Play interactive tour

Edit tour

Windows Analysis Report REQUIREMENT.exe

Overview

General Information

Sample Name:	REQUIREMENT.exe
Analysis ID:	502075
MD5:	fb70ff484021669624233d0fbd77ec6a
SHA1:	6820b13631967663ec2637c43c828468633051fd
SHA256:	2b40757a6763aa725d86426ce3cd16fcf1380a9152837d4fbe5e5b085710054c
Tags:	exeguloader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected GuLoader

Found potential dummy code loops (likely to delay analysis)

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Contains functionality to call native functions

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Program does not show much activity (idle)

Uses code obfuscation techniques (call, push, ret)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Detected potential crypto function

Classification

Process Tree

System is w10x64

REQUIREMENT.exe (PID: 6976 cmdline: 'C:\Users\user\Desktop\REQUIREMENT.exe' MD5: FB70FF484021669624233D0FBD77EC6A)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=downloa"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=downloa"}

Source: REQUIREMENT.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=downloa

Source: REQUIREMENT.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\REQUIREMENT.exe

Code function: 0_2_02C576AD NtAllocateVirtualMemory,

0_2_02C576AD

Source: REQUIREMENT.exe, 00000000.00000000.665138036.0000000000417000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameStablerne.exe vs REQUIREMENT.exe
Source: REQUIREMENT.exe	Binary or memory string: OriginalFilenameStablerne.exe vs REQUIREMENT.exe

Source: C:\Users\user\Desktop\REQUIREMENT.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_004016F9	0_2_004016F9
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_00401746	0_2_00401746
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_0040150A	0_2_0040150A
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C576AD	0_2_02C576AD
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C5BBCC	0_2_02C5BBCC
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C5AAF9	0_2_02C5AAF9
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C55A93	0_2_02C55A93
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C558A9	0_2_02C558A9
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C5A8BF	0_2_02C5A8BF
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C59A51	0_2_02C59A51
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C57A08	0_2_02C57A08
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C55E2B	0_2_02C55E2B
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C573C1	0_2_02C573C1
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C56185	0_2_02C56185
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C59D8D	0_2_02C59D8D
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C55F15	0_2_02C55F15
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C55F11	0_2_02C55F11

Source: C:\Users\user\Desktop\REQUIREMENT.exe

File created: C:\Users\user\AppData\Local\Temp\~DF487C68D7539D4AB0.TMP

Jump to behavior

Source: REQUIREMENT.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\REQUIREMENT.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\REQUIREMENT.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: classification engine

Classification label: mal68.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_00404C7B push eax; retf	0_2_00404C82
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_00404619 push esp; retf	0_2_0040461A
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_00405035 push ss; retf	0_2_00405037
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_00403ADA push ecx; retf	0_2_00403ADC
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_0040528D push esp; retf	0_2_0040528E
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_004044B5 push eax; retf	0_2_004044B6
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_00403B4B push ebp; retf	0_2_00403B4C
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_00405775 push eax; retf	0_2_00405779
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_00404F2B push edi; iretd	0_2_00404F3A
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C542C3 push eax; ret	0_2_02C542D0
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C526CA push FFFFFF81h; ret	0_2_02C526CC
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C540EC push eax; retn 0010h	0_2_02C5412E
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C5209B push ecx; ret	0_2_02C5209C
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C53E65 pushad ; ret	0_2_02C53E68
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C5A1C7 push eax; retf B6D8h	0_2_02C5C7F0
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C513C7 push eax; retf	0_2_02C513C8
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C50792 push ds; ret	0_2_02C50794
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C54B54 push ecx; ret	0_2_02C54B5A
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C54125 push eax; retn 0010h	0_2_02C5412E

Source: C:\Users\user\Desktop\REQUIREMENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\REQUIREMENT.exe	RDTSC instruction interceptor: First address: 000000000040F697 second address: 000000000040F697 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 popfd 0x00000004 cmp ecx, 0Fh 0x00000007 popad 0x00000008 wait 0x00000009 mfence 0x0000000c dec edi 0x0000000d wait 0x0000000e wait 0x0000000f cmp edi, 00000000h 0x00000012 jne 00007F6D0C3927BDh 0x00000014 pushfd 0x00000015 popfd 0x00000016 cmp ecx, 000000CAh 0x0000001c pushad 0x0000001d cmp eax, 000000F0h 0x00000022 cmp eax, 02h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\REQUIREMENT.exe	RDTSC instruction interceptor: First address: 0000000002C5A0C8 second address: 0000000002C5A0C8 instructions: 0x00000000 rdtsc 0x00000002 mov eax, AA54BF9Eh 0x00000007 xor eax, 18F07B17h 0x0000000c xor eax, 2300AFC3h 0x00000011 xor eax, 91A46B4Bh 0x00000016 cpuid 0x00000018 popad 0x00000019 cmp dl, 00000034h 0x0000001c call 00007F6D0C93C838h 0x00000021 lfence 0x00000024 mov edx, 246E52A3h 0x00000029 xor edx, 20DEFFF8h 0x0000002f xor edx, 4C51A0A7h 0x00000035 xor edx, 371F0DE8h 0x0000003b mov edx, dword ptr [edx] 0x0000003d lfence 0x00000040 jmp 00007F6D0C93C876h 0x00000042 cmp ecx, eax 0x00000044 cmp bh, ah 0x00000046 ret 0x00000047 sub edx, esi 0x00000049 ret 0x0000004a add edi, edx 0x0000004c dec dword ptr [ebp+000000F8h] 0x00000052 cmp dword ptr [ebp+000000F8h], 00000000h 0x00000059 jne 00007F6D0C93C817h 0x0000005b test bx, 23AAh 0x00000060 call 00007F6D0C93C874h 0x00000065 call 00007F6D0C93C85Ch 0x0000006a lfence 0x0000006d mov edx, 246E52A3h 0x00000072 xor edx, 20DEFFF8h 0x00000078 xor edx, 4C51A0A7h 0x0000007e xor edx, 371F0DE8h 0x00000084 mov edx, dword ptr [edx] 0x00000086 lfence 0x00000089 jmp 00007F6D0C93C876h 0x0000008b cmp ecx, eax 0x0000008d cmp bh, ah 0x0000008f ret 0x00000090 mov esi, edx 0x00000092 pushad 0x00000093 rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\REQUIREMENT.exe

Code function: 0_2_02C5A0C0 rdtsc

0_2_02C5A0C0

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\REQUIREMENT.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C594D3 mov eax, dword ptr fs:[00000030h]	0_2_02C594D3
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C5AAF9 mov eax, dword ptr fs:[00000030h]	0_2_02C5AAF9
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C57244 mov eax, dword ptr fs:[00000030h]	0_2_02C57244
Source: C:\Users\user\Desktop\REQUIREMENT.exe	Code function: 0_2_02C59C43 mov eax, dword ptr fs:[00000030h]	0_2_02C59C43

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\REQUIREMENT.exe

Code function: 0_2_02C5A0C0 rdtsc

0_2_02C5A0C0

Source: C:\Users\user\Desktop\REQUIREMENT.exe

Code function: 0_2_02C5BBCC RtlAddVectoredExceptionHandler,

0_2_02C5BBCC

Source: REQUIREMENT.exe, 00000000.00000002.1187775011.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: REQUIREMENT.exe, 00000000.00000002.1187775011.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: REQUIREMENT.exe, 00000000.00000002.1187775011.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: REQUIREMENT.exe, 00000000.00000002.1187775011.0000000000D80000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery21	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	502075
Start date:	13.10.2021
Start time:	15:36:14
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 23s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	REQUIREMENT.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 35.8% (good quality ratio 16.8%) Quality average: 28.9% Quality standard deviation: 35.7%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.82.210.154, 23.203.141.148, 20.50.102.62, 20.54.110.249, 40.112.88.60, 2.20.178.24, 2.20.178.33 Excluded domains from analysis (whitelisted): displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.945342837977056
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	REQUIREMENT.exe
File size:	102400
MD5:	fb70ff484021669624233d0fbd77ec6a
SHA1:	6820b13631967663ec2637c43c828468633051fd
SHA256:	2b40757a6763aa725d86426ce3cd16fcf1380a9152837d4fbe5e5b085710054c
SHA512:	57bcac78a12191df511dbb96f6d494096b56f269c3d009f373993574ff529698239bcc886dcc10ef162ef0c1d9ac0a4c6008813dc88becf4db8c700c35c0f47e
SSDEEP:	1536:tWD8iCOQRnNBM9rJvWMyWiWjkulM6AnhmXDLZBD:tW4iCOING9rAMy+M6KYB
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L....&.Q.................P...0......x........`....@........

File Icon


Icon Hash:	69e1c892f664c884

Static PE Info

General
Entrypoint:	0x401378
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x51B926D4 [Thu Jun 13 01:56:36 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	669316531b5190f02843878b6ed87394

Entrypoint Preview

Instruction
push 00410DDCh
call 00007F6D0C979F45h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx-04h], bh
js 00007F6D0C979F7Dh
std
test byte ptr [ebp+559B9F4Eh], bl
out 8Eh, al
mov ds, word ptr [00000000h]
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push ebx
inc ecx
inc esi
push esp
push ebx
push eax
dec esi
inc esp
dec ecx
dec esi
inc edi
inc ebp
dec esi
push ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
cmp byte ptr [edx-25h], ch
movsb
dec ebp

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15b34	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x17000	0x1cb2	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x134	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14fe8	0x15000	False	0.514962332589	data	6.38314027792	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x16000	0xd0c	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x17000	0x1cb2	0x2000	False	0.348388671875	data	3.76635467806	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CUSTOM	0x189b4	0x2fe	MS Windows icon resource - 1 icon, 32x32, 16 colors	English	United States
CUSTOM	0x180f6	0x8be	MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel	English	United States
CUSTOM	0x17df8	0x2fe	MS Windows icon resource - 1 icon, 32x32, 16 colors, 4 bits/pixel	English	United States
RT_ICON	0x17550	0x8a8	data
RT_GROUP_ICON	0x1753c	0x14	data
RT_VERSION	0x171a0	0x39c	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, __vbaDateVar, _CIlog, __vbaErrorOverflow, __vbaFileOpen, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaLateMemCall, __vbaVarAdd, __vbaStrToAnsi, __vbaVarDup, __vbaFpI4, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	Collides Systems, Inc.
InternalName	Stablerne
FileVersion	4.00
CompanyName	Collides Systems, Inc.
LegalTrademarks	Collides Systems, Inc.
Comments	Collides Systems, Inc.
ProductName	Collides Systems, Inc.
ProductVersion	4.00
FileDescription	Collides Systems, Inc.
OriginalFilename	Stablerne.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: REQUIREMENT.exe PID: 6976 Parent PID: 900

General

Start time:	15:37:10
Start date:	13/10/2021
Path:	C:\Users\user\Desktop\REQUIREMENT.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\REQUIREMENT.exe'
Imagebase:	0x400000
File size:	102400 bytes
MD5 hash:	FB70FF484021669624233D0FBD77EC6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: REQUIREMENT.exe PID: 6976 Parent PID: 900 REQUIREMENT.exeCOMMON

Executed Functions

Function 02C5BBCC, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 200COMMON

Download Yara Rule

Strings

$M, xrefs: 02C56E9E
`1, xrefs: 02C5633D
KV, xrefs: 02C56577
i&Hh, xrefs: 02C563EF
d-, xrefs: 02C56C1F
k/\, xrefs: 02C562E6

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID: i&Hh$k/\$$M$KV$`1$d-
API String ID: 0-591059297
Opcode ID: b657ed795989900cbf8d114a70dda0ada625eb5314c9e9d2291aaaf386a174e7
Instruction ID: aa03d1f4bae46d1242abd4538f1e313f28289aa8efa1098b98ce68b0af7689b6
Opcode Fuzzy Hash: b657ed795989900cbf8d114a70dda0ada625eb5314c9e9d2291aaaf386a174e7
Instruction Fuzzy Hash: 8C81C571604788CFDB39CE28D9A47EA37B2AF99344F11411EDC4A8B258CB35DB81CB49

Uniqueness

Uniqueness Score: -1.00%

Function 02C576AD, Relevance: 1.6, APIs: 1, Instructions: 101memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(201D6911,?,-67359B78), ref: 02C57864

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: dc811766c31f0888bcc64f9d77105b8f2004193ee5f56a3f5cde8f1f04a0954a
Instruction ID: e4329087017e9dae325831394fc4b7697807075d047551664174339a27eaca3b
Opcode Fuzzy Hash: dc811766c31f0888bcc64f9d77105b8f2004193ee5f56a3f5cde8f1f04a0954a
Instruction Fuzzy Hash: 2A41C2B46042899FEB309E29CC947EB77B2AF5A354F40412EDC899B214D7308A85CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00413E00, Relevance: 321.6, APIs: 161, Strings: 22, Instructions: 1312COMMON

Download Yara Rule

APIs

#646.MSVBVM60(?), ref: 00413EFF
__vbaStrMove.MSVBVM60 ref: 00413F0D
__vbaStrCmp.MSVBVM60(rebninger,00000000), ref: 00413F19
__vbaFreeStr.MSVBVM60 ref: 00413F2E
__vbaFreeVar.MSVBVM60 ref: 00413F3A
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 00413F5B
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 00413F83
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,000000B8), ref: 00413FB3
__vbaFreeObj.MSVBVM60 ref: 00413FBF
#541.MSVBVM60(0000000A,15:15:15), ref: 00413FD1
__vbaStrVarMove.MSVBVM60(0000000A), ref: 00413FDE
__vbaStrMove.MSVBVM60 ref: 00413FE9
__vbaFreeVar.MSVBVM60 ref: 00413FF5
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 0041400D
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 00414035
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,00000070), ref: 0041405F
__vbaFreeObj.MSVBVM60 ref: 0041406B
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 00414083
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,0000001C), ref: 004140AB
__vbaHresultCheckObj.MSVBVM60(00000000,?,004119AC,00000060), ref: 00414114
__vbaFreeObj.MSVBVM60 ref: 00414120
__vbaStrToAnsi.MSVBVM60(?,MEG), ref: 00414132
__vbaSetSystemError.MSVBVM60(00000000), ref: 00414140
__vbaFreeStr.MSVBVM60 ref: 0041414C
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 0041417A
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 004141A2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,00000068), ref: 004141CC
__vbaFreeObj.MSVBVM60 ref: 004141D8
#610.MSVBVM60(0000000A), ref: 004141E5
#552.MSVBVM60(?,0000000A,00000001), ref: 004141FB
__vbaVarMove.MSVBVM60 ref: 0041420D
__vbaFreeVar.MSVBVM60 ref: 00414219
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 00414231
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 00414259
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,0000013C), ref: 004142C8
__vbaFreeObj.MSVBVM60 ref: 004142D4
__vbaLateMemCall.MSVBVM60(?,Ytf0FfwBKC98,00000003), ref: 00414363
__vbaSetSystemError.MSVBVM60(000BC9FA), ref: 00414378
#612.MSVBVM60(0000000A), ref: 00414391
__vbaStrVarMove.MSVBVM60(0000000A), ref: 0041439E
__vbaStrMove.MSVBVM60 ref: 004143B2
__vbaFreeVar.MSVBVM60 ref: 004143BA
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 004143D3
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 00414401
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,00000110), ref: 00414435
__vbaStrMove.MSVBVM60 ref: 0041444A
__vbaFreeObj.MSVBVM60 ref: 00414458
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 0041446D
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 00414495
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,00000108), ref: 004144C1
__vbaFreeObj.MSVBVM60 ref: 004144C9
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 004144DE
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000044), ref: 004145DA
__vbaLateIdSt.MSVBVM60(?,00000000), ref: 00414623
__vbaFreeVar.MSVBVM60 ref: 0041462F
__vbaStrToAnsi.MSVBVM60(?,finmekaniker), ref: 00414646
__vbaSetSystemError.MSVBVM60(00000000), ref: 00414654
__vbaFreeStr.MSVBVM60 ref: 00414660
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 0041468E
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 004146B6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,00000068), ref: 004146E0
__vbaFreeObj.MSVBVM60 ref: 004146EC
#610.MSVBVM60(0000000A), ref: 004146F9
#552.MSVBVM60(?,0000000A,00000001), ref: 0041470F
__vbaVarMove.MSVBVM60 ref: 0041471E
__vbaFreeVar.MSVBVM60 ref: 0041472A
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 00414742
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 0041476A
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,0000013C), ref: 004147D9
__vbaFreeObj.MSVBVM60 ref: 004147E5
__vbaLateMemCall.MSVBVM60(?,iApzbb76Ji65,00000003), ref: 00414871
__vbaSetSystemError.MSVBVM60(0059E365,00231721), ref: 00414890
#702.MSVBVM60(0000000A,000000FF,000000FE,000000FE,000000FE), ref: 004148C5
__vbaStrMove.MSVBVM60 ref: 004148D9
__vbaFreeVar.MSVBVM60 ref: 004148E1
#611.MSVBVM60 ref: 004148E7
__vbaStrMove.MSVBVM60 ref: 004148F2
#610.MSVBVM60(00000002), ref: 004148FB
#552.MSVBVM60(?,00000002,00000001), ref: 00414911
__vbaVarMove.MSVBVM60 ref: 00414920
__vbaFreeVar.MSVBVM60 ref: 0041492C
_adj_fdiv_m64.MSVBVM60 ref: 00414955
__vbaFpI4.MSVBVM60(432A0000,?,43110000), ref: 00414986
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00411340,000002C0,?,43110000), ref: 004149BA
__vbaStrCopy.MSVBVM60(?,43110000), ref: 004149CB
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 004149D9
__vbaSetSystemError.MSVBVM60(00707257,003ED390,?), ref: 004149F7
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00414A0D
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 00414A3E
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 00414A66
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,000000D8), ref: 00414A96
__vbaStrMove.MSVBVM60 ref: 00414AAB
__vbaFreeObj.MSVBVM60 ref: 00414AB7
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 00414ACF
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 00414AF7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,000000F0), ref: 00414B27
__vbaStrMove.MSVBVM60 ref: 00414B3F
__vbaFreeObj.MSVBVM60 ref: 00414B4B
#610.MSVBVM60(0000000A), ref: 00414B58
#552.MSVBVM60(?,0000000A,00000001), ref: 00414B6E
__vbaVarMove.MSVBVM60 ref: 00414B80
__vbaFreeVar.MSVBVM60 ref: 00414B8C
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 00414BA4
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,0000001C), ref: 00414BCC
__vbaHresultCheckObj.MSVBVM60(00000000,?,004119AC,00000064), ref: 00414BF8
__vbaFreeObj.MSVBVM60 ref: 00414C04
__vbaStrToAnsi.MSVBVM60(?,Undeviousness), ref: 00414C1C
__vbaStrToAnsi.MSVBVM60(?,charbocle,00000000), ref: 00414C2B
__vbaSetSystemError.MSVBVM60(00000000), ref: 00414C35
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00414C4B
#594.MSVBVM60(0000000A), ref: 00414C85
__vbaFreeVar.MSVBVM60 ref: 00414C91
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 00414CA9
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 00414CD7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,000000B8), ref: 00414D0B
__vbaFreeObj.MSVBVM60 ref: 00414D13
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 00414D2B
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 00414D53
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,000000E0), ref: 00414D7F
__vbaStrMove.MSVBVM60 ref: 00414D93
__vbaFreeObj.MSVBVM60 ref: 00414D9F
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 00414DB7
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,0000001C), ref: 00414DDF
__vbaHresultCheckObj.MSVBVM60(00000000,?,004119AC,00000060), ref: 00414E3F
__vbaFreeObj.MSVBVM60 ref: 00414E4B
__vbaStrCopy.MSVBVM60 ref: 00414E8C
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00411370,000006F8), ref: 00414EC5
__vbaFreeStr.MSVBVM60 ref: 00414ED7
__vbaStrCopy.MSVBVM60 ref: 00414EF8
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00411370,000006F8), ref: 00414F31
__vbaFreeStr.MSVBVM60 ref: 00414F3D
__vbaStrCopy.MSVBVM60 ref: 00414F5E
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00411370,000006F8), ref: 00414F97
__vbaFreeStr.MSVBVM60 ref: 00414FA3
__vbaStrCopy.MSVBVM60 ref: 00414FC4
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00411370,000006F8), ref: 00414FFD
__vbaFreeStr.MSVBVM60 ref: 00415009
__vbaStrCopy.MSVBVM60 ref: 0041502A
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00411370,000006F8), ref: 00415063
__vbaFreeStr.MSVBVM60 ref: 0041506F
__vbaHresultCheckObj.MSVBVM60(00000000,00401150,00411340,000002B4), ref: 0041508C
__vbaVarAdd.MSVBVM60(0000000A,?,?), ref: 004150CA
__vbaVarMove.MSVBVM60 ref: 004150D1
#598.MSVBVM60 ref: 004150D7
__vbaVarTstLt.MSVBVM60(00000002,?), ref: 004150F8
__vbaFreeVar.MSVBVM60(004151D1), ref: 00415162
__vbaFreeStr.MSVBVM60 ref: 0041516D
__vbaFreeStr.MSVBVM60 ref: 00415172
__vbaFreeObj.MSVBVM60 ref: 0041517D
__vbaFreeStr.MSVBVM60 ref: 00415182
__vbaFreeVar.MSVBVM60 ref: 00415187
__vbaFreeStr.MSVBVM60 ref: 0041518C
__vbaFreeVar.MSVBVM60 ref: 00415191
__vbaFreeObj.MSVBVM60 ref: 00415196
__vbaFreeStr.MSVBVM60 ref: 0041519E
__vbaFreeObj.MSVBVM60 ref: 004151A6
__vbaFreeStr.MSVBVM60 ref: 004151AE
__vbaFreeStr.MSVBVM60 ref: 004151B6

Strings

Commutual, xrefs: 0041500B
MEG, xrefs: 0041412C
rebninger, xrefs: 00413F14
Valutareservernes, xrefs: 00414E6D
Ytf0FfwBKC98, xrefs: 00414346
Syndromerne5, xrefs: 00414818
Undeviousness, xrefs: 00414C16
Hypnotizabilities, xrefs: 00414FA5
Organophone2, xrefs: 00414ED9
Scopulousness, xrefs: 00414289
CLAMATORES, xrefs: 00414F3F
SEMIMALIGNANT, xrefs: 004140DB
problemsgende, xrefs: 00414E0F
finmekaniker, xrefs: 0041463E
15:15:15, xrefs: 00413FCB
liquidated, xrefs: 004149C0
charbocle, xrefs: 00414C25
extralegal, xrefs: 0041479A
GAARDES, xrefs: 0041451A
Crepey, xrefs: 00414307
Wrp, xrefs: 00414668
iApzbb76Ji65, xrefs: 00414857

Memory Dump Source

Source File: 00000000.00000002.1187541923.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1187526045.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1187588915.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1187595132.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$MoveNew2$CopyErrorSystem$Ansi$#552#610$Late$CallList$#541#594#598#611#612#646#702_adj_fdiv_m64
String ID: 15:15:15$CLAMATORES$Commutual$Crepey$GAARDES$Hypnotizabilities$MEG$Organophone2$SEMIMALIGNANT$Scopulousness$Syndromerne5$Undeviousness$Valutareservernes$Wrp$Ytf0FfwBKC98$charbocle$extralegal$finmekaniker$iApzbb76Ji65$liquidated$problemsgende$rebninger
API String ID: 2302085476-689379688
Opcode ID: f1792f72988de27c70c5bf8cd4df38c8e41023503000a4e09620b4630475d28a
Instruction ID: cc5b69b219045f30246a0569de28392265c9986ccb27710fb6c1dedbcdc9d664
Opcode Fuzzy Hash: f1792f72988de27c70c5bf8cd4df38c8e41023503000a4e09620b4630475d28a
Instruction Fuzzy Hash: EAC28F70900219AFCB24DF64DC89BE9BBB5FB48304F1085AAE14EB72A4DB745AC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00401378, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6"*), ref: 0040137D

Strings

VB5!6"*, xrefs: 00401378

Memory Dump Source

Source File: 00000000.00000002.1187541923.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1187526045.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1187588915.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1187595132.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6"*
API String ID: 1341478452-2992194029
Opcode ID: 0cbbcf3e6960033bdfc73981f7854c4ef6d83e89043feb0ad1be145916ad9ec0
Instruction ID: de1b4099ddef439ef961e277567c93a883eaa8dc164cbddf7ebed2e2a4e262b6
Opcode Fuzzy Hash: 0cbbcf3e6960033bdfc73981f7854c4ef6d83e89043feb0ad1be145916ad9ec0
Instruction Fuzzy Hash: 1001459009E7D56FD31757715C29AA23F789E1326470A11DBD8C1CA0B3C01D089AC776

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02C558A9, Relevance: 9.5, Strings: 7, Instructions: 717COMMON

Download Yara Rule

Strings

$M, xrefs: 02C56E9E
w2%h, xrefs: 02C561EC
`1, xrefs: 02C5633D
KV, xrefs: 02C56577
i&Hh, xrefs: 02C563EF
d-, xrefs: 02C56C1F
k/\, xrefs: 02C562E6

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID: i&Hh$k/\$w2%h$$M$KV$`1$d-
API String ID: 0-2385936248
Opcode ID: 97a3d1b5969fdc973403045ce9ab70810f80cb0572d682787e9731842dd174c6
Instruction ID: 0193419af919572446f00150e9fdcccbbee56e0235f4c0bd6edd4c341d2b0f22
Opcode Fuzzy Hash: 97a3d1b5969fdc973403045ce9ab70810f80cb0572d682787e9731842dd174c6
Instruction Fuzzy Hash: A962FCB2504399DFDB748F39CD447DA7BA2FF99310F458229DC899B228D3309A82CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02C55F15, Relevance: 9.4, Strings: 7, Instructions: 631COMMON

Download Yara Rule

Strings

$M, xrefs: 02C56E9E
w2%h, xrefs: 02C561EC
`1, xrefs: 02C5633D
KV, xrefs: 02C56577
i&Hh, xrefs: 02C563EF
d-, xrefs: 02C56C1F
k/\, xrefs: 02C562E6

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID: i&Hh$k/\$w2%h$$M$KV$`1$d-
API String ID: 0-2385936248
Opcode ID: 965d54499fdd82fe50e141e5d29f8ff733dce8ca9364a99ccee6edfd4a46b60d
Instruction ID: d9cd3425e486e8d40b37b9034b5317902353a5d3f2adb1a24b9381ae6f095958
Opcode Fuzzy Hash: 965d54499fdd82fe50e141e5d29f8ff733dce8ca9364a99ccee6edfd4a46b60d
Instruction Fuzzy Hash: 1F52FBB2604299DFDB748F39CD497DABBB2FF98310F518129DC499B224D3709A81CB85

Uniqueness

Uniqueness Score: -1.00%

Function 02C55F11, Relevance: 9.4, Strings: 7, Instructions: 605COMMON

Download Yara Rule

Strings

$M, xrefs: 02C56E9E
w2%h, xrefs: 02C561EC
`1, xrefs: 02C5633D
KV, xrefs: 02C56577
i&Hh, xrefs: 02C563EF
d-, xrefs: 02C56C1F
k/\, xrefs: 02C562E6

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID: i&Hh$k/\$w2%h$$M$KV$`1$d-
API String ID: 0-2385936248
Opcode ID: bcae70e7101ef842e4c0b74ccf27beb6cbfab9b1c1a5efacb235c0023fc854bf
Instruction ID: bcbaa18df7c1d962493f60a4d57bad67a1b7cf5a1301e8d97acff710d789719e
Opcode Fuzzy Hash: bcae70e7101ef842e4c0b74ccf27beb6cbfab9b1c1a5efacb235c0023fc854bf
Instruction Fuzzy Hash: 8D42FAB2604299DFDB748F39CD497EA7BB2FF99300F518129DC499B224D3709A81CB85

Uniqueness

Uniqueness Score: -1.00%

Function 02C56185, Relevance: 9.3, Strings: 7, Instructions: 528COMMON

Download Yara Rule

Strings

$M, xrefs: 02C56E9E
w2%h, xrefs: 02C561EC
`1, xrefs: 02C5633D
KV, xrefs: 02C56577
i&Hh, xrefs: 02C563EF
d-, xrefs: 02C56C1F
k/\, xrefs: 02C562E6

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID: i&Hh$k/\$w2%h$$M$KV$`1$d-
API String ID: 0-2385936248
Opcode ID: 5061f13b44eb664014f5041dbec93d60adc2f11ab87feec55da7937f0a682bc9
Instruction ID: b62c53476da99ff6da1c475fb24eae00a9406d444a763f87b49ca7da04adbbbd
Opcode Fuzzy Hash: 5061f13b44eb664014f5041dbec93d60adc2f11ab87feec55da7937f0a682bc9
Instruction Fuzzy Hash: E732DAB2604299DFDB748F39CD457DA7BB2FF99310F518129DC499B224C3709A81CB85

Uniqueness

Uniqueness Score: -1.00%

Function 02C5AAF9, Relevance: 4.3, Strings: 3, Instructions: 539COMMON

Download Yara Rule

Strings

<sn,, xrefs: 02C5B48B
<sn,, xrefs: 02C5B486
*S{, xrefs: 02C5B090

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID: *S{$<sn,$<sn,
API String ID: 0-1237897368
Opcode ID: 578e6fda8ac44374062e520f7830ab76bae9dbc53b1cb81818f323309282d86e
Instruction ID: ce2ec9fb826e1285702b1e9ec2fa1ffeadfc004a26a7687105bd2d39531d5ace
Opcode Fuzzy Hash: 578e6fda8ac44374062e520f7830ab76bae9dbc53b1cb81818f323309282d86e
Instruction Fuzzy Hash: 8632F6715083858FCB75CF38C8987DABFA1AF52354F49829ECC994F29AD7308681CB16

Uniqueness

Uniqueness Score: -1.00%

Function 02C57A08, Relevance: 2.7, Strings: 2, Instructions: 247COMMON

Download Yara Rule

Strings

SW-1, xrefs: 02C57D07
b6c, xrefs: 02C57D28

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID: SW-1$b6c
API String ID: 0-2125158211
Opcode ID: f66708f78c3c2f22292cd327e660c865fe70e079d41e74e2186d776f6dafd08b
Instruction ID: 1d66af13887a50bea7830bd3b7ca830040df4acee99b688a92deef73701d8960
Opcode Fuzzy Hash: f66708f78c3c2f22292cd327e660c865fe70e079d41e74e2186d776f6dafd08b
Instruction Fuzzy Hash: 27B1BC71604399DFCF74DF29CC51BEE77A2AF54300F40852EED8A9A250EB319A84DB16

Uniqueness

Uniqueness Score: -1.00%

Function 02C55E2B, Relevance: 2.7, Strings: 2, Instructions: 217COMMON

Download Yara Rule

Strings

w2%h, xrefs: 02C561EC
vsI, xrefs: 02C56EFB

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID: vsI$w2%h
API String ID: 0-1333476025
Opcode ID: 96afc194eacff695a9313cbcfdd627318219b3bb32f410459372bcaf7e026fea
Instruction ID: d98b94bf0acabbdeae608c50b26de5215a74a02e8d0fe12ab5fd1c90262f0a45
Opcode Fuzzy Hash: 96afc194eacff695a9313cbcfdd627318219b3bb32f410459372bcaf7e026fea
Instruction Fuzzy Hash: BF910272504259DFCB64AF35CD587EA7BB2FF95344F42852DEC89AB214D3309A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02C59D8D, Relevance: 2.6, Strings: 2, Instructions: 76COMMON

Download Yara Rule

Strings

WD, xrefs: 02C59EAD
`, xrefs: 02C59ED3

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID: WD$`
API String ID: 0-2995853769
Opcode ID: 4b6588e3ab1febd22cb482c0b37ae1091066e68b211a4a197483f047265f176b
Instruction ID: 4ab81458134f80d397e8c7c0f1b497417401f8047ad5379348efd1c51f86417b
Opcode Fuzzy Hash: 4b6588e3ab1febd22cb482c0b37ae1091066e68b211a4a197483f047265f176b
Instruction Fuzzy Hash: 47212973A052A4CBDF789D3988653DE32A36BD4310F96416F8C0E9B240C7308A85CE86

Uniqueness

Uniqueness Score: -1.00%

Function 02C59A51, Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

&CG, xrefs: 02C59B21

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID: &CG
API String ID: 0-2259257748
Opcode ID: c943926e80abe04a764767e094b3ee92f3dc9ac9a95f7bc3781269ad1bb66b87
Instruction ID: 2322b1ed60171d892fc2f5834386a8b58c3ca5be5eed0a7672af667c10f61906
Opcode Fuzzy Hash: c943926e80abe04a764767e094b3ee92f3dc9ac9a95f7bc3781269ad1bb66b87
Instruction Fuzzy Hash: 9B21C23560876BDBCB209E38C5D07D362A2BF6A744F854169DD898B206EB309982C699

Uniqueness

Uniqueness Score: -1.00%

Function 02C55A93, Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e51d7a037a3433aa252166822a998cacc7351107b19210ae4deaf98377824fe
Instruction ID: 4d35f8031277f98a998a4652019aca54ffe1d131f9ebaa7b61c7c1c77e910d35
Opcode Fuzzy Hash: 2e51d7a037a3433aa252166822a998cacc7351107b19210ae4deaf98377824fe
Instruction Fuzzy Hash: 24510772604799DFCB34CE25CAD87EA33E2AF99790F84452ACD4A8F644D371E681C708

Uniqueness

Uniqueness Score: -1.00%

Function 0040150A, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1187541923.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1187526045.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1187588915.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1187595132.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58187ee0e133b0b48bb3efed7ac890b15464e5e05c24970065dea5c804966976
Instruction ID: d394a65342a6a254380257ba0734a19f866dc21ad068f5b1ddaac111a7468d93
Opcode Fuzzy Hash: 58187ee0e133b0b48bb3efed7ac890b15464e5e05c24970065dea5c804966976
Instruction Fuzzy Hash: F641279025E2D4EFC71B47B64CBA2813FE1AE07108B1A88EFD6D54B8A3E555241FC727

Uniqueness

Uniqueness Score: -1.00%

Function 02C5A8BF, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b70a06bce648d8583238d81e27459b42c6f253e5a4c4bed79cc7564def3051
Instruction ID: 2e8605757ccf78f8a5fee5355ee8ac513edf4115df7901dce75889a6f14bdc77
Opcode Fuzzy Hash: b9b70a06bce648d8583238d81e27459b42c6f253e5a4c4bed79cc7564def3051
Instruction Fuzzy Hash: 6D4118725452A8DBDFB89F348D55BEA37E5AF95720F41011EDC0E9B200D731DA80CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00401746, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1187541923.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1187526045.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1187588915.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1187595132.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e24cef5b52d058c6559a4647f5f96652dbae51e6763f7f5d8b23a4fe3d590a8
Instruction ID: 0ef76ab4ed2bcdf07a831812e9108315abc5032b0251afc9fc56c28be75d868b
Opcode Fuzzy Hash: 9e24cef5b52d058c6559a4647f5f96652dbae51e6763f7f5d8b23a4fe3d590a8
Instruction Fuzzy Hash: 5E11DAB150E3E59FCB174B748CB52527FB0AF1B20070A44EBD4819F8A7E268281ED727

Uniqueness

Uniqueness Score: -1.00%

Function 02C573C1, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3718272f8100551f48d5a36edfd00569317f81eaa819ae6dfcbb43bccc1670
Instruction ID: 680bb278814a0fd4c40c386ee1ed23d526d97e2d33bafa771aa4b144362f3876
Opcode Fuzzy Hash: 8a3718272f8100551f48d5a36edfd00569317f81eaa819ae6dfcbb43bccc1670
Instruction Fuzzy Hash: EF110075508345DFEB64DE79CA856EBBBE1EF14700F91882CDCCAA6159D7308A81CB07

Uniqueness

Uniqueness Score: -1.00%

Function 02C59C43, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7add6c259b975eee3ff442f164733e0fcfaeeb46bd6e124cb8491cb4580bff2d
Instruction ID: 30bba876db23388042795ef214ee710bde445780986881f715b53218161be3b1
Opcode Fuzzy Hash: 7add6c259b975eee3ff442f164733e0fcfaeeb46bd6e124cb8491cb4580bff2d
Instruction Fuzzy Hash: 6C012874204658DFCB24DF18D9D1BD977E1BF99780F0240AADD0A8B321C730EA40DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004016F9, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1187541923.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1187526045.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1187588915.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1187595132.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction ID: 3a4f40afd7daac755765d0dbc513794409bb1d663c47dbf88c845af7c1cdfe86
Opcode Fuzzy Hash: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction Fuzzy Hash: CBF07A70124154EFCB06CF74D8A5A063BE1AF5B3407451CDAD9108F475D736B865EB12

Uniqueness

Uniqueness Score: -1.00%

Function 02C5A0C0, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7250da4545ba971dd811d105313be8f1dad4686cb35b2c787e39267e38313db6
Instruction ID: da70a84081eccab1f72bd0a449ecd59c250ee72eae458081291811f0fb1433d9
Opcode Fuzzy Hash: 7250da4545ba971dd811d105313be8f1dad4686cb35b2c787e39267e38313db6
Instruction Fuzzy Hash: 2FC08CA11300290D92A225762B4116A620B2BC43B0B92CB80290ADA049E80BCF89B8ED

Uniqueness

Uniqueness Score: -1.00%

Function 02C57244, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36bc7d487ba96a66477ca9e392b67307fae178c73110c3d13fe24889aee61fed
Instruction ID: 8ee829be132b79ae6bd4b28dfd87693515b478b4b870949c3c1599733c038702
Opcode Fuzzy Hash: 36bc7d487ba96a66477ca9e392b67307fae178c73110c3d13fe24889aee61fed
Instruction Fuzzy Hash: ECB092B62015809FEF02CB08D491B4073A4FB19688B0804D0E802CF712E224E900CA00

Uniqueness

Uniqueness Score: -1.00%

Function 02C594D3, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1188115207.0000000002C50000.00000040.00000001.sdmp, Offset: 02C50000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae7fad291eae15ed69b8f2648d9409e945b4bef56959a93eac20a496a96ea232
Instruction ID: 1ffe1277d2e9e802ce89c6276c2a69d9aa08595030a126d5131e590b08746204
Opcode Fuzzy Hash: ae7fad291eae15ed69b8f2648d9409e945b4bef56959a93eac20a496a96ea232
Instruction Fuzzy Hash: 8CB00275252655CFC795DF09C190F8173B5FB54751FD154D0E45187B15C364ED40C910

Uniqueness

Uniqueness Score: -1.00%

Function 004153F0, Relevance: 56.2, APIs: 29, Strings: 3, Instructions: 212COMMON

Download Yara Rule

APIs

#693.MSVBVM60(00411BC0), ref: 0041543E
#535.MSVBVM60 ref: 0041544C
#593.MSVBVM60(?), ref: 00415466
__vbaFreeVar.MSVBVM60 ref: 00415471
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 00415489
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 004154B4
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,00000110), ref: 004154E2
__vbaStrMove.MSVBVM60 ref: 004154F1
__vbaFreeObj.MSVBVM60 ref: 00415500
__vbaVarDup.MSVBVM60 ref: 00415516
#666.MSVBVM60(?,0000000A), ref: 00415524
__vbaVarMove.MSVBVM60 ref: 00415530
__vbaFreeVar.MSVBVM60 ref: 00415539
#709.MSVBVM60(ABC,00411BF0,000000FF,00000000), ref: 0041555C
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 0041557D
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 004155A2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,00000140), ref: 004155C8
__vbaFreeObj.MSVBVM60 ref: 004155CD
#704.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 004155E9
__vbaStrMove.MSVBVM60 ref: 004155F4
__vbaFreeVar.MSVBVM60 ref: 004155FD
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 00415616
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 0041563B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,00000070), ref: 0041565B
__vbaFreeObj.MSVBVM60 ref: 00415660
__vbaFileOpen.MSVBVM60(00000020,000000FF,000000D7,overmandende), ref: 00415670
__vbaFreeStr.MSVBVM60(004156CC), ref: 004156BB
__vbaFreeStr.MSVBVM60 ref: 004156C0
__vbaFreeVar.MSVBVM60 ref: 004156C5

Strings

overmandende, xrefs: 00415662
sandvaanere, xrefs: 00415508
ABC, xrefs: 00415557

Memory Dump Source

Source File: 00000000.00000002.1187541923.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1187526045.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1187588915.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1187595132.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$MoveNew2$#535#593#666#693#704#709FileOpen
String ID: ABC$overmandende$sandvaanere
API String ID: 2783911502-2510946440
Opcode ID: 65e9293facf0c2660340387a33d0552a21c1ab456952848f3d296378f7020c73
Instruction ID: a06e825c4a5b899eb8c72edeb3defb2ca8bc20afb4fae2a2334bc52d4f31c16d
Opcode Fuzzy Hash: 65e9293facf0c2660340387a33d0552a21c1ab456952848f3d296378f7020c73
Instruction Fuzzy Hash: E8816870900219EBCB10DFA4DD48ADD7BB9BF48715F20412AF115B72B4DB746986CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00415900, Relevance: 45.7, APIs: 23, Strings: 3, Instructions: 162COMMON

Download Yara Rule

APIs

__vbaStrCopy.MSVBVM60 ref: 00415948
#712.MSVBVM60(?,00411BC0,00000000,00000001,000000FF,00000000), ref: 0041595D
__vbaStrMove.MSVBVM60 ref: 0041596E
__vbaStrCmp.MSVBVM60(00411C24,?), ref: 00415979
#541.MSVBVM60(?,21:21:21), ref: 00415990
__vbaStrVarMove.MSVBVM60(?), ref: 0041599A
__vbaStrMove.MSVBVM60 ref: 004159A5
__vbaFreeVar.MSVBVM60 ref: 004159AA
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 004159C2
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 004159ED
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,000000B8), ref: 00415A1B
__vbaFreeObj.MSVBVM60 ref: 00415A20
#535.MSVBVM60 ref: 00415A26
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 00415A40
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,0000001C), ref: 00415A65
__vbaHresultCheckObj.MSVBVM60(00000000,?,004119AC,00000064), ref: 00415A87
__vbaFreeObj.MSVBVM60 ref: 00415A8C
__vbaVarDup.MSVBVM60 ref: 00415AA6
#687.MSVBVM60(?,?), ref: 00415AB4
__vbaDateVar.MSVBVM60(?), ref: 00415ABE
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00415AD0
__vbaFreeStr.MSVBVM60(00415B0F), ref: 00415B07
__vbaFreeStr.MSVBVM60 ref: 00415B0C

Strings

7/7/7, xrefs: 00415A98
val, xrefs: 0041592B
21:21:21, xrefs: 0041598A

Memory Dump Source

Source File: 00000000.00000002.1187541923.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1187526045.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1187588915.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1187595132.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$Move$New2$#535#541#687#712CopyDateList
String ID: 21:21:21$7/7/7$val
API String ID: 2692386279-935112925
Opcode ID: 49bd7410ae8e238e1930e1e641d2547cad50e5bec521b70a3c38167ed52ad4bd
Instruction ID: 649dc59e17a28ee32b3e7bfbb1b40b2440dfa965904a252ef816ae096b50634c
Opcode Fuzzy Hash: 49bd7410ae8e238e1930e1e641d2547cad50e5bec521b70a3c38167ed52ad4bd
Instruction Fuzzy Hash: FE515CB0950219EFCB00DFA4DD88EEEBBB9FB48745B10412AF105B71A4DB745889CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00415200, Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

#606.MSVBVM60(00000001,?), ref: 00415260
__vbaStrMove.MSVBVM60 ref: 0041526B
__vbaStrCmp.MSVBVM60(00411BA0,00000000), ref: 00415277
__vbaFreeStr.MSVBVM60 ref: 0041528A
__vbaFreeVar.MSVBVM60 ref: 00415299
#541.MSVBVM60(00000002,12:12:12), ref: 004152AD
__vbaStrVarMove.MSVBVM60(00000002), ref: 004152B7
__vbaStrMove.MSVBVM60 ref: 004152C2
__vbaFreeVar.MSVBVM60 ref: 004152CB
#648.MSVBVM60(00000002), ref: 004152DF
__vbaFreeVar.MSVBVM60 ref: 004152E8
__vbaNew2.MSVBVM60(00411954,004165D8), ref: 004152FC
__vbaHresultCheckObj.MSVBVM60(00000000,021E004C,00411944,00000014), ref: 00415327
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411964,000000B8), ref: 00415355
__vbaFreeObj.MSVBVM60 ref: 0041535A
__vbaHresultCheckObj.MSVBVM60(00000000,00401160,00411370,000006FC), ref: 0041537C
__vbaFreeStr.MSVBVM60(004153BA), ref: 004153B3

Strings

12:12:12, xrefs: 004152A7
, xrefs: 00415252

Memory Dump Source

Source File: 00000000.00000002.1187541923.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1187526045.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1187588915.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1187595132.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultMove$#541#606#648New2
String ID: $12:12:12
API String ID: 4248556555-1101392946
Opcode ID: 3444c9d9294d180a82de7abd9660ff13e8529a8f984cd07da943a0bca154414f
Instruction ID: 83ee81ce6452a25207ff11766608bb928af0de1826420e73baa0d5de8a64444e
Opcode Fuzzy Hash: 3444c9d9294d180a82de7abd9660ff13e8529a8f984cd07da943a0bca154414f
Instruction Fuzzy Hash: 35414F70940219EFCB00DFA4DE89AEEBBB8FF58745F10411AE506B72A0DB745845CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004157B0, Relevance: 16.6, APIs: 11, Instructions: 89COMMON

Download Yara Rule

APIs

#632.MSVBVM60(?,?,00000000,?), ref: 00415810
__vbaStrVarVal.MSVBVM60(?,?), ref: 0041581E
#516.MSVBVM60(00000000), ref: 00415825
__vbaFreeStr.MSVBVM60 ref: 00415839
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 00415849
#617.MSVBVM60(00000002,?,000000FF), ref: 0041586A
#617.MSVBVM60(00000002,?,00000000), ref: 00415888
__vbaStrVarMove.MSVBVM60(00000002), ref: 00415892
__vbaStrMove.MSVBVM60 ref: 0041589D
__vbaFreeVar.MSVBVM60 ref: 004158A6
__vbaFreeStr.MSVBVM60(004158DA), ref: 004158D3

Memory Dump Source

Source File: 00000000.00000002.1187541923.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1187526045.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1187588915.0000000000416000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1187595132.0000000000417000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#617Move$#516#632List
String ID:
API String ID: 3155365896-0
Opcode ID: 004e07a88051c3b9e5918c54962a835585965271906ecad5821f2cc3b7a4277e
Instruction ID: dd5464dcc0f5a364211659544102405d5a56ea62002bcb4a3c95b209bf9c0405
Opcode Fuzzy Hash: 004e07a88051c3b9e5918c54962a835585965271906ecad5821f2cc3b7a4277e
Instruction Fuzzy Hash: DF31C6B1C00219EFCB04DF94DD89DEEBBB8FF58705F10422AE602B6164E7B41549CB94

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report REQUIREMENT.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: REQUIREMENT.exe PID: 6976 Parent PID: 900

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: REQUIREMENT.exe PID: 6976 Parent PID: 900 REQUIREMENT.exeCOMMON

Executed Functions

Function 02C5BBCC, Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 200COMMON

Function 02C576AD, Relevance: 1.6, APIs: 1, Instructions: 101memorynativeCOMMON

Function 00413E00, Relevance: 321.6, APIs: 161, Strings: 22, Instructions: 1312COMMON