Play interactive tour

Edit tour

Windows Analysis Report payment confirmation.exe

Overview

General Information

Sample Name:	payment confirmation.exe
Analysis ID:	491535
MD5:	930debccdeecb4fc138b0319bef33720
SHA1:	b56f93dc8316eb35a3b311ce1c412e5d617bcfeb
SHA256:	03082b2f67073c9017a28fe1ef9166d38edd339ef72da583653f083ec2b9fac4
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

Initial sample is a PE file and has a suspicious name

Tries to detect virtualization through RDTSC time measurements

Executable has a suspicious name (potential lure to open the executable)

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Uses 32bit PE files

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to call native functions

Program does not show much activity (idle)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

payment confirmation.exe (PID: 3316 cmdline: 'C:\Users\user\Desktop\payment confirmation.exe' MD5: 930DEBCCDEECB4FC138B0319BEF33720)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=dow"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=dow"}

Multi AV Scanner detection for submitted file

Show sources

Source: payment confirmation.exe	Virustotal: Detection: 30%			Perma Link
Source: payment confirmation.exe	ReversingLabs: Detection: 15%

Source: payment confirmation.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=dow

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: payment confirmation.exe

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: payment confirmation.exe

Static file information: Suspicious name

Source: payment confirmation.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: payment confirmation.exe, 00000001.00000002.872716225.0000000000415000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamedamrred.exe vs payment confirmation.exe
Source: payment confirmation.exe	Binary or memory string: OriginalFilenamedamrred.exe vs payment confirmation.exe

Source: payment confirmation.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F72A4	1_2_021F72A4
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021FBC77	1_2_021FBC77
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6236	1_2_021F6236
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F622A	1_2_021F622A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F625A	1_2_021F625A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F624E	1_2_021F624E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6242	1_2_021F6242
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5A96	1_2_021F5A96
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5A8A	1_2_021F5A8A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5AAE	1_2_021F5AAE
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5AA2	1_2_021F5AA2
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5AEA	1_2_021F5AEA
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F637A	1_2_021F637A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5B78	1_2_021F5B78
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F636E	1_2_021F636E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F639E	1_2_021F639E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6392	1_2_021F6392
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6386	1_2_021F6386
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021FABBD	1_2_021FABBD
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F63C2	1_2_021F63C2
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5876	1_2_021F5876
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F589A	1_2_021F589A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F588E	1_2_021F588E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5882	1_2_021F5882
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F58A6	1_2_021F58A6
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F58CA	1_2_021F58CA
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F60FE	1_2_021F60FE
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F60F2	1_2_021F60F2
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6116	1_2_021F6116
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F610A	1_2_021F610A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6122	1_2_021F6122
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6146	1_2_021F6146
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5161	1_2_021F5161
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5996	1_2_021F5996
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F598A	1_2_021F598A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F59BA	1_2_021F59BA
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F59A2	1_2_021F59A2
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F59C6	1_2_021F59C6
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5652	1_2_021F5652
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5646	1_2_021F5646
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5676	1_2_021F5676
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5E9E	1_2_021F5E9E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5E92	1_2_021F5E92
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5E86	1_2_021F5E86
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5682	1_2_021F5682
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F76AB	1_2_021F76AB
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F575E	1_2_021F575E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5752	1_2_021F5752
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F576A	1_2_021F576A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5F9E	1_2_021F5F9E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5F92	1_2_021F5F92
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5FB6	1_2_021F5FB6
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5FAA	1_2_021F5FAA
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F57A6	1_2_021F57A6
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5FF6	1_2_021F5FF6
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6FEA	1_2_021F6FEA
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5C3E	1_2_021F5C3E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5C32	1_2_021F5C32
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5C56	1_2_021F5C56
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5C4A	1_2_021F5C4A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5C6E	1_2_021F5C6E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5C62	1_2_021F5C62
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F54D0	1_2_021F54D0
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5D3E	1_2_021F5D3E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5536	1_2_021F5536
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5D32	1_2_021F5D32
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F552A	1_2_021F552A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5D26	1_2_021F5D26
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5D56	1_2_021F5D56
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F554E	1_2_021F554E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5D4A	1_2_021F5D4A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5542	1_2_021F5542
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F5D7A	1_2_021F5D7A

Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F72A4 NtAllocateVirtualMemory,	1_2_021F72A4
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F787E NtAllocateVirtualMemory,	1_2_021F787E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F7872 NtAllocateVirtualMemory,	1_2_021F7872
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F7866 NtAllocateVirtualMemory,	1_2_021F7866
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F7896 NtAllocateVirtualMemory,	1_2_021F7896
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F788A NtAllocateVirtualMemory,	1_2_021F788A
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F78BA NtAllocateVirtualMemory,	1_2_021F78BA
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F76AB NtAllocateVirtualMemory,	1_2_021F76AB
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F774E NtAllocateVirtualMemory,	1_2_021F774E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F777E NtAllocateVirtualMemory,	1_2_021F777E
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F7772 NtAllocateVirtualMemory,	1_2_021F7772
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F7766 NtAllocateVirtualMemory,	1_2_021F7766

Source: C:\Users\user\Desktop\payment confirmation.exe

Process Stats: CPU usage > 98%

Source: payment confirmation.exe	Virustotal: Detection: 30%
Source: payment confirmation.exe	ReversingLabs: Detection: 15%

Source: payment confirmation.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\payment confirmation.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\payment confirmation.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\payment confirmation.exe

File created: C:\Users\user\AppData\Local\Temp\~DF6135C90C205E10D1.TMP

Jump to behavior

Source: classification engine

Classification label: mal84.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_00406252 push ebx; retf	1_2_00406257
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_0040645E push edi; retf	1_2_0040645F
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_00404A04 push 0000003Ah; iretd	1_2_00404A10
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_0040523B push edi; ret	1_2_0040523C
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_004080D3 push cs; ret	1_2_004080E9
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_004060E8 push dword ptr [edi-36h]; iretd	1_2_004060F4
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_00408098 push cs; ret	1_2_004080E9
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_004047D9 push cs; retf	1_2_0040483F
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_00404795 push cs; retf	1_2_004047B7
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F8A25 pushad ; retf	1_2_021F8A26
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F8A44 push eax; ret	1_2_021F8A45
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F2AFA push eax; ret	1_2_021F2B01
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F8336 push 5FF5B4E2h; ret	1_2_021F833D
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F236E push ecx; retf	1_2_021F2370
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F83AF push 84000016h; ret	1_2_021F83B4
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F8890 push esi; iretd	1_2_021F8896
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F1883 pushad ; ret	1_2_021F1889
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F3882 push eax; ret	1_2_021F3885
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F49C7 push esp; iretd	1_2_021F49CF
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F1698 pushad ; ret	1_2_021F16FD
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F16FE pushad ; ret	1_2_021F16FD
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F1716 pushad ; ret	1_2_021F16FD
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F170A pushad ; ret	1_2_021F16FD
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F1722 pushad ; ret	1_2_021F16FD
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F1568 push eax; ret	1_2_021F156C
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F45D4 pusha ; iretd	1_2_021F45E2

Source: C:\Users\user\Desktop\payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\payment confirmation.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\payment confirmation.exe	RDTSC instruction interceptor: First address: 000000000040EC4B second address: 000000000040EC4B instructions: 0x00000000 rdtsc 0x00000002 cmp ecx, 50h 0x00000005 cmp eax, 00000089h 0x0000000a popad 0x0000000b cmp eax, 4Fh 0x0000000e wait 0x0000000f dec edi 0x00000010 lfence 0x00000013 wait 0x00000014 cmp edi, 00000000h 0x00000017 jne 00007F6508BEA90Fh 0x00000019 pushfd 0x0000001a popfd 0x0000001b mfence 0x0000001e pushad 0x0000001f mfence 0x00000022 wait 0x00000023 rdtsc
Source: C:\Users\user\Desktop\payment confirmation.exe	RDTSC instruction interceptor: First address: 00000000021F6F29 second address: 00000000021F6F29 instructions: 0x00000000 rdtsc 0x00000002 mov eax, 6D2A1F19h 0x00000007 xor eax, 45945F07h 0x0000000c add eax, C726675Ch 0x00000011 add eax, 101B5887h 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007F650838F078h 0x0000001e lfence 0x00000021 mov edx, CC755165h 0x00000026 xor edx, BA4B37F6h 0x0000002c xor edx, 2C31E30Ah 0x00000032 xor edx, 25F1858Dh 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 pop ecx 0x00000042 add edi, edx 0x00000044 dec ecx 0x00000045 mov dword ptr [ebp+000001B3h], ecx 0x0000004b mov ecx, A73C3F3Ch 0x00000050 add ecx, 692C6FF6h 0x00000056 sub ecx, 1AB1EA29h 0x0000005c add ecx, 0A493AF7h 0x00000062 cmp dword ptr [ebp+000001B3h], ecx 0x00000068 mov ecx, dword ptr [ebp+000001B3h] 0x0000006e jne 00007F650838F02Dh 0x00000070 test al, al 0x00000072 mov dword ptr [ebp+0000025Bh], edi 0x00000078 mov edi, ecx 0x0000007a push edi 0x0000007b mov edi, dword ptr [ebp+0000025Bh] 0x00000081 call 00007F650838F148h 0x00000086 call 00007F650838F099h 0x0000008b lfence 0x0000008e mov edx, CC755165h 0x00000093 xor edx, BA4B37F6h 0x00000099 xor edx, 2C31E30Ah 0x0000009f xor edx, 25F1858Dh 0x000000a5 mov edx, dword ptr [edx] 0x000000a7 lfence 0x000000aa ret 0x000000ab mov esi, edx 0x000000ad pushad 0x000000ae rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\payment confirmation.exe

Code function: 1_2_021F7235 rdtsc

1_2_021F7235

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\payment confirmation.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021FABBD mov eax, dword ptr fs:[00000030h]	1_2_021FABBD
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F99FC mov eax, dword ptr fs:[00000030h]	1_2_021F99FC
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F9F4F mov eax, dword ptr fs:[00000030h]	1_2_021F9F4F
Source: C:\Users\user\Desktop\payment confirmation.exe	Code function: 1_2_021F6D48 mov eax, dword ptr fs:[00000030h]	1_2_021F6D48

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\payment confirmation.exe

Code function: 1_2_021F7235 rdtsc

1_2_021F7235

Source: C:\Users\user\Desktop\payment confirmation.exe

Code function: 1_2_021FBC77 RtlAddVectoredExceptionHandler,

1_2_021FBC77

Source: payment confirmation.exe, 00000001.00000002.872876297.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: payment confirmation.exe, 00000001.00000002.872876297.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: payment confirmation.exe, 00000001.00000002.872876297.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: &Program Manager
Source: payment confirmation.exe, 00000001.00000002.872876297.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery21	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
payment confirmation.exe	30%	Virustotal		Browse
payment confirmation.exe	16%	ReversingLabs	Win32.Trojan.Mucc

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491535
Start date:	27.09.2021
Start time:	17:18:37
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	payment confirmation.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 9.4% (good quality ratio 6.5%) Quality average: 46.4% Quality standard deviation: 35.6%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 2.18.108.150, 20.49.157.6, 23.209.125.83, 23.209.125.71, 20.54.110.249, 40.112.88.60, 20.82.209.183, 23.10.249.43, 23.10.249.26, 95.100.54.203 Excluded domains from analysis (whitelisted): a767.dspw65.akamai.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, cdn.onenote.net.edgekey.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, cdn.onenote.net, prod.fs.microsoft.com.akadns.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com, e1553.dspg.akamaiedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.750728457752444
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	payment confirmation.exe
File size:	90112
MD5:	930debccdeecb4fc138b0319bef33720
SHA1:	b56f93dc8316eb35a3b311ce1c412e5d617bcfeb
SHA256:	03082b2f67073c9017a28fe1ef9166d38edd339ef72da583653f083ec2b9fac4
SHA512:	bfd528e239d9dc5ed5c74b6443eb2f4eacf508e4254a7ece0f5d997f80103afea403510257c83a6820f4aa516ac87614887cb19f3b0082c5b0fd9c3ecab7daa7
SSDEEP:	1536:t+xDOj9YiJi9u4zT3rHf4AnDUHK1DxFAWfWt7vAjmt:t+xDO9YiJnELLFnDxF3MA8
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L....).O.................0... ...............@....@........

File Icon


Icon Hash:	821ca88c8e8c8c00

Static PE Info

General
Entrypoint:	0x4012c8
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4FA929E5 [Tue May 8 14:12:53 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	e73b8c032c82c64991ebe487a7ffcd43

Entrypoint Preview

Instruction
push 0040FF98h
call 00007F6508B26DF3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi+01h], al
inc esi
cmp dword ptr [ebx-5ABC39A1h], FFFFFFC6h
or eax, 71097B6Dh
clc
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
cmp eax, 6C614620h
jnc 00007F6508B26E56h
push 65646E75h
jc 00007F6508B26E64h
outsd
js 00007F6508B26E38h
add byte ptr [edx], cl
and byte ptr [0000000Ah], cl
add bh, bh
int3
xor dword ptr [eax], eax
cmp cl, dl
jo 00007F6508B26E14h
or al, D2h
xor al, E2h
inc ecx
lea ebp, dword ptr [ecx+4AEA7E0Ch]
setnb byte ptr [eax]
adc al, C4h
scasd
sbb eax, 8F43FF8Ch
das
mov byte ptr [752CBDB8h], al
sub edi, dword ptr [edx]
dec edi
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, EAh
add byte ptr [eax], al
xchg eax, edi
add dword ptr [eax], eax
add byte ptr [eax], al
or byte ptr [eax], al
arpl word ptr [eax+65h], bp
insb
jns 00007F6508B26E66h
jc 00007F6508B26E67h
add byte ptr [55000B01h], cl
inc esp
pop ecx
inc edi
push esp
dec ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x136b4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0x540	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xe8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x12b1c	0x13000	False	0.519017269737	data	6.24212865941	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x14000	0xcf4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x15000	0x540	0x1000	False	0.129150390625	data	1.40409416772	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x15418	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x15404	0x14	data
RT_VERSION	0x150f0	0x314	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaStrToAnsi, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0404 0x04b0
LegalCopyright	ChatSwipe
InternalName	damrred
FileVersion	4.04.0001
CompanyName	ChatSwipe
LegalTrademarks	ChatSwipe
Comments	ChatSwipe
ProductName	ChatSwipe
ProductVersion	4.04.0001
FileDescription	ChatSwipe
OriginalFilename	damrred.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2021 17:19:57.802509069 CEST	49448	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:19:57.828666925 CEST	53	49448	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:01.744852066 CEST	60342	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:01.758511066 CEST	53	60342	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:20.933399916 CEST	61346	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:20.946444035 CEST	53	61346	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:22.883145094 CEST	51774	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:22.897078037 CEST	53	51774	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:24.236115932 CEST	56023	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:24.250313997 CEST	53	56023	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:24.786951065 CEST	58384	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:24.800359964 CEST	53	58384	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:25.083745003 CEST	60261	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:25.097210884 CEST	53	60261	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:25.487617970 CEST	56061	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:25.500909090 CEST	53	56061	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:26.143419981 CEST	58336	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:26.219031096 CEST	53	58336	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:26.229260921 CEST	53781	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:26.263164043 CEST	53	53781	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:26.780441046 CEST	54064	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:26.794018030 CEST	53	54064	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:27.470508099 CEST	52811	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:27.484445095 CEST	53	52811	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:28.601474047 CEST	55299	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:28.615058899 CEST	53	55299	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:28.989866972 CEST	63745	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:29.082186937 CEST	53	63745	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:40.073616028 CEST	50055	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:40.094414949 CEST	53	50055	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:40.235743999 CEST	61374	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:40.253118992 CEST	53	61374	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:49.744210958 CEST	50339	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:49.764194012 CEST	53	50339	8.8.8.8	192.168.2.6
Sep 27, 2021 17:20:59.170593023 CEST	63307	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:20:59.236433983 CEST	53	63307	8.8.8.8	192.168.2.6
Sep 27, 2021 17:21:26.905345917 CEST	49694	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:21:26.931402922 CEST	53	49694	8.8.8.8	192.168.2.6
Sep 27, 2021 17:21:27.161016941 CEST	54982	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:21:27.188034058 CEST	53	54982	8.8.8.8	192.168.2.6
Sep 27, 2021 17:22:02.833758116 CEST	50010	53	192.168.2.6	8.8.8.8
Sep 27, 2021 17:22:02.860853910 CEST	53	50010	8.8.8.8	192.168.2.6

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: payment confirmation.exe PID: 3316 Parent PID: 5404

General

Start time:	17:19:36
Start date:	27/09/2021
Path:	C:\Users\user\Desktop\payment confirmation.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\payment confirmation.exe'
Imagebase:	0x400000
File size:	90112 bytes
MD5 hash:	930DEBCCDEECB4FC138B0319BEF33720
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: payment confirmation.exe PID: 3316 Parent PID: 5404 payment confirmation.exeCOMMON

Executed Functions

Function 021FBC77, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 174COMMON

Download Yara Rule

Strings

+>kU, xrefs: 021FC18E
n, xrefs: 021FBC97

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +>kU$n
API String ID: 0-520774417
Opcode ID: c0ea66cd419b6a82dc5054778605dd0f415b009439df31d0e20b43b2666ce42d
Instruction ID: e649cf5061bf19e72daf32122b7a06af69f9150749cadbbbda3f7140ca643a48
Opcode Fuzzy Hash: c0ea66cd419b6a82dc5054778605dd0f415b009439df31d0e20b43b2666ce42d
Instruction Fuzzy Hash: 0371F471248688CFCBB8DF68CA987EA77A2FF99350F12411ADD1A8F654C7319641CB50

Uniqueness

Uniqueness Score: -1.00%

Function 021F72A4, Relevance: 1.7, APIs: 1, Instructions: 162memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(5513FDEE,?,-BA99FE5B), ref: 021F78C2

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 30c96f0e65858a4957b4459047dcc310960ae7587cbcd49cae23fe2cb9e636e1
Instruction ID: 5397ea820c6fa4bc1f15be8f45225b505a0f72d50dc9b1d5a64b368aceb20632
Opcode Fuzzy Hash: 30c96f0e65858a4957b4459047dcc310960ae7587cbcd49cae23fe2cb9e636e1
Instruction Fuzzy Hash: F05168B2A413489FEB749F69CC843EA7BB2EF49310F05411DDD999B251D3309A41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 021F76AB, Relevance: 1.6, APIs: 1, Instructions: 111memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(5513FDEE,?,-BA99FE5B), ref: 021F78C2

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 966106594a0a0b2bad7c61db9adb0bc5efd955c0ea7f53569b99c71e83a94859
Instruction ID: b3824fa47e8d77ae40fbbf3f5f752e086954e320c619eb351af51e5576412961
Opcode Fuzzy Hash: 966106594a0a0b2bad7c61db9adb0bc5efd955c0ea7f53569b99c71e83a94859
Instruction Fuzzy Hash: 5641D1B6A053489FEBB08E66CC847EA7BA6EF49310F06451EDD9C9B250D3705A41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 021F7766, Relevance: 1.6, APIs: 1, Instructions: 98memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(5513FDEE,?,-BA99FE5B), ref: 021F78C2

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: d68e7b42e65ec6063cc43243aa999c23738e11d5516370def29d30e67921213f
Instruction ID: bbe234547a3a08aadca9a33396d9e112edec8dfc53039d043cdfd27af4714602
Opcode Fuzzy Hash: d68e7b42e65ec6063cc43243aa999c23738e11d5516370def29d30e67921213f
Instruction Fuzzy Hash: 923128726053849FEFB08F69DC947EABBA2EF89310F19451EDD599B261D3309606CF00

Uniqueness

Uniqueness Score: -1.00%

Function 021F774E, Relevance: 1.6, APIs: 1, Instructions: 97memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(5513FDEE,?,-BA99FE5B), ref: 021F78C2

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 060e66006a9c87822a55f6be553daa4c1a63322c286b115de06d66d240da0ce9
Instruction ID: da70c8e28c82ee00d59fb1d64c2a47f30ae5af5b06886b0b6a7d4b2b237fc4a7
Opcode Fuzzy Hash: 060e66006a9c87822a55f6be553daa4c1a63322c286b115de06d66d240da0ce9
Instruction Fuzzy Hash: BF3101726453449FEB708F66DC947EEBBA6EF89310F1A411EDD989B2A0D3709A05CB01

Uniqueness

Uniqueness Score: -1.00%

Function 021F7772, Relevance: 1.6, APIs: 1, Instructions: 91memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(5513FDEE,?,-BA99FE5B), ref: 021F78C2

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 0de92198db8cf6d636b9bfe3ed1ffbe461b4d38d3403b775636f327fb2ae3682
Instruction ID: 46948fc0027f96541319747490930731717d7945969c9710334f0a43c4a9eed4
Opcode Fuzzy Hash: 0de92198db8cf6d636b9bfe3ed1ffbe461b4d38d3403b775636f327fb2ae3682
Instruction Fuzzy Hash: F531CF726053449FEBB48F66DC947EABBA6EF89310F1A411DED599B260D3309A02CB00

Uniqueness

Uniqueness Score: -1.00%

Function 021F777E, Relevance: 1.6, APIs: 1, Instructions: 87memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(5513FDEE,?,-BA99FE5B), ref: 021F78C2

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: cb56041b6f9c95484ba6d6228b23c1ae68fe5f6d20d1a0ec23f8ff72431a1ed6
Instruction ID: fbf5a92233f955e3555c70aa48ebc2e2eb7c949a33f87f754e51e9a3af7404c2
Opcode Fuzzy Hash: cb56041b6f9c95484ba6d6228b23c1ae68fe5f6d20d1a0ec23f8ff72431a1ed6
Instruction Fuzzy Hash: D631CF726053449FEB748F66DC947EABBA6EF89310F1A411DED5C9B260D3309A06CB00

Uniqueness

Uniqueness Score: -1.00%

Function 021F7866, Relevance: 1.6, APIs: 1, Instructions: 60memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(5513FDEE,?,-BA99FE5B), ref: 021F78C2

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6228dbacfbf142d97cd12df0431cdd89d9e971f972db8321d819a0069772275b
Instruction ID: ef2b54795d206ab5edc42078b78e35919f8bda467a5e05a94ca04a95e205dbf5
Opcode Fuzzy Hash: 6228dbacfbf142d97cd12df0431cdd89d9e971f972db8321d819a0069772275b
Instruction Fuzzy Hash: AE21E9321452809FDBA19FA9DC907D97BB2AF8E300F09455DDD689F262D331A613CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F7872, Relevance: 1.6, APIs: 1, Instructions: 55memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(5513FDEE,?,-BA99FE5B), ref: 021F78C2

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 5289b939a87411fe066ff83544b6f67333f1f79ea0d0602664f85abd84b5dc6e
Instruction ID: a176da44429a79417028252ae9aa002bd7db4caab08148157698684250037509
Opcode Fuzzy Hash: 5289b939a87411fe066ff83544b6f67333f1f79ea0d0602664f85abd84b5dc6e
Instruction Fuzzy Hash: 1C11A3725422449FEBB58F5ADC90BDD77A2BF8E310F158119ED299B261C7319A02CF40

Uniqueness

Uniqueness Score: -1.00%

Function 021F787E, Relevance: 1.6, APIs: 1, Instructions: 53memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(5513FDEE,?,-BA99FE5B), ref: 021F78C2

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 28f51d906500c78c52cd56ad466818cba16e91faf79161a66d54df355700043d
Instruction ID: a5ca530e42302204dfd1ad8e3cfbf7053dd25c6a9c0b5c3e24ba3b2446130e3b
Opcode Fuzzy Hash: 28f51d906500c78c52cd56ad466818cba16e91faf79161a66d54df355700043d
Instruction Fuzzy Hash: 5711E9735412449FDBB18E95DC80BDD7762BF8E310F154119ED299B261C331D602CE40

Uniqueness

Uniqueness Score: -1.00%

Function 021F788A, Relevance: 1.6, APIs: 1, Instructions: 53memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(5513FDEE,?,-BA99FE5B), ref: 021F78C2

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 73dcd078a1d1cf47c646fa79ad2f33761e11cf22f55c053aa5de9db2403eb347
Instruction ID: 9fec0ff96733e80d548c67d6d874580074c2250663f0ae23b04d6e85fa7c1e52
Opcode Fuzzy Hash: 73dcd078a1d1cf47c646fa79ad2f33761e11cf22f55c053aa5de9db2403eb347
Instruction Fuzzy Hash: 2911A1721412449FDF759E99DC90BEDB766BF8E310F194119EE6D9B261C3319A02CE40

Uniqueness

Uniqueness Score: -1.00%

Function 021F7896, Relevance: 1.5, APIs: 1, Instructions: 48memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(5513FDEE,?,-BA99FE5B), ref: 021F78C2

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6a336f4290e442edca8439a4d7d500980c3596069004abe92a7d39095f32573d
Instruction ID: dc1f106555d271e034ee920a92a34ddac9b718ba01d44456d0abf6e851e38753
Opcode Fuzzy Hash: 6a336f4290e442edca8439a4d7d500980c3596069004abe92a7d39095f32573d
Instruction Fuzzy Hash: 6211D2321412449FDBB59E99DC90BDD7762BF8E310F058119EE2C9B261C3319A02CF40

Uniqueness

Uniqueness Score: -1.00%

Function 021F78BA, Relevance: 1.5, APIs: 1, Instructions: 46memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(5513FDEE,?,-BA99FE5B), ref: 021F78C2

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 3d1239629c01c31d49d2cb0f70db548f30625f0f39eeb6d959a588c70fc0e38f
Instruction ID: 5aab4e93c875e417dd3e7d2e9ca8b8cd5121b11d669bf1d228e16dd5acf95aa7
Opcode Fuzzy Hash: 3d1239629c01c31d49d2cb0f70db548f30625f0f39eeb6d959a588c70fc0e38f
Instruction Fuzzy Hash: 5401B5325057449FDF719EA9DC80BDD7762BF4D310F194219ED6D9B2A1D3318602CE00

Uniqueness

Uniqueness Score: -1.00%

Function 00412D00, Relevance: 75.6, APIs: 39, Strings: 4, Instructions: 329COMMON

Download Yara Rule

APIs

#612.MSVBVM60(?), ref: 00412D82
__vbaStrVarMove.MSVBVM60(?), ref: 00412D8C
__vbaStrMove.MSVBVM60 ref: 00412D97
__vbaFreeVar.MSVBVM60 ref: 00412DA0
#575.MSVBVM60(?,?), ref: 00412DBC
__vbaVarTstNe.MSVBVM60(?,?), ref: 00412DDE
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00412DF1
__vbaNew2.MSVBVM60(00410A54,004145C0), ref: 00412E11
__vbaHresultCheckObj.MSVBVM60(00000000,02A2004C,00410A44,00000034,?,?,00000ACB,?), ref: 00412E5B
__vbaObjSet.MSVBVM60(?,?,?,?,00000ACB,?), ref: 00412E6C
__vbaStrToAnsi.MSVBVM60(?,snappishly,00000000), ref: 00412E7C
__vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 00412E8F
__vbaFreeStr.MSVBVM60(?,?,00000ACB,?), ref: 00412EAE
__vbaFpI4.MSVBVM60(?,?,00000ACB,?), ref: 00412EC1
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,004104E0,000002C8), ref: 00412EF7
__vbaSetSystemError.MSVBVM60(00000000,00000002,00000002), ref: 00412F0D
__vbaNew2.MSVBVM60(00410A54,004145C0), ref: 00412F35
__vbaHresultCheckObj.MSVBVM60(00000000,02A2004C,00410A44,0000004C), ref: 00412F5A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410A80,0000001C,?,?,?,?), ref: 00412FAA
__vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 00412FBB
__vbaFreeObj.MSVBVM60(?,?,?,?), ref: 00412FC4
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,00410510,000006F8), ref: 00412FEC
__vbaStrCopy.MSVBVM60 ref: 00412FFA
__vbaFreeStr.MSVBVM60 ref: 00413033
__vbaHresultCheckObj.MSVBVM60(00000000,004010F0,004104E0,000002B4), ref: 00413060
__vbaStrToAnsi.MSVBVM60(?,SINGFEST,00267EEC), ref: 0041307D
__vbaSetSystemError.MSVBVM60(000C5DB5,00000000), ref: 00413094
__vbaFreeStr.MSVBVM60 ref: 004130B3
__vbaNew2.MSVBVM60(00410A54,004145C0), ref: 004130CC
__vbaLateMemCallLd.MSVBVM60(00000002,?,WkKauIFp5j1bv26pBJsl8jmR69NV785,00000000), ref: 004130E8
__vbaObjVar.MSVBVM60(00000000), ref: 004130F2
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 004130FD
__vbaHresultCheckObj.MSVBVM60(00000000,02A2004C,00410A44,0000000C), ref: 00413117
__vbaFreeObj.MSVBVM60 ref: 00413120
__vbaFreeVar.MSVBVM60 ref: 00413129
__vbaFreeObj.MSVBVM60(0041318A), ref: 00413174
__vbaFreeStr.MSVBVM60 ref: 00413179
__vbaFreeObj.MSVBVM60 ref: 00413182
__vbaFreeObj.MSVBVM60 ref: 00413187

Strings

Palmira, xrefs: 00412FF2
snappishly, xrefs: 00412E76
SINGFEST, xrefs: 00413077
WkKauIFp5j1bv26pBJsl8jmR69NV785, xrefs: 004130DC

Memory Dump Source

Source File: 00000001.00000002.872684077.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.872673654.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.872708843.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.872716225.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$ErrorNew2System$AnsiMove$#575#612AddrefCallCopyLateList
String ID: Palmira$SINGFEST$WkKauIFp5j1bv26pBJsl8jmR69NV785$snappishly
API String ID: 1255662601-1278630523
Opcode ID: 1cb76fd9674f41232b70776b282646ea54e9de5dfc9ffc596189a1b9d1892b09
Instruction ID: 141689f73db93d1858904da353f17bc2f4b8eee6bcb4d8b2d0e9e1c89a23f6e6
Opcode Fuzzy Hash: 1cb76fd9674f41232b70776b282646ea54e9de5dfc9ffc596189a1b9d1892b09
Instruction Fuzzy Hash: 18D17AB0900209EFDB10DFA0DE89ADEBBB9FF48704F10812AF545A72A1DB745985CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004012C8, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 73%

			_entry_() {
				signed char _t35;
				signed int _t36;
				signed char _t37;
				signed char _t38;
				signed char _t60;
				void* _t61;
				intOrPtr* _t62;
				intOrPtr* _t63;
				signed char _t64;
				void* _t74;
				void* _t75;
				signed int _t76;
				signed int _t77;
				void* _t82;
				void* _t85;
				void* _t86;
				void* _t90;

				_push("VB5!6!*"); // executed
				L004012C0(); // executed
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 + _t35;
				 *_t35 =  *_t35 ^ _t35;
				 *_t35 =  *_t35 + _t35;
				_t36 = _t35 + 1;
				 *_t36 =  *_t36 + _t36;
				 *_t36 =  *_t36 + _t36;
				 *_t36 =  *_t36 + _t36;
				 *((intOrPtr*)(_t74 + 1)) =  *((intOrPtr*)(_t74 + 1)) + _t36;
				_t75 = _t74 + 1;
				_t37 = _t36 | 0x71097b6d;
				asm("clc");
				 *_t37 =  *_t37 + _t37;
				 *_t37 =  *_t37 + _t37;
				 *_t37 =  *_t37 + _t37;
				 *_t37 =  *_t37 + _t37;
				 *_t37 =  *_t37 + _t37;
				_t85 = _t37 - 0x6c614620;
				if(_t85 >= 0) {
					L7:
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					 *_t37 =  *_t37 + _t37;
					L8:
					 *_t37 =  *_t37 + _t37;
					 *((intOrPtr*)(_t62 + _t77 * 8)) =  *((intOrPtr*)(_t62 + _t77 * 8)) + _t37;
					 *_t37 =  *_t37 + _t37;
					_t38 = _t64;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 | _t38;
					_t90 =  *_t38;
					asm("arpl [eax+0x65], bp");
					asm("insb");
					if(_t90 >= 0) {
						L11:
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						L12:
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38;
						 *_t38 =  *_t38;
						 *((intOrPtr*)(_t38 + 0x800080)) =  *((intOrPtr*)(_t38 + 0x800080)) + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + 0x80;
						 *((intOrPtr*)(_t38 - 0x3fffff80)) =  *((intOrPtr*)(_t38 - 0x3fffff80)) + _t38;
						asm("rol al, 0x0");
						 *((char*)(_t38 + 0x80)) =  *((char*)(_t38 + 0x80)) + 0xff;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + 1;
						 *_t38 =  *_t38 + _t38;
						asm("invalid");
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + 1;
						asm("invalid");
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						asm("sti");
						asm("sti");
						asm("sti");
						asm("sti");
						asm("sti");
						asm("sti");
						asm("lock add [edi-0x40b04041], bh");
						asm("sti");
						asm("lock add [edi-0x40bb4b41], bh");
						asm("hlt");
						asm("sti");
						asm("lock add [edi-0x40bb4b41], bh");
						asm("sti");
						asm("lock add [edi-0x40b04041], bh");
						asm("sti");
						asm("sti");
						asm("sti");
						asm("sti");
						asm("lock add [eax], al");
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *0x0000017A =  *((intOrPtr*)(0x17a)) + _t60;
						asm("sti");
						asm("sti");
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						 *_t38 =  *_t38 + _t38;
						asm("invalid");
						asm("invalid");
						 *_t38 =  *_t38 + 0xff;
						 *((intOrPtr*)(_t38 - 0x7f000100)) =  *((intOrPtr*)(_t38 - 0x7f000100)) + 1;
						 *((intOrPtr*)(_t38 - 0x7f000100)) =  *((intOrPtr*)(_t38 - 0x7f000100)) + 1;
						 *((intOrPtr*)(_t38 - 0x7f000100)) =  *((intOrPtr*)(_t38 - 0x7f000100)) + 1;
						 *((intOrPtr*)(_t38 - 0x7f000100)) =  *((intOrPtr*)(_t38 - 0x7f000100)) + 1;
						 *((intOrPtr*)(_t38 - 0x7f000100)) =  *((intOrPtr*)(_t38 - 0x7f000100)) + 1;
						if (_t38 + 1 > 0) goto L13;
						goto L13;
						goto __eax;
						L13:
						asm("invalid");
					}
					if(_t90 < 0) {
						goto L12;
					}
					 *0x55000b01 =  *0x55000b01 + _t60;
					_t82 = _t79 + 1;
					_pop(_t61);
					_push(_t82);
					_t60 = _t61 - 1;
					_t38 = _t38 - 1;
					_push(0xc);
					 *_t60 =  *_t60 + 0xc;
					 *_t38 =  *_t38 + _t38;
					_t63 = _t62 + 1;
					 *_t63 =  *_t63 + _t38;
					_t79 = _t82 + 1 +  *0xc;
					_t76 = _t75 + 1;
					 *_t38 =  *_t38 + _t38;
					 *((intOrPtr*)(_t82 + 1 +  *0xc + _t76 * 2)) =  *((intOrPtr*)(_t82 + 1 +  *0xc + _t76 * 2)) + _t60;
					 *_t76 =  *_t76 + 0xc;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t38;
					 *_t60 =  *_t60 + _t38;
					 *_t60 =  *_t60 + _t38;
					 *_t38 =  *_t38 + _t63;
					asm("adc [eax], dl");
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t60;
					 *_t38 =  *_t38 + _t38;
					 *_t76 =  *_t76 + _t63;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t60;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t63;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t38;
					 *_t60 =  *_t60 + _t38;
					 *((intOrPtr*)(_t38 + _t38)) =  *((intOrPtr*)(_t38 + _t38)) + _t38;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t63;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t38;
					 *_t38 =  *_t38 + _t38;
					goto L11;
				}
				_push(0x65646e75);
				if(_t85 < 0) {
					goto L8;
				}
				asm("outsd");
				if(_t85 >= 0) {
					 *_t62 =  *_t62 + _t60;
					 *0xa =  *0xa & _t60;
					asm("int3");
					 *_t37 =  *_t37 ^ _t37;
					_t86 = _t60 - _t62;
					if(_t86 >= 0) {
						_t37 = (_t37 | 0x000000d2) ^ 0x000000e2;
						_t60 = _t60 + 1;
						_t77 = _t60 + 0x4aea7e0c;
						 *_t37 = _t86 >= 0;
						asm("adc al, 0xc4");
						asm("scasd");
						asm("sbb eax, 0x8f43ff8c");
					}
					asm("invalid");
					asm("invalid");
					 *0x752cbdb8 = _t37;
					_t64 = _t64 -  *_t62 - 1;
					asm("lodsd");
				}
				 *((intOrPtr*)(_t62 - 0x6c2ca000)) =  *((intOrPtr*)(_t62 - 0x6c2ca000)) + _t60;
				 *_t37 =  *_t37 + _t37;
				 *_t37 =  *_t37 + _t37;
				 *_t37 =  *_t37 + _t37;
				 *_t37 =  *_t37 + _t37;
				 *_t37 =  *_t37 + _t37;
				 *_t37 =  *_t37 + _t37;
				goto L7;
			}

0x004012c8
0x004012cd
0x004012d2
0x004012d4
0x004012d6
0x004012d8
0x004012da
0x004012dc
0x004012dd
0x004012df
0x004012e1
0x004012e3
0x004012e6
0x004012ee
0x004012f3
0x004012f4
0x004012f6
0x004012f8
0x004012fa
0x004012fc
0x004012fe
0x00401303
0x00401359
0x00401359
0x0040135b
0x0040135d
0x0040135f
0x00401361
0x00401363
0x00401365
0x00401367
0x00401369
0x0040136b
0x0040136d
0x0040136e
0x0040136e
0x00401370
0x00401373
0x00401375
0x00401376
0x00401378
0x0040137a
0x0040137a
0x0040137c
0x0040137f
0x00401380
0x004013e6
0x004013e6
0x004013e8
0x004013e9
0x004013e9
0x004013eb
0x004013ed
0x004013f0
0x004013f3
0x004013f9
0x004013fb
0x004013fe
0x00401404
0x00401407
0x0040140e
0x00401410
0x00401412
0x00401414
0x00401418
0x00401420
0x00401424
0x00401426
0x00401428
0x0040142a
0x0040142c
0x0040142e
0x00401430
0x00401432
0x00401434
0x00401436
0x00401438
0x00401439
0x0040143a
0x0040143b
0x0040143c
0x0040143d
0x0040143e
0x0040144d
0x0040144e
0x0040145b
0x0040145d
0x0040145e
0x0040146d
0x0040146e
0x0040147a
0x0040147b
0x0040147c
0x0040147d
0x0040147e
0x00401481
0x00401483
0x00401485
0x00401487
0x00401489
0x0040148a
0x0040148b
0x0040148d
0x0040148f
0x00401491
0x00401493
0x00401495
0x00401497
0x00401499
0x0040149b
0x0040149d
0x0040149f
0x004014a1
0x004014a3
0x004014a5
0x004014a7
0x004014a9
0x004014ab
0x004014ae
0x004014b6
0x004014be
0x004014c6
0x004014ce
0x004014d8
0x004014d8
0x004014da
0x004014d9
0x004014d9
0x004014d9
0x00401382
0x00000000
0x00000000
0x00401384
0x0040138a
0x0040138b
0x0040138d
0x0040138e
0x00401390
0x00401393
0x00401394
0x00401396
0x00401398
0x00401399
0x0040139b
0x0040139d
0x0040139e
0x004013a0
0x004013a4
0x004013a6
0x004013a8
0x004013aa
0x004013ac
0x004013ae
0x004013b0
0x004013b2
0x004013b4
0x004013b6
0x004013b8
0x004013ba
0x004013bc
0x004013be
0x004013c0
0x004013c2
0x004013c4
0x004013c6
0x004013c8
0x004013ca
0x004013cc
0x004013cf
0x004013d1
0x004013d3
0x004013d6
0x004013d8
0x004013da
0x004013dc
0x004013de
0x004013e0
0x004013e2
0x004013e4
0x00000000
0x004013e4
0x00401305
0x0040130a
0x00000000
0x00000000
0x0040130c
0x0040130d
0x0040130f
0x00401311
0x00401319
0x0040131a
0x0040131c
0x0040131e
0x00401322
0x00401324
0x00401325
0x0040132b
0x0040132e
0x00401330
0x00401331
0x00401331
0x00401332
0x00401335
0x00401337
0x0040133e
0x0040133f
0x00401340
0x00401347
0x0040134d
0x0040134f
0x00401351
0x00401353
0x00401355
0x00401357
0x00000000

APIs

#100.MSVBVM60(VB5!6!*), ref: 004012CD

Strings

VB5!6!*, xrefs: 004012C8
Fal, xrefs: 004012FE

Memory Dump Source

Source File: 00000001.00000002.872684077.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.872673654.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.872708843.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.872716225.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: Fal$VB5!6!*
API String ID: 1341478452-2689561145
Opcode ID: 8d5fb7a0cd3a7b45159063b6536ae68279ad42776f1780a76d5e7850115211ca
Instruction ID: f6fe9e80f229126028a259fb7761a8f9a366ffeeb1079162d978ce714c2c7c12
Opcode Fuzzy Hash: 8d5fb7a0cd3a7b45159063b6536ae68279ad42776f1780a76d5e7850115211ca
Instruction Fuzzy Hash: 1D5177A694E7C14FD303977448692917FB0AE13229B1E46EBC4D2CF4F3E26C184AD766

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 021F54D0, Relevance: 5.7, Strings: 4, Instructions: 729COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E
T-0W, xrefs: 021F56E0

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$T-0W$X_5I
API String ID: 0-2349167386
Opcode ID: 910442d798f91cae964b8a0cfbd89ddd7749c5328f2ce9e9d8bd2ebf8edfe303
Instruction ID: 9e8a10565da4781bf991117879e4865f17d5a81a55b5a88286a5cd5d78d8bf7b
Opcode Fuzzy Hash: 910442d798f91cae964b8a0cfbd89ddd7749c5328f2ce9e9d8bd2ebf8edfe303
Instruction Fuzzy Hash: BA62ECB2644389DFDBB48F28CD847DABBB2FF59300F458129DD999B224D7309A85CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F552A, Relevance: 5.7, Strings: 4, Instructions: 651COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E
T-0W, xrefs: 021F56E0

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$T-0W$X_5I
API String ID: 0-2349167386
Opcode ID: b6cc828378693906a2e1dd2f9fd2f379b814a4ad8fce44ce283e7b38052e996a
Instruction ID: 80c98eaa4eb0690dbf5fc2c67b394ecdbf2f55887a751f7e7b1125a4c63a6fdf
Opcode Fuzzy Hash: b6cc828378693906a2e1dd2f9fd2f379b814a4ad8fce44ce283e7b38052e996a
Instruction Fuzzy Hash: 1352DCB2644389DFDBB48F29CD847DA7BB6FF99300F458129DD999B224D3309A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5536, Relevance: 5.6, Strings: 4, Instructions: 648COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E
T-0W, xrefs: 021F56E0

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$T-0W$X_5I
API String ID: 0-2349167386
Opcode ID: 62cc170fd6a89530e7f9f1c8fdfb30f833798c06847ac7400fd906a451b5f299
Instruction ID: f8ae2991bdc760bd3c477316cda954e13dde69c82e270fc954db2b6c74c1bdbe
Opcode Fuzzy Hash: 62cc170fd6a89530e7f9f1c8fdfb30f833798c06847ac7400fd906a451b5f299
Instruction Fuzzy Hash: A352DDB2644389DFDBB48F29CD847DA7BB6FF99300F458129DD999B224D3309A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5542, Relevance: 5.6, Strings: 4, Instructions: 645COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E
T-0W, xrefs: 021F56E0

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$T-0W$X_5I
API String ID: 0-2349167386
Opcode ID: 86d8c3a5e48ea6b14770c1f1a1192a3e84cb90be475a770e29896c8f7a3e7888
Instruction ID: 84743f14ef69bf7766755ddc68f884f3765d68ae5fd926cfdedf23aab3dea824
Opcode Fuzzy Hash: 86d8c3a5e48ea6b14770c1f1a1192a3e84cb90be475a770e29896c8f7a3e7888
Instruction Fuzzy Hash: 2852DDB2644389DFDBB48F29CD847DA7BB6FF99300F458129DD999B224D3309A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F554E, Relevance: 5.6, Strings: 4, Instructions: 643COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E
T-0W, xrefs: 021F56E0

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$T-0W$X_5I
API String ID: 0-2349167386
Opcode ID: b85b18c6926b19ebe79a863a7bc44da79cd95b31eb6b207fe31a1a37c469ff75
Instruction ID: 93a45607b21ed118d4050d24fe0f042519b93588bf736a207ebd19438798c3b9
Opcode Fuzzy Hash: b85b18c6926b19ebe79a863a7bc44da79cd95b31eb6b207fe31a1a37c469ff75
Instruction Fuzzy Hash: 5752DDB2644389DFDBB48F29CD847DA7BB6FF59300F458129DD999B224D3309A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5646, Relevance: 5.6, Strings: 4, Instructions: 608COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E
T-0W, xrefs: 021F56E0

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$T-0W$X_5I
API String ID: 0-2349167386
Opcode ID: 0f3e8f14f3fb37a9fc726824addcceef48585aeff0cd67509006fbf1cc104b20
Instruction ID: bde13d148ca66ccf0c8830aeff61882adb38de3dd1a653d693e53a8c5f75dd51
Opcode Fuzzy Hash: 0f3e8f14f3fb37a9fc726824addcceef48585aeff0cd67509006fbf1cc104b20
Instruction Fuzzy Hash: 8142DEB2644389DFDBB48F29CD847DABBB2FF59300F458129DD999B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5652, Relevance: 5.6, Strings: 4, Instructions: 606COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E
T-0W, xrefs: 021F56E0

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$T-0W$X_5I
API String ID: 0-2349167386
Opcode ID: 156946e30a489090611d495f0c94152aa1db7aa29126969a9deabb5872b2f7d8
Instruction ID: aa0ba86bc3390d3e2dab2491cce38da0cde6873024b7f4d6af7120cbb951b7ee
Opcode Fuzzy Hash: 156946e30a489090611d495f0c94152aa1db7aa29126969a9deabb5872b2f7d8
Instruction Fuzzy Hash: A342EEB2644389DFDBB48F29CD847DABBB2FF59300F458129DD999B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5676, Relevance: 5.6, Strings: 4, Instructions: 599COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E
T-0W, xrefs: 021F56E0

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$T-0W$X_5I
API String ID: 0-2349167386
Opcode ID: 8ea2493eb89468bc1cf372da063af9a15c08ac2793af5bd12735f6ef139afa18
Instruction ID: 4066a39057568c3fefc026c5b6ec72ad337c55ef1e8c9c69c6bff21f7d2f5da7
Opcode Fuzzy Hash: 8ea2493eb89468bc1cf372da063af9a15c08ac2793af5bd12735f6ef139afa18
Instruction Fuzzy Hash: B942DDB2644389DFDBB48F29CD847DABBB2FF59300F458129DD999B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5682, Relevance: 5.6, Strings: 4, Instructions: 598COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E
T-0W, xrefs: 021F56E0

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$T-0W$X_5I
API String ID: 0-2349167386
Opcode ID: bdaac1bb82faae321e2e39499fb407927feb30e1d07978f1390ce07972f94a30
Instruction ID: e1f091e9ae5777100299272b52acc38795083098cc6c4fc47c6077a07f4ca61f
Opcode Fuzzy Hash: bdaac1bb82faae321e2e39499fb407927feb30e1d07978f1390ce07972f94a30
Instruction Fuzzy Hash: 1442DDB2644389DFDBB48F29CD847DABBB2FF59300F458129DD999B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F59C6, Relevance: 5.5, Strings: 4, Instructions: 468COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7, xrefs: 021F5A05
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7$7LB$<aAl$X_5I
API String ID: 0-645492733
Opcode ID: 6d83d0fd7b1f1ba5ec22a6113f8ca5f8801f3573297e1e2e63e4fbfc83c42cab
Instruction ID: 2761ac2050d10728f258fbe7abd0d35ecf3aa7a1be07e4c6c989e4512a94b7ed
Opcode Fuzzy Hash: 6d83d0fd7b1f1ba5ec22a6113f8ca5f8801f3573297e1e2e63e4fbfc83c42cab
Instruction Fuzzy Hash: EE12EFB2644389DFDBB48F28CD857DA7BB6FF59300F458129DD989B224D3309A94CB81

Uniqueness

Uniqueness Score: -1.00%

Function 021F5752, Relevance: 4.3, Strings: 3, Instructions: 579COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: c86b870811b414139099a8067ae922262f37a845e8ce2b995db8a6f9d4b64ee0
Instruction ID: 72313c7510a6bcc475f24033a535ed388c756af019e08d5dafd43ad81c4fc62d
Opcode Fuzzy Hash: c86b870811b414139099a8067ae922262f37a845e8ce2b995db8a6f9d4b64ee0
Instruction Fuzzy Hash: 7E32EFB2644388DFDBB48F29CD847DA7BB6FF59300F458129DD999B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F575E, Relevance: 4.3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: dc5b078f7f81d8f79a7f3ff4afce049867d5fd034877c3d20f6ce92133e9eb11
Instruction ID: 0d1bca48243529f3d6735589b30555224f4d3a4afa8cced63700a63b8d0c7189
Opcode Fuzzy Hash: dc5b078f7f81d8f79a7f3ff4afce049867d5fd034877c3d20f6ce92133e9eb11
Instruction Fuzzy Hash: C432DEB2644388DFDBB48F29CD847DA7BB6FF59300F458129DD999B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F576A, Relevance: 4.3, Strings: 3, Instructions: 561COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: 2e6623b79ff0c2b257ecec01b7ff665d558fce5b1281969b65c101481d750910
Instruction ID: bfa544c43d46624963bf0b18edc573d22a79c358004abc918f3bb4082973a3e7
Opcode Fuzzy Hash: 2e6623b79ff0c2b257ecec01b7ff665d558fce5b1281969b65c101481d750910
Instruction Fuzzy Hash: 9B32DEB2644388DFDBB48F29CD847DABBB6FF59300F458129DD999B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F57A6, Relevance: 4.3, Strings: 3, Instructions: 551COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: 3ab9329044c5418bc8708189b95cbc307e5b3c5139813896db34496ec689e460
Instruction ID: 5dff4cca1989facf9ecabbb4623965af0b80261f513459a29e94e2f6008f6754
Opcode Fuzzy Hash: 3ab9329044c5418bc8708189b95cbc307e5b3c5139813896db34496ec689e460
Instruction Fuzzy Hash: 9732DEB2644389DFCBB48F28CD847DA7BB6FF59300F458129DD999B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F58A6, Relevance: 4.3, Strings: 3, Instructions: 529COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: bf9e23b64c958e7ccbf1ef5601d2db7a25a544dd22cf74234c30e79c26156133
Instruction ID: b03f26f0f35ea2996924b67929d06e799fa24d854d0c472751b489f9ba85bda8
Opcode Fuzzy Hash: bf9e23b64c958e7ccbf1ef5601d2db7a25a544dd22cf74234c30e79c26156133
Instruction Fuzzy Hash: A432D0B2644389DFCBB48F29CD857DA7BB6FF59300F458129DDA89B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5876, Relevance: 4.3, Strings: 3, Instructions: 522COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: 41bb99d2f1574e379e06a65728eee7e584ab6420cb05d5a626658fe858d6a62d
Instruction ID: 1972d04b2782a51f45d219a6ca27995a6d3546fe00250de3bc402d72f15a705a
Opcode Fuzzy Hash: 41bb99d2f1574e379e06a65728eee7e584ab6420cb05d5a626658fe858d6a62d
Instruction Fuzzy Hash: BF32DFB2644389DFCBB48F29CD847DA7BB2FF59300F458129DDA89B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5882, Relevance: 4.3, Strings: 3, Instructions: 515COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: 705956dfcda9bbf3c57b54d8ac085ffb41464c54058c5b26a230e55a7df571fd
Instruction ID: 77589df0fef420a8ebd8e2744a2b4cd1c674de47206fda760909f69d5baa0199
Opcode Fuzzy Hash: 705956dfcda9bbf3c57b54d8ac085ffb41464c54058c5b26a230e55a7df571fd
Instruction Fuzzy Hash: 9422E0B2644389DFCBB48F29CD847DABBB6FF59300F458129DD989B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F589A, Relevance: 4.3, Strings: 3, Instructions: 511COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: ac0491129eb1af1ca17129f99e517e30cc9a99fd2e047d526ed62872b159455d
Instruction ID: bf344aa533c3c1b6bae4d6b1bc069977f59a4648da5792eaf93fd6d8404e62ee
Opcode Fuzzy Hash: ac0491129eb1af1ca17129f99e517e30cc9a99fd2e047d526ed62872b159455d
Instruction Fuzzy Hash: D622D0B2644389DFCBB48F28CD857DA7BB6FF59300F458129DDA99B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F588E, Relevance: 4.3, Strings: 3, Instructions: 511COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: 6e77ee805aafe167da2cf631e12892e79b49d2ed9fef14647ecbf89a23d0783e
Instruction ID: a8c1747c9c93c8310ff3cace7c3ec345fc12da61d245bc1d22c27e5e6658639c
Opcode Fuzzy Hash: 6e77ee805aafe167da2cf631e12892e79b49d2ed9fef14647ecbf89a23d0783e
Instruction Fuzzy Hash: 5C22E0B2644389DFDBB48F29CD847DA7BB6FF59300F458129DDA89B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F58CA, Relevance: 4.3, Strings: 3, Instructions: 508COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: b1c7f9dd18967469ad98013dff116be6d9220b79f872034e81c6bdf2498d5dec
Instruction ID: 92ad34bc57d6a274a93acf14164976e577f0140b734dc00a029598ba35e2e4d9
Opcode Fuzzy Hash: b1c7f9dd18967469ad98013dff116be6d9220b79f872034e81c6bdf2498d5dec
Instruction Fuzzy Hash: 8922E0B2644389DFCBB48F28CD847DABBB6FF59300F458129DD999B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F598A, Relevance: 4.2, Strings: 3, Instructions: 478COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: f11ac2f4bac89cc834acd4f143003502f48610ec102034a57ffc41a38e228120
Instruction ID: 236a3bd6c7b97712860b726b7e9a5fbd7e96d1a6bdb7c7ba060afc31355fcf67
Opcode Fuzzy Hash: f11ac2f4bac89cc834acd4f143003502f48610ec102034a57ffc41a38e228120
Instruction Fuzzy Hash: 7E22E0B2644349DFCBB48F28CD857DABBB6FF59300F458129DDA99B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5996, Relevance: 4.2, Strings: 3, Instructions: 471COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: 1c350d9c92f1d7b35451ebf10e7492004112dd112dcd1773e06628c75093a440
Instruction ID: 053f5e75cec857add7e5dcff3cd912cf5b56f1f7f9136ea41e8931cdcc89f907
Opcode Fuzzy Hash: 1c350d9c92f1d7b35451ebf10e7492004112dd112dcd1773e06628c75093a440
Instruction Fuzzy Hash: 5622EFB2644389DFCBB48F28CD857DA7BB6FF59300F458129DDA99B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F59A2, Relevance: 4.2, Strings: 3, Instructions: 471COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: e20cb3c16a65ab06ae8d0cfdb465e11e90fd1b6709cdaa25b783dd99582770f7
Instruction ID: e026eab5072c9975175f6c09b17fcef28e06d13bce1681481d3c356520ac0bc8
Opcode Fuzzy Hash: e20cb3c16a65ab06ae8d0cfdb465e11e90fd1b6709cdaa25b783dd99582770f7
Instruction Fuzzy Hash: 9512DFB2644389DFDBB48F28CD847DA7BB6FF59300F458129DDA89B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F59BA, Relevance: 4.2, Strings: 3, Instructions: 465COMMON

Download Yara Rule

Strings

X_5I, xrefs: 021F5A1D
7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl$X_5I
API String ID: 0-1656295580
Opcode ID: b1e73772ebadd984db6d0076c3081dc8fb1e34904e89ddb5e89856eb2b53feaa
Instruction ID: 28e426bd7bca5701632b8ee95b8adef091b459ca0244eb794f72dfc2743be30c
Opcode Fuzzy Hash: b1e73772ebadd984db6d0076c3081dc8fb1e34904e89ddb5e89856eb2b53feaa
Instruction Fuzzy Hash: A812EFB2644389DFCBB48F28CD847DA7BB6FF59300F458129DDA89B224D3309A94CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5A8A, Relevance: 2.9, Strings: 2, Instructions: 435COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: 229f26d4c004539597e2911a85569bf8e9bc4ed497f1c3a6f70fc61911d5008f
Instruction ID: ba3f5eef37a4f97b7e490ec0386fa1f4a61c944ac13ad3e1fdb67112c83417f8
Opcode Fuzzy Hash: 229f26d4c004539597e2911a85569bf8e9bc4ed497f1c3a6f70fc61911d5008f
Instruction Fuzzy Hash: 5C12CE72644388DFDBB48F28CD84BDA7BB6FF59300F454129DDA99B224D7709A84CB42

Uniqueness

Uniqueness Score: -1.00%

Function 021F5AA2, Relevance: 2.9, Strings: 2, Instructions: 435COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: 2572558ba29ce0d50b12d10ebedf6ae07010ad04aa0a9959219748cc68ebdf52
Instruction ID: 786c9c98670c859565a5cd48eb569323bcb0161a8d73c111a354bb3a9b7382e1
Opcode Fuzzy Hash: 2572558ba29ce0d50b12d10ebedf6ae07010ad04aa0a9959219748cc68ebdf52
Instruction Fuzzy Hash: 7402CF72684388DFDBB48F28CD857DA7BB6FF59300F45412ADD989B224D7309A84CB42

Uniqueness

Uniqueness Score: -1.00%

Function 021F5A96, Relevance: 2.9, Strings: 2, Instructions: 432COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: af689ba7d499ee851f07fbc4fbe1d751cb02b462b8c1f2877ae20da991509732
Instruction ID: 73bfeb425af8894b5c799fd780adb2b0f033c617c36f1320e251c08d960493ed
Opcode Fuzzy Hash: af689ba7d499ee851f07fbc4fbe1d751cb02b462b8c1f2877ae20da991509732
Instruction Fuzzy Hash: 5312CF72684388DFDBB48F28CD84BDA7BB6FF59300F454129DDA99B224D7709A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5AAE, Relevance: 2.9, Strings: 2, Instructions: 428COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: 83766fb966cf03452f09e7d1507e8ad1b8a3e9018c2d8b8eb77b6590f71d7748
Instruction ID: ba97b512a81d88ec4ce9e15b7176c9e13122fbc28b73fb8893e5fcb6e6cb260e
Opcode Fuzzy Hash: 83766fb966cf03452f09e7d1507e8ad1b8a3e9018c2d8b8eb77b6590f71d7748
Instruction Fuzzy Hash: CF02D072684388DFDBB48F28CD847DA7BB6FF59300F45412ADD999B224D7709A84CB42

Uniqueness

Uniqueness Score: -1.00%

Function 021F5AEA, Relevance: 2.9, Strings: 2, Instructions: 423COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: 773e3017ee626805ef4b92a2ca6f8511e9eff7ebba878fdf1507b8d041f973ea
Instruction ID: 8af93dc8d0d384cbacbe5e0439fc36de80c12f5e3495e53f82e149746313b983
Opcode Fuzzy Hash: 773e3017ee626805ef4b92a2ca6f8511e9eff7ebba878fdf1507b8d041f973ea
Instruction Fuzzy Hash: 1502CF72684388DFDBB48F28CD85BDA7BB6FF59300F45412ADD999B224D7309A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5B78, Relevance: 2.9, Strings: 2, Instructions: 405COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: b12aecd556f8ea2ec430add519d36b8d99e100d1691bd8fcdf43ffa60a244fac
Instruction ID: 3c4a2d1577818684721bb4ae8352efcf0eeebf8ebb41f2c64fead627979538ef
Opcode Fuzzy Hash: b12aecd556f8ea2ec430add519d36b8d99e100d1691bd8fcdf43ffa60a244fac
Instruction Fuzzy Hash: 3F02EE726843889FDBB58F38CD84BDA7BB6FF19340F55412ADD989B224D7309A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5C32, Relevance: 2.9, Strings: 2, Instructions: 385COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: 2a4f5c83fd63e3d2b039731f673a96fbeb3a6302ed2ae4350d92988d79f93481
Instruction ID: 52c1cde1291668bf91cece500485389c63931ac3d08addbc8a8f5c3e19cd6329
Opcode Fuzzy Hash: 2a4f5c83fd63e3d2b039731f673a96fbeb3a6302ed2ae4350d92988d79f93481
Instruction Fuzzy Hash: 9CF1DE726843889FDBB58F28CD847DA7BB6FF59340F45412ADE989B224D7309A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5C3E, Relevance: 2.9, Strings: 2, Instructions: 377COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: 5950af72ff3b8358fa52b4f628c9c55b05df842c6529bd8594da8d46b0659e43
Instruction ID: 7f042f20a46f40604f18096097d860115816fa1f4ca4cb26e73ad68f161b0766
Opcode Fuzzy Hash: 5950af72ff3b8358fa52b4f628c9c55b05df842c6529bd8594da8d46b0659e43
Instruction Fuzzy Hash: 7DF1DF726843889FDBB58F28CD84BDA7BB6FF19340F454129DE989B224D3309A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5C4A, Relevance: 2.9, Strings: 2, Instructions: 374COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: 5b8f43ef0b0e2a836ca377bb0c628079efdc8fde2ac4f41f79063a60030abb7e
Instruction ID: 600eb89ac864cad244278f95a08db260a6dc22d5376c697565d9641b7d8afe42
Opcode Fuzzy Hash: 5b8f43ef0b0e2a836ca377bb0c628079efdc8fde2ac4f41f79063a60030abb7e
Instruction Fuzzy Hash: 51F1C072684388DFDBB58F28CD84BDA77B6FF19340F45412ADE989B224D7319A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5C56, Relevance: 2.9, Strings: 2, Instructions: 373COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: 718ea9d8bedd667aaabe58873fbd6abf6002cfd52d7b633f1b16de3fc78ba4cb
Instruction ID: 738f7ed2f2c13feca4ddce59c440ae6bbf9d448b3e121ec6f7bccd8d3fbbad31
Opcode Fuzzy Hash: 718ea9d8bedd667aaabe58873fbd6abf6002cfd52d7b633f1b16de3fc78ba4cb
Instruction Fuzzy Hash: C7F1CF72684388DFDBB58F28CD847DA7BB6FF19340F454129DE989B224D7319A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5C6E, Relevance: 2.9, Strings: 2, Instructions: 371COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: bf216aa526eabd18349a23f99de56678b7fdfe1f6dc028f02aab7558fafedba4
Instruction ID: ad727533b2e73c4b2a0b89d5d885643a51abec5e3c7562ab2edb48705b3db845
Opcode Fuzzy Hash: bf216aa526eabd18349a23f99de56678b7fdfe1f6dc028f02aab7558fafedba4
Instruction Fuzzy Hash: 84F1CF72684388DFDBB58F28CD84BDA7BB6FF19340F454129DE989B224D7309A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5C62, Relevance: 2.9, Strings: 2, Instructions: 371COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: 43c8c495ad7f1eda2e58f12b071d209ecde61ab434b4993bdba1f1fdeb530efe
Instruction ID: 81ebd7ec2e9252ffbf9cab8eaef2a0c6ee20b86645befafd2202a8a56dfa63fe
Opcode Fuzzy Hash: 43c8c495ad7f1eda2e58f12b071d209ecde61ab434b4993bdba1f1fdeb530efe
Instruction Fuzzy Hash: B1F1D072684388DFDBB58F28CD84BDA7BB6FF19340F454129DE989B224D7319A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5D32, Relevance: 2.8, Strings: 2, Instructions: 347COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: bfe87a64e73ab054d5c9944e95e31628241da06967c4dd279a9afb88560f1768
Instruction ID: 418b43bc7204e5d7e65a0b0ef6377bce7294526aaf363c3349d63b195eedc7d5
Opcode Fuzzy Hash: bfe87a64e73ab054d5c9944e95e31628241da06967c4dd279a9afb88560f1768
Instruction Fuzzy Hash: 38E1E0B26843889FDFB58F68CD847DA37B6FF59300F45412ADE589B224D7319A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5D56, Relevance: 2.8, Strings: 2, Instructions: 347COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: 64bc35e9fd182e4950839da2c79dceada65507d526480220e771287188036d31
Instruction ID: b505266d2f41a6ac94acb27f76a4df44042ab6b1ca4e2b3307029b0fd4ef55dc
Opcode Fuzzy Hash: 64bc35e9fd182e4950839da2c79dceada65507d526480220e771287188036d31
Instruction Fuzzy Hash: 26E1DFB26843889FDFB58F68CD847DA3BB6FF59300F45412ADE589B224D7319A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5D26, Relevance: 2.8, Strings: 2, Instructions: 346COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: e67afa9e0a3a9b8bf0c0996e92246abb2b8b90464b13b5ea3c3aea0684326605
Instruction ID: bf6ffaa5e651e91b51acb70d4a6ce9f2210ae11ae465f7981ca3408f41126012
Opcode Fuzzy Hash: e67afa9e0a3a9b8bf0c0996e92246abb2b8b90464b13b5ea3c3aea0684326605
Instruction Fuzzy Hash: 69E1DF726843889FDFB58F68CD84BDA3BB6FF59340F454129DE589B224D7309A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5D3E, Relevance: 2.8, Strings: 2, Instructions: 342COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: d96583e039aa849272f726b2f8a14ce2e2b1e87df209235ee35b895047e59e5b
Instruction ID: 15c5f267ad0cf9bd6dbdeea2ae9b346e18e23e9e3091a7618a4c9733325bd19b
Opcode Fuzzy Hash: d96583e039aa849272f726b2f8a14ce2e2b1e87df209235ee35b895047e59e5b
Instruction Fuzzy Hash: 17E1EFB26843889FDFB58F68CD847DA3BB6FF59300F45412ADE589B224D7319A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5D4A, Relevance: 2.8, Strings: 2, Instructions: 338COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: f34968c7fc4f67458526059e41bde7e06d1abda4aee614b760394a946b512387
Instruction ID: db5e9e8e8250487816261b7e17498d97353a18e75883229b48d2a0f84e4913a8
Opcode Fuzzy Hash: f34968c7fc4f67458526059e41bde7e06d1abda4aee614b760394a946b512387
Instruction Fuzzy Hash: E1E1EEB26843889FDFB58F28CD847DA3BB6FF19300F45412ADE589B224D7309A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5D7A, Relevance: 2.8, Strings: 2, Instructions: 329COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: 901a94d8d89fb95943b5fc8adb34afb36fd054617a4b6194891a9368834396c6
Instruction ID: 8c7f34f4eac350de48db8e6c6bb1a7a78a0ce5d5035a439acf9bee67735168ec
Opcode Fuzzy Hash: 901a94d8d89fb95943b5fc8adb34afb36fd054617a4b6194891a9368834396c6
Instruction Fuzzy Hash: F7E1DEB26843889FDFB58F68CD847DA3BB6FF59300F45412ADE589B224D7309A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5E86, Relevance: 2.8, Strings: 2, Instructions: 295COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: a731abfd0551400b6c15006ccd9c2bdce3a2811235b0a8288b12f7c777841222
Instruction ID: c5d2712b28b2d9876d521c49e82fc2f783032bcbc827f50027cba8ed75c2124c
Opcode Fuzzy Hash: a731abfd0551400b6c15006ccd9c2bdce3a2811235b0a8288b12f7c777841222
Instruction Fuzzy Hash: CDC1EEB26842889FDFB58F68CD84BDA3BB6FF59300F45412ADD5C9B224C7319A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5E9E, Relevance: 2.8, Strings: 2, Instructions: 293COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: f69dc9504ffc9ca5638204ffbf9540f33c2f7c76533798d96c1a26d288b55579
Instruction ID: 9591f68949bd506ce4bbaeec153f87f9dfe477c0a70fdd11956957ff8a853976
Opcode Fuzzy Hash: f69dc9504ffc9ca5638204ffbf9540f33c2f7c76533798d96c1a26d288b55579
Instruction Fuzzy Hash: 22C1DFB26842889FDFB58F68CD84BDA3BB6FF59300F45412ADD5C9B224D7319A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5E92, Relevance: 2.8, Strings: 2, Instructions: 292COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: 69bf4e891cf51c2cd214c2a34c511c0876adef5a2dcec4a4157b4167ad498e8a
Instruction ID: a04bf44315efcbb63892c448afc447b5d92418d697be5eb30d0b3721e1aae9bc
Opcode Fuzzy Hash: 69bf4e891cf51c2cd214c2a34c511c0876adef5a2dcec4a4157b4167ad498e8a
Instruction Fuzzy Hash: B4C1DEB26842889FDFB58F68CD84BDA3BB6FF59300F45412ADD5C9B224D7319A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F5FF6, Relevance: 2.8, Strings: 2, Instructions: 260COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: a10b67fc61a3a22c2a3a6c3914c1f198b81a4469f6ba4ca3dce38660afb2733f
Instruction ID: c4f1477ca19736c1e08af3d4d568cd9031e6baa491c844b4ce49d89df5e85610
Opcode Fuzzy Hash: a10b67fc61a3a22c2a3a6c3914c1f198b81a4469f6ba4ca3dce38660afb2733f
Instruction Fuzzy Hash: 9AB1F0726802889FDFB5CF78CD847DA3BB6BF58300F54412ADE589B224C7319A84CB81

Uniqueness

Uniqueness Score: -1.00%

Function 021F5F92, Relevance: 2.8, Strings: 2, Instructions: 253COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: fa32066be6099b128f382fa29497563a0a405ecae20601f0eb70a30461ba8ffd
Instruction ID: 5818aa5f5693f83be81fee92eb446f3404507ad0e453bb4420d7bd4a5ec5a34a
Opcode Fuzzy Hash: fa32066be6099b128f382fa29497563a0a405ecae20601f0eb70a30461ba8ffd
Instruction Fuzzy Hash: B3B1CF726842889FDFB58F68CD84BDA3BB6FF58300F55412ADE5C9B224D7319A84CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F5FAA, Relevance: 2.8, Strings: 2, Instructions: 253COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: 14170ca1ea2d71c1d25c60d3e31de9c0a5405f59e7c74e1802a06e59c7c8a07c
Instruction ID: 7a128869d0f636fbc4489e98344fff558710437a6449c49573c411f25f8735e3
Opcode Fuzzy Hash: 14170ca1ea2d71c1d25c60d3e31de9c0a5405f59e7c74e1802a06e59c7c8a07c
Instruction Fuzzy Hash: 94A1DDB26802889FDFB58F68CD84BDA37B6BF58310F55412ADE6C9B214D7319A84CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F5F9E, Relevance: 2.8, Strings: 2, Instructions: 250COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: bf82b427babf682b1e50e09591815b4ed54e441c26edae3e1117d6181b2a1958
Instruction ID: c8bd4f66aa6d9d9e94a456b27a6caf21650b17f5e73b9be22e99a876250d9cdf
Opcode Fuzzy Hash: bf82b427babf682b1e50e09591815b4ed54e441c26edae3e1117d6181b2a1958
Instruction Fuzzy Hash: DAB1DF72684288DFDFB58F68CD84BDA77B6BF58300F55412ADE5C9B224C7319A84CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F5FB6, Relevance: 2.7, Strings: 2, Instructions: 246COMMON

Download Yara Rule

Strings

7LB, xrefs: 021F6097
<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 7LB$<aAl
API String ID: 0-3722837282
Opcode ID: cfe03aa7c62221ce77f5e74655a672d53acaadd3462635898976b56d1f6b29c6
Instruction ID: f276696b6a3cb41e07df5fa08abec09589194573a7b0edc1d21eed210c63eaac
Opcode Fuzzy Hash: cfe03aa7c62221ce77f5e74655a672d53acaadd3462635898976b56d1f6b29c6
Instruction Fuzzy Hash: 68A1DFB2680288DFDFB58F68CD84BDA77B6BF58300F55412ADE6C9B214D7319A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F6122, Relevance: 1.5, Strings: 1, Instructions: 205COMMON

Download Yara Rule

Strings

<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <aAl
API String ID: 0-2143971877
Opcode ID: aa4d445aae1ad7cdecc30e06d877e1cd82ef54e6344f1eea5d3b928592632bef
Instruction ID: 441ee914b05f13380db53d06d80c0bf2e0be256ef6c89eba33ad3ae16e1d2194
Opcode Fuzzy Hash: aa4d445aae1ad7cdecc30e06d877e1cd82ef54e6344f1eea5d3b928592632bef
Instruction Fuzzy Hash: 4681CFB26802889FDFB58F68CD84BDA77B6FF58310F44412ADE5C9B224C7319A85CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F60F2, Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <aAl
API String ID: 0-2143971877
Opcode ID: 0fe3e44a09e988d545bd9c11e49f3abff0244ad0a4f63b0cdd2c931e71560753
Instruction ID: 704fb8271c05df60ae42c526828a6e603876893802b01819d1b564941c3ab83c
Opcode Fuzzy Hash: 0fe3e44a09e988d545bd9c11e49f3abff0244ad0a4f63b0cdd2c931e71560753
Instruction Fuzzy Hash: 2691BF716802889FDFB58F68CD84BDA77B6FF58310F54412ADE5C9B214C7719A84CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F60FE, Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <aAl
API String ID: 0-2143971877
Opcode ID: 190fde11c43e1e0652b820a5b510dc5d8fe658968a3117b695107097ea26b410
Instruction ID: 10a0307c1793c78af559e404da6a7790718050b2444f204de9b5fa50d409d717
Opcode Fuzzy Hash: 190fde11c43e1e0652b820a5b510dc5d8fe658968a3117b695107097ea26b410
Instruction Fuzzy Hash: 8E81BF726802889FDFB58F68CD84BDA7BB6FF58310F54412ADE5D9B224C7319A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F610A, Relevance: 1.4, Strings: 1, Instructions: 200COMMON

Download Yara Rule

Strings

<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <aAl
API String ID: 0-2143971877
Opcode ID: da5cfce3eccee9d1ff1fd7bf25f6619a99af2a0ccd89ac8cdcfc11710646201a
Instruction ID: ecc52e9dffad2e6c8b9b4068b5d3cfabd0bc0cbbe58e8be494c23f8b17db2aca
Opcode Fuzzy Hash: da5cfce3eccee9d1ff1fd7bf25f6619a99af2a0ccd89ac8cdcfc11710646201a
Instruction Fuzzy Hash: 7681BDB16802889FDFB5CF68CD84BDA7BB6BF58310F54412ADE5C9B224C7719A84CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F6116, Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <aAl
API String ID: 0-2143971877
Opcode ID: bfff7c93fa98a8e50c7f1668d0fe42d0f7245d6ead75d6b14e66faf85730f213
Instruction ID: ab5be2a4e5db2d1a5aac3801cd741b58de594ea6df09e0bb02a5e2e5f8535168
Opcode Fuzzy Hash: bfff7c93fa98a8e50c7f1668d0fe42d0f7245d6ead75d6b14e66faf85730f213
Instruction Fuzzy Hash: FD81ADB16802889FDFB5CF68CD84BDA7BB6BF58310F54412ADE5C9B224C7719A84CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F6146, Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <aAl
API String ID: 0-2143971877
Opcode ID: eb4fd619c7833a74ac0d13c24aeb7c0e9b8f31fbca3e1971f9a88bf61960a2af
Instruction ID: bac5ce85ac80fa8ebd7a33f06c7224e77148e80e734238171bf878778e3bc8d4
Opcode Fuzzy Hash: eb4fd619c7833a74ac0d13c24aeb7c0e9b8f31fbca3e1971f9a88bf61960a2af
Instruction Fuzzy Hash: 2381ACB16802889FDFB5CF68CD84BDA7BB6BF58310F44412ADE5D9B224C7719A85CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F6236, Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <aAl
API String ID: 0-2143971877
Opcode ID: 5ee1ebd9b96fb190edb683edbfb4006b27d16bbcd120a61e3435782b4b5bc925
Instruction ID: c9f29b9ad89aebe2e00838cafa77742ffaa3e6edac8e058016d5a0edf9341892
Opcode Fuzzy Hash: 5ee1ebd9b96fb190edb683edbfb4006b27d16bbcd120a61e3435782b4b5bc925
Instruction Fuzzy Hash: FF71AC716402889FDFB58F28CD84BDA3BB6FF59310F44812AED5D9B224D7319A84CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F622A, Relevance: 1.4, Strings: 1, Instructions: 171COMMON

Download Yara Rule

Strings

<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <aAl
API String ID: 0-2143971877
Opcode ID: e395124f6a4d5c7f8449709c34e5b599e9a5dbd0faac003381a434573aa52357
Instruction ID: 7d7f04d898c59a5518c0fb625f40a2a447a062d9e3ab6809cb65e910d5cc99f2
Opcode Fuzzy Hash: e395124f6a4d5c7f8449709c34e5b599e9a5dbd0faac003381a434573aa52357
Instruction Fuzzy Hash: 9C717A716402889FDFB58F28CD84BDA3BB6BF58310F44812AED5D9B224D7319A94CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F6242, Relevance: 1.4, Strings: 1, Instructions: 158COMMON

Download Yara Rule

Strings

<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <aAl
API String ID: 0-2143971877
Opcode ID: 8279b06a6ecce6b7d9d317a894a03d6d7b6dea8be781b98cb8d3837e3c522075
Instruction ID: 224a7abe3c8ca0f9d7a01effe19718b8ec3d8e08738d610095e3549ba56c8fbd
Opcode Fuzzy Hash: 8279b06a6ecce6b7d9d317a894a03d6d7b6dea8be781b98cb8d3837e3c522075
Instruction Fuzzy Hash: D9618B716402889FDFB59F28CD84BDA7BB6BF59300F44412AED5D9B224D7319A88CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021F624E, Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <aAl
API String ID: 0-2143971877
Opcode ID: c564da3a239d7b4d31b4ca24733068b62c8c5aeb52cbd9d71ec6bd68e5c4a746
Instruction ID: ed974b7e94d273754712f75c305ba45348b2dbd276de567c1213de3074368719
Opcode Fuzzy Hash: c564da3a239d7b4d31b4ca24733068b62c8c5aeb52cbd9d71ec6bd68e5c4a746
Instruction Fuzzy Hash: C2618C716402889FDFB59F28CD84BDA7BB6BF58310F44412AEE5D9B224DB319A94CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F625A, Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

<aAl, xrefs: 021F628E

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <aAl
API String ID: 0-2143971877
Opcode ID: 463450ea9712490d9abf99a920efecb5abba49144f76e1e9c5210dc142f1b576
Instruction ID: 923b3c19ef108fbf8fc11fc4d8b2b66c91cacdd882a0a2da3f686f74a85d159b
Opcode Fuzzy Hash: 463450ea9712490d9abf99a920efecb5abba49144f76e1e9c5210dc142f1b576
Instruction Fuzzy Hash: 0061AC716402889FDFB59F28CD84BDE7BB2BF58310F44412AEE5D9B224DB319A95CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F5161, Relevance: 1.4, Strings: 1, Instructions: 113COMMON

Download Yara Rule

Strings

-Dz, xrefs: 021F5443

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: -Dz
API String ID: 0-203867881
Opcode ID: 200af518a598a775b31f7502ed280c93ee28a97f19881aad98974e90c9f95bd8
Instruction ID: 23566acd4abae0ca2b4ef934f6493f7670642ed0376e3553f91f6080d793087b
Opcode Fuzzy Hash: 200af518a598a775b31f7502ed280c93ee28a97f19881aad98974e90c9f95bd8
Instruction Fuzzy Hash: C841E072684348EFC7B4CE15D9E53DB77B3AB9C700FA4412ACA5E1B205D3316A80CB55

Uniqueness

Uniqueness Score: -1.00%

Function 021F6FEA, Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

`, xrefs: 021F7109

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: `
API String ID: 0-1850852036
Opcode ID: 5ff772b8807f9dc1df9b83297daf691b9121492a73763d9468927a78c49eb392
Instruction ID: dd781691f8fe3d23e80917d9772f8b0bc911fc3d14a792b8a19e0f2b29b567c2
Opcode Fuzzy Hash: 5ff772b8807f9dc1df9b83297daf691b9121492a73763d9468927a78c49eb392
Instruction Fuzzy Hash: F6310B32549388CBEF789F358D583DEB3A3AF99360F6A421ACD294B694D771414ACE01

Uniqueness

Uniqueness Score: -1.00%

Function 021FABBD, Relevance: .6, Instructions: 622COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56440ce2e965393387894e294a2737178b75809dd3be9020ba7f575c7f9d558e
Instruction ID: 3399faaf3b9501e0c72f159cf77990066ecabce8589a6540e05019aac8a59a04
Opcode Fuzzy Hash: 56440ce2e965393387894e294a2737178b75809dd3be9020ba7f575c7f9d558e
Instruction Fuzzy Hash: EE421C715483C58FCF75DF38C8987DA7BA2AF56320F558299C9AD8F296D3348602C712

Uniqueness

Uniqueness Score: -1.00%

Function 021F636E, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34e35356b088750a9b0aa1666cb4bbc35951a6e7e45adf428b82042c931e74d9
Instruction ID: e77f114da8e1dd319a480bcc18a17622f71597ed4493f4e04724558aa8f3de12
Opcode Fuzzy Hash: 34e35356b088750a9b0aa1666cb4bbc35951a6e7e45adf428b82042c931e74d9
Instruction Fuzzy Hash: DB416B716402889FDFB59F68DD84BDA3BB6BF19300F44412AEE69DA224CB359A54CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F637A, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc4deaa7e731a42fcc9cc0d0ecf15df2fb5ffaadf36ccc1cab73414ee7413dbe
Instruction ID: 9a6cb680c2bd26553447cac95249ce43002b7083b2be9ce288806b4e7a43f4e7
Opcode Fuzzy Hash: fc4deaa7e731a42fcc9cc0d0ecf15df2fb5ffaadf36ccc1cab73414ee7413dbe
Instruction Fuzzy Hash: F5418C716442889FCFB69F68DD84BDA3BB6BF19300F44011AEE69DB225CB319A54CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F6386, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9410a932ba08bb24fd5de20f98cfc2deb1ebf973ff80293d6177c802adf55cc
Instruction ID: 637266ec67f3d25fe973c5cf455e8a4a69ac6200a701ce77bf94c85a9f941872
Opcode Fuzzy Hash: c9410a932ba08bb24fd5de20f98cfc2deb1ebf973ff80293d6177c802adf55cc
Instruction Fuzzy Hash: 00417D71244288DFCFB59F68DD84BDA7BB6BF19300F44411AEE69DA224DB319A54CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F6392, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e81ccf6ff62858c1bfc3150255366ce58e1d708bf9bfa477681c87cd094646c3
Instruction ID: 026a1b29b451d3b14596ec9403d106826b727dca25facc91ccc8078fbba03a5e
Opcode Fuzzy Hash: e81ccf6ff62858c1bfc3150255366ce58e1d708bf9bfa477681c87cd094646c3
Instruction Fuzzy Hash: 20419D71240288DFCFB59F68DD84BDA7BB6BF19300F44412AEE6DDA224DB319A54CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F639E, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e98bab70476e6b8f3f158b5c7092bafca3de6913767f0e750c479110517e8563
Instruction ID: 75d4cecb4bbe5de903932776b4d5ef9173bea5b126890fd2885a7d917a1ee4bf
Opcode Fuzzy Hash: e98bab70476e6b8f3f158b5c7092bafca3de6913767f0e750c479110517e8563
Instruction Fuzzy Hash: 4841AE71244288DFCFB69F68DC847CA3BB2BF19300F44011AEE69DB225DB359A58CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F63C2, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0cee8cb25535175a372c7b82ca3141c7d0c1daccd5f59f02cefc63e820b88c1
Instruction ID: bb119fa747666119fe6ea64920be7c137bd0e6bda647e46c93f60c8f0793f0a0
Opcode Fuzzy Hash: d0cee8cb25535175a372c7b82ca3141c7d0c1daccd5f59f02cefc63e820b88c1
Instruction Fuzzy Hash: 7C41CE71644288DFCFB59F78D8847DA7BB2BF19300F44422AEE6DDA225CB319654CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021F9F4F, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4780de29484e1cef887ab79f943b86a6d25dfc116ea48ec6c2b7075bf923bd6e
Instruction ID: 311f69ae237a4b3e4f148d727d979a42656de12d091b1f2283c3acb8cd5cd281
Opcode Fuzzy Hash: 4780de29484e1cef887ab79f943b86a6d25dfc116ea48ec6c2b7075bf923bd6e
Instruction Fuzzy Hash: CE112D74B493499FCBB8CE28C9D4BDA77A1AF89754F05412ADA6D8B360D7309900CB10

Uniqueness

Uniqueness Score: -1.00%

Function 021F99FC, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f0f6b0ce8da660d17550e3363172d1685b2c23d010c1c4bc2c549449fa6cd46
Instruction ID: bec689f7d9182fd36379df3894fdae46ff2c4c4ac6050afbd7849114f2df8aff
Opcode Fuzzy Hash: 9f0f6b0ce8da660d17550e3363172d1685b2c23d010c1c4bc2c549449fa6cd46
Instruction Fuzzy Hash: 67F0E9B62086C48FCF74CE35C9D1BDAB373EF54314F814019E04E87602C3359609C604

Uniqueness

Uniqueness Score: -1.00%

Function 021F6D48, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e8e364d78a2949adc09bf5e36ab7e6dac44fae7eda608bd48678c5b75deed3d
Instruction ID: 98fe3dc45543876c6f3a28a3dee86d76bfb47420870f68b2f3e32da04fefd75d
Opcode Fuzzy Hash: 4e8e364d78a2949adc09bf5e36ab7e6dac44fae7eda608bd48678c5b75deed3d
Instruction Fuzzy Hash: 40C092BBA026808FFB41CF08C481F0173B5FF64A48B890494E402CF712D338E900CA04

Uniqueness

Uniqueness Score: -1.00%

Function 021F7235, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.873217700.00000000021F0000.00000040.00000001.sdmp, Offset: 021F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction ID: f1647c15dfe5582e2114d8b48c9dc7a79c4e1b76aa7bcc19d5d00c5bce2ac4c7
Opcode Fuzzy Hash: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 004134C0, Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

#672.MSVBVM60(00000000,40080000,00000000,3FF00000,00000000,3FF00000,00000000,3FF00000), ref: 0041350C
__vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413512
__vbaNew2.MSVBVM60(00410A54,004145C0,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413537
__vbaLateMemCallLd.MSVBVM60(?,?,qTu9tyktlIOgozvLrZMBbdZxTILvo43,00000000), ref: 00413553
__vbaObjVar.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 0041355D
__vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413568
__vbaHresultCheckObj.MSVBVM60(00000000,02A2004C,00410A44,0000000C), ref: 00413582
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 0041358B
__vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413594
__vbaFreeObj.MSVBVM60(004135C6), ref: 004135BF

Strings

qTu9tyktlIOgozvLrZMBbdZxTILvo43, xrefs: 00413547

Memory Dump Source

Source File: 00000001.00000002.872684077.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.872673654.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.872708843.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.872716225.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#672AddrefCallCheckHresultLateNew2
String ID: qTu9tyktlIOgozvLrZMBbdZxTILvo43
API String ID: 263512575-2009357870
Opcode ID: 2fdb642e3af6af87b71f4bd35a3e9ef681424f86f318ed93a570013748b7a9a2
Instruction ID: bcae5c24f45c13e761b427d51ba33806316f77bc21679ff17bd25b96583f9bc7
Opcode Fuzzy Hash: 2fdb642e3af6af87b71f4bd35a3e9ef681424f86f318ed93a570013748b7a9a2
Instruction Fuzzy Hash: 8E216B70800245FBDB10AF95DE49FAABBB8FB98B02F10802AF541B21A0C7781580CF6C

Uniqueness

Uniqueness Score: -1.00%

Function 004131B0, Relevance: 12.1, APIs: 8, Instructions: 99COMMON

Download Yara Rule

APIs

__vbaAryConstruct2.MSVBVM60(?,00410B00,00000005), ref: 004131EC
#682.MSVBVM60(?,?), ref: 0041322D
__vbaFpR8.MSVBVM60 ref: 00413233
__vbaFreeVar.MSVBVM60 ref: 00413257
_adj_fdiv_m64.MSVBVM60 ref: 00413289
__vbaFpI4.MSVBVM60(42FC0000,?,436E0000), ref: 004132B7
__vbaHresultCheckObj.MSVBVM60(00000000,?,004104E0,000002C0,?,436E0000), ref: 004132EB
__vbaAryDestruct.MSVBVM60(00000000,?,00413316), ref: 0041330F

Memory Dump Source

Source File: 00000001.00000002.872684077.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.872673654.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.872708843.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.872716225.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#682CheckConstruct2DestructFreeHresult_adj_fdiv_m64
String ID:
API String ID: 4111779564-0
Opcode ID: 702e25635df67ff455c2ff624359795747a1e338e45617674404ac5756a66937
Instruction ID: a2174186820c36526dcdf6a683496151ead26c10be7a501887b504582c1d32c4
Opcode Fuzzy Hash: 702e25635df67ff455c2ff624359795747a1e338e45617674404ac5756a66937
Instruction Fuzzy Hash: 7E318F74D00208EBCB04DF90DE49BEEBBB8FB48701F10816AF541BA2A4C7B85981CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00413330, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

__vbaVarTstNe.MSVBVM60(?,?), ref: 00413394
__vbaInStr.MSVBVM60(00000000,Bebyrdelses9,Hvislendes8,FF96B5C0), ref: 004133AF

Strings

Bebyrdelses9, xrefs: 004133A9
Hvislendes8, xrefs: 004133A4

Memory Dump Source

Source File: 00000001.00000002.872684077.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.872673654.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.872708843.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.872716225.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba
String ID: Bebyrdelses9$Hvislendes8
API String ID: 3524132090-1996639642
Opcode ID: ab7b0e047ced4e79adbad3868a82938debe202d9b1fa139cc244e160ccc66b14
Instruction ID: d707bbdce24dfc12e123cf445103b3220a8727acc68b9e3c7f6b2619942e4b84
Opcode Fuzzy Hash: ab7b0e047ced4e79adbad3868a82938debe202d9b1fa139cc244e160ccc66b14
Instruction Fuzzy Hash: A5010CB0910258ABCB10DF94C989FDDBFB8FF08B44F14801AF505B6290D7B865858B99

Uniqueness

Uniqueness Score: -1.00%

Function 004133F0, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410A54,004145C0), ref: 00413433
__vbaHresultCheckObj.MSVBVM60(00000000,02A2004C,00410A44,0000004C), ref: 00413458
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410A80,00000028), ref: 00413478
__vbaFreeObj.MSVBVM60 ref: 00413481

Memory Dump Source

Source File: 00000001.00000002.872684077.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.872673654.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.872708843.0000000000414000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.872716225.0000000000415000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID:
API String ID: 4261391273-0
Opcode ID: 2b9320a272ef49ea83206e9824e08fc9e53d6602d6d8ee9ab1e119a35ddf3539
Instruction ID: 9d04e6d2bf56e23b294e6acb72464170c3215468c102a5cbbb64b02e9b92ea8a
Opcode Fuzzy Hash: 2b9320a272ef49ea83206e9824e08fc9e53d6602d6d8ee9ab1e119a35ddf3539
Instruction Fuzzy Hash: 54119E74640205ABD7109FA5CE09FDA7BF8FF18B45F104126F645E32A0E7B899858BA8

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report payment confirmation.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: payment confirmation.exe PID: 3316 Parent PID: 5404

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: payment confirmation.exe PID: 3316 Parent PID: 5404 payment confirmation.exeCOMMON

Executed Functions

Function 021FBC77, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 174COMMON

Function 004012C8, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156
COMMON