Loading ...

Play interactive tourEdit tour

Windows Analysis Report FACTURA.exe

Overview

General Information

Sample Name:FACTURA.exe
Analysis ID:491983
MD5:dbe61cfd43c95752f6dfbde236558782
SHA1:71b7f9ea7778a67ffc75fa0f7d8a74dc243aae22
SHA256:7194eca2c497f9ea9c3bb989fb7f328d9740b6d396af39ec66ec730c0db61044
Tags:exeGuLoader
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected GuLoader
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Found potential dummy code loops (likely to delay analysis)
Uses 32bit PE files
Sample file is different than original file name gathered from version info
PE file contains strange resources
Contains functionality to read the PEB
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to call native functions
Program does not show much activity (idle)
Contains functionality for execution timing, often used to detect debuggers
Abnormal high CPU Usage

Classification

Process Tree

  • System is w10x64
  • FACTURA.exe (PID: 3092 cmdline: 'C:\Users\user\Desktop\FACTURA.exe' MD5: DBE61CFD43C95752F6DFBDE236558782)
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id="}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

    Sigma Overview

    No Sigma rule has matched

    Jbx Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Found malware configurationShow sources
    Source: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id="}
    Multi AV Scanner detection for submitted fileShow sources
    Source: FACTURA.exeVirustotal: Detection: 24%Perma Link
    Source: FACTURA.exeReversingLabs: Detection: 26%
    Source: FACTURA.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

    Networking:

    barindex
    C2 URLs / IPs found in malware configurationShow sources
    Source: Malware configuration extractorURLs: https://drive.google.com/uc?export=download&id=
    Source: FACTURA.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: FACTURA.exe, 00000000.00000002.824965821.0000000000415000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameexposure.exe vs FACTURA.exe
    Source: FACTURA.exeBinary or memory string: OriginalFilenameexposure.exe vs FACTURA.exe
    Source: FACTURA.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_004088D40_2_004088D4
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02ADBE110_2_02ADBE11
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD7A420_2_02AD7A42
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD62B90_2_02AD62B9
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD7AB50_2_02AD7AB5
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD04B70_2_02AD04B7
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD60850_2_02AD6085
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02ADAC9F0_2_02ADAC9F
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD042D0_2_02AD042D
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD64380_2_02AD6438
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD5E730_2_02AD5E73
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD7A400_2_02AD7A40
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD77AC0_2_02AD77AC
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD61A50_2_02AD61A5
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD65B10_2_02AD65B1
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD579C0_2_02AD579C
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD5FEF0_2_02AD5FEF
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD5F120_2_02AD5F12
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD9F6C0_2_02AD9F6C
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02ADA97E0_2_02ADA97E
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD65400_2_02AD6540
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD735A0_2_02AD735A
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD7A42 NtAllocateVirtualMemory,0_2_02AD7A42
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD7AB5 NtAllocateVirtualMemory,0_2_02AD7AB5
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD7A40 NtAllocateVirtualMemory,0_2_02AD7A40
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD7BC1 NtAllocateVirtualMemory,0_2_02AD7BC1
    Source: C:\Users\user\Desktop\FACTURA.exeProcess Stats: CPU usage > 98%
    Source: FACTURA.exeVirustotal: Detection: 24%
    Source: FACTURA.exeReversingLabs: Detection: 26%
    Source: FACTURA.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\FACTURA.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: C:\Users\user\Desktop\FACTURA.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
    Source: C:\Users\user\Desktop\FACTURA.exeFile created: C:\Users\user\AppData\Local\Temp\~DFC7F0E2A53F7EEA66.TMPJump to behavior
    Source: classification engineClassification label: mal76.troj.evad.winEXE@1/0@0/0

    Data Obfuscation:

    barindex
    Yara detected GuLoaderShow sources
    Source: Yara matchFile source: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, type: MEMORY
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_00404C45 push ds; retf 0_2_00404C50
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_00404CEF push es; retf 0_2_00404CF5
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_00402EAF push edi; ret 0_2_00402EB0
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_0040710A push ebp; iretd 0_2_0040710B
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_00407328 push edx; ret 0_2_0040732B
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD8AC9 push ebp; iretd 0_2_02AD8AFE
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD4E7A push B48F7408h; retf 0_2_02AD4E7F
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD3B19 push 89000002h; ret 0_2_02AD3B1F
    Source: C:\Users\user\Desktop\FACTURA.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\FACTURA.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\FACTURA.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\FACTURA.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\FACTURA.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

    Malware Analysis System Evasion:

    barindex
    Tries to detect virtualization through RDTSC time measurementsShow sources
    Source: C:\Users\user\Desktop\FACTURA.exeRDTSC instruction interceptor: First address: 000000000040ED87 second address: 000000000040ED87 instructions: 0x00000000 rdtsc 0x00000002 mfence 0x00000005 nop 0x00000006 popad 0x00000007 cmp ecx, 7Dh 0x0000000a mfence 0x0000000d dec edi 0x0000000e mfence 0x00000011 wait 0x00000012 cmp edi, 00000000h 0x00000015 jne 00007FC810A3F940h 0x00000017 mfence 0x0000001a cmp eax, 32h 0x0000001d pushad 0x0000001e wait 0x0000001f lfence 0x00000022 rdtsc
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD72A1 rdtsc 0_2_02AD72A1

    Anti Debugging:

    barindex
    Found potential dummy code loops (likely to delay analysis)Show sources
    Source: C:\Users\user\Desktop\FACTURA.exeProcess Stats: CPU usage > 90% for more than 60s
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD70C9 mov eax, dword ptr fs:[00000030h]0_2_02AD70C9
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD9C78 mov eax, dword ptr fs:[00000030h]0_2_02AD9C78
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02ADA199 mov eax, dword ptr fs:[00000030h]0_2_02ADA199
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD4929 mov eax, dword ptr fs:[00000030h]0_2_02AD4929
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02AD72A1 rdtsc 0_2_02AD72A1
    Source: C:\Users\user\Desktop\FACTURA.exeCode function: 0_2_02ADBE11 RtlAddVectoredExceptionHandler,0_2_02ADBE11
    Source: FACTURA.exe, 00000000.00000002.825239169.0000000000D70000.00000002.00020000.sdmpBinary or memory string: Program Manager
    Source: FACTURA.exe, 00000000.00000002.825239169.0000000000D70000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
    Source: FACTURA.exe, 00000000.00000002.825239169.0000000000D70000.00000002.00020000.sdmpBinary or memory string: Progman
    Source: FACTURA.exe, 00000000.00000002.825239169.0000000000D70000.00000002.00020000.sdmpBinary or memory string: Progmanlock

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11OS Credential DumpingSecurity Software Discovery21Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Information Discovery11Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    FACTURA.exe25%VirustotalBrowse
    FACTURA.exe27%ReversingLabsWin32.Trojan.Mucc

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    No Antivirus matches

    Domains and IPs

    Contacted Domains

    No contacted domains info

    Contacted IPs

    No contacted IP infos

    General Information

    Joe Sandbox Version:33.0.0 White Diamond
    Analysis ID:491983
    Start date:28.09.2021
    Start time:08:46:57
    Joe Sandbox Product:CloudBasic
    Overall analysis duration:0h 7m 29s
    Hypervisor based Inspection enabled:false
    Report type:full
    Sample file name:FACTURA.exe
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
    Number of analysed new started processes analysed:18
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • HDC enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Detection:MAL
    Classification:mal76.troj.evad.winEXE@1/0@0/0
    EGA Information:Failed
    HDC Information:
    • Successful, ratio: 28.4% (good quality ratio 14.8%)
    • Quality average: 29.2%
    • Quality standard deviation: 33.4%
    HCA Information:Failed
    Cookbook Comments:
    • Adjust boot time
    • Enable AMSI
    • Found application associated with file extension: .exe
    • Override analysis time to 240s for sample files taking high CPU consumption
    Warnings:
    Show All
    • Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
    • Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.82.209.183, 80.67.82.235, 80.67.82.211, 8.253.207.120, 67.27.157.254, 8.248.131.254, 67.27.157.126, 8.253.204.120, 20.199.120.182, 20.199.120.151, 20.54.110.249, 40.112.88.60, 23.211.4.86, 20.199.120.85
    • Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net
    • Not all processes where analyzed, report is missing behavior information

    Simulations

    Behavior and APIs

    No simulations

    Joe Sandbox View / Context

    IPs

    No context

    Domains

    No context

    ASN

    No context

    JA3 Fingerprints

    No context

    Dropped Files

    No context

    Created / dropped Files

    No created / dropped files found

    Static File Info

    General

    File type:PE32 executable (GUI) Intel 80386, for MS Windows
    Entropy (8bit):5.825848109421746
    TrID:
    • Win32 Executable (generic) a (10002005/4) 99.15%
    • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
    • Generic Win/DOS Executable (2004/3) 0.02%
    • DOS Executable Generic (2002/1) 0.02%
    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
    File name:FACTURA.exe
    File size:90112
    MD5:dbe61cfd43c95752f6dfbde236558782
    SHA1:71b7f9ea7778a67ffc75fa0f7d8a74dc243aae22
    SHA256:7194eca2c497f9ea9c3bb989fb7f328d9740b6d396af39ec66ec730c0db61044
    SHA512:080df78e19db66f774e4924875da9301fdfb164563b32e3bbf3e32ef720de2d146e2e67f7752eea5ac1d30c64f81209a9b52a1d3a48009402e9f5b91b41226c7
    SSDEEP:768:t2FgA8P1DadQOyLO/j5RhgmDSXlqhZLkVYC5OEn7m7j1Oavx6aG7Cj7nFytQ:t2AP1msO7ZgmDSVq7VUlIj1jJ6nm7/
    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L....l.Y.................0... ...............@....@........

    File Icon

    Icon Hash:821ca88c8e8c8c00

    Static PE Info

    General

    Entrypoint:0x4012c8
    Entrypoint Section:.text
    Digitally signed:false
    Imagebase:0x400000
    Subsystem:windows gui
    Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    DLL Characteristics:
    Time Stamp:0x59A36C05 [Mon Aug 28 01:04:05 2017 UTC]
    TLS Callbacks:
    CLR (.Net) Version:
    OS Version Major:4
    OS Version Minor:0
    File Version Major:4
    File Version Minor:0
    Subsystem Version Major:4
    Subsystem Version Minor:0
    Import Hash:e73b8c032c82c64991ebe487a7ffcd43

    Entrypoint Preview

    Instruction
    push 004102D0h
    call 00007FC810B103B3h
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    xor byte ptr [eax], al
    add byte ptr [eax], al
    inc eax
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax-68h], cl
    cmp dword ptr [ebp+44E604D0h], edx
    lahf
    adc al, BDh
    add bh, al
    adc al, DEh
    mov esp, 00000000h
    add byte ptr [eax], al
    add dword ptr [eax], eax
    add byte ptr [eax], al
    inc edx
    add byte ptr [esi], al
    push eax
    add dword ptr [ecx], 53h
    dec ebx
    inc ecx
    inc esp
    inc ebp
    dec esp
    dec ecx
    inc edi
    push ebx
    push esp
    inc ebp
    add ah, al
    sub dword ptr [ebx], ecx
    add eax, dword ptr [eax]
    add byte ptr [eax], al
    add bh, bh
    int3
    xor dword ptr [eax], eax
    cmp cl, ah
    jmp far 4561h : 5915348Fh
    test eax, D213FA98h
    mov esp, edi
    rol byte ptr [edx], FFFFFFF1h
    call 00007FC8239FE986h
    dec eax
    call far E4BBh : 71A84919h
    imul edi, dword ptr [edx], 9933AD4Fh
    iretw
    adc dword ptr [edi+00AA000Ch], esi
    pushad
    rcl dword ptr [ebx+00000000h], cl
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    pop edi
    in eax, dx
    add byte ptr [eax], al
    test byte ptr [ecx], al
    add byte ptr [eax], al
    add byte ptr [656C4600h], al
    jnc 00007FC810B103F7h
    add byte ptr [65000301h], cl
    insb
    outsd
    add byte ptr [ecx], bl
    add dword ptr [eax], eax
    inc edx
    add byte ptr [edx], ah

    Data Directories

    NameVirtual AddressVirtual Size Is in Section
    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IMPORT0x139e40x28.text
    IMAGE_DIRECTORY_ENTRY_RESOURCE0x150000x548.rsrc
    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2300x20
    IMAGE_DIRECTORY_ENTRY_IAT0x10000xe8.text
    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

    Sections

    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
    .text0x10000x12e4c0x13000False0.52587890625data6.31843765659IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    .data0x140000xcf40x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
    .rsrc0x150000x5480x1000False0.132080078125data1.43485201544IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

    Resources

    NameRVASizeTypeLanguageCountry
    RT_ICON0x154200x128GLS_BINARY_LSB_FIRST
    RT_GROUP_ICON0x1540c0x14data
    RT_VERSION0x150f00x31cdataChineseTaiwan

    Imports

    DLLImport
    MSVBVM60.DLL_CIcos, _adj_fptan, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaStrToAnsi, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

    Version Infos

    DescriptionData
    Translation0x0404 0x04b0
    LegalCopyrightChatSwipe
    InternalNameexposure
    FileVersion4.04.0001
    CompanyNameChatSwipe
    LegalTrademarksChatSwipe
    CommentsChatSwipe
    ProductNameChatSwipe
    ProductVersion4.04.0001
    FileDescriptionChatSwipe
    OriginalFilenameexposure.exe

    Possible Origin

    Language of compilation systemCountry where language is spokenMap
    ChineseTaiwan

    Network Behavior

    Network Port Distribution

    UDP Packets

    TimestampSource PortDest PortSource IPDest IP
    Sep 28, 2021 08:47:53.494539022 CEST5745953192.168.2.38.8.8.8
    Sep 28, 2021 08:47:53.522447109 CEST53574598.8.8.8192.168.2.3
    Sep 28, 2021 08:48:19.628271103 CEST5787553192.168.2.38.8.8.8
    Sep 28, 2021 08:48:19.655313969 CEST53578758.8.8.8192.168.2.3
    Sep 28, 2021 08:48:37.631825924 CEST5415453192.168.2.38.8.8.8
    Sep 28, 2021 08:48:37.652549982 CEST53541548.8.8.8192.168.2.3
    Sep 28, 2021 08:48:46.377896070 CEST5280653192.168.2.38.8.8.8
    Sep 28, 2021 08:48:46.396681070 CEST53528068.8.8.8192.168.2.3
    Sep 28, 2021 08:48:46.483184099 CEST5391053192.168.2.38.8.8.8
    Sep 28, 2021 08:48:46.501982927 CEST53539108.8.8.8192.168.2.3
    Sep 28, 2021 08:48:47.583432913 CEST6402153192.168.2.38.8.8.8
    Sep 28, 2021 08:48:47.602916956 CEST53640218.8.8.8192.168.2.3
    Sep 28, 2021 08:48:55.512278080 CEST6078453192.168.2.38.8.8.8
    Sep 28, 2021 08:48:55.530760050 CEST53607848.8.8.8192.168.2.3
    Sep 28, 2021 08:49:00.857177973 CEST5114353192.168.2.38.8.8.8
    Sep 28, 2021 08:49:00.893752098 CEST53511438.8.8.8192.168.2.3
    Sep 28, 2021 08:49:02.150414944 CEST5600953192.168.2.38.8.8.8
    Sep 28, 2021 08:49:02.202404022 CEST53560098.8.8.8192.168.2.3
    Sep 28, 2021 08:49:02.715295076 CEST5902653192.168.2.38.8.8.8
    Sep 28, 2021 08:49:02.738986969 CEST53590268.8.8.8192.168.2.3
    Sep 28, 2021 08:49:03.082223892 CEST4957253192.168.2.38.8.8.8
    Sep 28, 2021 08:49:03.118984938 CEST53495728.8.8.8192.168.2.3
    Sep 28, 2021 08:49:03.691489935 CEST6082353192.168.2.38.8.8.8
    Sep 28, 2021 08:49:03.764597893 CEST53608238.8.8.8192.168.2.3
    Sep 28, 2021 08:49:04.197411060 CEST5213053192.168.2.38.8.8.8
    Sep 28, 2021 08:49:04.216444969 CEST53521308.8.8.8192.168.2.3
    Sep 28, 2021 08:49:04.728686094 CEST5510253192.168.2.38.8.8.8
    Sep 28, 2021 08:49:04.748616934 CEST53551028.8.8.8192.168.2.3
    Sep 28, 2021 08:49:05.416394949 CEST5623653192.168.2.38.8.8.8
    Sep 28, 2021 08:49:05.435782909 CEST53562368.8.8.8192.168.2.3
    Sep 28, 2021 08:49:05.596211910 CEST5652753192.168.2.38.8.8.8
    Sep 28, 2021 08:49:05.622039080 CEST53565278.8.8.8192.168.2.3
    Sep 28, 2021 08:49:06.751741886 CEST4955953192.168.2.38.8.8.8
    Sep 28, 2021 08:49:06.797861099 CEST53495598.8.8.8192.168.2.3
    Sep 28, 2021 08:49:07.508202076 CEST5265053192.168.2.38.8.8.8
    Sep 28, 2021 08:49:07.527658939 CEST53526508.8.8.8192.168.2.3
    Sep 28, 2021 08:49:09.044059038 CEST6329753192.168.2.38.8.8.8
    Sep 28, 2021 08:49:09.061002016 CEST53632978.8.8.8192.168.2.3
    Sep 28, 2021 08:49:31.731404066 CEST5836153192.168.2.38.8.8.8
    Sep 28, 2021 08:49:31.750919104 CEST53583618.8.8.8192.168.2.3
    Sep 28, 2021 08:49:43.325959921 CEST5361553192.168.2.38.8.8.8
    Sep 28, 2021 08:49:43.354787111 CEST53536158.8.8.8192.168.2.3
    Sep 28, 2021 08:49:49.664633036 CEST5072853192.168.2.38.8.8.8
    Sep 28, 2021 08:49:49.689380884 CEST53507288.8.8.8192.168.2.3
    Sep 28, 2021 08:49:56.247452974 CEST5377753192.168.2.38.8.8.8
    Sep 28, 2021 08:49:56.266958952 CEST53537778.8.8.8192.168.2.3
    Sep 28, 2021 08:50:27.188128948 CEST5710653192.168.2.38.8.8.8
    Sep 28, 2021 08:50:27.207036972 CEST53571068.8.8.8192.168.2.3
    Sep 28, 2021 08:51:45.373792887 CEST6035253192.168.2.38.8.8.8
    Sep 28, 2021 08:51:45.407704115 CEST53603528.8.8.8192.168.2.3

    Code Manipulations

    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    System Behavior

    General

    Start time:08:47:58
    Start date:28/09/2021
    Path:C:\Users\user\Desktop\FACTURA.exe
    Wow64 process (32bit):true
    Commandline:'C:\Users\user\Desktop\FACTURA.exe'
    Imagebase:0x400000
    File size:90112 bytes
    MD5 hash:DBE61CFD43C95752F6DFBDE236558782
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Visual Basic
    Yara matches:
    • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Author: Joe Security
    Reputation:low

    Disassembly

    Code Analysis

    Reset < >

      Executed Functions

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: n
      • API String ID: 0-2013832146
      • Opcode ID: 9d3a7a357f530660da5ce8230ab6bbb0d7d384a6538e43c02868cc3ec6e8cb4c
      • Instruction ID: f4869883484fcb5b1678fdb2c139f9cf1dcd3c1f27f0764829d5316ad11a8448
      • Opcode Fuzzy Hash: 9d3a7a357f530660da5ce8230ab6bbb0d7d384a6538e43c02868cc3ec6e8cb4c
      • Instruction Fuzzy Hash: 6671F270648688CFDB79CF28C9A57EA77B2AF85350F95412EDC4B8F294CB349644CB41
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • NtAllocateVirtualMemory.NTDLL(1A3AFB73,?,5C1E2C25,?), ref: 02AD7C46
      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID:
      • API String ID: 2167126740-0
      • Opcode ID: cf9c9fc78abe1e321ba6dc0b1e14ca8de64794b2aea2061064beba26a6dd904e
      • Instruction ID: f230634f590ee041f5111c5a863641b8c4a964b321a67d9057a14fd3d4f6f34c
      • Opcode Fuzzy Hash: cf9c9fc78abe1e321ba6dc0b1e14ca8de64794b2aea2061064beba26a6dd904e
      • Instruction Fuzzy Hash: 1FE1FC768092959FDB229F28CC813EABBB4FF0A304F45056DCC869F612DB359507CB86
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • NtAllocateVirtualMemory.NTDLL(1A3AFB73,?,5C1E2C25,?), ref: 02AD7C46
      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID:
      • API String ID: 2167126740-0
      • Opcode ID: 25d2f6e2dc48ff9b6fae2c96217f167724899f518de1dc354283a31b9d2e24a2
      • Instruction ID: 066b68da87defdd0d8d30296903d82a6bf5b89dd9f2a8c5715875834ebb35709
      • Opcode Fuzzy Hash: 25d2f6e2dc48ff9b6fae2c96217f167724899f518de1dc354283a31b9d2e24a2
      • Instruction Fuzzy Hash: 137179769082A9DFDB219F24CD543E9BBB5EF09304F41052DDC8B9B681D7315906CB85
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • NtAllocateVirtualMemory.NTDLL(1A3AFB73,?,5C1E2C25,?), ref: 02AD7C46
      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID:
      • API String ID: 2167126740-0
      • Opcode ID: 4a765d63626689ad273d73d90cb73fb79ffb62874618089b7b135d8532906e26
      • Instruction ID: cb8f7c4c7746f13a6cb16253415236c43f27b0054c2f3ec6bdc06035993aa606
      • Opcode Fuzzy Hash: 4a765d63626689ad273d73d90cb73fb79ffb62874618089b7b135d8532906e26
      • Instruction Fuzzy Hash: 4C713636C092A99FDB228F24CD447D87BB4EF09304F95016DDC8A9B352DB719A16CB86
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • NtAllocateVirtualMemory.NTDLL(1A3AFB73,?,5C1E2C25,?), ref: 02AD7C46
      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID: AllocateMemoryVirtual
      • String ID:
      • API String ID: 2167126740-0
      • Opcode ID: 586a4d8da55145f3140e1e1c38da019cf3df7dac8d0b982aaf935b928f8bef2a
      • Instruction ID: 75a027ee959c2e9a752e30a8e8935af6443d7b203b8a004fc3324b555bbf0114
      • Opcode Fuzzy Hash: 586a4d8da55145f3140e1e1c38da019cf3df7dac8d0b982aaf935b928f8bef2a
      • Instruction Fuzzy Hash: 92515839C491D99FD7228F20CD857D87B78EF1A304BA401A9CC968F7A2DB718516CBD2
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • #612.MSVBVM60(?), ref: 004130B2
      • __vbaStrVarMove.MSVBVM60(?), ref: 004130BC
      • __vbaStrMove.MSVBVM60 ref: 004130C7
      • __vbaFreeVar.MSVBVM60 ref: 004130D0
      • #575.MSVBVM60(?,?), ref: 004130EC
      • __vbaVarTstNe.MSVBVM60(?,?), ref: 0041310E
      • __vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00413121
      • __vbaNew2.MSVBVM60(00410D84,004145C0), ref: 00413141
      • __vbaHresultCheckObj.MSVBVM60(00000000,0295004C,00410D74,00000034,?,?,00000ACB,?), ref: 0041318B
      • __vbaObjSet.MSVBVM60(?,?,?,?,00000ACB,?), ref: 0041319C
      • __vbaStrToAnsi.MSVBVM60(?,snappishly,00000000), ref: 004131AC
      • __vbaSetSystemError.MSVBVM60(00000000,00000000), ref: 004131BF
      • __vbaFreeStr.MSVBVM60(?,?,00000ACB,?), ref: 004131DE
      • __vbaFpI4.MSVBVM60(?,?,00000ACB,?), ref: 004131F1
      • __vbaHresultCheckObj.MSVBVM60(00000000,004010F0,00410808,000002C8), ref: 00413227
      • __vbaSetSystemError.MSVBVM60(00000000,00000002,00000002), ref: 0041323D
      • __vbaNew2.MSVBVM60(00410D84,004145C0), ref: 00413265
      • __vbaHresultCheckObj.MSVBVM60(00000000,0295004C,00410D74,0000004C), ref: 0041328A
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00410DB0,0000001C,?,?,?,?), ref: 004132DA
      • __vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 004132EB
      • __vbaFreeObj.MSVBVM60(?,?,?,?), ref: 004132F4
      • __vbaHresultCheckObj.MSVBVM60(00000000,004010F0,00410838,000006F8), ref: 0041331C
      • __vbaStrCopy.MSVBVM60 ref: 0041332A
      • __vbaFreeStr.MSVBVM60 ref: 00413363
      • __vbaHresultCheckObj.MSVBVM60(00000000,004010F0,00410808,000002B4), ref: 00413390
      • __vbaStrToAnsi.MSVBVM60(?,SINGFEST,00267EEC), ref: 004133AD
      • __vbaSetSystemError.MSVBVM60(000C5DB5,00000000), ref: 004133C4
      • __vbaFreeStr.MSVBVM60 ref: 004133E3
      • __vbaNew2.MSVBVM60(00410D84,004145C0), ref: 004133FC
      • __vbaLateMemCallLd.MSVBVM60(00000002,?,WkKauIFp5j1bv26pBJsl8jmR69NV785,00000000), ref: 00413418
      • __vbaObjVar.MSVBVM60(00000000), ref: 00413422
      • __vbaObjSetAddref.MSVBVM60(?,00000000), ref: 0041342D
      • __vbaHresultCheckObj.MSVBVM60(00000000,0295004C,00410D74,0000000C), ref: 00413447
      • __vbaFreeObj.MSVBVM60 ref: 00413450
      • __vbaFreeVar.MSVBVM60 ref: 00413459
      • __vbaFreeObj.MSVBVM60(004134BA), ref: 004134A4
      • __vbaFreeStr.MSVBVM60 ref: 004134A9
      • __vbaFreeObj.MSVBVM60 ref: 004134B2
      • __vbaFreeObj.MSVBVM60 ref: 004134B7
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.824896155.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.824880012.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.824946532.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.824965821.0000000000415000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$CheckHresult$ErrorNew2System$AnsiMove$#575#612AddrefCallCopyLateList
      • String ID: Palmira$SINGFEST$WkKauIFp5j1bv26pBJsl8jmR69NV785$snappishly
      • API String ID: 1255662601-1278630523
      • Opcode ID: b7ff3e9925992947cf04c6992dd0375549094de3faf27181eb32eb93f9c3c0bf
      • Instruction ID: 0d5587fd8c0bd55eb485f6ee848fe8bf113e5db8a1ce6710b5eba349c8f1ac13
      • Opcode Fuzzy Hash: b7ff3e9925992947cf04c6992dd0375549094de3faf27181eb32eb93f9c3c0bf
      • Instruction Fuzzy Hash: 71D17CB0900209EFDB10DFA0DD89ADEBBB9FF48705F10816AF545A72A0DB746985CF58
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.824896155.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.824880012.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.824946532.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.824965821.0000000000415000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: #100
      • String ID: VB5!6!*
      • API String ID: 1341478452-2574520878
      • Opcode ID: c7f145222507c124e895aeab3ef7919b29f0aff6f1955bcbc78387e1d90b982b
      • Instruction ID: 17833fc050e3fab55cbbf5c26b001a3787d40637aad72701e2958b30af14cec3
      • Opcode Fuzzy Hash: c7f145222507c124e895aeab3ef7919b29f0aff6f1955bcbc78387e1d90b982b
      • Instruction Fuzzy Hash: D901BD6449E3C48FD3174A709C662A13FB4DE43268B0A05EBC9C2DB0A3C16C0C8BCB23
      Uniqueness

      Uniqueness Score: -1.00%

      Non-executed Functions

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: A
      • API String ID: 0-3554254475
      • Opcode ID: efcb99fd92342d25ab0c049ff8b00e0fd56dce3d12d16d1efdd5ba7554136f59
      • Instruction ID: c23052db83a1e80a8140bd9dd99729d76652e8c2295cd5355aae05a827849dcf
      • Opcode Fuzzy Hash: efcb99fd92342d25ab0c049ff8b00e0fd56dce3d12d16d1efdd5ba7554136f59
      • Instruction Fuzzy Hash: 3EA15B39C083699FC721DF3489480D5BBB0EF49328F5A075DDAA6CBB92D7205992C789
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: P
      • API String ID: 0-3110715001
      • Opcode ID: 3b9aea8eee3330c0a797d1a1001b182ef90d2155d9b8ccc18fe1feb430714c78
      • Instruction ID: 4a5c22de87746aed76ebc81838ed5333a431a93ed58d1ffba9ecbfd62650c683
      • Opcode Fuzzy Hash: 3b9aea8eee3330c0a797d1a1001b182ef90d2155d9b8ccc18fe1feb430714c78
      • Instruction Fuzzy Hash: BDD1FD72900389DFDB70CE78DD847DA7BB2BF58724F16422ADD599B220CB305A818B45
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: A
      • API String ID: 0-3554254475
      • Opcode ID: 9c15fe0f817333019d40a65f393c6fca0852e79319dcaf26554da5c24b4ea85d
      • Instruction ID: 4d7e43827dd64e9aaf460a875327826bc74362a8405e419606cd681ae35532e9
      • Opcode Fuzzy Hash: 9c15fe0f817333019d40a65f393c6fca0852e79319dcaf26554da5c24b4ea85d
      • Instruction Fuzzy Hash: 1051E239C092999FC7025F348C465D5BFB1EE65300FB9489CD9958B722DA708592C793
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: \ZJ|
      • API String ID: 0-2459000568
      • Opcode ID: 33a5da9f6285007ae5638feff8c17827a25d55efbcd55ef535c2e0445edaaca7
      • Instruction ID: a068057bbec2dd34f9d3a3f4abecbafbc1a2dcd55e624ccebfbb6126040a6781
      • Opcode Fuzzy Hash: 33a5da9f6285007ae5638feff8c17827a25d55efbcd55ef535c2e0445edaaca7
      • Instruction Fuzzy Hash: 173156726563C54BDB3A8E3449B07F66BA21FB6250FDD851ECCD79B382CA304A49C352
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID: `
      • API String ID: 0-1850852036
      • Opcode ID: 6c00cff5476102ce2cfb37ef7d3914117f581f36a6d501a40848da11b0589b20
      • Instruction ID: 5bd7bd6a8e7e2b3ee4bc133fafe4fd3d718168e41fe6c3c644b4e02a5ca3efbc
      • Opcode Fuzzy Hash: 6c00cff5476102ce2cfb37ef7d3914117f581f36a6d501a40848da11b0589b20
      • Instruction Fuzzy Hash: 7121A17264028ADBDF788E6ADE593DEB6A3AFD5300F15802ACC0E8B254CF714605CB15
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: e56b7d89c16adea2b9a6246c3039a6b7c5e7b9bc06bd7d30cd295bbb22694eaf
      • Instruction ID: bc69cda0ebf37557e8ea1afaace63e8af10e8c11e3c10f5c80423eb21f7f88be
      • Opcode Fuzzy Hash: e56b7d89c16adea2b9a6246c3039a6b7c5e7b9bc06bd7d30cd295bbb22694eaf
      • Instruction Fuzzy Hash: 2612EE726042899FDB749F38DD857EA7BB6FF98300F158129DD899B210DB309A81CF41
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 03e9ad5986bea87e3b9655ba620c941b3160a2abc01e97167e24fd780487ae21
      • Instruction ID: 95d7b1698c77cbfb750540e6e47df88509e8c0ea9ece6b8cfa46a393ccf62d42
      • Opcode Fuzzy Hash: 03e9ad5986bea87e3b9655ba620c941b3160a2abc01e97167e24fd780487ae21
      • Instruction Fuzzy Hash: 40F1FDB66042899FDB749F38CE847DA7BB6FF98700F45412DDD899B214DB309A81CB05
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.824896155.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.824880012.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.824946532.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.824965821.0000000000415000.00000002.00020000.sdmp Download File
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 3c283bd569546b192d3023e07e4cb5a3687d06b5f7e4adbccf57e58c494e5879
      • Instruction ID: 834a0336746ada2f6c027e86ff76bb9deea05e5ee4f62b26cf92b464b69d52dc
      • Opcode Fuzzy Hash: 3c283bd569546b192d3023e07e4cb5a3687d06b5f7e4adbccf57e58c494e5879
      • Instruction Fuzzy Hash: 32C1CC7181B395CFDB2BDFB58089281BFA1EE1332472806EAC5D14F676EA325116CF49
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 70db5357718b1a701cb416d1481beb8ef6ad4435a5b729be81e548f619e1bb89
      • Instruction ID: 6a7569084c39635c17937b66f2a6fbd78e6289244edf15f4a62722f1237e70f5
      • Opcode Fuzzy Hash: 70db5357718b1a701cb416d1481beb8ef6ad4435a5b729be81e548f619e1bb89
      • Instruction Fuzzy Hash: 32E10E72604289DFCB749F38DD857DA7BB6FF98300F15812ADD499B224DB309A81CB01
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 615b4c0446ea3f49b0911eeae9765ae9354ebb77e4c3621ea0d868ec542e6342
      • Instruction ID: 2e2bb7637729ceec5ab9b56034a9fa9f351347fd93ff11751af92e90ccc5e2a2
      • Opcode Fuzzy Hash: 615b4c0446ea3f49b0911eeae9765ae9354ebb77e4c3621ea0d868ec542e6342
      • Instruction Fuzzy Hash: EAE10D72604289DFCB718F38CD857DA7BB6FF98300F55812ADC499B224DB308A81CB42
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: ce8672d03a7f807f0b72d6e6d2090d0efefc8dd4e3057c3cd10e0984a076f5cc
      • Instruction ID: dced524d07eb902057f80d79f8bd6da2b9c9cf1a319d7431d986332dc148dd1f
      • Opcode Fuzzy Hash: ce8672d03a7f807f0b72d6e6d2090d0efefc8dd4e3057c3cd10e0984a076f5cc
      • Instruction Fuzzy Hash: 69D1EDB2A0438ADFDB648F34C9457DABBB2FF44300F558A19DC8A97260C7345A91CF86
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 1a11d421de8c8342e587f20edb6328d7a4abb111c07ccf714b0b5b72ed5f8614
      • Instruction ID: 66a26d3cf3b69638f8621300a3e15b5d7f9549a483ec451d53b9eb2b8ea0103c
      • Opcode Fuzzy Hash: 1a11d421de8c8342e587f20edb6328d7a4abb111c07ccf714b0b5b72ed5f8614
      • Instruction Fuzzy Hash: 50B1DB72904289DFDB718E74DD857DA3BB6FF98300F65812ADD599B220CB708A81CB52
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 3106d229d04d692ef2e77950aada0637f6797386cb308d9cfeb1f033bfc60785
      • Instruction ID: 986fb169fb0d4559d78d391ff27176a27e2748c89b4c54b24eee394bbf2450a9
      • Opcode Fuzzy Hash: 3106d229d04d692ef2e77950aada0637f6797386cb308d9cfeb1f033bfc60785
      • Instruction Fuzzy Hash: 8391F1769403499FDB70CE68DD843DA7BB2FF98324F16422DDE599B261CB305A82CB44
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 46b51e048c7e2313d2db120a88073fe9a4aa111ab9622e7215f7d6ade98ca50a
      • Instruction ID: f5c607b268a99cf2c0f6aad12e458782eb1c0194508491c48562df439013ebf4
      • Opcode Fuzzy Hash: 46b51e048c7e2313d2db120a88073fe9a4aa111ab9622e7215f7d6ade98ca50a
      • Instruction Fuzzy Hash: 9561ED71240289DFDB749F79CE847DA7BB6FF98310F158129ED098B224DB30AA428F50
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: c8a0a20e1ee51959bbdcb14ff6084b72f93dba8858950cafd23522dd07519f12
      • Instruction ID: 7afa592030bcff858a908d045b4a8ccbafc28e44c48b26cb8da7ecb18b30a103
      • Opcode Fuzzy Hash: c8a0a20e1ee51959bbdcb14ff6084b72f93dba8858950cafd23522dd07519f12
      • Instruction Fuzzy Hash: 2351D071A402899FDB659F78CD84BDA7BB6FF94300F648129DD188B320DB709952CF92
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 27e3f02baee2af89cec7a88986825d68ce23654cb7c6f7c770de03cd933f16ec
      • Instruction ID: e15435008cec4db6ed5a20aeb4cc9ff6fdb249de4ce2de9fdab8eff5e812342c
      • Opcode Fuzzy Hash: 27e3f02baee2af89cec7a88986825d68ce23654cb7c6f7c770de03cd933f16ec
      • Instruction Fuzzy Hash: 6B316B722052059BDB3C6E3859A1BFB7BF7AF80310F52821FD8A797295CB304985C606
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 76f0b55dccf6807490b7b502c18daf41d4fd67c77ca1ab6019f9dfd56d3349ed
      • Instruction ID: ce9d6d0bdd2cca5e24aee744b0ae9d789c7bd99dc378bf13ce4125adf916bf07
      • Opcode Fuzzy Hash: 76f0b55dccf6807490b7b502c18daf41d4fd67c77ca1ab6019f9dfd56d3349ed
      • Instruction Fuzzy Hash: D33154B2A152548BDB34CE2A8DC46DBB3A76FD8310F56812E9C4AA7318D7314E468791
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 99ed3584abbd662585046dff2472a8494dc8b9a182adce6a4d67696e4d5e8c0a
      • Instruction ID: 19978aaa27c82e2ad7e2de2484361dbce05b6c280bf400aa0ca1ad5b0811709b
      • Opcode Fuzzy Hash: 99ed3584abbd662585046dff2472a8494dc8b9a182adce6a4d67696e4d5e8c0a
      • Instruction Fuzzy Hash: 5C219035248386CBCB34DF78CAD07EA73B1FF69310F888529D99A8B603EB345941C655
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 8fc420d273d1dbbec8efcd96eb189e3bf1348c19d32623c6df263b8b9f3168bc
      • Instruction ID: 5ba22731b7a259c9ff97db627134e0485341604aca8c3abb03d5fae11232cae2
      • Opcode Fuzzy Hash: 8fc420d273d1dbbec8efcd96eb189e3bf1348c19d32623c6df263b8b9f3168bc
      • Instruction Fuzzy Hash: 13114871210244CFD731DF15C9C8BEAB3B6FF98710F95842AD90A8F222CB31AA80CB10
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: c491e342abe94fe1d52c5faf868fe2989723703793feac2d4a1f289ff2ac636c
      • Instruction ID: 5021c5020a598dd2a36701353d854b8354f30967fe77af19a5aab36549f1a586
      • Opcode Fuzzy Hash: c491e342abe94fe1d52c5faf868fe2989723703793feac2d4a1f289ff2ac636c
      • Instruction Fuzzy Hash: FC011E3AC447A996D774CA58A848094B770BB0963CB5B038DDF756B3F2DB241E82878C
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 1c7057b99bbfdb360f51d6f9205ac55aa527941d68593f36b096df0c51ad11c2
      • Instruction ID: 345769228123f3b9518f8f509df8312db6f07fb44bdb340f2063ccca39edd480
      • Opcode Fuzzy Hash: 1c7057b99bbfdb360f51d6f9205ac55aa527941d68593f36b096df0c51ad11c2
      • Instruction Fuzzy Hash: D4C08C438490A30A1195B8742F44ABA88B38286A24386829034069A25CFC828E522480
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 4ba775aabdf0d2a55e6624732f259b3a90c7e170d6ac6c4cf349cb88e530cee0
      • Instruction ID: dc31f6672b170853de2da9f106d182633077a1d6c2b8f86218e6db96adef012e
      • Opcode Fuzzy Hash: 4ba775aabdf0d2a55e6624732f259b3a90c7e170d6ac6c4cf349cb88e530cee0
      • Instruction Fuzzy Hash: 28C092B72025818FEF16DB18E982F40B3E0FB19798B8C04E0E00ACF712D228EE40CA00
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.825566947.0000000002AD0000.00000040.00000001.sdmp, Offset: 02AD0000, based on PE: false
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: ad5489512d7b4f343dee42640b774e85f02627c68c5464dee338ccd406767c8d
      • Instruction ID: 4b3f1326f76c937de6503405a1688da9b4553711e98fb9704d2f5e022b7a8900
      • Opcode Fuzzy Hash: ad5489512d7b4f343dee42640b774e85f02627c68c5464dee338ccd406767c8d
      • Instruction Fuzzy Hash: 04B00275651640CFCF55CF09C595F4173B5F759B50F4155D4EC118BB11C365E900CB10
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • #672.MSVBVM60(00000000,40080000,00000000,3FF00000,00000000,3FF00000,00000000,3FF00000), ref: 0041383C
      • __vbaFpR8.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413842
      • __vbaNew2.MSVBVM60(00410D84,004145C0,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413867
      • __vbaLateMemCallLd.MSVBVM60(?,?,qTu9tyktlIOgozvLrZMBbdZxTILvo43,00000000), ref: 00413883
      • __vbaObjVar.MSVBVM60(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 0041388D
      • __vbaObjSetAddref.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 00413898
      • __vbaHresultCheckObj.MSVBVM60(00000000,0295004C,00410D74,0000000C), ref: 004138B2
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 004138BB
      • __vbaFreeVar.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00401176), ref: 004138C4
      • __vbaFreeObj.MSVBVM60(004138F6), ref: 004138EF
      Strings
      • qTu9tyktlIOgozvLrZMBbdZxTILvo43, xrefs: 00413877
      Memory Dump Source
      • Source File: 00000000.00000002.824896155.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.824880012.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.824946532.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.824965821.0000000000415000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$Free$#672AddrefCallCheckHresultLateNew2
      • String ID: qTu9tyktlIOgozvLrZMBbdZxTILvo43
      • API String ID: 263512575-2009357870
      • Opcode ID: 4cb1cde790545eb464053114bb3a8167544c938275a43a9d17ae03b155d86b56
      • Instruction ID: c253b1bfd5a0572f23cec325a0714bf761f95ab3cfca3d95f9ca873934ea1365
      • Opcode Fuzzy Hash: 4cb1cde790545eb464053114bb3a8167544c938275a43a9d17ae03b155d86b56
      • Instruction Fuzzy Hash: 83216D70800245ABDB10AFA5DE49FAABBB8FB84B01F10442AF541B21A0C7781584CF6C
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaAryConstruct2.MSVBVM60(?,00410E30,00000005), ref: 0041351C
      • #682.MSVBVM60(?,?), ref: 0041355D
      • __vbaFpR8.MSVBVM60 ref: 00413563
      • __vbaFreeVar.MSVBVM60 ref: 00413587
      • _adj_fdiv_m64.MSVBVM60 ref: 004135B9
      • __vbaFpI4.MSVBVM60(42FC0000,?,436E0000), ref: 004135E7
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00410808,000002C0,?,436E0000), ref: 0041361B
      • __vbaAryDestruct.MSVBVM60(00000000,?,00413646), ref: 0041363F
      Memory Dump Source
      • Source File: 00000000.00000002.824896155.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.824880012.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.824946532.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.824965821.0000000000415000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$#682CheckConstruct2DestructFreeHresult_adj_fdiv_m64
      • String ID:
      • API String ID: 4111779564-0
      • Opcode ID: e62ca088f5888306f1cf8c12939e7d5925f17c87f0bf71f1e0c03a6e5061250f
      • Instruction ID: b794b623ff05eb2fa41294c73b355869bf6e79cfb98e4157bd9c0308730c5ed9
      • Opcode Fuzzy Hash: e62ca088f5888306f1cf8c12939e7d5925f17c87f0bf71f1e0c03a6e5061250f
      • Instruction Fuzzy Hash: 42317074D01248EBCB04DF91DE48BEEBBB5FB48741F108126F541BA2A4C7785985CF58
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaVarTstNe.MSVBVM60(?,?), ref: 004136C4
      • __vbaInStr.MSVBVM60(00000000,Bebyrdelses9,Hvislendes8,FF96B5C0), ref: 004136DF
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.824896155.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.824880012.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.824946532.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.824965821.0000000000415000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba
      • String ID: Bebyrdelses9$Hvislendes8
      • API String ID: 3524132090-1996639642
      • Opcode ID: 4635f32193daae2aa8e47e09c039dc4039083a46a718858c23e34bc51cb6fe72
      • Instruction ID: b9e890dec8e843e3124d5b060597782141b10bbb870ffd677e771ac47927739a
      • Opcode Fuzzy Hash: 4635f32193daae2aa8e47e09c039dc4039083a46a718858c23e34bc51cb6fe72
      • Instruction Fuzzy Hash: 5E011AB4900258FBCB10DF99C989BDEBFBCBF08B44F14801AF504B7250D7B959898B99
      Uniqueness

      Uniqueness Score: -1.00%

      APIs
      • __vbaNew2.MSVBVM60(00410D84,004145C0), ref: 00413763
      • __vbaHresultCheckObj.MSVBVM60(00000000,0295004C,00410D74,0000004C), ref: 00413788
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410DB0,00000028), ref: 004137A8
      • __vbaFreeObj.MSVBVM60 ref: 004137B1
      Memory Dump Source
      • Source File: 00000000.00000002.824896155.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.824880012.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.824946532.0000000000414000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.824965821.0000000000415000.00000002.00020000.sdmp Download File
      Similarity
      • API ID: __vba$CheckHresult$FreeNew2
      • String ID:
      • API String ID: 4261391273-0
      • Opcode ID: 64a0bf905c91bf65d467e9ede08194cbd6a38aa1d719e52ca43387f3460232fc
      • Instruction ID: b08ee81b766199889998fc290562f6ca8260c0836c4478f53d241033f9c0e3b2
      • Opcode Fuzzy Hash: 64a0bf905c91bf65d467e9ede08194cbd6a38aa1d719e52ca43387f3460232fc
      • Instruction Fuzzy Hash: 8B1194B4640205ABD7009FA5DE49FDA7BF8FB05B05F104125F600E31E0D77859848798
      Uniqueness

      Uniqueness Score: -1.00%