functions

Program does not show much activity (idle)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

Payment_Advice.exe (PID: 4472 cmdline: 'C:\Users\user\Desktop\Payment_Advice.exe' MD5: 3A27F66A430A3B54D24FB8F75E837175)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=do"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=do"}

Multi AV Scanner detection for submitted file

Show sources

Source: Payment_Advice.exe

ReversingLabs: Detection: 11%

Source: Payment_Advice.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=do

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: Payment_Advice.exe

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: Payment_Advice.exe

Static file information: Suspicious name

Source: Payment_Advice.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: Payment_Advice.exe, 00000000.00000002.813548449.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameAFFEJENDES.exe vs Payment_Advice.exe
Source: Payment_Advice.exe	Binary or memory string: OriginalFilenameAFFEJENDES.exe vs Payment_Advice.exe

Source: Payment_Advice.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_02277792	0_2_02277792
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0227BB90	0_2_0227BB90
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_022752DA	0_2_022752DA
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_02279B36	0_2_02279B36
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_02277B60	0_2_02277B60
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_02275463	0_2_02275463
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_02277528	0_2_02277528
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0227A9AA	0_2_0227A9AA

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 0_2_02277792 NtAllocateVirtualMemory,

0_2_02277792

Source: C:\Users\user\Desktop\Payment_Advice.exe

Process Stats: CPU usage > 98%

Source: Payment_Advice.exe

ReversingLabs: Detection: 11%

Source: Payment_Advice.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Payment_Advice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\Payment_Advice.exe

File created: C:\Users\user\AppData\Local\Temp\~DF32C15638EC5B1167.TMP

Jump to behavior

Source: classification engine

Classification label: mal84.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0040407C pushfd ; retf	0_2_0040417B
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_00404004 pushfd ; retf	0_2_0040417B
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_004040D2 pushfd ; retf	0_2_0040417B
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_00406AAD push edi; retf	0_2_00406AB8
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_00408578 push BCCCD893h; retf	0_2_0040857D
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_00405124 push ebp; ret	0_2_00405126
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0040332B pushad ; ret	0_2_004034E9
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_004053ED push 98EC4AA3h; iretd	0_2_00405421
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_004031F9 push cs; retf	0_2_004031FA
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_00403397 pushad ; ret	0_2_004034E9
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_0040639F push eax; iretd	0_2_004063A0
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_00406BB3 push edi; ret	0_2_00406BC2
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_02270475 push ds; iretd	0_2_022704F9

Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Payment_Advice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Payment_Advice.exe	RDTSC instruction interceptor: First address: 000000000040EAAD second address: 000000000040EAAD instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 nop 0x00000006 popad 0x00000007 cmp ecx, 000000E3h 0x0000000d wait 0x0000000e dec edi 0x0000000f cmp ecx, 0000009Bh 0x00000015 cmp ecx, 21h 0x00000018 cmp edi, 00000000h 0x0000001b jne 00007F774439025Ch 0x0000001d wait 0x0000001e nop 0x0000001f pushad 0x00000020 mfence 0x00000023 mfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\Payment_Advice.exe	RDTSC instruction interceptor: First address: 000000000227703A second address: 000000000227703A instructions: 0x00000000 rdtsc 0x00000002 mov eax, 3D8136F2h 0x00000007 sub eax, 4424654Ch 0x0000000c add eax, 25DE290Dh 0x00000011 xor eax, 1F3AFAB2h 0x00000016 cpuid 0x00000018 jmp 00007F774490E99Ah 0x0000001a test dx, ax 0x0000001d popad 0x0000001e call 00007F774490E95Bh 0x00000023 lfence 0x00000026 mov edx, 9B1CCDD8h 0x0000002b xor edx, AF97A1F8h 0x00000031 xor edx, A8058B4Dh 0x00000037 xor edx, E370E779h 0x0000003d mov edx, dword ptr [edx] 0x0000003f lfence 0x00000042 ret 0x00000043 sub edx, esi 0x00000045 ret 0x00000046 pop ecx 0x00000047 add edi, edx 0x00000049 dec ecx 0x0000004a mov dword ptr [ebp+000001E8h], ecx 0x00000050 mov ecx, 9B315063h 0x00000055 add ecx, 41FD8E20h 0x0000005b xor ecx, BAB84FC4h 0x00000061 sub ecx, 67969147h 0x00000067 cmp dword ptr [ebp+000001E8h], ecx 0x0000006d mov ecx, dword ptr [ebp+000001E8h] 0x00000073 jne 00007F774490E90Dh 0x00000075 mov dword ptr [ebp+00000216h], edx 0x0000007b mov edx, ecx 0x0000007d push edx 0x0000007e mov edx, dword ptr [ebp+00000216h] 0x00000084 cmp bl, dl 0x00000086 call 00007F774490E9BCh 0x0000008b call 00007F774490E9C9h 0x00000090 lfence 0x00000093 mov edx, 9B1CCDD8h 0x00000098 xor edx, AF97A1F8h 0x0000009e xor edx, A8058B4Dh 0x000000a4 xor edx, E370E779h 0x000000aa mov edx, dword ptr [edx] 0x000000ac lfence 0x000000af ret 0x000000b0 mov esi, edx 0x000000b2 pushad 0x000000b3 rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 0_2_02277032 rdtsc

0_2_02277032

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\Payment_Advice.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_02276E76 mov eax, dword ptr fs:[00000030h]	0_2_02276E76
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_02279E4A mov eax, dword ptr fs:[00000030h]	0_2_02279E4A
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_022798A6 mov eax, dword ptr fs:[00000030h]	0_2_022798A6
Source: C:\Users\user\Desktop\Payment_Advice.exe	Code function: 0_2_02274D08 mov eax, dword ptr fs:[00000030h]	0_2_02274D08

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 0_2_02277032 rdtsc

0_2_02277032

Source: C:\Users\user\Desktop\Payment_Advice.exe

Code function: 0_2_0227BB90 RtlAddVectoredExceptionHandler,

0_2_0227BB90

Source: Payment_Advice.exe, 00000000.00000002.814578023.0000000000D60000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: Payment_Advice.exe, 00000000.00000002.814578023.0000000000D60000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Payment_Advice.exe, 00000000.00000002.814578023.0000000000D60000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Payment_Advice.exe, 00000000.00000002.814578023.0000000000D60000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery21	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Payment_Advice.exe	11%	ReversingLabs	Win32.Trojan.Mucc

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491364
Start date:	27.09.2021
Start time:	14:15:52
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Payment_Advice.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 17.7% (good quality ratio 10.9%) Quality average: 36.7% Quality standard deviation: 33.6%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.54.113.53, 20.82.210.154, 209.197.3.8, 20.199.120.151, 20.54.110.249, 40.112.88.60, 20.199.120.85, 23.10.249.26, 23.10.249.43, 20.49.157.6 Excluded domains from analysis (whitelisted): client.wns.windows.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, cds.d2s7q6s2.hwcdn.net, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.758289537816364
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Payment_Advice.exe
File size:	90112
MD5:	3a27f66a430a3b54d24fb8f75e837175
SHA1:	4af41cd66669d3c2307c1b5af5c198778d174826
SHA256:	dd996392170826c47b9ab378464423e470a1bdfdff7bcd183c61e3e7896d4326
SHA512:	2be02118a3affd640c2b1489816cd396ad3d1af6ab229a3a86bcc20f695445777c1146ffc7488b5bc664d16a6283a3bfa3256758804c2d0851a2bd261c1e1034
SSDEEP:	768:tCbCZDdDSaAhQ41sPuTPfBcrGemB0KxtNavGJluWmqzYlf5sh/YDtOika:twCDDt41hO9mBHp88CmQua
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L...0..V.................0... ...............@....@........

File Icon


Icon Hash:	821ca88c8e8c8c00

Static PE Info

General
Entrypoint:	0x4012c8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5692D030 [Sun Jan 10 21:42:08 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e73b8c032c82c64991ebe487a7ffcd43

Entrypoint Preview

Instruction
push 0040FDF4h
call 00007F7744924313h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi+07B9DDCAh], ch
xchg eax, esp
int 47h
xchg eax, edx
pushfd
pop eax
movsx ecx, byte ptr [ebx-32h]
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, bh
das
sbb al, 03h
push esp
imul esi, dword ptr [ebx+74h], 6Fh
insd
jc 00007F7744924383h
popad
jc 00007F7744924324h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
cmp byte ptr [edi-7ED8AE9Ah], al
dec dword ptr [esi]
dec esp
mov dword ptr [A07C7AE1h], eax
xchg eax, esi
xor al, 99h
inc edx
dec ebp
jp 00007F774492438Eh
bound esi, dword ptr [ecx+608545E1h]
xchg byte ptr [ebx], dl
and al, ABh
xchg eax, edi
jmp far 6699h : 33AD4F3Ah
iretd
adc dword ptr [edi+00AA000Ch], esi
pushad
rcl dword ptr [ebx+00000000h], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sub al, 00000000h
add byte ptr [eax+00000001h], bl
or dword ptr [eax], eax
push ebx
jo 00007F7744924391h
outsd
outsb
jns 00007F774492438Bh
jnc 00007F774492438Fh
add byte ptr [46000B01h], cl
jc 00007F7744924387h
jnc 00007F774492438Dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13514	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0x550	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xe8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1297c	0x13000	False	0.520379317434	data	6.25517473092	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x14000	0xcf4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0x550	0x1000	False	0.131591796875	data	1.42355103484	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x15428	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x15414	0x14	data
RT_VERSION	0x150f0	0x324	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaStrToAnsi, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0404 0x04b0
LegalCopyright	ChatSwipe
InternalName	AFFEJENDES
FileVersion	4.04.0001
CompanyName	ChatSwipe
LegalTrademarks	ChatSwipe
Comments	ChatSwipe
ProductName	ChatSwipe
ProductVersion	4.04.0001
FileDescription	ChatSwipe
OriginalFilename	AFFEJENDES.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 14:16:42.581877947 CEST	57459	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:16:42.602843046 CEST	53	57459	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:09.412630081 CEST	57875	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:09.444770098 CEST	53	57875	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:33.710269928 CEST	54154	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:33.726066113 CEST	53	54154	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:35.781797886 CEST	52806	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:35.794826031 CEST	53	52806	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:35.805238008 CEST	53910	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:35.947669029 CEST	53	53910	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:37.450665951 CEST	64021	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:37.520899057 CEST	53	64021	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:38.148211002 CEST	60784	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:38.228849888 CEST	53	60784	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:38.563065052 CEST	51143	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:38.575897932 CEST	53	51143	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:38.961806059 CEST	56009	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:38.974756956 CEST	53	56009	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:39.162245989 CEST	59026	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:39.176083088 CEST	53	59026	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:39.658467054 CEST	49572	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:39.672683954 CEST	53	49572	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:40.135082960 CEST	60823	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:40.148325920 CEST	53	60823	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:40.891104937 CEST	52130	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:40.904860020 CEST	53	52130	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:41.761092901 CEST	55102	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:41.838918924 CEST	53	55102	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:42.300556898 CEST	56236	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:42.313446045 CEST	53	56236	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:43.084541082 CEST	56527	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:43.114649057 CEST	53	56527	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:46.656061888 CEST	49559	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:46.690603971 CEST	53	49559	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:52.638237953 CEST	52650	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:52.656342030 CEST	53	52650	8.8.8.8	192.168.2.3
Sep 27, 2021 14:17:56.558738947 CEST	63297	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:17:56.571821928 CEST	53	63297	8.8.8.8	192.168.2.3
Sep 27, 2021 14:18:08.572305918 CEST	58361	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:18:08.605453014 CEST	53	58361	8.8.8.8	192.168.2.3
Sep 27, 2021 14:18:24.734656096 CEST	53615	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:18:24.748394012 CEST	53	53615	8.8.8.8	192.168.2.3
Sep 27, 2021 14:18:41.190301895 CEST	50728	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:18:41.206404924 CEST	53	50728	8.8.8.8	192.168.2.3
Sep 27, 2021 14:19:04.434187889 CEST	53777	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:19:04.447694063 CEST	53	53777	8.8.8.8	192.168.2.3
Sep 27, 2021 14:19:15.725678921 CEST	57106	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:19:15.739092112 CEST	53	57106	8.8.8.8	192.168.2.3
Sep 27, 2021 14:19:37.634990931 CEST	60352	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:19:37.648443937 CEST	53	60352	8.8.8.8	192.168.2.3
Sep 27, 2021 14:20:13.994735003 CEST	56773	53	192.168.2.3	8.8.8.8
Sep 27, 2021 14:20:14.008353949 CEST	53	56773	8.8.8.8	192.168.2.3

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: Payment_Advice.exe PID: 4472 Parent PID: 6116

General

Start time:	14:16:47
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\Payment_Advice.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Payment_Advice.exe'
Imagebase:	0x400000
File size:	90112 bytes
MD5 hash:	3A27F66A430A3B54D24FB8F75E837175
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Payment_Advice.exe PID: 4472 Parent PID: 6116 Payment_Advice.exeCOMMON

Executed Functions

Function 0227BB90, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 186COMMON

Download Yara Rule

Strings

n, xrefs: 0227BBB0

Memory Dump Source

Source File: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Offset: 02270000, based on PE: false

Yara matches

Similarity

API ID:
String ID: n
API String ID: 0-2013832146
Opcode ID: 166047a0b199204b3490b6450e6f89d08e837a960be7bb572a732080390c64bd
Instruction ID: ec1b7f9388d2482df4fbbca982edfc08e51bed0dcbf9e35d620437950abc2aa4
Opcode Fuzzy Hash: 166047a0b199204b3490b6450e6f89d08e837a960be7bb572a732080390c64bd
Instruction Fuzzy Hash: D6711231518389CFCB78CF78C9987E937A2EF55320F85422ECC0A9B668D3705A81CB85

Uniqueness

Uniqueness Score: -1.00%

Function 02277792, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 02277987

Strings

Q,, xrefs: 02277821

Memory Dump Source

Source File: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Offset: 02270000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: Q,
API String ID: 2167126740-1768252776
Opcode ID: 0d9c1b5963e555809ef12cd4d62f233c3675bfc6e1835d4acec0142998560a34
Instruction ID: 1b83b6743d5fce42e47bea028a4b7667316c6bbfc3ed1b400a93e96a3cf074fa
Opcode Fuzzy Hash: 0d9c1b5963e555809ef12cd4d62f233c3675bfc6e1835d4acec0142998560a34
Instruction Fuzzy Hash: E151BCB15583888FDB749F64CC917EABBA1FF4A354F45012EDD8E8B265D7308A80CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00412B60, Relevance: 75.6, APIs: 39, Strings: 4, Instructions: 329COMMON

Download Yara Rule

APIs

#612.MSVBVM60(?), ref: 00412BE2
__vbaStrVarMove.MSVBVM60(?), ref: 00412BEC
__vbaStrMove.MSVBVM60 ref: 00412BF7
__vbaFreeVar.MSVBVM60 ref: 00412C00
#575.MSVBVM60(?,?), ref: 00412C1C
__vbaVarTstNe.MSVBVM60(?,?), ref: 00412C3E
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00412C51
__vbaNew2.MSVBVM60(004108BC,004145C0), ref: 00412C71
__vbaHresultCheckObj.MSVBVM60(00000000,02A2004C,004108AC,00000034,?,?,00000ACB,?), ref: 00412CBB
__vbaObjSet.MSVBVM60(?,?,?,?,00000ACB,?), ref: 00412CCC
__vbaStrToAnsi.MSVBVM60(?,snappishly,00000000), ref: 00412CDC
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 00412CEF
__vbaFreeStr.MSVBVM60(?,?,00000ACB,?), ref: 00412D0E
__vbaFpI4.MSVBVM60(?,?,00000ACB,?), ref: 00412D21
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,00410354,000002C8), ref: 00412D57
__vbaSetSystemError.MSVBVM60(00000000,00000002,00000002), ref: 00412D6D
__vbaNew2.MSVBVM60(004108BC,004145C0), ref: 00412D95
__vbaHresultCheckObj.MSVBVM60(00000000,02A2004C,004108AC,0000004C), ref: 00412DBA
__vbaHresultCheckObj.MSVBVM60(00000000,?,004108E8,0000001C,?,?,?,?), ref: 00412E0A
__vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 00412E1B
__vbaFreeObj.MSVBVM60(?,?,?,?), ref: 00412E24
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,00410384,000006F8), ref: 00412E4C
__vbaStrCopy.MSVBVM60 ref: 00412E5A
__vbaFreeStr.MSVBVM60 ref: 00412E93
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,00410354,000002B4), ref: 00412EC0
__vbaStrToAnsi.MSVBVM60(?,SINGFEST,00267EEC), ref: 00412EDD
__vbaSetSystemError.MSVBVM60(000C5DB5,00000000), ref: 00412EF4
__vbaFreeStr.MSVBVM60 ref: 00412F13
__vbaNew2.MSVBVM60(004108BC,004145C0), ref: 00412F2C
__vbaLateMemCallLd.MSVBVM60(00000002,?,WkKauIFp5j1bv26pBJsl8jmR69NV785,00000000), ref: 00412F48
__vbaObjVar.MSVBVM60(00000000), ref: 00412F52
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 00412F5D
__vbaHresultCheckObj.MSVBVM60(00000000,02A2004C,004108AC,0000000C), ref: 00412F77
__vbaFreeObj.MSVBVM60 ref: 00412F80
__vbaFreeVar.MSVBVM60 ref: 00412F89
__vbaFreeObj.MSVBVM60(00412FEA), ref: 00412FD4
__vbaFreeStr.MSVBVM60 ref: 00412FD9
__vbaFreeObj.MSVBVM60 ref: 00412FE2
__vbaFreeObj.MSVBVM60 ref: 00412FE7

Strings

SINGFEST, xrefs: 00412ED7
snappishly, xrefs: 00412CD6
WkKauIFp5j1bv26pBJsl8jmR69NV785, xrefs: 00412F3C
Palmira, xrefs: 00412E52

Memory Dump Source

Source File: 00000000.00000002.813340991.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.813318951.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.813491533.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.813548449.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$ErrorNew2System$AnsiMove$#575#612AddrefCallCopyLateList
String ID: Palmira$SINGFEST$WkKauIFp5j1bv26pBJsl8jmR69NV785$snappishly
API String ID: 1255662601-1278630523
Opcode ID: 549b60827e920eedba0eec8639b3ed821ef44e175e2498523b760d8efa285644
Instruction ID: f6b96e105d13d64ceb7cdb1f2ea9978f928e83ae26243f1649d855809936c206
Opcode Fuzzy Hash: 549b60827e920eedba0eec8639b3ed821ef44e175e2498523b760d8efa285644
Instruction Fuzzy Hash: 20D16B70900209EFDB10DFA0DE89ADEBBB9FF48704F10816AF545A72A1D7745985CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004012C8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 73%

			_entry_() {
				signed char _t30;
				signed int _t31;
				signed char _t33;
				signed char _t34;
				signed int _t35;
				signed char _t37;
				signed char _t38;
				signed int* _t40;
				void* _t57;
				intOrPtr* _t59;
				signed int _t61;
				signed int _t62;
				void* _t69;
				signed char _t70;
				void* _t71;
				void* _t73;
				signed char _t78;
				void* _t82;
				intOrPtr _t83;

				_push("VB5!6!*"); // executed
				L004012C0(); // executed
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 ^ _t30;
				 *_t30 =  *_t30 + _t30;
				_t31 = _t30 + 1;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *_t31 =  *_t31 + _t31;
				 *((intOrPtr*)(_t69 + 0x7b9ddca)) =  *((intOrPtr*)(_t69 + 0x7b9ddca)) + _t57;
				_t61 = _t31;
				asm("pushfd");
				_pop(_t33);
				_t59 =  *((char*)(_t40 - 0x32));
				_t34 = _t33 & 0x00000000;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t59 =  *_t59 + _t34;
				 *_t34 =  *_t34 + _t34;
				 *_t34 =  *_t34 + _t34;
				_t35 = _t40 + _t34;
				asm("das");
				asm("sbb al, 0x3");
				_push(_t73);
				_t70 =  *[gs:ebx+0x74] * 0x6f;
				_t78 = _t70;
				asm("insd");
				if(_t78 < 0) {
					L5:
					 *_t35 =  *_t35 + _t35;
					 *((intOrPtr*)(_t61 - 0x67ffff18)) =  *((intOrPtr*)(_t61 - 0x67ffff18)) + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 | _t35;
					_t82 =  *_t35;
					_push(_t40);
					if(_t82 < 0) {
						L16:
						 *_t35 =  *_t35;
						 *_t35 =  *_t35;
						L17:
						 *_t35 =  *_t35 + _t35;
						 *((intOrPtr*)(_t35 + 0x800080)) =  *((intOrPtr*)(_t35 + 0x800080)) + _t35;
						L18:
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + 0x80;
						 *((intOrPtr*)(_t35 - 0x3fffff80)) =  *((intOrPtr*)(_t35 - 0x3fffff80)) + _t35;
						L19:
						 *_t35 =  *_t35;
						asm("rol al, 0xc0");
						 *((intOrPtr*)(_t35 + 0x8080)) =  *((intOrPtr*)(_t35 + 0x8080)) + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + 1;
						 *_t35 =  *_t35 + _t35;
						asm("invalid");
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + 1;
						asm("invalid");
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						asm("sti");
						asm("sti");
						asm("sti");
						asm("sti");
						asm("sti");
						asm("sti");
						asm("lock add [edi-0x40b04041], bh");
						asm("sti");
						asm("lock add [edi-0x40bb4b41], bh");
						asm("hlt");
						asm("sti");
						asm("lock add [edi-0x40bb4b41], bh");
						asm("sti");
						asm("lock add [edi-0x40b04041], bh");
						asm("sti");
						asm("sti");
						asm("sti");
						asm("sti");
						asm("lock add [eax], al");
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *((intOrPtr*)(_t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 - 0xfffffffffffffffc)) =  *((intOrPtr*)(_t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 + _t40 - 0xfffffffffffffffc)) + _t59;
						asm("sti");
						asm("sti");
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						 *_t35 =  *_t35 + _t35;
						asm("invalid");
						asm("invalid");
						 *_t35 =  *_t35 + 0xff;
						 *((intOrPtr*)(_t35 - 0x7f000100)) =  *((intOrPtr*)(_t35 - 0x7f000100)) + 1;
						 *((intOrPtr*)(_t35 - 0x7f000100)) =  *((intOrPtr*)(_t35 - 0x7f000100)) + 1;
						 *((intOrPtr*)(_t35 - 0x7f000100)) =  *((intOrPtr*)(_t35 - 0x7f000100)) + 1;
						 *((intOrPtr*)(_t35 - 0x7f000100)) =  *((intOrPtr*)(_t35 - 0x7f000100)) + 1;
						 *((intOrPtr*)(_t35 - 0x7f000100)) =  *((intOrPtr*)(_t35 - 0x7f000100)) + 1;
						if (_t35 + 1 > 0) goto L20;
						goto L20;
						goto __eax;
						L20:
						asm("invalid");
					}
					asm("outsd");
					asm("outsb");
					if(_t82 >= 0) {
						L15:
						 *_t35 =  *_t35 + _t35;
						goto L16;
					}
					if(_t82 >= 0) {
						goto L17;
					}
					 *0x46000b01 =  *0x46000b01 + _t59;
					_t83 =  *0x46000b01;
					if(_t83 < 0) {
						goto L17;
					}
					if(_t83 >= 0) {
						goto L18;
					}
					asm("outsd");
					if(_t83 < 0) {
						goto L19;
					}
					if (_t83 >= 0) goto L12;
					asm("sbb [ecx], eax");
					 *_t61 =  *_t61 + _t35;
					_t37 = _t35 &  *_t40;
					L13:
					_t35 = _t37 &  *(_t70 + 1);
					 *_t35 =  *_t35 + _t35;
					asm("insb");
					if ( *_t35 == 0) goto L14;
					 *_t70 =  *_t70 + _t40;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t59 =  *_t59 + _t35;
					 *_t59 =  *_t59 + _t35;
					 *_t35 =  *_t35 + _t61;
					asm("adc [eax], dl");
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t59;
					 *_t35 =  *_t35 + _t35;
					 *_t70 =  *_t70 + _t61;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t59;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t61;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t59 =  *_t59 + _t35;
					 *((intOrPtr*)(_t35 + _t35)) =  *((intOrPtr*)(_t35 + _t35)) + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t61;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					 *_t35 =  *_t35 + _t35;
					goto L15;
				}
				asm("popad");
				if (_t78 < 0) goto L3;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 ^ _t35;
				 *_t70 =  *_t70 - 1;
				_t73 = _t73;
				 *0xa07c7ae1 = _t35;
				_t38 = _t70;
				_t70 = _t35;
				_t37 = _t38 ^ 0x00000099;
				_t61 = _t61 + 1;
				if(_t71 != 1) {
					goto L13;
				}
				asm("bound esi, [ecx+0x608545e1]");
				_t7 = _t61;
				_t61 =  *_t40;
				 *_t40 = _t7;
				_t35 = _t62;
				goto 0x6699;
				asm("iretd");
				asm("adc [edi+0xaa000c], esi");
				asm("pushad");
				asm("rcl dword [ebx], cl");
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				goto L5;
			}

0x004012c8
0x004012cd
0x004012d2
0x004012d4
0x004012d6
0x004012d8
0x004012da
0x004012dc
0x004012dd
0x004012df
0x004012e1
0x004012e3
0x004012ec
0x004012ed
0x004012ee
0x004012ef
0x004012f3
0x004012f5
0x004012f7
0x004012f9
0x004012fb
0x004012fd
0x004012ff
0x00401301
0x00401302
0x00401304
0x00401305
0x00401305
0x0040130a
0x0040130b
0x0040136e
0x0040136e
0x00401370
0x00401376
0x00401378
0x0040137a
0x0040137a
0x0040137c
0x0040137d
0x004013ee
0x004013ee
0x004013f1
0x004013f2
0x004013f2
0x004013f4
0x004013fa
0x004013fa
0x004013fc
0x004013ff
0x00401401
0x00401401
0x00401404
0x00401407
0x0040140f
0x00401411
0x00401413
0x00401415
0x00401419
0x00401421
0x00401425
0x00401427
0x00401429
0x0040142b
0x0040142d
0x0040142f
0x00401431
0x00401433
0x00401435
0x00401437
0x00401439
0x0040143a
0x0040143b
0x0040143c
0x0040143d
0x0040143e
0x0040143f
0x0040144e
0x0040144f
0x0040145c
0x0040145e
0x0040145f
0x0040146e
0x0040146f
0x0040147b
0x0040147c
0x0040147d
0x0040147e
0x0040147f
0x00401482
0x00401484
0x00401486
0x00401488
0x0040148a
0x0040148b
0x0040148c
0x0040148e
0x00401490
0x00401492
0x00401494
0x00401496
0x00401498
0x0040149a
0x0040149c
0x0040149e
0x004014a0
0x004014a2
0x004014a4
0x004014a6
0x004014a8
0x004014aa
0x004014ac
0x004014af
0x004014b7
0x004014bf
0x004014c7
0x004014cf
0x004014d9
0x004014d9
0x004014db
0x004014da
0x004014da
0x004014da
0x0040137f
0x00401380
0x00401381
0x004013ec
0x004013ec
0x00000000
0x004013ec
0x00401383
0x00000000
0x00000000
0x00401385
0x00401385
0x0040138b
0x00000000
0x00000000
0x0040138d
0x00000000
0x00000000
0x0040138f
0x00401390
0x00000000
0x00000000
0x00401393
0x00401396
0x00401398
0x0040139b
0x0040139d
0x0040139d
0x004013a0
0x004013a2
0x004013a3
0x004013a5
0x004013a7
0x004013a9
0x004013ab
0x004013ad
0x004013af
0x004013b1
0x004013b3
0x004013b5
0x004013b7
0x004013b9
0x004013bb
0x004013bd
0x004013bf
0x004013c1
0x004013c3
0x004013c5
0x004013c7
0x004013c9
0x004013cb
0x004013cd
0x004013d0
0x004013d2
0x004013d4
0x004013d7
0x004013d9
0x004013db
0x004013dd
0x004013df
0x004013e1
0x004013e3
0x004013e5
0x004013e7
0x004013e9
0x004013eb
0x00000000
0x004013eb
0x0040130d
0x0040130e
0x00401312
0x00401314
0x00401316
0x0040131a
0x00401322
0x00401324
0x00401325
0x0040132a
0x0040132a
0x0040132b
0x0040132d
0x0040132f
0x00000000
0x00000000
0x00401331
0x00401337
0x00401337
0x00401337
0x0040133b
0x0040133c
0x00401343
0x00401344
0x0040134a
0x0040134b
0x00401351
0x00401353
0x00401355
0x00401357
0x00401359
0x0040135b
0x0040135d
0x0040135f
0x00401361
0x00401363
0x00401365
0x00401367
0x00401369
0x0040136b
0x0040136d
0x00000000

APIs

#100.MSVBVM60(VB5!6!*), ref: 004012CD

Strings

VB5!6!*, xrefs: 004012C8

Memory Dump Source

Source File: 00000000.00000002.813340991.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.813318951.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.813491533.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.813548449.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6!*
API String ID: 1341478452-2574520878
Opcode ID: 65bcabd2d3b2cfcce738f6ace49643eb3e149e76052b2364305ed67a51d6a320
Instruction ID: 4eed00bb182fb4e9760f5624f56705828db8982adf34c12508b44d950381b41b
Opcode Fuzzy Hash: 65bcabd2d3b2cfcce738f6ace49643eb3e149e76052b2364305ed67a51d6a320
Instruction Fuzzy Hash: D25161A680E7D14EE703877499652517FB0AE23214B1E46EBC4D1DF8F3D26D080AD76A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02277B60, Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

\[, xrefs: 02278670

Memory Dump Source

Source File: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Offset: 02270000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: \[
API String ID: 2167126740-191474855
Opcode ID: 527b2ed5938abba0864d76a6ca46fd908d6cfd5492cf4c8eee6c753555a70178
Instruction ID: 893fcb98aa64f82e2e252b712cdf6e15daef1379951256974235bb6efea77760
Opcode Fuzzy Hash: 527b2ed5938abba0864d76a6ca46fd908d6cfd5492cf4c8eee6c753555a70178
Instruction Fuzzy Hash: 8D4164724583C29FD7128F35C8597DABFA2FF03314F28468AD5D08B196D7368046CB96

Uniqueness

Uniqueness Score: -1.00%

Function 022752DA, Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

6IUE, xrefs: 02275313

Memory Dump Source

Source File: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Offset: 02270000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 6IUE
API String ID: 0-1245041184
Opcode ID: e489b09a122f032e8e348cb77035d0033939843620599919a98c1b601a7ea370
Instruction ID: 0b7d65d5e14b5131603d44806d479f796498197a7dfd3df31b42ce00e2a2e9ee
Opcode Fuzzy Hash: e489b09a122f032e8e348cb77035d0033939843620599919a98c1b601a7ea370
Instruction Fuzzy Hash: 16510370658389DFDB38CE6689E57EAB7E2AF49304FC4412F8D4E4B648C730A616CB14

Uniqueness

Uniqueness Score: -1.00%

Function 02275463, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Offset: 02270000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 978d4a5f71b55d43a0c0a798b3c9bd7e22805d9c3f99aef39f41ab84ff396341
Instruction ID: 8c919cd154007948a66cb56aa8ee7071389d581969af6d8f3ce4740219e893f9
Opcode Fuzzy Hash: 978d4a5f71b55d43a0c0a798b3c9bd7e22805d9c3f99aef39f41ab84ff396341
Instruction Fuzzy Hash: 9231DE700A57A58BD334CF15C5A67A9F360FB4A701F80822ECE8A47525DB329A638704

Uniqueness

Uniqueness Score: -1.00%

Function 02279B36, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Offset: 02270000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ae1afb39738df6c5a403b937dc02b6d906dbdc38ddff6bf5ae25d4c651179a
Instruction ID: dfcc9154e519a6f64f0571a7904e88fb67e14e01affa20ba9faedb0717aad275
Opcode Fuzzy Hash: d2ae1afb39738df6c5a403b937dc02b6d906dbdc38ddff6bf5ae25d4c651179a
Instruction Fuzzy Hash: 753179726AE7CA8BEF358D6488617F67FE29B2A310F88841E9DC647345C2304880C751

Uniqueness

Uniqueness Score: -1.00%

Function 02274D08, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Offset: 02270000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 404ef0f1b2de695faac87a09f5aff3b41c58405891568882eacff2783e03003e
Instruction ID: 86565772dd018c91972d84caa4c433fa09cb9c9617c8e1d3b8ddb0a512db91b2
Opcode Fuzzy Hash: 404ef0f1b2de695faac87a09f5aff3b41c58405891568882eacff2783e03003e
Instruction Fuzzy Hash: C32137311A8385CFC759DF64C498BE5BBB1FF57320F16828EC9869B626C7318942CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0227A9AA, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Offset: 02270000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30689278a13f5107e5e35c13c9347907b7318d695664c28b3557b4a008ff872
Instruction ID: c568a1acc7a3deb5ba99acd4e45ccd6d25b974961582d55e4fe22e1b16d1bbb9
Opcode Fuzzy Hash: f30689278a13f5107e5e35c13c9347907b7318d695664c28b3557b4a008ff872
Instruction Fuzzy Hash: 5F21F6367593468BCB308E68C9C07DBB3A2EF5A760F8A422D8D898B205D3758845C742

Uniqueness

Uniqueness Score: -1.00%

Function 02277528, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Offset: 02270000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67c04d2023855d1e060f83c072c6d78ab1557a50b5d88a36466b01f1a3e4d6bd
Instruction ID: 55bc496c0a81b7b8cdedf98df3a563eb4dd767509b86c99fc5ba199fc69bf467
Opcode Fuzzy Hash: 67c04d2023855d1e060f83c072c6d78ab1557a50b5d88a36466b01f1a3e4d6bd
Instruction Fuzzy Hash: 1511BE715083499FCB689F34D9AA7EB7BE5AF5A740F42041EACCA8B200D7309785CB03

Uniqueness

Uniqueness Score: -1.00%

Function 02279E4A, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Offset: 02270000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7df9c44accca24f6afbe94477e4184b295804a6abeb80414054942c883eee08
Instruction ID: 16228bf631110b7e9cbfe70c2794e75b18816bda7a730883b8b8f387d7d38715
Opcode Fuzzy Hash: b7df9c44accca24f6afbe94477e4184b295804a6abeb80414054942c883eee08
Instruction Fuzzy Hash: 9A011E74218349CFCB78DF58D9D4ADA73B1BF59300F44406AED4A9B3A9DB30A980CB15

Uniqueness

Uniqueness Score: -1.00%

Function 02277032, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Offset: 02270000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f45aced2850e5c42fd8482fc0f6d686161b02630ca106807527fda30894e8122
Instruction ID: 22e0d3cf8af249755f391f0ae51f61cecd8b2818efa95b57bb56788ca31e3c8a
Opcode Fuzzy Hash: f45aced2850e5c42fd8482fc0f6d686161b02630ca106807527fda30894e8122
Instruction Fuzzy Hash: 7DC0804B83C16749558511B45BC53E7442246D6390F46825014069260CE4A6CDC54C05

Uniqueness

Uniqueness Score: -1.00%

Function 022798A6, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Offset: 02270000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd04a7d9b221595474c1aca05f61eff7a2ccca4ddde934fe215bdbaf50c42f1c
Instruction ID: a0c837c3a6a00c4695e456b93962e429bc379ba25fde3c98856ef1f42514fb12
Opcode Fuzzy Hash: cd04a7d9b221595474c1aca05f61eff7a2ccca4ddde934fe215bdbaf50c42f1c
Instruction Fuzzy Hash: 37C048342109408BD266CE5AC5A8B81B3AABF48E00FD284A5E8418BA21D328ED828A00

Uniqueness

Uniqueness Score: -1.00%

Function 02276E76, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.816420146.0000000002270000.00000040.00000001.sdmp, Offset: 02270000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 00413320, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

#672.MSVBVM60(00000000,40080000,00000000,3FF00000,00000000,3FF00000,00000000,3FF00000), ref: 0041336C
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413372
__vbaNew2.MSVBVM60(004108BC,004145C0,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413397
__vbaLateMemCallLd.MSVBVM60(?,?,qTu9tyktlIOgozvLrZMBbdZxTILvo43,00000000), ref: 004133B3
__vbaObjVar.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 004133BD
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 004133C8
__vbaHresultCheckObj.MSVBVM60(00000000,02A2004C,004108AC,0000000C), ref: 004133E2
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 004133EB
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 004133F4
__vbaFreeObj.MSVBVM60(00413426), ref: 0041341F

Strings

qTu9tyktlIOgozvLrZMBbdZxTILvo43, xrefs: 004133A7

Memory Dump Source

Source File: 00000000.00000002.813340991.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.813318951.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.813491533.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.813548449.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#672AddrefCallCheckHresultLateNew2
String ID: qTu9tyktlIOgozvLrZMBbdZxTILvo43
API String ID: 263512575-2009357870
Opcode ID: 36584572401e04012f78945e83adea8b1831ef180e897a26de6f6ac3869dc4d6
Instruction ID: 7a8fe742ff895f9b851228b7399f7d21353efe8e7ce09d9d37503a31ccbe14a6
Opcode Fuzzy Hash: 36584572401e04012f78945e83adea8b1831ef180e897a26de6f6ac3869dc4d6
Instruction Fuzzy Hash: 34214F70900245EBDB10AF95DE49FABBB78FB94B02F10442AF541B25A0D7781581CF6D

Uniqueness

Uniqueness Score: -1.00%

Function 00413010, Relevance: 12.1, APIs: 8, Instructions: 99COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,00410968,00000005), ref: 0041304C
#682.MSVBVM60(?,?), ref: 0041308D
__vbaFpR8.MSVBVM60 ref: 00413093
__vbaFreeVar.MSVBVM60 ref: 004130B7
_adj_fdiv_m64.MSVBVM60 ref: 004130E9
__vbaFpI4.MSVBVM60(42FC0000,?,436E0000), ref: 00413117
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410354,000002C0,?,436E0000), ref: 0041314B
__vbaAryDestruct.MSVBVM60(00000000,?,00413176), ref: 0041316F

Memory Dump Source

Source File: 00000000.00000002.813340991.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.813318951.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.813491533.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.813548449.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#682CheckConstruct2DestructFreeHresult_adj_fdiv_m64
String ID:
API String ID: 4111779564-0
Opcode ID: f9306a69acf47cef25a353af5213d63752a5c7571344e3560a397993017aea1d
Instruction ID: 33a578bc5aba2e40f90e141480eeadbd3ff91af455526bef480b3debfbd54266
Opcode Fuzzy Hash: f9306a69acf47cef25a353af5213d63752a5c7571344e3560a397993017aea1d
Instruction Fuzzy Hash: 01318174D00248EBDB04CF91DE48BEEBBB8FB48701F10812AF541BA2A4C7B85985CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00413190, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

__vbaVarTstNe.MSVBVM60(?,?), ref: 004131F4
__vbaInStr.MSVBVM60(00000000,Bebyrdelses9,Hvislendes8,FF96B5C0), ref: 0041320F

Strings

Bebyrdelses9, xrefs: 00413209
Hvislendes8, xrefs: 00413204

Memory Dump Source

Source File: 00000000.00000002.813340991.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.813318951.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.813491533.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.813548449.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba
String ID: Bebyrdelses9$Hvislendes8
API String ID: 3524132090-1996639642
Opcode ID: 6a0abc1d5a2de543b24974b2caca9fd62b173441c529924bae74daf47a8d6f90
Instruction ID: 9c73fb05ed69dc07260d5ffe9d4696bf8dbe35c1989c5c085c288ee580072a22
Opcode Fuzzy Hash: 6a0abc1d5a2de543b24974b2caca9fd62b173441c529924bae74daf47a8d6f90
Instruction Fuzzy Hash: 690148B0950258EBCB10EF98C989BDEBFB8BF08B04F24805AF544B6251D7B815858B99

Uniqueness

Uniqueness Score: -1.00%

Function 00413250, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(004108BC,004145C0), ref: 00413293
__vbaHresultCheckObj.MSVBVM60(00000000,02A2004C,004108AC,0000004C), ref: 004132B8
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004108E8,00000028), ref: 004132D8
__vbaFreeObj.MSVBVM60 ref: 004132E1

Memory Dump Source

Source File: 00000000.00000002.813340991.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.813318951.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.813491533.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.813548449.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID:
API String ID: 4261391273-0
Opcode ID: c2c956cce8ae0fb1c7abbef811d818e2b5e0fe525585c4d75af6ba34e555b409
Instruction ID: 81a809eaaed7dc680e9ce63a33d747393ba5a439aff1a2f19fcf1fdef59f5c17
Opcode Fuzzy Hash: c2c956cce8ae0fb1c7abbef811d818e2b5e0fe525585c4d75af6ba34e555b409
Instruction Fuzzy Hash: A9115174640205BBD700AF65DE49FDA7BF8FB18B01F104165FA45E32A0D7B859858BE8

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Payment_Advice.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Payment_Advice.exe PID: 4472 Parent PID: 6116

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Payment_Advice.exe PID: 4472 Parent PID: 6116 Payment_Advice.exeCOMMON

Executed Functions

Function 0227BB90, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 186COMMON

Function 004012C8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 131
COMMON