Play interactive tour

Edit tour

Windows Analysis Report Statement of Account.exe

Overview

General Information

Sample Name:	Statement of Account.exe
Analysis ID:	502024
MD5:	1232806812f946a2afabc5f5fe489de5
SHA1:	f9a820627667403e90b3a387de0b644f8f0ddc31
SHA256:	86907475c81bc4700fc465c758592c51e905feed8aecdc0c10ccb6a8c650218a
Tags:	exeguloader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Potential malicious icon found

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Uses 32bit PE files

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Program does not show much activity (idle)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

Statement of Account.exe (PID: 5984 cmdline: 'C:\Users\user\Desktop\Statement of Account.exe' MD5: 1232806812F946A2AFABC5F5FE489DE5)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.783365997.0000000004BF0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.783365997.0000000004BF0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download"}

Multi AV Scanner detection for submitted file

Show sources

Source: Statement of Account.exe

ReversingLabs: Detection: 21%

Machine Learning detection for sample

Show sources

Source: Statement of Account.exe

Joe Sandbox ML: detected

Source: Statement of Account.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_00403248
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edi, edi	0_2_00403248
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_00403248
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_00403248
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then sub ecx, F6DD248Dh	0_2_0040225E
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_0040225E
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edi, edi	0_2_0040225E
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_0040225E
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_0040225E
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edi, edi	0_2_0040346B
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_0040346B
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_0040346B
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_00403611
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_00403611
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_00403827
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edi, edi	0_2_004032D4
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_004032D4
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_004032D4
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_00403697
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_00403697
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_004038AC
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edi, edi	0_2_0040336A
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_0040336A
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_0040336A
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_0040371F
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_0040371F
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_004039C9
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edi, edi	0_2_004033EA
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_004033EA
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_004033EA
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_00403581
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_00403581
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_00403586
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_00403586
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_00403588
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_00403588
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_0040358A
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_0040358A
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_0040358C
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_0040358C
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_0040358E
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_0040358E
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_00403590
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_00403590
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_00403592
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_00403592
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_00403596
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_00403596
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_00403598
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_00403598
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_0040359A
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_0040359A
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_0040359C
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_0040359C
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_0040359E
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_0040359E
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_004035A0
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_004035A0
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_004035A2
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_004035A2
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_004035A4
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_004035A4
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_004035A6
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_004035A6
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_004035A8
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_004035A8
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_004035AA
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_004035AA
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_004031BE
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edi, edi	0_2_004031BE
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 4x nop then mov edx, edx	0_2_004031BE
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 5x nop then xor eax, dword ptr [edx+esi]	0_2_004031BE

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Source: Statement of Account.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: Statement of Account.exe, 00000000.00000000.254053791.000000000041C000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameedderfu.exe vs Statement of Account.exe
Source: Statement of Account.exe, 00000000.00000002.782119525.0000000002220000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameedderfu.exeFE2X vs Statement of Account.exe
Source: Statement of Account.exe	Binary or memory string: OriginalFilenameedderfu.exe vs Statement of Account.exe

Source: Statement of Account.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_00401868	0_2_00401868
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_00403248	0_2_00403248
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_0040225E	0_2_0040225E
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_0040346B	0_2_0040346B
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_00403611	0_2_00403611
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_004032D4	0_2_004032D4
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_0040336A	0_2_0040336A
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_004033EA	0_2_004033EA
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_00403590	0_2_00403590
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_004031BE	0_2_004031BE
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_04BFA8A1	0_2_04BFA8A1
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_04BF01FB	0_2_04BF01FB
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_04BF5B52	0_2_04BF5B52

Source: C:\Users\user\Desktop\Statement of Account.exe

Code function: String function: 0040177E appears 94 times

Source: C:\Users\user\Desktop\Statement of Account.exe

Process Stats: CPU usage > 98%

Source: Statement of Account.exe

ReversingLabs: Detection: 21%

Source: Statement of Account.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Statement of Account.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Statement of Account.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: classification engine

Classification label: mal84.rans.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.783365997.0000000004BF0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_00404E6E push esp; retf	0_2_00404E8E
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_00407C85 push C8F569B9h; ret	0_2_00407C8A
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_00403E8E push esi; retf	0_2_00403E95
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_04BF194C push ds; ret	0_2_04BF194F
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_04BF3F03 push edx; iretd	0_2_04BF3F04

Source: initial sample

Static PE information: section name: .text entropy: 6.81553512761

Source: C:\Users\user\Desktop\Statement of Account.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Statement of Account.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Statement of Account.exe

Code function: 0_2_04BF7A2F rdtsc

0_2_04BF7A2F

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\Statement of Account.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_00403248 mov ebx, dword ptr fs:[00000030h]	0_2_00403248
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_0040225E mov ebx, dword ptr fs:[00000030h]	0_2_0040225E
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_004031BE mov ebx, dword ptr fs:[00000030h]	0_2_004031BE
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_04BF75F7 mov eax, dword ptr fs:[00000030h]	0_2_04BF75F7
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_04BF9952 mov eax, dword ptr fs:[00000030h]	0_2_04BF9952
Source: C:\Users\user\Desktop\Statement of Account.exe	Code function: 0_2_04BF9EF4 mov eax, dword ptr fs:[00000030h]	0_2_04BF9EF4

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Statement of Account.exe

Code function: 0_2_04BF7A2F rdtsc

0_2_04BF7A2F

Source: Statement of Account.exe, 00000000.00000002.781361345.0000000000DB0000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: Statement of Account.exe, 00000000.00000002.781361345.0000000000DB0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Statement of Account.exe, 00000000.00000002.781361345.0000000000DB0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Statement of Account.exe, 00000000.00000002.781361345.0000000000DB0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery11	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Software Packing1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	System Information Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Obfuscated Files or Information4	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Statement of Account.exe	22%	ReversingLabs	Win32.Trojan.Mucc
Statement of Account.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	502024
Start date:	13.10.2021
Start time:	14:27:11
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Statement of Account.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.rans.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.9% (good quality ratio 0.7%) Quality average: 37.6% Quality standard deviation: 20.2%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 95.100.216.89, 20.82.209.183, 8.247.248.249, 8.247.248.223, 8.247.244.249, 20.82.210.154, 2.20.178.24, 2.20.178.33, 20.54.110.249, 40.112.88.60, 52.251.79.25 Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, eus2-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, ris.api.iris.microsoft.com, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.343524499435611
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Statement of Account.exe
File size:	135168
MD5:	1232806812f946a2afabc5f5fe489de5
SHA1:	f9a820627667403e90b3a387de0b644f8f0ddc31
SHA256:	86907475c81bc4700fc465c758592c51e905feed8aecdc0c10ccb6a8c650218a
SHA512:	14e655a40e696c7fedc58754e4263c512a2d0d0b922daee5c3e84594b3c639b0995e7b57ac10af97c69098e9bc9e42f336999fbafb44bb79470f4d568f690c4e
SSDEEP:	1536:BO7rxt7IPeC+EPGqwK+L1zDfCyuOiye7cuA+gg+5fTMZ9cBjyG3VqbfuYpZN88M+:U7dK2CneTx3Cyi31SQLGZq
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L.....9X.....................`......h.............@.............B..

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x401868
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5839B8B9 [Sat Nov 26 16:30:49 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c727a98e677fb7bd25bb06d2a2d956f1

Entrypoint Preview

Instruction
push 00410318h
call 00007F3E4CA86D95h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sal byte ptr [esi-4E903F92h], 1
jle 00007F3E4CA86DEFh
stosd
pop es
cmpsb
mov edi, 36CC837Eh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
test al, 60h
push cs
add ecx, dword ptr [ecx+4Eh]
inc esp
inc edx
push edx
add byte ptr [edx], ah
add al, byte ptr [eax]
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
and esp, dword ptr [eax]
add al, D8h
pushad
scasb
rcr ah, cl
inc ebp
mov dword ptr [ecx-39h], ecx
mov dh, 86h
div dword ptr [ebx-54h]
into
jecxz 00007F3E4CA86D25h
mov bl, A5h
aad 49h
dec esp
mov esp, 19989AB2h
idiv dword ptr [ebp-46h]
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc ecx, ebp
add byte ptr [eax], al
inc ebx
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax], eax
arpl word ptr [ebp+6Ch], sp
bound esi, dword ptr [edx+65h]
jnc 00007F3E4CA86E0Ah
add byte ptr [54000601h], cl
push 35656572h
add byte ptr [ecx], bl
add dword ptr [eax], eax
inc edx
add byte ptr [edx], ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1a894	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c000	0x4562	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x154	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19dd0	0x1a000	False	0.568171574519	data	6.81553512761	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x1b000	0xaf0	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1c000	0x4562	0x5000	False	0.39609375	data	4.60717950331	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
DATA	0x1ca74	0x3aee	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel	English	United States
RT_ICON	0x1c944	0x130	data
RT_ICON	0x1c65c	0x2e8	data
RT_ICON	0x1c534	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x1c504	0x30	data
RT_VERSION	0x1c1a0	0x364	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryDestruct, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaStrToAnsi, __vbaVarDup, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	RealNetworks, Inc.
InternalName	edderfu
FileVersion	66.00
CompanyName	RealNetworks, Inc.
LegalTrademarks	RealNetworks, Inc.
Comments	RealNetworks, Inc.
ProductName	RealNetworks, Inc.
ProductVersion	66.00
FileDescription	RealNetworks, Inc.
OriginalFilename	edderfu.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: Statement of Account.exe PID: 5984 Parent PID: 6140

General

Start time:	14:28:13
Start date:	13/10/2021
Path:	C:\Users\user\Desktop\Statement of Account.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Statement of Account.exe'
Imagebase:	0x400000
File size:	135168 bytes
MD5 hash:	1232806812F946A2AFABC5F5FE489DE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.783365997.0000000004BF0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Statement of Account.exe PID: 5984 Parent PID: 6140 Statement of Account.exeCOMMON

Executed Functions

Function 00403611, Relevance: 18.3, APIs: 1, Strings: 11, Instructions: 305memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

====, xrefs: 0040362E
^z(, xrefs: 00403870
====, xrefs: 0040361A
====, xrefs: 0040363D
====, xrefs: 00403624
====, xrefs: 00403638
====, xrefs: 00403615
====, xrefs: 0040361F
====, xrefs: 00403642
====, xrefs: 00403633
====, xrefs: 00403629

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ====$====$====$====$====$====$====$====$====$====$^z(
API String ID: 4275171209-447172488
Opcode ID: 8adc28fe4066b599d39d9a04c4d7bf605e19ef2e50023be9e7212b37326a879c
Instruction ID: 5f3c7a90d1f10c9e9557625816a7fd5da0e1faf1cd99d328bc8b51946578e281
Opcode Fuzzy Hash: 8adc28fe4066b599d39d9a04c4d7bf605e19ef2e50023be9e7212b37326a879c
Instruction Fuzzy Hash: F1617E66B1A7000B975998BE48D0967C4C7AFEF260369E63E611DF3365FDB9CC4B1208

Uniqueness

Uniqueness Score: -1.00%

Function 0040225E, Relevance: 6.1, APIs: 1, Strings: 1, Instructions: 3124COMMON

Download Yara Rule

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ^z(
API String ID: 0-2030494510
Opcode ID: e22d85cd73b19177ff458873809f9c374b333f88516d7514abdeef52d1859869
Instruction ID: d78857c9e0874f44735923c086fdda9921d41c974775fd4003bc8095aeb63bb1
Opcode Fuzzy Hash: e22d85cd73b19177ff458873809f9c374b333f88516d7514abdeef52d1859869
Instruction Fuzzy Hash: ED0380137CE3C087CF174679A4A04E1BFA25F9F13833DB9ED91E99A276D77688058A04

Uniqueness

Uniqueness Score: -1.00%

Function 00401868, Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 890COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 0040186D

Strings

VB5!6&*, xrefs: 00401868

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 3589f2169d779f9764457056dbb0c43c8e21d2b85a2bdf17378d4b20b17c7230
Instruction ID: c699d778e38de2022f5eda90a95cecba70808f7006fc03cfa1878d7864005508
Opcode Fuzzy Hash: 3589f2169d779f9764457056dbb0c43c8e21d2b85a2bdf17378d4b20b17c7230
Instruction Fuzzy Hash: 1C52AB7144E3C18FC7138B748DA65A17FB0AE1331471E05DBC8C19F1B3E229696ADB66

Uniqueness

Uniqueness Score: -1.00%

Function 004031BE, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 589COMMON

Download Yara Rule

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ^z(
API String ID: 0-2030494510
Opcode ID: b855a7a426f6e6a06f2cf81487d225813502af9f540177796208e210945a06a8
Instruction ID: bf5917811784987984844a965dc5675692b788bb35766bd811862c2817ebab27
Opcode Fuzzy Hash: b855a7a426f6e6a06f2cf81487d225813502af9f540177796208e210945a06a8
Instruction Fuzzy Hash: CAD16A66B197000B875A88BE48D0966C4C79FEF261329E53D652EF73A5FDB9CC0B124C

Uniqueness

Uniqueness Score: -1.00%

Function 00403248, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 578COMMON

Download Yara Rule

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ^z(
API String ID: 0-2030494510
Opcode ID: c388ebab009c73dfa29c07c1dfb5f0f9b2331e6a5d29e89859a345b997d10db8
Instruction ID: 377ab30adf3a175aba7a39cc8f9fb7f18befe5c9c8afd9597e5c9caaf157e335
Opcode Fuzzy Hash: c388ebab009c73dfa29c07c1dfb5f0f9b2331e6a5d29e89859a345b997d10db8
Instruction Fuzzy Hash: 7AD19F26B197004B8B6998BE44D0557C8C79FEF262339E57E211DF33A5E9BDCD0A118C

Uniqueness

Uniqueness Score: -1.00%

Function 004032D4, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 521COMMON

Download Yara Rule

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ^z(
API String ID: 0-2030494510
Opcode ID: c81b83907168fac2c8b9051c246813265b7bf444a7f5e7feafb954c52e813215
Instruction ID: ffb5dc293b29b89982e6ad6332a70b4185f67dacd84093a9acae399c32590c1a
Opcode Fuzzy Hash: c81b83907168fac2c8b9051c246813265b7bf444a7f5e7feafb954c52e813215
Instruction Fuzzy Hash: 4FB16C66B197000B875A98BE48D0966C4C79FEF260379E53D652DF33A5EDBACC0A124C

Uniqueness

Uniqueness Score: -1.00%

Function 004033EA, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 477COMMON

Download Yara Rule

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ^z(
API String ID: 0-2030494510
Opcode ID: 02ecd01afb6ed021ec12e043efab9a024197a78aa68fadd22d262dc28ccc01c7
Instruction ID: 861764535614c7cee8b86a98059ebaf015eefcb4d6c1a64293a3e8b1498d1c1d
Opcode Fuzzy Hash: 02ecd01afb6ed021ec12e043efab9a024197a78aa68fadd22d262dc28ccc01c7
Instruction Fuzzy Hash: 6BA16B26B197000B875E88BE48D0966C4C79FEF260369E63D651EF33A5EDB9CD0B124C

Uniqueness

Uniqueness Score: -1.00%

Function 0040336A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 473COMMON

Download Yara Rule

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ^z(
API String ID: 0-2030494510
Opcode ID: 3587d274b381b5e4659c52ea5430644a507edd0f88b85b10bfcc444ee9523479
Instruction ID: 075dc6325eecaf43e9d0ad70c7fb4866e83cff2bf8c25fdefd9fa5a4184014cf
Opcode Fuzzy Hash: 3587d274b381b5e4659c52ea5430644a507edd0f88b85b10bfcc444ee9523479
Instruction Fuzzy Hash: 13B16B66B197000B875E88BE48D0966C4C7AFEF260369E63D651EF33A5FD79CD0A124C

Uniqueness

Uniqueness Score: -1.00%

Function 0040346B, Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 403memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: d0de33fd77c4b5639d9ac844fda27257aec6c224432d04cccba05e2b8d041003
Instruction ID: 8df38f90751ef3cf4162047dc06c6ddd0e4041bc6e1ae0dfa3807f9c78836c90
Opcode Fuzzy Hash: d0de33fd77c4b5639d9ac844fda27257aec6c224432d04cccba05e2b8d041003
Instruction Fuzzy Hash: 1E917066B1A7000B875998BE48D0967C4C7AFDF260369E63D651DF33A5EDB9CC0B124C

Uniqueness

Uniqueness Score: -1.00%

Function 00403590, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 336memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: 21f3d8fb8498c4e2bc354341cef68249e498c064d4e3472da80a7cef3c298f59
Instruction ID: c85b99bba22a1d7302b9d6ddef70cb6964b393247ae731c51e90ea9021b94ab5
Opcode Fuzzy Hash: 21f3d8fb8498c4e2bc354341cef68249e498c064d4e3472da80a7cef3c298f59
Instruction Fuzzy Hash: 1C717D65B1A7000F975998BE48D0966C4C7AFEF260369E63D611EF3365F9B9CD0B120C

Uniqueness

Uniqueness Score: -1.00%

Function 004035A8, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 336memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: bd245cd8ecde0f9c2fb3d9308078012c7d432142b7e8d5eb31715eddd2998ff0
Instruction ID: 76891881b05798997e40421ebc7a7d9b9b60fb876a34674ef1382235d64d5857
Opcode Fuzzy Hash: bd245cd8ecde0f9c2fb3d9308078012c7d432142b7e8d5eb31715eddd2998ff0
Instruction Fuzzy Hash: 7C718E25B1A7000B875988BE48D0966C4C79FEF260369E63D611EF3365FD79CD0A120C

Uniqueness

Uniqueness Score: -1.00%

Function 00403581, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 335memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: 951a9c4d1fa58db0dd3c15ff8f9f5d594673f6d1b232162b86defae86f53df9d
Instruction ID: 38b601eec5bd70f3c924873a539390ee06f03332943b8dd26978cbe1544854bc
Opcode Fuzzy Hash: 951a9c4d1fa58db0dd3c15ff8f9f5d594673f6d1b232162b86defae86f53df9d
Instruction Fuzzy Hash: 77717E25B1A7000F975988BE48D0966C4C79FEF260369E63D651EF3365FDB9CC0A120C

Uniqueness

Uniqueness Score: -1.00%

Function 00403592, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 335memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: 58c7839a6b324c3ad4432d3726031346661a7aff0cab5873a3790386ae6b5cbf
Instruction ID: cdbf1efe13b4ec393177bfc80aab3219d81e7d25e54b36e000b807e870fe9beb
Opcode Fuzzy Hash: 58c7839a6b324c3ad4432d3726031346661a7aff0cab5873a3790386ae6b5cbf
Instruction Fuzzy Hash: BD717D65B1A7000B975998BE48D0966C4C7AFEF260369E63D611EF3365F9B9CD0B120C

Uniqueness

Uniqueness Score: -1.00%

Function 004035A6, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 335memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: eaed97e922a7f6b2bd1eb5d781b0f36aced40fff44d6d23881249fb06788962b
Instruction ID: 163081c8a02bb4782d892cae045dab98194d3a0c954378214d5fa912c5efa40b
Opcode Fuzzy Hash: eaed97e922a7f6b2bd1eb5d781b0f36aced40fff44d6d23881249fb06788962b
Instruction Fuzzy Hash: CC718E25B197000B975988BE48D0966C4C7AFEF260369E63D611EF3365F9B9CD0B124C

Uniqueness

Uniqueness Score: -1.00%

Function 00403596, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 334memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: fb2e3ecd65f4bdc3adcc71f920788cb86c9d1fd54df7ba30d83de25f7d531ac4
Instruction ID: 67614ea11f6b7a415e49c4f7aa3e8db6d08edec43dd990a7540fb373c2112858
Opcode Fuzzy Hash: fb2e3ecd65f4bdc3adcc71f920788cb86c9d1fd54df7ba30d83de25f7d531ac4
Instruction Fuzzy Hash: EC717E25B1A7000F975988BE48D0966C4C7AFEF260369E63D651EF3365FDB9CD0A120C

Uniqueness

Uniqueness Score: -1.00%

Function 004035AA, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 334memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: ce440ae6a6a82b80a1e3f463d220d596ff32cc71457f6c1a25c606e81a6af82a
Instruction ID: 8b80c05ea159284fe6f2935979dfb2e7a14140fa287c8eeb0d9166fa07146e58
Opcode Fuzzy Hash: ce440ae6a6a82b80a1e3f463d220d596ff32cc71457f6c1a25c606e81a6af82a
Instruction Fuzzy Hash: D6717E65B1A7000B975988BE48D0966C4C79FEF260369E63E651EF3365FD79CD0B120C

Uniqueness

Uniqueness Score: -1.00%

Function 00403598, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 333memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: d1e125e1140717d5c59de900ea3bc0b0a43e965cd800ea55e86e19222105dfee
Instruction ID: 69299c7f44f34bfe9ee0ef548cdb6d6a97c62b28602c1763d114152fa25762b5
Opcode Fuzzy Hash: d1e125e1140717d5c59de900ea3bc0b0a43e965cd800ea55e86e19222105dfee
Instruction Fuzzy Hash: A3716E25B1A7000B975998BE48D0967C4C7AFEF260369E63D651EF3365FDB9CD0A120C

Uniqueness

Uniqueness Score: -1.00%

Function 0040359C, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 333memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: 89138ecfa9c5ac12ce18a54470201df617200feb4b8c2fc597744cb311f3bb15
Instruction ID: 7dc42279062e56b064ae9ac9cfbbf5279f65462015cb57a5137c31f71c727c84
Opcode Fuzzy Hash: 89138ecfa9c5ac12ce18a54470201df617200feb4b8c2fc597744cb311f3bb15
Instruction Fuzzy Hash: 1F717E26B197000B875988BE48D0966C4C7AFEF260369E63D611EF3365FDB9CC0A220C

Uniqueness

Uniqueness Score: -1.00%

Function 00403586, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 332memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: 5f696fe9b83856c87b1124166119d5b42b2a082ad538536fcff10a1c40b5931e
Instruction ID: 95cc46694bd6db50db9cbd3cf5ac480a503dfe74d288319765380379d916775b
Opcode Fuzzy Hash: 5f696fe9b83856c87b1124166119d5b42b2a082ad538536fcff10a1c40b5931e
Instruction Fuzzy Hash: AF716E65B1A7000B975998BE48D0966C4C7AFEF260369E63D611EF3365FDB9CC0A124C

Uniqueness

Uniqueness Score: -1.00%

Function 0040359A, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 332memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: 963e72745027b826179a1a71952c9e6f8fce1c55ed926a3512d5260484c24f28
Instruction ID: c387a9bbe2cfb3c565cb096c5bc9407f4e1be484dc614dbdf6186419e781e3b1
Opcode Fuzzy Hash: 963e72745027b826179a1a71952c9e6f8fce1c55ed926a3512d5260484c24f28
Instruction Fuzzy Hash: 62717D65B1A7000B975988BE48D0966C4C7AFEF260369E63D651EF33A5FDB9CC0A120C

Uniqueness

Uniqueness Score: -1.00%

Function 0040359E, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 332memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: 2178eb2882050fb418e85e14eec50ba392c6b1406fd2100a0c0c381fdb439856
Instruction ID: 60a9126c88c7d02fe1da73cee228f4545ddd6c0009e62efe782a1f049b99a0ca
Opcode Fuzzy Hash: 2178eb2882050fb418e85e14eec50ba392c6b1406fd2100a0c0c381fdb439856
Instruction Fuzzy Hash: F9716E66B197000B875998BE48D0966C4C7AFEF260369E63D651EF3365FDB9CC0B224C

Uniqueness

Uniqueness Score: -1.00%

Function 00403588, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 331memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: 578ae8c1448dcfcc0f4e75309e42adffc6684c30020e704a763ded63c4a469fd
Instruction ID: c5d960181de94f90b9cf5520a833aa7d35a06da1af4c124089ade7b99ae16359
Opcode Fuzzy Hash: 578ae8c1448dcfcc0f4e75309e42adffc6684c30020e704a763ded63c4a469fd
Instruction Fuzzy Hash: 0E716D65B1A7000B975998BE48D0966C4C7AFEF260369E63D611EF33A5FDB9CC0A120C

Uniqueness

Uniqueness Score: -1.00%

Function 0040358A, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 330memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: 69b918029b12386a651cc198035e791b58bc0f87f559b8d976bac690373bce41
Instruction ID: dfbf85627321ce4a83014a59554f7daa21cbf7f332a57b1ebc4845b201642eff
Opcode Fuzzy Hash: 69b918029b12386a651cc198035e791b58bc0f87f559b8d976bac690373bce41
Instruction Fuzzy Hash: B4717C26B1A7000B975998BE48D0966C4C7AFEF260369E63D611EF3365FDB9CC0A120C

Uniqueness

Uniqueness Score: -1.00%

Function 0040358C, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 330memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: 7483d63f67293be80721b1f3108dfb3e35c81776aeaa58e42a6fa1aca26ae3f2
Instruction ID: 5f9a084178d5184fb3d88cf8dd3fa375fdd6aebb3b423fea0bb48b7dd12c6b31
Opcode Fuzzy Hash: 7483d63f67293be80721b1f3108dfb3e35c81776aeaa58e42a6fa1aca26ae3f2
Instruction Fuzzy Hash: 8E717D66B1A7000B875988BE48D0967C4C7AFEF260369E63D611DF3365FDB9CC0A120C

Uniqueness

Uniqueness Score: -1.00%

Function 004035A0, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 330memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: cf6ff6666456f06b5d53c715fd26a5893887f6fb5bbd8280910064db2da6a0a1
Instruction ID: 2b09b9f2530b3ce272cfcf1872c105018aa97f4aeb626be72fc9abed05a2bcad
Opcode Fuzzy Hash: cf6ff6666456f06b5d53c715fd26a5893887f6fb5bbd8280910064db2da6a0a1
Instruction Fuzzy Hash: 15716D65B1A7000B975998BE48D0966C4C7AFEF260369E63D651EF33A5FDB9CC0A120C

Uniqueness

Uniqueness Score: -1.00%

Function 004035A2, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 330memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: f56ca24b88e008184225e36d72b82bb2b24cbba14b4f34b39c0624edcc967553
Instruction ID: 38a859f75f5a2e9b9156f15c17bdc40a8fd265ba54d13924f3c00f7fb796e552
Opcode Fuzzy Hash: f56ca24b88e008184225e36d72b82bb2b24cbba14b4f34b39c0624edcc967553
Instruction Fuzzy Hash: BF717D66B1A7000B875998BE48D0966C4C7AFEF260369E63D651DF3365FDB9CC0A220C

Uniqueness

Uniqueness Score: -1.00%

Function 0040358E, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 329memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: fee373050e9c05dad242a229d6db72927db8f7a17fac034b760082eca3321c84
Instruction ID: 60ed01a64fe559e026f014f7b2cd837c0e09fda8d5a05436a5416d92a2f556b4
Opcode Fuzzy Hash: fee373050e9c05dad242a229d6db72927db8f7a17fac034b760082eca3321c84
Instruction Fuzzy Hash: CC715D66B1A7000B975998BE48D0967C4C7AFEF260369E63D651EF3365FDB9CC0A120C

Uniqueness

Uniqueness Score: -1.00%

Function 004035A4, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 329memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: 27a50e679ddde43b3c6570c27ec4a78d20ea85d5ae097210a1c1a7c7be7272fb
Instruction ID: b76a3c10af986cd15d8c9dd5a6c7cab600cac54288001238d8aa0a43875c84ac
Opcode Fuzzy Hash: 27a50e679ddde43b3c6570c27ec4a78d20ea85d5ae097210a1c1a7c7be7272fb
Instruction Fuzzy Hash: 84716D25B1A7000B975988BE48D0967C4C7AFEF260369E63D651EF3365FDB9CD0A120C

Uniqueness

Uniqueness Score: -1.00%

Function 00403697, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 271memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: 6f76b25c40b3a8ef45de8fac2145520f8b7baad9a9638663d61df0e3919779a0
Instruction ID: db9e23c48cf17c69bcb1a08fd40614fa486614060072053dea8dc9602b33c5d7
Opcode Fuzzy Hash: 6f76b25c40b3a8ef45de8fac2145520f8b7baad9a9638663d61df0e3919779a0
Instruction Fuzzy Hash: B551AC26B1A7000B875998BE48D0912D5C7AFEF260729E23D611DF7365FEB9CC0B2208

Uniqueness

Uniqueness Score: -1.00%

Function 0040371F, Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: 3a1c73a4e481d9f747f9b3ee9581ebd7f75286a5ddd0ea4c1688d1a8a5ddcf3b
Instruction ID: cfc1d3e5e181e67efbfcf4663e56d8536ded9e922ee7d7ca941917a21d7b3f04
Opcode Fuzzy Hash: 3a1c73a4e481d9f747f9b3ee9581ebd7f75286a5ddd0ea4c1688d1a8a5ddcf3b
Instruction Fuzzy Hash: DA517826B1A7000B975988BE08D0966D4C7EFEF260369E63D652DF3365FDB9CC4A124C

Uniqueness

Uniqueness Score: -1.00%

Function 00403827, Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-464E4580,-AB3A48E1), ref: 00403862

Strings

^z(, xrefs: 00403870

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: ^z(
API String ID: 4275171209-2030494510
Opcode ID: ffdf2e8d1f3dd31e283a4c1c938990df6cc5d07b273ff1299ba68ef02257919d
Instruction ID: e689f0f8c528213acb699f4907d818edecc23586e1e45fbf0a02ae86b47fbe7f
Opcode Fuzzy Hash: ffdf2e8d1f3dd31e283a4c1c938990df6cc5d07b273ff1299ba68ef02257919d
Instruction Fuzzy Hash: D431C125B197000BC75989BE48C4916D4C7EFEF260765B63D612DF3395FA79CC4B1248

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04BF5B52, Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783365997.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680b880ba669df22ce500e079ee6ced9ca0b75a6004b4a81040a24a068b64c82
Instruction ID: 00681876d080d4a5ca29abe91a4945b3e1a4498f90e36ca750630a9ec80107c1
Opcode Fuzzy Hash: 680b880ba669df22ce500e079ee6ced9ca0b75a6004b4a81040a24a068b64c82
Instruction Fuzzy Hash: 73A148B1A043489FDF38DE258DE53EA37E2AF99340F59452ECE4E8B205D7316A46C705

Uniqueness

Uniqueness Score: -1.00%

Function 004038AC, Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b4d432ccd4d00890a5343b1168b168d5a4fb75fe1b9f609097012aab11521bc
Instruction ID: a3efac549a0402143def7d523f2bf36ff4e16c3438ab124f50d59c48b4791ad6
Opcode Fuzzy Hash: 7b4d432ccd4d00890a5343b1168b168d5a4fb75fe1b9f609097012aab11521bc
Instruction Fuzzy Hash: 16219A65B2A7000F8B9988FE48D0916C4C7AFDF260365A63D611DF3396FAA9CC4B124C

Uniqueness

Uniqueness Score: -1.00%

Function 04BF01FB, Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783365997.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f426daa415400d37a408e62abcee8837f7f542f41dd70702967dfec0b225d279
Instruction ID: c706603fd7eb6f2ff85e42f4aef1efc79f8a4ad5001a476e800ccf8fa82d39ab
Opcode Fuzzy Hash: f426daa415400d37a408e62abcee8837f7f542f41dd70702967dfec0b225d279
Instruction Fuzzy Hash: D151587470034A8FDF38AF388DA47DA37A2AF52390F59819ACD8D8B155D735998DC702

Uniqueness

Uniqueness Score: -1.00%

Function 004039C9, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92aa99e8caadf07ddc65e25b03418e240b56c27e1f67df3ee5c6d4f763250049
Instruction ID: 7e52518399d3a27c5aca762b5d4bc23598a075cfa464b1231a93a6b66469411c
Opcode Fuzzy Hash: 92aa99e8caadf07ddc65e25b03418e240b56c27e1f67df3ee5c6d4f763250049
Instruction Fuzzy Hash: E0F06D35B1A7004F8B689EBE88D45169AE2DBAF220320B43CA01DF3354E978CC8A524C

Uniqueness

Uniqueness Score: -1.00%

Function 04BFA8A1, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783365997.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49160aa2472ca13540c6194a7f8d59f9bc4dd2af6b78d6690af3a7d96e3ba0f2
Instruction ID: 0bcf251fdaa0896216402f24eeb5caa1d012d40854cd27047a4ffcc835b473c3
Opcode Fuzzy Hash: 49160aa2472ca13540c6194a7f8d59f9bc4dd2af6b78d6690af3a7d96e3ba0f2
Instruction Fuzzy Hash: 6221F7397097568FCF248EB8C8D43E773A1AF59750F8A8098CE8E87651E3309846C751

Uniqueness

Uniqueness Score: -1.00%

Function 04BF9EF4, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783365997.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5d8cb6584655bed047ee2016b44dcb5b4929c148a0aa11fe1ddea36bdaedba5
Instruction ID: daa5aeff19506f75c7056e6ddf61658d8dcbd393fbf8ee4b3a9dcba39cce20ee
Opcode Fuzzy Hash: f5d8cb6584655bed047ee2016b44dcb5b4929c148a0aa11fe1ddea36bdaedba5
Instruction Fuzzy Hash: A10125B171564ACFDB78DE24DAC4BEA73A2FF89340F50816AEA0D8B250D334A940CA10

Uniqueness

Uniqueness Score: -1.00%

Function 04BF75F7, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783365997.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d4656de8d9bcda6a16c8e516fc251f9b9b4f510e3748dd72fff26ab2a7e8fd4
Instruction ID: 050aa4b3466f3e82f05914af5a1d21ee4dd022625b4d67f60cb9a8638d6c3236
Opcode Fuzzy Hash: 6d4656de8d9bcda6a16c8e516fc251f9b9b4f510e3748dd72fff26ab2a7e8fd4
Instruction Fuzzy Hash: 05B092B22005808FEF02CB08C481F0073A0FB06648B0804D0E002DB612C224ED00CA04

Uniqueness

Uniqueness Score: -1.00%

Function 04BF7A2F, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783365997.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction ID: f1647c15dfe5582e2114d8b48c9dc7a79c4e1b76aa7bcc19d5d00c5bce2ac4c7
Opcode Fuzzy Hash: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 04BF9952, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.783365997.0000000004BF0000.00000040.00000001.sdmp, Offset: 04BF0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4d64bc36b2a8cdc062b5304c05de1d5a66d8f20fcfded725e1e143fa45bb1a0
Instruction ID: 26992d48d4f1a329c5574f8c67ea7758957dbbbf39bd036a870a106e9d3fb61e
Opcode Fuzzy Hash: b4d64bc36b2a8cdc062b5304c05de1d5a66d8f20fcfded725e1e143fa45bb1a0
Instruction Fuzzy Hash: 91B092382117408FC245CE09C180F8073B0FB08A80F814880E8008BB12C228E8008900

Uniqueness

Uniqueness Score: -1.00%

Function 0041A4FB, Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 220
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0041A4FB(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				char _v36;
				void* _v44;
				intOrPtr _v52;
				char _v60;
				intOrPtr _v68;
				char _v76;
				char _v80;
				char* _t56;
				void* _t58;
				intOrPtr* _t59;
				void* _t60;
				void* _t62;
				intOrPtr* _t63;
				void* _t64;
				void* _t66;
				intOrPtr* _t67;
				void* _t68;
				void* _t71;
				intOrPtr* _t72;
				void* _t73;
				char _t75;
				intOrPtr _t76;
				void* _t107;
				intOrPtr* _t109;
				intOrPtr* _t111;
				intOrPtr* _t112;
				intOrPtr* _t113;
				intOrPtr* _t114;
				intOrPtr* _t115;
				intOrPtr* _t116;
				intOrPtr* _t117;
				intOrPtr* _t118;
				void* _t119;
				void* _t121;
				intOrPtr _t122;
				void* _t126;
				void* _t135;

				_t122 = _t121 - 0xc;
				 *[fs:0x0] = _t122;
				_v16 = _t122 - 0x50;
				_v12 = 0x401650;
				_t75 = 0;
				_v8 = 0;
				_t109 = _a4;
				 *((intOrPtr*)( *_t109 + 4))(_t109, __edi, __esi, __ebx,  *[fs:0x0], 0x401676, _t119);
				_v28 = 0;
				_v32 = 0;
				_v36 = 0;
				_v44 = 0;
				_v60 = 0;
				_v76 = 0;
				_v80 = 0;
				L0040177E();
				_v68 = _t109;
				_v76 = 9;
				L00401760();
				_t56 =  &_v60;
				_push(_t56);
				L0040170C();
				L00401802();
				if( ~(0 | _t56 != 0x0000ffff) == 0) {
					_t107 = 0x411fa0;
				} else {
					_t126 =  *0x41b380 - _t75; // 0x240e8cc
					if(_t126 == 0) {
						_push(0x41b380);
						_push(0x411fb0);
						L00401838();
					}
					_t113 =  *0x41b380; // 0x240e8cc
					_t62 =  *((intOrPtr*)( *_t113 + 0x14))(_t113,  &_v44);
					asm("fclex");
					if(_t62 >= _t75) {
						_t107 = 0x411fa0;
					} else {
						_t107 = 0x411fa0;
						_push(0x14);
						_push(0x411fa0);
						_push(_t113);
						_push(_t62);
						L00401832();
					}
					_t63 = _v44;
					_t76 = 1;
					_t114 = _t63;
					_t64 =  *((intOrPtr*)( *_t63 + 0x138))(_t63, L"Sprinkelvrkernes", _t76);
					asm("fclex");
					if(_t64 < 0) {
						_push(0x138);
						_push(0x411fc0);
						_push(_t114);
						_push(_t64);
						L00401832();
					}
					L0040182C();
					if( *0x41b380 == 0) {
						_push(0x41b380);
						_push(0x411fb0);
						L00401838();
					}
					_t115 =  *0x41b380; // 0x240e8cc
					_t66 =  *((intOrPtr*)( *_t115 + 0x14))(_t115,  &_v44);
					asm("fclex");
					if(_t66 < 0) {
						_push(0x14);
						_push(_t107);
						_push(_t115);
						_push(_t66);
						L00401832();
					}
					_t67 = _v44;
					_t116 = _t67;
					_t68 =  *((intOrPtr*)( *_t67 + 0x138))(_t67, L"Inferencing", _t76);
					asm("fclex");
					if(_t68 < 0) {
						_push(0x138);
						_push(0x411fc0);
						_push(_t116);
						_push(_t68);
						L00401832();
					}
					L0040182C();
					_push(0);
					_push( &_v60);
					_v52 = _t76;
					_v60 = 2;
					L0040171E();
					L0040183E();
					L00401802();
					if( *0x41b380 == 0) {
						_push(0x41b380);
						_push(0x411fb0);
						L00401838();
					}
					_t117 =  *0x41b380; // 0x240e8cc
					_t71 =  *((intOrPtr*)( *_t117 + 0x1c))(_t117,  &_v44);
					asm("fclex");
					if(_t71 < 0) {
						_push(0x1c);
						_push(_t107);
						_push(_t117);
						_push(_t71);
						L00401832();
					}
					_t72 = _v44;
					_t118 = _t72;
					_t73 =  *((intOrPtr*)( *_t72 + 0x50))(_t72);
					asm("fclex");
					if(_t73 < 0) {
						_push(0x50);
						_push(0x411ff4);
						_push(_t118);
						_push(_t73);
						L00401832();
					}
					L0040182C();
					_t75 = 0;
				}
				_t135 =  *0x41b380 - _t75; // 0x240e8cc
				if(_t135 == 0) {
					_push(0x41b380);
					_push(0x411fb0);
					L00401838();
				}
				_t111 =  *0x41b380; // 0x240e8cc
				_t58 =  *((intOrPtr*)( *_t111 + 0x14))(_t111,  &_v44);
				asm("fclex");
				if(_t58 < _t75) {
					_push(0x14);
					_push(_t107);
					_push(_t111);
					_push(_t58);
					L00401832();
				}
				_t59 = _v44;
				_t112 = _t59;
				_t60 =  *((intOrPtr*)( *_t59 + 0x68))(_t59,  &_v80);
				asm("fclex");
				if(_t60 < _t75) {
					_push(0x68);
					_push(0x411fc0);
					_push(_t112);
					_push(_t60);
					L00401832();
				}
				L0040182C();
				L00401706();
				L0040183E();
				_push(0x41a7a4);
				L004017E4();
				L004017E4();
				L004017E4();
				return _t60;
			}

0x0041a4fe
0x0041a50d
0x0041a51a
0x0041a51d
0x0041a524
0x0041a526
0x0041a529
0x0041a52f
0x0041a538
0x0041a53b
0x0041a53e
0x0041a541
0x0041a544
0x0041a547
0x0041a54a
0x0041a54d
0x0041a558
0x0041a55b
0x0041a562
0x0041a567
0x0041a56a
0x0041a56b
0x0041a581
0x0041a589
0x0041a6fd
0x0041a58f
0x0041a58f
0x0041a595
0x0041a597
0x0041a59c
0x0041a5a1
0x0041a5a1
0x0041a5a6
0x0041a5b3
0x0041a5b8
0x0041a5ba
0x0041a5cd
0x0041a5bc
0x0041a5bc
0x0041a5c1
0x0041a5c3
0x0041a5c4
0x0041a5c5
0x0041a5c6
0x0041a5c6
0x0041a5d2
0x0041a5d7
0x0041a5d8
0x0041a5e3
0x0041a5eb
0x0041a5ed
0x0041a5ef
0x0041a5f4
0x0041a5f9
0x0041a5fa
0x0041a5fb
0x0041a5fb
0x0041a603
0x0041a60f
0x0041a611
0x0041a616
0x0041a61b
0x0041a61b
0x0041a620
0x0041a62d
0x0041a632
0x0041a634
0x0041a636
0x0041a638
0x0041a639
0x0041a63a
0x0041a63b
0x0041a63b
0x0041a640
0x0041a64c
0x0041a64e
0x0041a656
0x0041a658
0x0041a65a
0x0041a65f
0x0041a664
0x0041a665
0x0041a666
0x0041a666
0x0041a66e
0x0041a676
0x0041a678
0x0041a679
0x0041a67c
0x0041a683
0x0041a68d
0x0041a695
0x0041a6a1
0x0041a6a3
0x0041a6a8
0x0041a6ad
0x0041a6ad
0x0041a6b2
0x0041a6bf
0x0041a6c4
0x0041a6c6
0x0041a6c8
0x0041a6ca
0x0041a6cb
0x0041a6cc
0x0041a6cd
0x0041a6cd
0x0041a6d2
0x0041a6d6
0x0041a6da
0x0041a6df
0x0041a6e1
0x0041a6e3
0x0041a6e5
0x0041a6ea
0x0041a6eb
0x0041a6ec
0x0041a6ec
0x0041a6f4
0x0041a6f9
0x0041a6f9
0x0041a702
0x0041a708
0x0041a70a
0x0041a70f
0x0041a714
0x0041a714
0x0041a719
0x0041a726
0x0041a72b
0x0041a72d
0x0041a72f
0x0041a731
0x0041a732
0x0041a733
0x0041a734
0x0041a734
0x0041a739
0x0041a743
0x0041a745
0x0041a74a
0x0041a74c
0x0041a74e
0x0041a750
0x0041a755
0x0041a756
0x0041a757
0x0041a757
0x0041a75f
0x0041a764
0x0041a76e
0x0041a773
0x0041a78e
0x0041a796
0x0041a79e
0x0041a7a3

APIs

__vbaStrCopy.MSVBVM60 ref: 0041A54D
__vbaVarDup.MSVBVM60 ref: 0041A562
#562.MSVBVM60(?), ref: 0041A56B
__vbaFreeVar.MSVBVM60(?), ref: 0041A581
__vbaNew2.MSVBVM60(00411FB0,0041B380,?), ref: 0041A5A1
__vbaHresultCheckObj.MSVBVM60(00000000,0240E8CC,00411FA0,00000014), ref: 0041A5C6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FC0,00000138), ref: 0041A5FB
__vbaFreeObj.MSVBVM60(00000000,?,00411FC0,00000138), ref: 0041A603
__vbaNew2.MSVBVM60(00411FB0,0041B380), ref: 0041A61B
__vbaHresultCheckObj.MSVBVM60(00000000,0240E8CC,00411FA0,00000014), ref: 0041A63B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FC0,00000138), ref: 0041A666
__vbaFreeObj.MSVBVM60(00000000,?,00411FC0,00000138), ref: 0041A66E
#705.MSVBVM60(?,00000000), ref: 0041A683
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A68D
__vbaFreeVar.MSVBVM60(?,00000000), ref: 0041A695
__vbaNew2.MSVBVM60(00411FB0,0041B380,?,00000000), ref: 0041A6AD
__vbaHresultCheckObj.MSVBVM60(00000000,0240E8CC,00411FA0,0000001C), ref: 0041A6CD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FF4,00000050), ref: 0041A6EC
__vbaFreeObj.MSVBVM60(00000000,?,00411FF4,00000050), ref: 0041A6F4
__vbaNew2.MSVBVM60(00411FB0,0041B380,?), ref: 0041A714
__vbaHresultCheckObj.MSVBVM60(00000000,0240E8CC,00411FA0,00000014), ref: 0041A734
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FC0,00000068), ref: 0041A757
__vbaFreeObj.MSVBVM60(00000000,?,00411FC0,00000068), ref: 0041A75F
#611.MSVBVM60(00000000,?,00411FC0,00000068), ref: 0041A764
__vbaStrMove.MSVBVM60(00000000,?,00411FC0,00000068), ref: 0041A76E
__vbaFreeStr.MSVBVM60(0041A7A4), ref: 0041A78E
__vbaFreeStr.MSVBVM60(0041A7A4), ref: 0041A796
__vbaFreeStr.MSVBVM60(0041A7A4), ref: 0041A79E

Strings

Inferencing, xrefs: 0041A644
Sprinkelvrkernes, xrefs: 0041A5DD

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$Move$#562#611#705Copy
String ID: Inferencing$Sprinkelvrkernes
API String ID: 3821766861-2317132577
Opcode ID: 51e7085789cf1d258c850246914e4ec5b3b66e0650942eb44180adf7d1a0a7f3
Instruction ID: e4a62e94063a05c66032b052c4ea7847904c08b794f7784f8031365a27f6b6a3
Opcode Fuzzy Hash: 51e7085789cf1d258c850246914e4ec5b3b66e0650942eb44180adf7d1a0a7f3
Instruction Fuzzy Hash: 78719771940208ABCB10EFA5C885EDEBBB8EF18704F54413EF141B31E1D7789986CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041A293, Relevance: 31.7, APIs: 21, Instructions: 181
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0041A293(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0) {
				intOrPtr _v8;
				long long* _v12;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				char _v44;
				intOrPtr _v52;
				char _v60;
				intOrPtr _v68;
				char _v76;
				intOrPtr _v84;
				char _v92;
				intOrPtr _v100;
				char _v108;
				char _v176;
				char* _t54;
				void* _t57;
				intOrPtr* _t58;
				void* _t59;
				void* _t61;
				intOrPtr* _t62;
				void* _t63;
				intOrPtr* _t64;
				char _t65;
				void* _t67;
				intOrPtr* _t97;
				intOrPtr* _t98;
				intOrPtr* _t99;
				intOrPtr* _t100;
				intOrPtr* _t101;
				intOrPtr _t104;
				long long* _t105;
				intOrPtr _t108;
				intOrPtr _t111;

				_push(0x401676);
				_t54 =  *[fs:0x0];
				_push(_t54);
				 *[fs:0x0] = _t104;
				_t105 = _t104 - 0xb4;
				_v12 = _t105;
				_v8 = 0x401640;
				asm("fldz");
				 *_t105 = __fp0;
				_v28 = 0;
				_v36 = 0;
				_v40 = 0;
				_v44 = 0;
				_v60 = 0;
				_v76 = 0;
				_v92 = 0;
				_v108 = 0;
				_v176 = 0;
				L00401724();
				L0040172A();
				asm("fcomp qword [0x401638]");
				asm("fnstsw ax");
				asm("sahf");
				if(0 != 0) {
					_push(0);
					_push( &_v60);
					_v52 = 1;
					_v60 = 2;
					L0040171E();
					L0040183E();
					L00401802();
					_t108 =  *0x41b380; // 0x240e8cc
					if(_t108 == 0) {
						_push(0x41b380);
						_push(0x411fb0);
						L00401838();
					}
					_t97 =  *0x41b380; // 0x240e8cc
					_t57 =  *((intOrPtr*)( *_t97 + 0x14))(_t97,  &_v44);
					asm("fclex");
					if(_t57 < 0) {
						_push(0x14);
						_push(0x411fa0);
						_push(_t97);
						_push(_t57);
						L00401832();
					}
					_t58 = _v44;
					_t98 = _t58;
					_t59 =  *((intOrPtr*)( *_t58 + 0xd0))(_t58,  &_v40);
					asm("fclex");
					if(_t59 < 0) {
						_push(0xd0);
						_push(0x411fc0);
						_push(_t98);
						_push(_t59);
						L00401832();
					}
					_v40 = 0;
					L0040183E();
					L0040182C();
					_t111 =  *0x41b380; // 0x240e8cc
					if(_t111 == 0) {
						_push(0x41b380);
						_push(0x411fb0);
						L00401838();
					}
					_t99 =  *0x41b380; // 0x240e8cc
					_t61 =  *((intOrPtr*)( *_t99 + 0x14))(_t99,  &_v44);
					asm("fclex");
					if(_t61 < 0) {
						_push(0x14);
						_push(0x411fa0);
						_push(_t99);
						_push(_t61);
						L00401832();
					}
					_t62 = _v44;
					_t100 = _t62;
					_t63 =  *((intOrPtr*)( *_t62 + 0xb8))(_t62,  &_v176);
					asm("fclex");
					if(_t63 < 0) {
						_push(0xb8);
						_push(0x411fc0);
						_push(_t100);
						_push(_t63);
						L00401832();
					}
					L0040182C();
					L00401712();
					_t64 =  &_v44;
					L00401718();
					_t101 = _t64;
					_v100 = 0x80020004;
					_v84 = 0x80020004;
					_v68 = 0x80020004;
					_v52 = 0x80020004;
					_t65 = 0xa;
					_v108 = _t65;
					_v92 = _t65;
					_v76 = _t65;
					_v60 = _t65;
					_t67 =  *((intOrPtr*)( *_t101 + 0x44))(_t101, 0x7304,  &_v60,  &_v76,  &_v92,  &_v108, _t64, _t63);
					asm("fclex");
					if(_t67 < 0) {
						_push(0x44);
						_push(0x4140a8);
						_push(_t101);
						_push(_t67);
						L00401832();
					}
					L0040182C();
					_push( &_v108);
					_push( &_v92);
					_push( &_v76);
					_t54 =  &_v60;
					_push(_t54);
					_push(4);
					L0040181A();
				}
				asm("wait");
				_push(0x41a4e0);
				_v32 =  *0x401630;
				L004017E4();
				L004017E4();
				return _t54;
			}

0x0041a298
0x0041a29d
0x0041a2a3
0x0041a2a4
0x0041a2ab
0x0041a2b4
0x0041a2b7
0x0041a2c0
0x0041a2c4
0x0041a2c7
0x0041a2ca
0x0041a2cd
0x0041a2d0
0x0041a2d3
0x0041a2d6
0x0041a2d9
0x0041a2dc
0x0041a2df
0x0041a2e5
0x0041a2ea
0x0041a2ef
0x0041a2f5
0x0041a2f7
0x0041a2f8
0x0041a301
0x0041a302
0x0041a303
0x0041a30a
0x0041a311
0x0041a31b
0x0041a323
0x0041a328
0x0041a32e
0x0041a330
0x0041a335
0x0041a33a
0x0041a33a
0x0041a33f
0x0041a34c
0x0041a351
0x0041a353
0x0041a355
0x0041a357
0x0041a35c
0x0041a35d
0x0041a35e
0x0041a35e
0x0041a363
0x0041a36d
0x0041a36f
0x0041a377
0x0041a379
0x0041a37b
0x0041a380
0x0041a385
0x0041a386
0x0041a387
0x0041a387
0x0041a392
0x0041a395
0x0041a39d
0x0041a3a2
0x0041a3a8
0x0041a3aa
0x0041a3af
0x0041a3b4
0x0041a3b4
0x0041a3b9
0x0041a3c6
0x0041a3cb
0x0041a3cd
0x0041a3cf
0x0041a3d1
0x0041a3d6
0x0041a3d7
0x0041a3d8
0x0041a3d8
0x0041a3dd
0x0041a3ea
0x0041a3ec
0x0041a3f4
0x0041a3f6
0x0041a3f8
0x0041a3fd
0x0041a402
0x0041a403
0x0041a404
0x0041a404
0x0041a40c
0x0041a411
0x0041a417
0x0041a41b
0x0041a427
0x0041a429
0x0041a42c
0x0041a42f
0x0041a432
0x0041a435
0x0041a439
0x0041a448
0x0041a44b
0x0041a44e
0x0041a45a
0x0041a45f
0x0041a461
0x0041a463
0x0041a465
0x0041a46a
0x0041a46b
0x0041a46c
0x0041a46c
0x0041a474
0x0041a47c
0x0041a480
0x0041a484
0x0041a485
0x0041a488
0x0041a489
0x0041a48b
0x0041a490
0x0041a499
0x0041a49a
0x0041a49f
0x0041a4d2
0x0041a4da
0x0041a4df

APIs

#585.MSVBVM60 ref: 0041A2E5
__vbaFpR8.MSVBVM60 ref: 0041A2EA
#705.MSVBVM60(?,00000000), ref: 0041A311
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A31B
__vbaFreeVar.MSVBVM60(?,00000000), ref: 0041A323
__vbaNew2.MSVBVM60(00411FB0,0041B380,?,00000000), ref: 0041A33A
__vbaHresultCheckObj.MSVBVM60(00000000,0240E8CC,00411FA0,00000014), ref: 0041A35E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FC0,000000D0), ref: 0041A387
__vbaStrMove.MSVBVM60(00000000,?,00411FC0,000000D0), ref: 0041A395
__vbaFreeObj.MSVBVM60(00000000,?,00411FC0,000000D0), ref: 0041A39D
__vbaNew2.MSVBVM60(00411FB0,0041B380), ref: 0041A3B4
__vbaHresultCheckObj.MSVBVM60(00000000,0240E8CC,00411FA0,00000014), ref: 0041A3D8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FC0,000000B8), ref: 0041A404
__vbaFreeObj.MSVBVM60(00000000,?,00411FC0,000000B8), ref: 0041A40C
#685.MSVBVM60(00000000,?,00411FC0,000000B8), ref: 0041A411
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041A41B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004140A8,00000044), ref: 0041A46C
__vbaFreeObj.MSVBVM60(00000000,00000000,004140A8,00000044), ref: 0041A474
__vbaFreeVarList.MSVBVM60(00000004,00000002,?,?,?), ref: 0041A48B
__vbaFreeStr.MSVBVM60(0041A4E0), ref: 0041A4D2
__vbaFreeStr.MSVBVM60(0041A4E0), ref: 0041A4DA

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$MoveNew2$#585#685#705List
String ID:
API String ID: 1883905597-0
Opcode ID: 4af66d2636b733f8bfa0d42efa1ee19e054fcf8241a6208cd623da2006dd6cd1
Instruction ID: 8e057da6baa7aea7e884b84dbd96e27b717d54f8d68aef8176495a7c40090423
Opcode Fuzzy Hash: 4af66d2636b733f8bfa0d42efa1ee19e054fcf8241a6208cd623da2006dd6cd1
Instruction Fuzzy Hash: 9B515B71D40208AFDB04EF95C886EEEBBB8EF58304F14412BF505B71A1DB785985CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0D8, Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0041A0D8(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v40;
				void* _v44;
				void* _v48;
				signed int _v56;
				char _v64;
				intOrPtr _v72;
				char _v80;
				intOrPtr _v88;
				char _v96;
				intOrPtr _v104;
				char _v112;
				char* _v120;
				intOrPtr _v128;
				char* _t48;
				void* _t69;
				void* _t71;
				intOrPtr _t72;

				_t72 = _t71 - 0x18;
				 *[fs:0x0] = _t72;
				L00401670();
				_v28 = _t72;
				_v24 = 0x4015e8;
				_v20 = 0;
				_v16 = 0;
				_t48 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401676, _t69);
				_v8 = 1;
				_v8 = 2;
				_push(0x414088);
				L0040173C();
				if(_t48 != 2) {
					_v8 = 3;
					_v56 = _v56 & 0x00000000;
					_v64 = 2;
					_push(0xfffffffe);
					_push(0xfffffffe);
					_push(0xfffffffe);
					_push(0xffffffff);
					_push( &_v64);
					L00401736();
					L0040183E();
					L00401802();
					_v8 = 4;
					_push(0);
					L00401814();
					_v8 = 5;
					_push(0);
					_push(0);
					_push(1);
					L00401730();
					L0040183E();
					_v8 = 6;
					_v104 = 0x80020004;
					_v112 = 0xa;
					_v88 = 0x80020004;
					_v96 = 0xa;
					_v72 = 0x80020004;
					_v80 = 0xa;
					_v120 = L"Gregarinian";
					_v128 = 8;
					L00401760();
					_push( &_v112);
					_push( &_v96);
					_push( &_v80);
					_push(0);
					_push( &_v64);
					L00401772();
					_push( &_v112);
					_push( &_v96);
					_push( &_v80);
					_t48 =  &_v64;
					_push(_t48);
					_push(4);
					L0040181A();
				}
				_v8 = 8;
				_push(0xffffffff);
				L00401814();
				_v8 = 9;
				_v40 = 0x74be;
				_push(0x41a26a);
				L004017E4();
				L004017E4();
				return _t48;
			}

0x0041a0db
0x0041a0ea
0x0041a0f6
0x0041a0fe
0x0041a101
0x0041a108
0x0041a10f
0x0041a11e
0x0041a121
0x0041a128
0x0041a12f
0x0041a134
0x0041a13c
0x0041a142
0x0041a149
0x0041a14d
0x0041a154
0x0041a156
0x0041a158
0x0041a15a
0x0041a15f
0x0041a160
0x0041a16a
0x0041a172
0x0041a177
0x0041a17e
0x0041a180
0x0041a185
0x0041a18c
0x0041a18e
0x0041a190
0x0041a192
0x0041a19c
0x0041a1a1
0x0041a1a8
0x0041a1af
0x0041a1b6
0x0041a1bd
0x0041a1c4
0x0041a1cb
0x0041a1d2
0x0041a1d9
0x0041a1e6
0x0041a1ee
0x0041a1f2
0x0041a1f6
0x0041a1f7
0x0041a1fc
0x0041a1fd
0x0041a205
0x0041a209
0x0041a20d
0x0041a20e
0x0041a211
0x0041a212
0x0041a214
0x0041a219
0x0041a21c
0x0041a223
0x0041a225
0x0041a22a
0x0041a231
0x0041a237
0x0041a25c
0x0041a264
0x0041a269

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 0041A0F6
__vbaI4Str.MSVBVM60(00414088,?,?,?,?,00401676), ref: 0041A134
#704.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A160
__vbaStrMove.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A16A
__vbaFreeVar.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A172
__vbaOnError.MSVBVM60(00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A180
#706.MSVBVM60(00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A192
__vbaStrMove.MSVBVM60(00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A19C
__vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A1E6
#595.MSVBVM60(00000002,00000000,0000000A,0000000A,0000000A,?,?,?,?,?,?,?,00000001,00000000,00000000,00000000), ref: 0041A1FD
__vbaFreeVarList.MSVBVM60(00000004,00000002,0000000A,0000000A,0000000A,00000002,00000000,0000000A,0000000A,0000000A), ref: 0041A214
__vbaOnError.MSVBVM60(000000FF,00414088,?,?,?,?,00401676), ref: 0041A225
__vbaFreeStr.MSVBVM60(0041A26A,000000FF,00414088), ref: 0041A25C
__vbaFreeStr.MSVBVM60(0041A26A,000000FF,00414088), ref: 0041A264

Strings

Gregarinian, xrefs: 0041A1D2

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$ErrorMove$#595#704#706ChkstkList
String ID: Gregarinian
API String ID: 2605556234-529014253
Opcode ID: 332999a956faff3ca323b17fdb63ae289050c7da44dbfd8467f33a582b4b14a0
Instruction ID: 61711bc0fe1659fe700315f95cdbf0b0bcac3e982cefed0e12b66b7ae9c375fb
Opcode Fuzzy Hash: 332999a956faff3ca323b17fdb63ae289050c7da44dbfd8467f33a582b4b14a0
Instruction Fuzzy Hash: 6041FCB1D01208ABDB10EFD5C945BDDBBB9AF04314F60812AF1217B2E1DBB95A09CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041A7C1, Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00411FB0,0041B380), ref: 0041A803
__vbaHresultCheckObj.MSVBVM60(00000000,0240E8CC,00411FA0,00000014), ref: 0041A827
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FC0,000000C8), ref: 0041A850
__vbaFreeObj.MSVBVM60 ref: 0041A858

Memory Dump Source

Source File: 00000000.00000002.780241120.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.780206846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.780407527.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.780459140.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID:
API String ID: 4261391273-0
Opcode ID: f46290d3cf6403a78f385dc738c220fd733660bdc44dc27ebbbb8d4edabd9919
Instruction ID: 07dc329e075834e95cdee82abf139fa4e62b68b6e7db1671a0c815c55b28da4c
Opcode Fuzzy Hash: f46290d3cf6403a78f385dc738c220fd733660bdc44dc27ebbbb8d4edabd9919
Instruction Fuzzy Hash: C911A370981208ABD700AB55CC46FEFBBA8EB44744F14452AF104B31E0D7B828828BA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Statement of Account.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Statement of Account.exe PID: 5984 Parent PID: 6140

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Statement of Account.exe PID: 5984 Parent PID: 6140 Statement of Account.exeCOMMON

Executed Functions

Function 00403611, Relevance: 18.3, APIs: 1, Strings: 11, Instructions: 305memoryCOMMON

Function 0040225E, Relevance: 6.1, APIs: 1, Strings: 1, Instructions: 3124COMMON

Function 0041A4FB, Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 220
COMMON

Function 0041A293, Relevance: 31.7, APIs: 21, Instructions: 181
COMMON

Function 0041A0D8, Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 97
COMMON