Loading ...

Play interactive tourEdit tour

Windows Analysis Report Statement of Account.exe

Overview

General Information

Sample Name:Statement of Account.exe
Analysis ID:501915
MD5:0fb63e5eb6af1aff086e3c2a2321f716
SHA1:5e7e1db40c9104297c3b05b26c97a788eb92401b
SHA256:0b65815d462586870177898072a1500ec014a390eb466ea0dd716567ada4109a
Tags:exeguloader
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Potential malicious icon found
Yara detected GuLoader
C2 URLs / IPs found in malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Creates a DirectInput object (often for capturing keystrokes)
Uses 32bit PE files
Sample file is different than original file name gathered from version info
PE file contains strange resources
Contains functionality to read the PEB
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to call native functions
Program does not show much activity (idle)
Contains functionality for execution timing, often used to detect debuggers
Abnormal high CPU Usage

Classification

Process Tree

  • System is w10x64
  • Statement of Account.exe (PID: 6644 cmdline: 'C:\Users\user\Desktop\Statement of Account.exe' MD5: 0FB63E5EB6AF1AFF086E3C2A2321F716)
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=dow"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

    Sigma Overview

    No Sigma rule has matched

    Jbx Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Found malware configurationShow sources
    Source: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=dow"}
    Machine Learning detection for sampleShow sources
    Source: Statement of Account.exeJoe Sandbox ML: detected
    Source: Statement of Account.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

    Networking:

    barindex
    C2 URLs / IPs found in malware configurationShow sources
    Source: Malware configuration extractorURLs: https://drive.google.com/uc?export=dow
    Source: Statement of Account.exe, 00000000.00000002.1201052412.000000000079A000.00000004.00000020.sdmpBinary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

    System Summary:

    barindex
    Potential malicious icon foundShow sources
    Source: initial sampleIcon embedded in PE file: bad icon match: 20047c7c70f0e004
    Source: Statement of Account.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: Statement of Account.exe, 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameUnnec1.exe vs Statement of Account.exe
    Source: Statement of Account.exe, 00000000.00000002.1201717663.00000000029A0000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameUnnec1.exeFE2X vs Statement of Account.exe
    Source: Statement of Account.exeBinary or memory string: OriginalFilenameUnnec1.exe vs Statement of Account.exe
    Source: Statement of Account.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_004018680_2_00401868
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_0040228E0_2_0040228E
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_004032530_2_00403253
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_0040346F0_2_0040346F
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_004036120_2_00403612
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_004032D90_2_004032D9
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_004034FC0_2_004034FC
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_004033530_2_00403353
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_004033E40_2_004033E4
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_004035830_2_00403583
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_004031B30_2_004031B3
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00747DA90_2_00747DA9
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00749C650_2_00749C65
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00747D740_2_00747D74
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_0074A9150_2_0074A915
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_0074A6610_2_0074A661
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00747E390_2_00747E39
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00747BFE0_2_00747BFE
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00745FA10_2_00745FA1
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: String function: 0040177E appears 94 times
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00747DA9 NtAllocateVirtualMemory,0_2_00747DA9
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00747D74 NtAllocateVirtualMemory,0_2_00747D74
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00747E39 NtAllocateVirtualMemory,0_2_00747E39
    Source: C:\Users\user\Desktop\Statement of Account.exeProcess Stats: CPU usage > 98%
    Source: Statement of Account.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\Statement of Account.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: C:\Users\user\Desktop\Statement of Account.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
    Source: classification engineClassification label: mal76.rans.troj.evad.winEXE@1/0@0/0

    Data Obfuscation:

    barindex
    Yara detected GuLoaderShow sources
    Source: Yara matchFile source: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, type: MEMORY
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00403F55 push 00000043h; ret 0_2_00403F65
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_004021A3 push FFFFFFC6h; retf 0_2_00402213
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_004067B9 push eax; retf 0_2_004067BA
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_007434E9 push FFFFFF8Bh; retn 0008h0_2_00743562
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_0074355C push FFFFFF8Bh; retn 0008h0_2_00743562
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00744D58 push es; ret 0_2_00744EB7
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00742180 push edx; ret 0_2_00742199
    Source: initial sampleStatic PE information: section name: .text entropy: 6.83550763896
    Source: C:\Users\user\Desktop\Statement of Account.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\Statement of Account.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\Statement of Account.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\Statement of Account.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\Statement of Account.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\Statement of Account.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\Statement of Account.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\Statement of Account.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\Statement of Account.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: C:\Users\user\Desktop\Statement of Account.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00747A27 rdtsc 0_2_00747A27

    Anti Debugging:

    barindex
    Found potential dummy code loops (likely to delay analysis)Show sources
    Source: C:\Users\user\Desktop\Statement of Account.exeProcess Stats: CPU usage > 90% for more than 60s
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_0040228E mov ebx, dword ptr fs:[00000030h]0_2_0040228E
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_004031B3 mov ebx, dword ptr fs:[00000030h]0_2_004031B3
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_0074997B mov eax, dword ptr fs:[00000030h]0_2_0074997B
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00747608 mov eax, dword ptr fs:[00000030h]0_2_00747608
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00749E9C mov eax, dword ptr fs:[00000030h]0_2_00749E9C
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Users\user\Desktop\Statement of Account.exeCode function: 0_2_00747A27 rdtsc 0_2_00747A27
    Source: Statement of Account.exe, 00000000.00000002.1201243204.0000000000D20000.00000002.00020000.sdmpBinary or memory string: Program Manager
    Source: Statement of Account.exe, 00000000.00000002.1201243204.0000000000D20000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
    Source: Statement of Account.exe, 00000000.00000002.1201243204.0000000000D20000.00000002.00020000.sdmpBinary or memory string: Progman
    Source: Statement of Account.exe, 00000000.00000002.1201243204.0000000000D20000.00000002.00020000.sdmpBinary or memory string: Progmanlock

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11Input Capture1Security Software Discovery11Remote ServicesInput Capture1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsSoftware Packing1LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolArchive Collected Data1Exfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Deobfuscate/Decode Files or Information1NTDSSystem Information Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptObfuscated Files or Information3LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    Statement of Account.exe100%Joe Sandbox ML

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    No Antivirus matches

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    windowsupdate.s.llnwi.net
    178.79.242.128
    truefalse
      unknown

      Contacted IPs

      No contacted IP infos

      General Information

      Joe Sandbox Version:33.0.0 White Diamond
      Analysis ID:501915
      Start date:13.10.2021
      Start time:12:07:41
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 8m 36s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:Statement of Account.exe
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
      Number of analysed new started processes analysed:15
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • HCA enabled
      • EGA enabled
      • HDC enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Detection:MAL
      Classification:mal76.rans.troj.evad.winEXE@1/0@0/0
      EGA Information:Failed
      HDC Information:
      • Successful, ratio: 0.6% (good quality ratio 0.6%)
      • Quality average: 47%
      • Quality standard deviation: 8.2%
      HCA Information:Failed
      Cookbook Comments:
      • Adjust boot time
      • Enable AMSI
      • Found application associated with file extension: .exe
      • Override analysis time to 240s for sample files taking high CPU consumption
      Warnings:
      Show All
      • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
      • Excluded IPs from analysis (whitelisted): 95.100.218.79, 20.82.210.154, 209.197.3.8, 2.20.178.24, 2.20.178.33, 20.54.110.249, 40.112.88.60
      • Excluded domains from analysis (whitelisted): displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, cds.d2s7q6s2.hwcdn.net, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net
      • VT rate limit hit for: /opt/package/joesandbox/database/analysis/501915/sample/Statement of Account.exe

      Simulations

      Behavior and APIs

      No simulations

      Joe Sandbox View / Context

      IPs

      No context

      Domains

      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
      windowsupdate.s.llnwi.netjh6KzwrXQp.exeGet hashmaliciousBrowse
      • 178.79.242.0
      heX1kOkwqy.exeGet hashmaliciousBrowse
      • 178.79.242.0
      mixsix_20211013-084409.exeGet hashmaliciousBrowse
      • 178.79.242.0
      2rd Quater Order Quotation.zip.xlsGet hashmaliciousBrowse
      • 178.79.242.128
      DOC REC EIPT.htmlGet hashmaliciousBrowse
      • 178.79.242.128
      Efe-8 GPP Project Steel Pipe Tender.exeGet hashmaliciousBrowse
      • 178.79.242.128
      emil.franchi@global.com #Ud83d#Udce0 VGX47BBSBJ44838.HTMGet hashmaliciousBrowse
      • 178.79.242.128
      DHL Lieferschein,pdf.exeGet hashmaliciousBrowse
      • 178.79.242.128
      Payment_MT103.exeGet hashmaliciousBrowse
      • 178.79.242.0
      Doc-CS3.exeGet hashmaliciousBrowse
      • 178.79.242.128
      SecuriteInfo.com.Suspicious.Win32.Save.a.28039.exeGet hashmaliciousBrowse
      • 178.79.242.0
      oG3zl54AA5.exeGet hashmaliciousBrowse
      • 178.79.242.128
      dNlT8STqLN.exeGet hashmaliciousBrowse
      • 178.79.242.128
      Revised Quotation F657.exeGet hashmaliciousBrowse
      • 178.79.242.0
      Quotation Request.pdf.exeGet hashmaliciousBrowse
      • 178.79.242.0
      Proof of payment.jpg.exeGet hashmaliciousBrowse
      • 178.79.242.128
      vk5MXd2Rxm.msiGet hashmaliciousBrowse
      • 178.79.242.0
      jjBv8SpZXm.exeGet hashmaliciousBrowse
      • 178.79.242.128
      COPIA DE PAGO.exeGet hashmaliciousBrowse
      • 178.79.242.0
      Dekont.exeGet hashmaliciousBrowse
      • 178.79.242.0

      ASN

      No context

      JA3 Fingerprints

      No context

      Dropped Files

      No context

      Created / dropped Files

      No created / dropped files found

      Static File Info

      General

      File type:PE32 executable (GUI) Intel 80386, for MS Windows
      Entropy (8bit):6.361190831487217
      TrID:
      • Win32 Executable (generic) a (10002005/4) 99.15%
      • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
      • Generic Win/DOS Executable (2004/3) 0.02%
      • DOS Executable Generic (2002/1) 0.02%
      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
      File name:Statement of Account.exe
      File size:135168
      MD5:0fb63e5eb6af1aff086e3c2a2321f716
      SHA1:5e7e1db40c9104297c3b05b26c97a788eb92401b
      SHA256:0b65815d462586870177898072a1500ec014a390eb466ea0dd716567ada4109a
      SHA512:4dfd892dec9c4182005f668b201063085c6868085c2f556791c5654516ce9a4be9c7a7c887e0da182f7cfb29c5690cf45638fb6749bf49e7ba74929d82c35a82
      SSDEEP:1536:5sYs89TfPXmlAo30SC66Biy2bbMSekC7dY5KwchyuGWawkANvv0LLhQ4sZiDNmMN:5JXS0SC6aiyCYUKw7T3hBd
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L....u.W.....................`......h.............@.............B..

      File Icon

      Icon Hash:20047c7c70f0e004

      Static PE Info

      General

      Entrypoint:0x401868
      Entrypoint Section:.text
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
      DLL Characteristics:
      Time Stamp:0x578A7516 [Sat Jul 16 17:55:34 2016 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:c727a98e677fb7bd25bb06d2a2d956f1

      Entrypoint Preview

      Instruction
      push 00410428h
      call 00007FF908AFFBA5h
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      xor byte ptr [eax], al
      add byte ptr [eax], al
      cmp byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      xchg eax, ebp
      xchg eax, ecx
      shr dword ptr [8B4B3A7Ch+ebx*2], FFFFFFC8h
      mov bl, 0Bh
      mov byte ptr [si-61h], bl
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add dword ptr [eax], eax
      add byte ptr [eax], al
      inc edx
      add byte ptr [esi], al
      push eax
      add dword ptr [ecx], 6Ch
      popad
      je 00007FF908AFFC26h
      imul esp, dword ptr [ebx+00h], 00000002h
      add bh, bh
      int3
      xor dword ptr [eax], eax
      and ebp, dword ptr [ecx+51ABB3F1h]
      jmp far 173Bh : 9F8F446Ch
      popad
      pop edi
      jne 00007FF908AFFC05h
      mov dl, 26h
      inc ecx
      call 00007FF9546F6925h
      lahf
      push esi
      jne 00007FF908AFFBA3h
      in eax, dx
      jmp 00007FF908AFFB49h
      mov eax, 33AD4F3Ah
      cdq
      iretw
      adc dword ptr [edi+00AA000Ch], esi
      pushad
      rcl dword ptr [ebx+00000000h], cl
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      and dl, ch
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      push es
      add byte ptr [ebx+79h], dl
      jnc 00007FF908AFFC2Ch
      add byte ptr fs:[50000501h], cl
      push edx
      dec ecx
      pop edx
      inc ebp
      add byte ptr [ecx], bl
      add dword ptr [eax], eax
      inc edx
      add byte ptr [edx], ah
      add byte ptr [00005000h+eax], ah

      Data Directories

      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0x1a9b40x28.text
      IMAGE_DIRECTORY_ENTRY_RESOURCE0x1c0000x4562.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2280x20
      IMAGE_DIRECTORY_ENTRY_IAT0x10000x154.text
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

      Sections

      NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x10000x19ef00x1a000False0.567673903245data6.83550763896IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
      .data0x1b0000xaf00x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
      .rsrc0x1c0000x45620x5000False0.396142578125data4.61030929614IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

      Resources

      NameRVASizeTypeLanguageCountry
      DATA0x1ca740x3aeeMS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixelEnglishUnited States
      RT_ICON0x1c9440x130data
      RT_ICON0x1c65c0x2e8data
      RT_ICON0x1c5340x128GLS_BINARY_LSB_FIRST
      RT_GROUP_ICON0x1c5040x30data
      RT_VERSION0x1c1a00x364dataEnglishUnited States

      Imports

      DLLImport
      MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryDestruct, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaStrToAnsi, __vbaVarDup, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

      Version Infos

      DescriptionData
      Translation0x0409 0x04b0
      LegalCopyrightRealNetworks, Inc.
      InternalNameUnnec1
      FileVersion66.00
      CompanyNameRealNetworks, Inc.
      LegalTrademarksRealNetworks, Inc.
      CommentsRealNetworks, Inc.
      ProductNameRealNetworks, Inc.
      ProductVersion66.00
      FileDescriptionRealNetworks, Inc.
      OriginalFilenameUnnec1.exe

      Possible Origin

      Language of compilation systemCountry where language is spokenMap
      EnglishUnited States

      Network Behavior

      No network behavior found

      Code Manipulations

      Statistics

      CPU Usage

      Click to jump to process

      Memory Usage

      Click to jump to process

      System Behavior

      General

      Start time:12:08:43
      Start date:13/10/2021
      Path:C:\Users\user\Desktop\Statement of Account.exe
      Wow64 process (32bit):true
      Commandline:'C:\Users\user\Desktop\Statement of Account.exe'
      Imagebase:0x400000
      File size:135168 bytes
      MD5 hash:0FB63E5EB6AF1AFF086E3C2A2321F716
      Has elevated privileges:true
      Has administrator privileges:true
      Programmed in:Visual Basic
      Yara matches:
      • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, Author: Joe Security
      Reputation:low

      Disassembly

      Code Analysis

      Reset < >

        Executed Functions

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID:
        • String ID: 2{(
        • API String ID: 0-567337003
        • Opcode ID: 63439c9ec744c1406257ffd94406b24432308e06ab6f5143b9fa5000b0fb8a40
        • Instruction ID: 57ba11aa83dfed3106d619c5ea88a7ba6c2d691ffbf575091fe2677b5d8bb17a
        • Opcode Fuzzy Hash: 63439c9ec744c1406257ffd94406b24432308e06ab6f5143b9fa5000b0fb8a40
        • Instruction Fuzzy Hash: CC0382137CE3C087CF064679A4604E1BFA64F9F16833DB9ED90F99A276DB7688058B44
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: #100
        • String ID: VB5!6&*
        • API String ID: 1341478452-3593831657
        • Opcode ID: f2279260892cb21ade80456d067ea20da467df8b311742760409f2a7a34d1920
        • Instruction ID: 2c794714ff59fb297c0d733b3354e0d028a4b7cf92a481e287fc4f878059adb1
        • Opcode Fuzzy Hash: f2279260892cb21ade80456d067ea20da467df8b311742760409f2a7a34d1920
        • Instruction Fuzzy Hash: C642887144E3C18FD7138B709DA55A27FB0EE1331431E05DBC8C19E1B3E2296A6ADB66
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • NtAllocateVirtualMemory.NTDLL(-49925038,?,-025E0F1F), ref: 00747FC2
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, Offset: 00740000, based on PE: false
        Yara matches
        Similarity
        • API ID: AllocateMemoryVirtual
        • String ID: @w<
        • API String ID: 2167126740-3413300001
        • Opcode ID: 2260817a5f83d91307e0b3d6ee21f0b7a118b36bf15ceff1294f0ad6ac63a192
        • Instruction ID: e443e58e32af5c7fe7dfcbb79e37747767b5ee3e3bea005957e85c9d8a6455ab
        • Opcode Fuzzy Hash: 2260817a5f83d91307e0b3d6ee21f0b7a118b36bf15ceff1294f0ad6ac63a192
        • Instruction Fuzzy Hash: 42716671A042898FDB30DE68CD907DE77A3EF99354F60422EDD4D9B211D7358A42CB42
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • NtAllocateVirtualMemory.NTDLL(-49925038,?,-025E0F1F), ref: 00747FC2
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, Offset: 00740000, based on PE: false
        Yara matches
        Similarity
        • API ID: AllocateMemoryVirtual
        • String ID: @w<
        • API String ID: 2167126740-3413300001
        • Opcode ID: 0d07282e462c2c7a9cc15a883361fd9ac5cfe34de17c22de81de55124f842c82
        • Instruction ID: 1cb654231d0d30a7913b0df7fce45cb80bcfe02a8b535d852e7f887fccac2a58
        • Opcode Fuzzy Hash: 0d07282e462c2c7a9cc15a883361fd9ac5cfe34de17c22de81de55124f842c82
        • Instruction Fuzzy Hash: 166123316043898FDB70DE69CD907DE77A2EF99390F64862EDC899B251D7318A41CB42
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID:
        • String ID: 2{(
        • API String ID: 0-567337003
        • Opcode ID: 37ac4fe554e2ba704bd6d92e82d548658d6afe85cfcafad7e521a8da8b78cc77
        • Instruction ID: 947d9fee064a10136ea1cdf8bb06c12ffb6e450ced2c0a112f069f309a5908aa
        • Opcode Fuzzy Hash: 37ac4fe554e2ba704bd6d92e82d548658d6afe85cfcafad7e521a8da8b78cc77
        • Instruction Fuzzy Hash: A0E14962B097000B875998BE48D0957D4C79FEE26133AE63E212DF33A9FDB9CD4B1148
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • NtAllocateVirtualMemory.NTDLL(-49925038,?,-025E0F1F), ref: 00747FC2
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, Offset: 00740000, based on PE: false
        Yara matches
        Similarity
        • API ID: AllocateMemoryVirtual
        • String ID: @w<
        • API String ID: 2167126740-3413300001
        • Opcode ID: 56a35f70e3e253e383dc354e8cc5be57bcaca9c2d608c0b415985f0276b167d1
        • Instruction ID: 285610f0f6a66523196a26953cf308effffcaf5b07dcd51313f81d888e34eea0
        • Opcode Fuzzy Hash: 56a35f70e3e253e383dc354e8cc5be57bcaca9c2d608c0b415985f0276b167d1
        • Instruction Fuzzy Hash: 705135316043898FDB70DE68CD917DE77A2EF5A394F64462EDC8D9B221CB318A41CB42
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID:
        • String ID: 2{(
        • API String ID: 0-567337003
        • Opcode ID: 95da383446e1338b1e0ed8ab0d5066364683ed2832b50d849d78dac53b13ca24
        • Instruction ID: 8950c05e6a813930741275e85335b9a444677e5ef7e39b43e91fdcc1b75ebf84
        • Opcode Fuzzy Hash: 95da383446e1338b1e0ed8ab0d5066364683ed2832b50d849d78dac53b13ca24
        • Instruction Fuzzy Hash: BAD13962B097000B875998BE58D0957C4C79FEE26133AE63A212DF73A9FDB9CD4B1148
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID:
        • String ID: 2{(
        • API String ID: 0-567337003
        • Opcode ID: 7133e379a9b8e5a3c5643b549c29c2d4bd44f872e3825206a6979d52cdf5853f
        • Instruction ID: f16e2acfd0e3d663043f54b79206c011ee0c0cd3ac5b06e019f1c480bf830ba8
        • Opcode Fuzzy Hash: 7133e379a9b8e5a3c5643b549c29c2d4bd44f872e3825206a6979d52cdf5853f
        • Instruction Fuzzy Hash: 29C13962B097000B875998BE58D0957C4C79FEE26137AE63E212DF33A9FDB9CD4B1148
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID:
        • String ID: 2{(
        • API String ID: 0-567337003
        • Opcode ID: 9bafb642ba8771cdb79815446434c9d8df5ca1fc5a3162c5862e7c6cd4c5b18a
        • Instruction ID: 7151c6f5333340f095987206affb5e2a67d0a34353a51c582d9de604444780a8
        • Opcode Fuzzy Hash: 9bafb642ba8771cdb79815446434c9d8df5ca1fc5a3162c5862e7c6cd4c5b18a
        • Instruction Fuzzy Hash: 71D14C62B097000B875998BF48D0957D4C79FEE26133AE63A212EF73A5FDB9CD4B1148
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID:
        • String ID: 2{(
        • API String ID: 0-567337003
        • Opcode ID: 1970cee312d0d5cba3fb0834d3bd40a772140d6f9adeff9ac83d3305707a7985
        • Instruction ID: bcc092de0a3615e329720e0a71a25a2e390fc814cf5eb41a1a7b0cd836596205
        • Opcode Fuzzy Hash: 1970cee312d0d5cba3fb0834d3bd40a772140d6f9adeff9ac83d3305707a7985
        • Instruction Fuzzy Hash: 90A12862B097000B875998BF48D0957C4C79FEE26137AE63A612DF33A5FDB9CD4B1188
        Uniqueness

        Uniqueness Score: -1.00%

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID:
        • String ID: 2{(
        • API String ID: 0-567337003
        • Opcode ID: 93139a3b17a322932cb2b2bf55e2cb6771939e3f6acc73521039b399c13c644e
        • Instruction ID: a230e582f750caac10f177c00e109ccf0cdbc82802e96d4a350e730dcfd92b6b
        • Opcode Fuzzy Hash: 93139a3b17a322932cb2b2bf55e2cb6771939e3f6acc73521039b399c13c644e
        • Instruction Fuzzy Hash: BDB16962B0A7000B875998BE48D0957C4C79FEE26137AE63E612DF33A5FDB9CD4B1148
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • VirtualAlloc.KERNELBASE(00000000,00011000,-5C92AE07,DA412600), ref: 0040390A
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID: 2{(
        • API String ID: 4275171209-567337003
        • Opcode ID: b58fb5a4e213150918a9a87e2ae998d2608cb7436f9872effb9f1a792e8aa5f9
        • Instruction ID: 174071516bc3faeda928163bf9cdbca5260201ddd388679fb1a309d28c89e731
        • Opcode Fuzzy Hash: b58fb5a4e213150918a9a87e2ae998d2608cb7436f9872effb9f1a792e8aa5f9
        • Instruction Fuzzy Hash: F8913862B0A7000B875998BE48D0957C4C79FEE26133AE63E612DF33A5FDB9CD4B1548
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • VirtualAlloc.KERNELBASE(00000000,00011000,-5C92AE07,DA412600), ref: 0040390A
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID: 2{(
        • API String ID: 4275171209-567337003
        • Opcode ID: 86a96efbd91a2241dbeec3f46f6806bb8c3649e48e4b5517877a609b17666be7
        • Instruction ID: 8e3dfb4cff514a221e44cb6d15c2739243af014dc1e86412a64fc0d124e27755
        • Opcode Fuzzy Hash: 86a96efbd91a2241dbeec3f46f6806bb8c3649e48e4b5517877a609b17666be7
        • Instruction Fuzzy Hash: 2B916B22B097000B875998BE48D0957C4C79FEE26133AE63E612EF73A5FD79CD4B1148
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • VirtualAlloc.KERNELBASE(00000000,00011000,-5C92AE07,DA412600), ref: 0040390A
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID: 2{(
        • API String ID: 4275171209-567337003
        • Opcode ID: 72852831ac85888f31d5929a07fd4d940197d7f020247b501924e0e3b3e42bd6
        • Instruction ID: 1b89e3a78a08d88fc6b35615d353f5eaf0a9b9d23ddac29f1a9a1e7fbdca70ef
        • Opcode Fuzzy Hash: 72852831ac85888f31d5929a07fd4d940197d7f020247b501924e0e3b3e42bd6
        • Instruction Fuzzy Hash: 9F716962B097000B875998BE48D0957C4C79FEE26133AE63E612EF73A5FD79CD4B1248
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • VirtualAlloc.KERNELBASE(00000000,00011000,-5C92AE07,DA412600), ref: 0040390A
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID: 2{(
        • API String ID: 4275171209-567337003
        • Opcode ID: 13fbe8721932b69cefba68eb82371b60d50631d2881a3e99bb9eb0cbf78e6e1c
        • Instruction ID: 42bd114ca400c69f24f0e41a2cc27bfa66053e6f9ed75c70f0d3eea71acad7d5
        • Opcode Fuzzy Hash: 13fbe8721932b69cefba68eb82371b60d50631d2881a3e99bb9eb0cbf78e6e1c
        • Instruction Fuzzy Hash: D7615B62B097000B8759987E48D0967C4C79FEE26133AE63E612DF73A5FE79CD4B1188
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • VirtualAlloc.KERNELBASE(00000000,00011000,-5C92AE07,DA412600), ref: 0040390A
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID: 2{(
        • API String ID: 4275171209-567337003
        • Opcode ID: e38e0567e9d0852ac44c111e577793df70aa441cc8bb6fe02fc38f118e2bf7e4
        • Instruction ID: daee14b9e8d8c0ba62b7f91f15ed38cde81c88e1eb9abac6eb78a7f656e098f5
        • Opcode Fuzzy Hash: e38e0567e9d0852ac44c111e577793df70aa441cc8bb6fe02fc38f118e2bf7e4
        • Instruction Fuzzy Hash: 8F516C26B0A7000B875998BE48D0967C4C79FEE221339E53E612DF73A5ED79CD4B1188
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • VirtualAlloc.KERNELBASE(00000000,00011000,-5C92AE07,DA412600), ref: 0040390A
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID: 2{(
        • API String ID: 4275171209-567337003
        • Opcode ID: 5395e1c0db93b5d92d38d84c6ecdd7b9292325e04f4e73af1cdfbc3cc884377e
        • Instruction ID: f4e0ec912a1b2658e752b9fbdbe7cba7a6201791b84baff7a504778cf6baa33e
        • Opcode Fuzzy Hash: 5395e1c0db93b5d92d38d84c6ecdd7b9292325e04f4e73af1cdfbc3cc884377e
        • Instruction Fuzzy Hash: 76518F22B097004B8759987E48D0967D4C79FEE221339E53E612EF73A4ED79CD4B158C
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • VirtualAlloc.KERNELBASE(00000000,00011000,-5C92AE07,DA412600), ref: 0040390A
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID: 2{(
        • API String ID: 4275171209-567337003
        • Opcode ID: c1686dfa350538e48e9782e03870f0cbd5073a0587a304749a603386d589496b
        • Instruction ID: b1c1a8f7e7d4cc0f710186e2c7d22a70eac7b6bddaf0fda48543274677d6c2a0
        • Opcode Fuzzy Hash: c1686dfa350538e48e9782e03870f0cbd5073a0587a304749a603386d589496b
        • Instruction Fuzzy Hash: D5416C26B0A7004B875D987E48D0967C4C79FDE211339E53E651EF73A4ED79CD4B2188
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • VirtualAlloc.KERNELBASE(00000000,00011000,-5C92AE07,DA412600), ref: 0040390A
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: AllocVirtual
        • String ID: 2{(
        • API String ID: 4275171209-567337003
        • Opcode ID: 2490c3e836596be41fbf223f9b9c15065f801fe6a25ac3ed99bd4a3f14e8a27b
        • Instruction ID: 8895b614794365ed2771c7c91adefafcfa401f59e4367f400fae7f5c2f8659ea
        • Opcode Fuzzy Hash: 2490c3e836596be41fbf223f9b9c15065f801fe6a25ac3ed99bd4a3f14e8a27b
        • Instruction Fuzzy Hash: 3E418D22B0A7000B8719887E44D085794C79FDA221339E53E501EF7365ED79CD4B158C
        Uniqueness

        Uniqueness Score: -1.00%

        Non-executed Functions

        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, Offset: 00740000, based on PE: false
        Yara matches
        Similarity
        • API ID:
        • String ID: CN$5dZ$gobe
        • API String ID: 0-4277095857
        • Opcode ID: 4247333309cf527ebfc45ec9a4ca210696b6fe47f5fa230874a6a5218a89d2e0
        • Instruction ID: 3293c3096e0ade01f2c7343c523c81fe7be33ab5307f1df004f4213db03d927d
        • Opcode Fuzzy Hash: 4247333309cf527ebfc45ec9a4ca210696b6fe47f5fa230874a6a5218a89d2e0
        • Instruction Fuzzy Hash: 1271147164830A9FEB249E39CD547DA7BF2BF95390F85412EDDC997214D33489868F02
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, Offset: 00740000, based on PE: false
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 11c0faef243d701a8da630eec0ce6decdd5e56faf82340bea598c90c56ec46b2
        • Instruction ID: 99d1b8a476f305f24246bc6b235537e4f6e241fd9311b5e76e88b3ebf0f7c924
        • Opcode Fuzzy Hash: 11c0faef243d701a8da630eec0ce6decdd5e56faf82340bea598c90c56ec46b2
        • Instruction Fuzzy Hash: 725118716453869FDF319E3889A97DB3BE2AF52350F980129CDC8CB252D335CA48CB11
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, Offset: 00740000, based on PE: false
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: e510cb3bbf8a7a733afd195a407b45b5acb8393e1dff3638b5c2459cf00bbde0
        • Instruction ID: aa16b5f09d95f576ea25ce57976f53db1cc36b48f663256ff7035363e609b478
        • Opcode Fuzzy Hash: e510cb3bbf8a7a733afd195a407b45b5acb8393e1dff3638b5c2459cf00bbde0
        • Instruction Fuzzy Hash: 6941EF7164138ADFDB34DE2889A8BDF37A2AF6A750F944129DD888B205D3349A85CB11
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, Offset: 00740000, based on PE: false
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 04907c20c89cb2811950e50d30480976063644bcc66ec0e0be1f8f6d92b9f68b
        • Instruction ID: e5361b837c1659a1cbc4057cfaadc144a70db726b9d5f83f6ff49511262344cc
        • Opcode Fuzzy Hash: 04907c20c89cb2811950e50d30480976063644bcc66ec0e0be1f8f6d92b9f68b
        • Instruction Fuzzy Hash: F931047164138A9FDF34DE398E68BCF37A2AF567A0F940129DC888B215D335CA44CA11
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, Offset: 00740000, based on PE: false
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: f0fdd3e42e1386980ebb2a5cae81ab77c3ac756c6d7673f923af5c53eee5d92e
        • Instruction ID: f57a9852d6a478bcf5cea1bb0f3ad14f3b0a6b27ed06b61a660950f02a7ee8b6
        • Opcode Fuzzy Hash: f0fdd3e42e1386980ebb2a5cae81ab77c3ac756c6d7673f923af5c53eee5d92e
        • Instruction Fuzzy Hash: 4B2108397453479FDB209E29C4E07D777A1EF6B760B9A411ACC86C7351E3349846C642
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, Offset: 00740000, based on PE: false
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 41ce5d0ae3c1866cba01f31cba84cdd73d98ed07d03a1e7abfce0e36ac80f7d7
        • Instruction ID: 0de12fa2d11b1719dc57fa0a66ae65e5a9036a709a23fa07a5ed2002375cb59e
        • Opcode Fuzzy Hash: 41ce5d0ae3c1866cba01f31cba84cdd73d98ed07d03a1e7abfce0e36ac80f7d7
        • Instruction Fuzzy Hash: AD213B7558124A8BDB3C9E3C8C383EB33A2AF96350FD5811EDC4BDB245CB3186428A05
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, Offset: 00740000, based on PE: false
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: c145d129d7f599ffdf14f69ffd97e29c091dcf6501a2544e0235a76cfb7891c8
        • Instruction ID: 343252ad2be81e6409891f50ed14797febed70e3b2901fe4f5f7e6d0d189bb8d
        • Opcode Fuzzy Hash: c145d129d7f599ffdf14f69ffd97e29c091dcf6501a2544e0235a76cfb7891c8
        • Instruction Fuzzy Hash: 84210471A143059FEB281EB489957EBFBA6BF51750F02061D8CC793190D7708588CF06
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, Offset: 00740000, based on PE: false
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 6d54f3f1599d54fa1911934bfd1a0bdc3845ce355a0aba3ac547e89bf068dba4
        • Instruction ID: 799b702df3a06438af4d5ac51eddfba5f71e89b1e1db87c8dc232b407ab9d5c9
        • Opcode Fuzzy Hash: 6d54f3f1599d54fa1911934bfd1a0bdc3845ce355a0aba3ac547e89bf068dba4
        • Instruction Fuzzy Hash: 18C04CB76004878BE745DA08C471B4173A6F765658FC406D4F113CB6E1D324ED508900
        Uniqueness

        Uniqueness Score: -1.00%

        Memory Dump Source
        • Source File: 00000000.00000002.1200992906.0000000000740000.00000040.00000001.sdmp, Offset: 00740000, based on PE: false
        Yara matches
        Similarity
        • API ID:
        • String ID:
        • API String ID:
        • Opcode ID: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
        • Instruction ID: f1647c15dfe5582e2114d8b48c9dc7a79c4e1b76aa7bcc19d5d00c5bce2ac4c7
        • Opcode Fuzzy Hash: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
        • Instruction Fuzzy Hash:
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 53%
        			E0041A61B(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12) {
        				char _v8;
        				intOrPtr _v12;
        				intOrPtr _v16;
        				char _v28;
        				char _v32;
        				char _v36;
        				void* _v44;
        				intOrPtr _v52;
        				char _v60;
        				intOrPtr _v68;
        				char _v76;
        				char _v80;
        				char* _t56;
        				void* _t58;
        				intOrPtr* _t59;
        				void* _t60;
        				void* _t62;
        				intOrPtr* _t63;
        				void* _t64;
        				void* _t66;
        				intOrPtr* _t67;
        				void* _t68;
        				void* _t71;
        				intOrPtr* _t72;
        				void* _t73;
        				char _t75;
        				intOrPtr _t76;
        				void* _t107;
        				intOrPtr* _t109;
        				intOrPtr* _t111;
        				intOrPtr* _t112;
        				intOrPtr* _t113;
        				intOrPtr* _t114;
        				intOrPtr* _t115;
        				intOrPtr* _t116;
        				intOrPtr* _t117;
        				intOrPtr* _t118;
        				void* _t119;
        				void* _t121;
        				intOrPtr _t122;
        				void* _t126;
        				void* _t135;
        
        				_t122 = _t121 - 0xc;
        				 *[fs:0x0] = _t122;
        				_v16 = _t122 - 0x50;
        				_v12 = 0x401650;
        				_t75 = 0;
        				_v8 = 0;
        				_t109 = _a4;
        				 *((intOrPtr*)( *_t109 + 4))(_t109, __edi, __esi, __ebx,  *[fs:0x0], 0x401676, _t119);
        				_v28 = 0;
        				_v32 = 0;
        				_v36 = 0;
        				_v44 = 0;
        				_v60 = 0;
        				_v76 = 0;
        				_v80 = 0;
        				L0040177E();
        				_v68 = _t109;
        				_v76 = 9;
        				L00401760();
        				_t56 =  &_v60;
        				_push(_t56);
        				L0040170C();
        				L00401802();
        				if( ~(0 | _t56 != 0x0000ffff) == 0) {
        					_t107 = 0x4120b4;
        				} else {
        					_t126 =  *0x41b380 - _t75; // 0x222e8cc
        					if(_t126 == 0) {
        						_push(0x41b380);
        						_push(0x4120c4);
        						L00401838();
        					}
        					_t113 =  *0x41b380; // 0x222e8cc
        					_t62 =  *((intOrPtr*)( *_t113 + 0x14))(_t113,  &_v44);
        					asm("fclex");
        					if(_t62 >= _t75) {
        						_t107 = 0x4120b4;
        					} else {
        						_t107 = 0x4120b4;
        						_push(0x14);
        						_push(0x4120b4);
        						_push(_t113);
        						_push(_t62);
        						L00401832();
        					}
        					_t63 = _v44;
        					_t76 = 1;
        					_t114 = _t63;
        					_t64 =  *((intOrPtr*)( *_t63 + 0x138))(_t63, L"Sprinkelvrkernes", _t76);
        					asm("fclex");
        					if(_t64 < 0) {
        						_push(0x138);
        						_push(0x4120d4);
        						_push(_t114);
        						_push(_t64);
        						L00401832();
        					}
        					L0040182C();
        					if( *0x41b380 == 0) {
        						_push(0x41b380);
        						_push(0x4120c4);
        						L00401838();
        					}
        					_t115 =  *0x41b380; // 0x222e8cc
        					_t66 =  *((intOrPtr*)( *_t115 + 0x14))(_t115,  &_v44);
        					asm("fclex");
        					if(_t66 < 0) {
        						_push(0x14);
        						_push(_t107);
        						_push(_t115);
        						_push(_t66);
        						L00401832();
        					}
        					_t67 = _v44;
        					_t116 = _t67;
        					_t68 =  *((intOrPtr*)( *_t67 + 0x138))(_t67, L"Inferencing", _t76);
        					asm("fclex");
        					if(_t68 < 0) {
        						_push(0x138);
        						_push(0x4120d4);
        						_push(_t116);
        						_push(_t68);
        						L00401832();
        					}
        					L0040182C();
        					_push(0);
        					_push( &_v60);
        					_v52 = _t76;
        					_v60 = 2;
        					L0040171E();
        					L0040183E();
        					L00401802();
        					if( *0x41b380 == 0) {
        						_push(0x41b380);
        						_push(0x4120c4);
        						L00401838();
        					}
        					_t117 =  *0x41b380; // 0x222e8cc
        					_t71 =  *((intOrPtr*)( *_t117 + 0x1c))(_t117,  &_v44);
        					asm("fclex");
        					if(_t71 < 0) {
        						_push(0x1c);
        						_push(_t107);
        						_push(_t117);
        						_push(_t71);
        						L00401832();
        					}
        					_t72 = _v44;
        					_t118 = _t72;
        					_t73 =  *((intOrPtr*)( *_t72 + 0x50))(_t72);
        					asm("fclex");
        					if(_t73 < 0) {
        						_push(0x50);
        						_push(0x412108);
        						_push(_t118);
        						_push(_t73);
        						L00401832();
        					}
        					L0040182C();
        					_t75 = 0;
        				}
        				_t135 =  *0x41b380 - _t75; // 0x222e8cc
        				if(_t135 == 0) {
        					_push(0x41b380);
        					_push(0x4120c4);
        					L00401838();
        				}
        				_t111 =  *0x41b380; // 0x222e8cc
        				_t58 =  *((intOrPtr*)( *_t111 + 0x14))(_t111,  &_v44);
        				asm("fclex");
        				if(_t58 < _t75) {
        					_push(0x14);
        					_push(_t107);
        					_push(_t111);
        					_push(_t58);
        					L00401832();
        				}
        				_t59 = _v44;
        				_t112 = _t59;
        				_t60 =  *((intOrPtr*)( *_t59 + 0x68))(_t59,  &_v80);
        				asm("fclex");
        				if(_t60 < _t75) {
        					_push(0x68);
        					_push(0x4120d4);
        					_push(_t112);
        					_push(_t60);
        					L00401832();
        				}
        				L0040182C();
        				L00401706();
        				L0040183E();
        				_push(0x41a8c4);
        				L004017E4();
        				L004017E4();
        				L004017E4();
        				return _t60;
        			}













































        0x0041a61e
        0x0041a62d
        0x0041a63a
        0x0041a63d
        0x0041a644
        0x0041a646
        0x0041a649
        0x0041a64f
        0x0041a658
        0x0041a65b
        0x0041a65e
        0x0041a661
        0x0041a664
        0x0041a667
        0x0041a66a
        0x0041a66d
        0x0041a678
        0x0041a67b
        0x0041a682
        0x0041a687
        0x0041a68a
        0x0041a68b
        0x0041a6a1
        0x0041a6a9
        0x0041a81d
        0x0041a6af
        0x0041a6af
        0x0041a6b5
        0x0041a6b7
        0x0041a6bc
        0x0041a6c1
        0x0041a6c1
        0x0041a6c6
        0x0041a6d3
        0x0041a6d8
        0x0041a6da
        0x0041a6ed
        0x0041a6dc
        0x0041a6dc
        0x0041a6e1
        0x0041a6e3
        0x0041a6e4
        0x0041a6e5
        0x0041a6e6
        0x0041a6e6
        0x0041a6f2
        0x0041a6f7
        0x0041a6f8
        0x0041a703
        0x0041a70b
        0x0041a70d
        0x0041a70f
        0x0041a714
        0x0041a719
        0x0041a71a
        0x0041a71b
        0x0041a71b
        0x0041a723
        0x0041a72f
        0x0041a731
        0x0041a736
        0x0041a73b
        0x0041a73b
        0x0041a740
        0x0041a74d
        0x0041a752
        0x0041a754
        0x0041a756
        0x0041a758
        0x0041a759
        0x0041a75a
        0x0041a75b
        0x0041a75b
        0x0041a760
        0x0041a76c
        0x0041a76e
        0x0041a776
        0x0041a778
        0x0041a77a
        0x0041a77f
        0x0041a784
        0x0041a785
        0x0041a786
        0x0041a786
        0x0041a78e
        0x0041a796
        0x0041a798
        0x0041a799
        0x0041a79c
        0x0041a7a3
        0x0041a7ad
        0x0041a7b5
        0x0041a7c1
        0x0041a7c3
        0x0041a7c8
        0x0041a7cd
        0x0041a7cd
        0x0041a7d2
        0x0041a7df
        0x0041a7e4
        0x0041a7e6
        0x0041a7e8
        0x0041a7ea
        0x0041a7eb
        0x0041a7ec
        0x0041a7ed
        0x0041a7ed
        0x0041a7f2
        0x0041a7f6
        0x0041a7fa
        0x0041a7ff
        0x0041a801
        0x0041a803
        0x0041a805
        0x0041a80a
        0x0041a80b
        0x0041a80c
        0x0041a80c
        0x0041a814
        0x0041a819
        0x0041a819
        0x0041a822
        0x0041a828
        0x0041a82a
        0x0041a82f
        0x0041a834
        0x0041a834
        0x0041a839
        0x0041a846
        0x0041a84b
        0x0041a84d
        0x0041a84f
        0x0041a851
        0x0041a852
        0x0041a853
        0x0041a854
        0x0041a854
        0x0041a859
        0x0041a863
        0x0041a865
        0x0041a86a
        0x0041a86c
        0x0041a86e
        0x0041a870
        0x0041a875
        0x0041a876
        0x0041a877
        0x0041a877
        0x0041a87f
        0x0041a884
        0x0041a88e
        0x0041a893
        0x0041a8ae
        0x0041a8b6
        0x0041a8be
        0x0041a8c3

        APIs
        • __vbaStrCopy.MSVBVM60 ref: 0041A66D
        • __vbaVarDup.MSVBVM60 ref: 0041A682
        • #562.MSVBVM60(?), ref: 0041A68B
        • __vbaFreeVar.MSVBVM60(?), ref: 0041A6A1
        • __vbaNew2.MSVBVM60(004120C4,0041B380,?), ref: 0041A6C1
        • __vbaHresultCheckObj.MSVBVM60(00000000,0222E8CC,004120B4,00000014), ref: 0041A6E6
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120D4,00000138), ref: 0041A71B
        • __vbaFreeObj.MSVBVM60(00000000,?,004120D4,00000138), ref: 0041A723
        • __vbaNew2.MSVBVM60(004120C4,0041B380), ref: 0041A73B
        • __vbaHresultCheckObj.MSVBVM60(00000000,0222E8CC,004120B4,00000014), ref: 0041A75B
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120D4,00000138), ref: 0041A786
        • __vbaFreeObj.MSVBVM60(00000000,?,004120D4,00000138), ref: 0041A78E
        • #705.MSVBVM60(?,00000000), ref: 0041A7A3
        • __vbaStrMove.MSVBVM60(?,00000000), ref: 0041A7AD
        • __vbaFreeVar.MSVBVM60(?,00000000), ref: 0041A7B5
        • __vbaNew2.MSVBVM60(004120C4,0041B380,?,00000000), ref: 0041A7CD
        • __vbaHresultCheckObj.MSVBVM60(00000000,0222E8CC,004120B4,0000001C), ref: 0041A7ED
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,00412108,00000050), ref: 0041A80C
        • __vbaFreeObj.MSVBVM60(00000000,?,00412108,00000050), ref: 0041A814
        • __vbaNew2.MSVBVM60(004120C4,0041B380,?), ref: 0041A834
        • __vbaHresultCheckObj.MSVBVM60(00000000,0222E8CC,004120B4,00000014), ref: 0041A854
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120D4,00000068), ref: 0041A877
        • __vbaFreeObj.MSVBVM60(00000000,?,004120D4,00000068), ref: 0041A87F
        • #611.MSVBVM60(00000000,?,004120D4,00000068), ref: 0041A884
        • __vbaStrMove.MSVBVM60(00000000,?,004120D4,00000068), ref: 0041A88E
        • __vbaFreeStr.MSVBVM60(0041A8C4), ref: 0041A8AE
        • __vbaFreeStr.MSVBVM60(0041A8C4), ref: 0041A8B6
        • __vbaFreeStr.MSVBVM60(0041A8C4), ref: 0041A8BE
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$CheckHresult$New2$Move$#562#611#705Copy
        • String ID: Inferencing$Sprinkelvrkernes
        • API String ID: 3821766861-2317132577
        • Opcode ID: 7b5456bd5a9818ceb5aaaf33ef31a6fbdd74a259eae5a56b032d6012081af64e
        • Instruction ID: 1ca10e00d9fd91bc4e38b211f751ff3e16b1161f05eb4674b0ddfadc4a4b0065
        • Opcode Fuzzy Hash: 7b5456bd5a9818ceb5aaaf33ef31a6fbdd74a259eae5a56b032d6012081af64e
        • Instruction Fuzzy Hash: 4D716271941208ABCB10FFA5C885EDEBBB8EF18704F14412EF541B31E1D7789996CBA9
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 37%
        			E0041A3B3(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0) {
        				intOrPtr _v8;
        				long long* _v12;
        				char _v28;
        				intOrPtr _v32;
        				char _v36;
        				char _v40;
        				char _v44;
        				intOrPtr _v52;
        				char _v60;
        				intOrPtr _v68;
        				char _v76;
        				intOrPtr _v84;
        				char _v92;
        				intOrPtr _v100;
        				char _v108;
        				char _v176;
        				char* _t54;
        				void* _t57;
        				intOrPtr* _t58;
        				void* _t59;
        				void* _t61;
        				intOrPtr* _t62;
        				void* _t63;
        				intOrPtr* _t64;
        				char _t65;
        				void* _t67;
        				intOrPtr* _t97;
        				intOrPtr* _t98;
        				intOrPtr* _t99;
        				intOrPtr* _t100;
        				intOrPtr* _t101;
        				intOrPtr _t104;
        				long long* _t105;
        				intOrPtr _t108;
        				intOrPtr _t111;
        
        				_push(0x401676);
        				_t54 =  *[fs:0x0];
        				_push(_t54);
        				 *[fs:0x0] = _t104;
        				_t105 = _t104 - 0xb4;
        				_v12 = _t105;
        				_v8 = 0x401640;
        				asm("fldz");
        				 *_t105 = __fp0;
        				_v28 = 0;
        				_v36 = 0;
        				_v40 = 0;
        				_v44 = 0;
        				_v60 = 0;
        				_v76 = 0;
        				_v92 = 0;
        				_v108 = 0;
        				_v176 = 0;
        				L00401724();
        				L0040172A();
        				asm("fcomp qword [0x401638]");
        				asm("fnstsw ax");
        				asm("sahf");
        				if(0 != 0) {
        					_push(0);
        					_push( &_v60);
        					_v52 = 1;
        					_v60 = 2;
        					L0040171E();
        					L0040183E();
        					L00401802();
        					_t108 =  *0x41b380; // 0x222e8cc
        					if(_t108 == 0) {
        						_push(0x41b380);
        						_push(0x4120c4);
        						L00401838();
        					}
        					_t97 =  *0x41b380; // 0x222e8cc
        					_t57 =  *((intOrPtr*)( *_t97 + 0x14))(_t97,  &_v44);
        					asm("fclex");
        					if(_t57 < 0) {
        						_push(0x14);
        						_push(0x4120b4);
        						_push(_t97);
        						_push(_t57);
        						L00401832();
        					}
        					_t58 = _v44;
        					_t98 = _t58;
        					_t59 =  *((intOrPtr*)( *_t58 + 0xd0))(_t58,  &_v40);
        					asm("fclex");
        					if(_t59 < 0) {
        						_push(0xd0);
        						_push(0x4120d4);
        						_push(_t98);
        						_push(_t59);
        						L00401832();
        					}
        					_v40 = 0;
        					L0040183E();
        					L0040182C();
        					_t111 =  *0x41b380; // 0x222e8cc
        					if(_t111 == 0) {
        						_push(0x41b380);
        						_push(0x4120c4);
        						L00401838();
        					}
        					_t99 =  *0x41b380; // 0x222e8cc
        					_t61 =  *((intOrPtr*)( *_t99 + 0x14))(_t99,  &_v44);
        					asm("fclex");
        					if(_t61 < 0) {
        						_push(0x14);
        						_push(0x4120b4);
        						_push(_t99);
        						_push(_t61);
        						L00401832();
        					}
        					_t62 = _v44;
        					_t100 = _t62;
        					_t63 =  *((intOrPtr*)( *_t62 + 0xb8))(_t62,  &_v176);
        					asm("fclex");
        					if(_t63 < 0) {
        						_push(0xb8);
        						_push(0x4120d4);
        						_push(_t100);
        						_push(_t63);
        						L00401832();
        					}
        					L0040182C();
        					L00401712();
        					_t64 =  &_v44;
        					L00401718();
        					_t101 = _t64;
        					_v100 = 0x80020004;
        					_v84 = 0x80020004;
        					_v68 = 0x80020004;
        					_v52 = 0x80020004;
        					_t65 = 0xa;
        					_v108 = _t65;
        					_v92 = _t65;
        					_v76 = _t65;
        					_v60 = _t65;
        					_t67 =  *((intOrPtr*)( *_t101 + 0x44))(_t101, 0x7304,  &_v60,  &_v76,  &_v92,  &_v108, _t64, _t63);
        					asm("fclex");
        					if(_t67 < 0) {
        						_push(0x44);
        						_push(0x4141bc);
        						_push(_t101);
        						_push(_t67);
        						L00401832();
        					}
        					L0040182C();
        					_push( &_v108);
        					_push( &_v92);
        					_push( &_v76);
        					_t54 =  &_v60;
        					_push(_t54);
        					_push(4);
        					L0040181A();
        				}
        				asm("wait");
        				_push(0x41a600);
        				_v32 =  *0x401630;
        				L004017E4();
        				L004017E4();
        				return _t54;
        			}






































        0x0041a3b8
        0x0041a3bd
        0x0041a3c3
        0x0041a3c4
        0x0041a3cb
        0x0041a3d4
        0x0041a3d7
        0x0041a3e0
        0x0041a3e4
        0x0041a3e7
        0x0041a3ea
        0x0041a3ed
        0x0041a3f0
        0x0041a3f3
        0x0041a3f6
        0x0041a3f9
        0x0041a3fc
        0x0041a3ff
        0x0041a405
        0x0041a40a
        0x0041a40f
        0x0041a415
        0x0041a417
        0x0041a418
        0x0041a421
        0x0041a422
        0x0041a423
        0x0041a42a
        0x0041a431
        0x0041a43b
        0x0041a443
        0x0041a448
        0x0041a44e
        0x0041a450
        0x0041a455
        0x0041a45a
        0x0041a45a
        0x0041a45f
        0x0041a46c
        0x0041a471
        0x0041a473
        0x0041a475
        0x0041a477
        0x0041a47c
        0x0041a47d
        0x0041a47e
        0x0041a47e
        0x0041a483
        0x0041a48d
        0x0041a48f
        0x0041a497
        0x0041a499
        0x0041a49b
        0x0041a4a0
        0x0041a4a5
        0x0041a4a6
        0x0041a4a7
        0x0041a4a7
        0x0041a4b2
        0x0041a4b5
        0x0041a4bd
        0x0041a4c2
        0x0041a4c8
        0x0041a4ca
        0x0041a4cf
        0x0041a4d4
        0x0041a4d4
        0x0041a4d9
        0x0041a4e6
        0x0041a4eb
        0x0041a4ed
        0x0041a4ef
        0x0041a4f1
        0x0041a4f6
        0x0041a4f7
        0x0041a4f8
        0x0041a4f8
        0x0041a4fd
        0x0041a50a
        0x0041a50c
        0x0041a514
        0x0041a516
        0x0041a518
        0x0041a51d
        0x0041a522
        0x0041a523
        0x0041a524
        0x0041a524
        0x0041a52c
        0x0041a531
        0x0041a537
        0x0041a53b
        0x0041a547
        0x0041a549
        0x0041a54c
        0x0041a54f
        0x0041a552
        0x0041a555
        0x0041a559
        0x0041a568
        0x0041a56b
        0x0041a56e
        0x0041a57a
        0x0041a57f
        0x0041a581
        0x0041a583
        0x0041a585
        0x0041a58a
        0x0041a58b
        0x0041a58c
        0x0041a58c
        0x0041a594
        0x0041a59c
        0x0041a5a0
        0x0041a5a4
        0x0041a5a5
        0x0041a5a8
        0x0041a5a9
        0x0041a5ab
        0x0041a5b0
        0x0041a5b9
        0x0041a5ba
        0x0041a5bf
        0x0041a5f2
        0x0041a5fa
        0x0041a5ff

        APIs
        • #585.MSVBVM60 ref: 0041A405
        • __vbaFpR8.MSVBVM60 ref: 0041A40A
        • #705.MSVBVM60(?,00000000), ref: 0041A431
        • __vbaStrMove.MSVBVM60(?,00000000), ref: 0041A43B
        • __vbaFreeVar.MSVBVM60(?,00000000), ref: 0041A443
        • __vbaNew2.MSVBVM60(004120C4,0041B380,?,00000000), ref: 0041A45A
        • __vbaHresultCheckObj.MSVBVM60(00000000,0222E8CC,004120B4,00000014), ref: 0041A47E
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120D4,000000D0), ref: 0041A4A7
        • __vbaStrMove.MSVBVM60(00000000,?,004120D4,000000D0), ref: 0041A4B5
        • __vbaFreeObj.MSVBVM60(00000000,?,004120D4,000000D0), ref: 0041A4BD
        • __vbaNew2.MSVBVM60(004120C4,0041B380), ref: 0041A4D4
        • __vbaHresultCheckObj.MSVBVM60(00000000,0222E8CC,004120B4,00000014), ref: 0041A4F8
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120D4,000000B8), ref: 0041A524
        • __vbaFreeObj.MSVBVM60(00000000,?,004120D4,000000B8), ref: 0041A52C
        • #685.MSVBVM60(00000000,?,004120D4,000000B8), ref: 0041A531
        • __vbaObjSet.MSVBVM60(?,00000000), ref: 0041A53B
        • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,004141BC,00000044), ref: 0041A58C
        • __vbaFreeObj.MSVBVM60(00000000,00000000,004141BC,00000044), ref: 0041A594
        • __vbaFreeVarList.MSVBVM60(00000004,00000002,?,?,?), ref: 0041A5AB
        • __vbaFreeStr.MSVBVM60(0041A600), ref: 0041A5F2
        • __vbaFreeStr.MSVBVM60(0041A600), ref: 0041A5FA
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$CheckHresult$MoveNew2$#585#685#705List
        • String ID:
        • API String ID: 1883905597-0
        • Opcode ID: 63421a9509fddde33e2b9721e7834bb841acca9c7d8312db5abf39a871933f99
        • Instruction ID: 3cec69d711b73efda37130997c75e32e02e41384d9b8891cc4808bf4d1993a41
        • Opcode Fuzzy Hash: 63421a9509fddde33e2b9721e7834bb841acca9c7d8312db5abf39a871933f99
        • Instruction Fuzzy Hash: BD516CB1D00208AFCB14EF95C886EDEBBB8EF58304F14412BF105B71A1DB785985CB69
        Uniqueness

        Uniqueness Score: -1.00%

        C-Code - Quality: 57%
        			E0041A1F8(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
        				char _v8;
        				intOrPtr _v16;
        				intOrPtr _v20;
        				intOrPtr _v24;
        				intOrPtr _v28;
        				short _v40;
        				void* _v44;
        				void* _v48;
        				signed int _v56;
        				char _v64;
        				intOrPtr _v72;
        				char _v80;
        				intOrPtr _v88;
        				char _v96;
        				intOrPtr _v104;
        				char _v112;
        				char* _v120;
        				intOrPtr _v128;
        				char* _t48;
        				void* _t69;
        				void* _t71;
        				intOrPtr _t72;
        
        				_t72 = _t71 - 0x18;
        				 *[fs:0x0] = _t72;
        				L00401670();
        				_v28 = _t72;
        				_v24 = 0x4015e8;
        				_v20 = 0;
        				_v16 = 0;
        				_t48 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401676, _t69);
        				_v8 = 1;
        				_v8 = 2;
        				_push(0x41419c);
        				L0040173C();
        				if(_t48 != 2) {
        					_v8 = 3;
        					_v56 = _v56 & 0x00000000;
        					_v64 = 2;
        					_push(0xfffffffe);
        					_push(0xfffffffe);
        					_push(0xfffffffe);
        					_push(0xffffffff);
        					_push( &_v64);
        					L00401736();
        					L0040183E();
        					L00401802();
        					_v8 = 4;
        					_push(0);
        					L00401814();
        					_v8 = 5;
        					_push(0);
        					_push(0);
        					_push(1);
        					L00401730();
        					L0040183E();
        					_v8 = 6;
        					_v104 = 0x80020004;
        					_v112 = 0xa;
        					_v88 = 0x80020004;
        					_v96 = 0xa;
        					_v72 = 0x80020004;
        					_v80 = 0xa;
        					_v120 = L"Gregarinian";
        					_v128 = 8;
        					L00401760();
        					_push( &_v112);
        					_push( &_v96);
        					_push( &_v80);
        					_push(0);
        					_push( &_v64);
        					L00401772();
        					_push( &_v112);
        					_push( &_v96);
        					_push( &_v80);
        					_t48 =  &_v64;
        					_push(_t48);
        					_push(4);
        					L0040181A();
        				}
        				_v8 = 8;
        				_push(0xffffffff);
        				L00401814();
        				_v8 = 9;
        				_v40 = 0x74be;
        				_push(0x41a38a);
        				L004017E4();
        				L004017E4();
        				return _t48;
        			}

























        0x0041a1fb
        0x0041a20a
        0x0041a216
        0x0041a21e
        0x0041a221
        0x0041a228
        0x0041a22f
        0x0041a23e
        0x0041a241
        0x0041a248
        0x0041a24f
        0x0041a254
        0x0041a25c
        0x0041a262
        0x0041a269
        0x0041a26d
        0x0041a274
        0x0041a276
        0x0041a278
        0x0041a27a
        0x0041a27f
        0x0041a280
        0x0041a28a
        0x0041a292
        0x0041a297
        0x0041a29e
        0x0041a2a0
        0x0041a2a5
        0x0041a2ac
        0x0041a2ae
        0x0041a2b0
        0x0041a2b2
        0x0041a2bc
        0x0041a2c1
        0x0041a2c8
        0x0041a2cf
        0x0041a2d6
        0x0041a2dd
        0x0041a2e4
        0x0041a2eb
        0x0041a2f2
        0x0041a2f9
        0x0041a306
        0x0041a30e
        0x0041a312
        0x0041a316
        0x0041a317
        0x0041a31c
        0x0041a31d
        0x0041a325
        0x0041a329
        0x0041a32d
        0x0041a32e
        0x0041a331
        0x0041a332
        0x0041a334
        0x0041a339
        0x0041a33c
        0x0041a343
        0x0041a345
        0x0041a34a
        0x0041a351
        0x0041a357
        0x0041a37c
        0x0041a384
        0x0041a389

        APIs
        • __vbaChkstk.MSVBVM60(?,00401676), ref: 0041A216
        • __vbaI4Str.MSVBVM60(0041419C,?,?,?,?,00401676), ref: 0041A254
        • #704.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A280
        • __vbaStrMove.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A28A
        • __vbaFreeVar.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A292
        • __vbaOnError.MSVBVM60(00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A2A0
        • #706.MSVBVM60(00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A2B2
        • __vbaStrMove.MSVBVM60(00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A2BC
        • __vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A306
        • #595.MSVBVM60(00000002,00000000,0000000A,0000000A,0000000A,?,?,?,?,?,?,?,00000001,00000000,00000000,00000000), ref: 0041A31D
        • __vbaFreeVarList.MSVBVM60(00000004,00000002,0000000A,0000000A,0000000A,00000002,00000000,0000000A,0000000A,0000000A), ref: 0041A334
        • __vbaOnError.MSVBVM60(000000FF,0041419C,?,?,?,?,00401676), ref: 0041A345
        • __vbaFreeStr.MSVBVM60(0041A38A,000000FF,0041419C), ref: 0041A37C
        • __vbaFreeStr.MSVBVM60(0041A38A,000000FF,0041419C), ref: 0041A384
        Strings
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$Free$ErrorMove$#595#704#706ChkstkList
        • String ID: Gregarinian
        • API String ID: 2605556234-529014253
        • Opcode ID: fd858aa33504d7d1bef5df7bf90d63c53837a0ecd557d500c7d11b84555da9de
        • Instruction ID: cd3b174f99e919f32002e4993b5f28d473eccbf5e9b78832f6f784166e9a82a9
        • Opcode Fuzzy Hash: fd858aa33504d7d1bef5df7bf90d63c53837a0ecd557d500c7d11b84555da9de
        • Instruction Fuzzy Hash: AE41FEB1D0120CABDB10EFD5C945BDDB7B9AF04314F60812AF121BB2E1DBB95A09CB55
        Uniqueness

        Uniqueness Score: -1.00%

        APIs
        • __vbaNew2.MSVBVM60(004120C4,0041B380), ref: 0041A923
        • __vbaHresultCheckObj.MSVBVM60(00000000,0222E8CC,004120B4,00000014), ref: 0041A947
        • __vbaHresultCheckObj.MSVBVM60(00000000,?,004120D4,000000C8), ref: 0041A970
        • __vbaFreeObj.MSVBVM60 ref: 0041A978
        Memory Dump Source
        • Source File: 00000000.00000002.1200732127.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
        • Associated: 00000000.00000002.1200718204.0000000000400000.00000002.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200793501.000000000041B000.00000004.00020000.sdmp Download File
        • Associated: 00000000.00000002.1200800354.000000000041C000.00000002.00020000.sdmp Download File
        Similarity
        • API ID: __vba$CheckHresult$FreeNew2
        • String ID:
        • API String ID: 4261391273-0
        • Opcode ID: aa56e75fb5b33d3b6b9463f90962b6f9f020495991c4239fb487540005550423
        • Instruction ID: ca9ac7d6905c7e50583db873f8b344b2454e11bae1e7767cb1e878e70bdca947
        • Opcode Fuzzy Hash: aa56e75fb5b33d3b6b9463f90962b6f9f020495991c4239fb487540005550423
        • Instruction Fuzzy Hash: 3B1186B1981208BFD710EB55CC46EEFBBA8EB58744F11462AF100B31E1D7B85991CBA9
        Uniqueness

        Uniqueness Score: -1.00%