Play interactive tour

Edit tour

Windows Analysis Report ZAM#U00d3WIENIE.exe

Overview

General Information

Sample Name:	ZAM#U00d3WIENIE.exe
Analysis ID:	502209
MD5:	4805bfc9145d8aa3ac43d1cc29c451ed
SHA1:	7787fa250b35d1a67142d230cbedbc357eb8cb9c
SHA256:	bac5da263610272c5c5be4ecb5a16626c653a757abaffc8402d210227ec04bb8
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected GuLoader

Found potential dummy code loops (likely to delay analysis)

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Contains functionality to call native functions

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Program does not show much activity (idle)

Uses code obfuscation techniques (call, push, ret)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Detected potential crypto function

Classification

Process Tree

System is w10x64

ZAM#U00d3WIENIE.exe (PID: 6008 cmdline: 'C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe' MD5: 4805BFC9145D8AA3AC43D1CC29C451ED)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=downloa"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=downloa"}

Source: ZAM#U00d3WIENIE.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=downloa

Source: ZAM#U00d3WIENIE.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D7A18 NtAllocateVirtualMemory,		0_2_021D7A18
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D7AB7 NtAllocateVirtualMemory,		0_2_021D7AB7

Source: ZAM#U00d3WIENIE.exe, 00000000.00000002.771912024.0000000000416000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamefamiliegruppers.exe vs ZAM#U00d3WIENIE.exe
Source: ZAM#U00d3WIENIE.exe	Binary or memory string: OriginalFilenamefamiliegruppers.exe vs ZAM#U00d3WIENIE.exe

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_0040167A	0_2_0040167A
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_0040162D	0_2_0040162D
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_0040143E	0_2_0040143E
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D7A18	0_2_021D7A18
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021DBDB9	0_2_021DBDB9
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D5A37	0_2_021D5A37
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D6233	0_2_021D6233
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D7E75	0_2_021D7E75
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D5E6E	0_2_021D5E6E
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D7EA0	0_2_021D7EA0
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D66F2	0_2_021D66F2
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D9F0C	0_2_021D9F0C
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021DAB24	0_2_021DAB24
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D5B5F	0_2_021D5B5F
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D7F4C	0_2_021D7F4C
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D634E	0_2_021D634E
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D5FB1	0_2_021D5FB1
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D042E	0_2_021D042E
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D8022	0_2_021D8022
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D5C6B	0_2_021D5C6B
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D609E	0_2_021D609E
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D588B	0_2_021D588B
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D64A0	0_2_021D64A0
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D64E5	0_2_021D64E5
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D8113	0_2_021D8113
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D5909	0_2_021D5909
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D5505	0_2_021D5505
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D6104	0_2_021D6104
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D5D65	0_2_021D5D65
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D659E	0_2_021D659E
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D5597	0_2_021D5597

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe

File created: C:\Users\user\AppData\Local\Temp\~DF737D484AB8F1AB01.TMP

Jump to behavior

Source: ZAM#U00d3WIENIE.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: classification engine

Classification label: mal68.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_00402E52 push esi; ret	0_2_00402E53
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_00405E3D pushfd ; retf	0_2_00405E3E
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_00402ECA push esi; ret	0_2_00402ECB
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_00402EFC push ss; ret	0_2_00402EFD
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_00402E84 push ss; ret	0_2_00402E85
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_00403CBF push ebp; retf	0_2_00403CCB
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D6A51 push ecx; iretd	0_2_021D90A4
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D6A9A push ecx; iretd	0_2_021D90A4
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D6AC0 push ecx; iretd	0_2_021D90A4
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D2EE5 push edx; iretd	0_2_021D92BC
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D0B53 push FFFFFF98h; iretd	0_2_021D0B56
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021DA371 push ecx; ret	0_2_021DA372
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021DA383 push ecx; ret	0_2_021DA384
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D902A push ecx; iretd	0_2_021D90A4
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D9047 push 3966FF69h; retf	0_2_021D909D
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D38C2 push ebx; ret	0_2_021D38D4
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D7DAF push 38E68469h; ret	0_2_021D7E05

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe

RDTSC instruction interceptor: First address: 000000000040F508 second address: 000000000040F508 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 popfd 0x00000004 cmp ecx, 000000F6h 0x0000000a popad 0x0000000b wait 0x0000000c cmp eax, 5Bh 0x0000000f dec edi 0x00000010 mfence 0x00000013 nop 0x00000014 cmp edi, 00000000h 0x00000017 jne 00007F931C9628C0h 0x00000019 mfence 0x0000001c pushfd 0x0000001d popfd 0x0000001e pushad 0x0000001f pushfd 0x00000020 popfd 0x00000021 nop 0x00000022 rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe

Code function: 0_2_021D7293 rdtsc

0_2_021D7293

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D9AF1 mov eax, dword ptr fs:[00000030h]	0_2_021D9AF1
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021DA05D mov eax, dword ptr fs:[00000030h]	0_2_021DA05D
Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe	Code function: 0_2_021D70B2 mov eax, dword ptr fs:[00000030h]	0_2_021D70B2

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe

Code function: 0_2_021D7293 rdtsc

0_2_021D7293

Source: C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe

Code function: 0_2_021DBDB9 RtlAddVectoredExceptionHandler,

0_2_021DBDB9

Source: ZAM#U00d3WIENIE.exe, 00000000.00000002.772116138.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: ZAM#U00d3WIENIE.exe, 00000000.00000002.772116138.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: ZAM#U00d3WIENIE.exe, 00000000.00000002.772116138.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: ZAM#U00d3WIENIE.exe, 00000000.00000002.772116138.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: ZAM#U00d3WIENIE.exe, 00000000.00000002.772116138.0000000000CC0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery21	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	502209
Start date:	13.10.2021
Start time:	17:55:39
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	ZAM#U00d3WIENIE.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 25.6% (good quality ratio 17.1%) Quality average: 41.1% Quality standard deviation: 36.1%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 95.100.218.79, 95.100.216.89, 20.82.210.154, 40.112.88.60, 2.20.178.33, 2.20.178.24, 52.251.79.25, 20.54.110.249 Excluded domains from analysis (whitelisted): fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, asf-ris-prod-neu.northeurope.cloudapp.azure.com, consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, eus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.844997038967016
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	ZAM#U00d3WIENIE.exe
File size:	98304
MD5:	4805bfc9145d8aa3ac43d1cc29c451ed
SHA1:	7787fa250b35d1a67142d230cbedbc357eb8cb9c
SHA256:	bac5da263610272c5c5be4ecb5a16626c653a757abaffc8402d210227ec04bb8
SHA512:	493487b0fc72108bc8669cd981f8b226956c63e5098addb36b88a2a78f6f120d785dd35c1e44f37c1ad7a1656ac7769fb7ebf4ce4c5864b6789496326d684792
SSDEEP:	1536:tlDO6+ecV15gr1zsaZMkKfsw1yNbmPsQTz5It5W3gVARkD:tlRwVLgr1zsa4qSkAI/WwVARk
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L.....7W.................@...0...............P....@........

File Icon


Icon Hash:	69e1c892f664c884

Static PE Info

General
Entrypoint:	0x4012b4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5737ACED [Sat May 14 22:55:41 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3d3cd1bd8dcc611a5734bf41f4e1a6a6

Entrypoint Preview

Instruction
push 00410938h
call 00007F931CAADF43h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, ah
iretd
push esi
scasb
scasd
out 05h, eax
inc ebp
mov bh, 98h
out 42h, eax
daa
in al, dx
fld qword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+6Dh], cl
insd
popad
outsb
imul esp, dword ptr [esi+65h], 656E7473h
jnc 00007F931CAADFC5h
cmp dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
cmp byte ptr [ebp+137AFA88h], bl
out E1h, eax
inc edi
lodsb

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14534	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x1c3a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xf0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13928	0x14000	False	0.517761230469	data	6.30128676097	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x15000	0xcc4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x1c3a	0x2000	False	0.346923828125	data	3.69728781195	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CUSTOM	0x1793c	0x2fe	MS Windows icon resource - 1 icon, 32x32, 16 colors	English	United States
CUSTOM	0x1707e	0x8be	MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel	English	United States
CUSTOM	0x16d80	0x2fe	MS Windows icon resource - 1 icon, 32x32, 16 colors, 4 bits/pixel	English	United States
RT_ICON	0x164d8	0x8a8	data
RT_GROUP_ICON	0x164c4	0x14	data
RT_VERSION	0x161a0	0x324	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaVarAdd, __vbaVarDup, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	ExpressVPN
InternalName	familiegruppers
FileVersion	4.00
CompanyName	ExpressVPN
LegalTrademarks	ExpressVPN
Comments	ExpressVPN
ProductName	ExpressVPN
ProductVersion	4.00
FileDescription	ExpressVPN
OriginalFilename	familiegruppers.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: ZAM#U00d3WIENIE.exe PID: 6008 Parent PID: 5184

General

Start time:	17:56:39
Start date:	13/10/2021
Path:	C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\ZAM#U00d3WIENIE.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	4805BFC9145D8AA3AC43D1CC29C451ED
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: ZAM#U00d3WIENIE.exe PID: 6008 Parent PID: 5184 ZAM#U00d3WIENIE.exeCOMMON

Executed Functions

Function 021DBDB9, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Download Yara Rule

Strings

aDc, xrefs: 021DC1D2
<#]_, xrefs: 021DC0BA

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <#]_$aDc
API String ID: 0-1919000578
Opcode ID: effb452cea37a51e0affbdf164933278cbd602009f9d92ab70c317ee46616413
Instruction ID: 50135204b9504e91a53076ecc9f3359e603ab168a4d01e9870747ce541922fe8
Opcode Fuzzy Hash: effb452cea37a51e0affbdf164933278cbd602009f9d92ab70c317ee46616413
Instruction Fuzzy Hash: 87710271144389CFDB79DE28CAA97EB37A2EF95350F62412ACC4A8F394C7319A40CB55

Uniqueness

Uniqueness Score: -1.00%

Function 021D7A18, Relevance: 1.6, APIs: 1, Instructions: 137memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 021D7BBB

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 47bc3c02887a894a5a963fc8c34693d386dc64c3ffbb10a3e2994aa8a8f07217
Instruction ID: 8b3ba0682d033e631f4efaa1b833288fd80ff2ac161a7599cea75fed37cec60c
Opcode Fuzzy Hash: 47bc3c02887a894a5a963fc8c34693d386dc64c3ffbb10a3e2994aa8a8f07217
Instruction Fuzzy Hash: 55510372609798CFEB748F28C885BEEBBA2EF49340F82051DED5D9B650C7394A41CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D7AB7, Relevance: 1.6, APIs: 1, Instructions: 136memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL ref: 021D7BBB

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 19f83ee1e99f004eb64f19c78e72872709a0b7744051fa1d1f5a5440b5e041cf
Instruction ID: 5439e2780fa1ce792c13b647609dc6ee5cc82918db3633b53b703ada2fa19c4b
Opcode Fuzzy Hash: 19f83ee1e99f004eb64f19c78e72872709a0b7744051fa1d1f5a5440b5e041cf
Instruction Fuzzy Hash: 4C41C5B7719798CFEB288F24C8867DA7B92FF48340FD2145DD96C4B650C6398B41CA51

Uniqueness

Uniqueness Score: -1.00%

Function 00413E70, Relevance: 110.7, APIs: 59, Strings: 4, Instructions: 479COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00411478,00415010), ref: 00413F09
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413F28
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112B0,000000F8), ref: 00413F4E
__vbaNew2.MSVBVM60(00411478,00415010), ref: 00413F67
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413F80
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112B0,000001B4), ref: 00414030
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00414040
#606.MSVBVM60(00000001,?), ref: 0041405D
__vbaStrMove.MSVBVM60 ref: 00414068
__vbaStrCmp.MSVBVM60(004112E4,00000000), ref: 0041407A
__vbaFreeStr.MSVBVM60 ref: 00414089
__vbaFreeVar.MSVBVM60 ref: 00414098
#706.MSVBVM60(00000001,00000000,00000000), ref: 004140A9
__vbaStrMove.MSVBVM60 ref: 004140B4
__vbaNew2.MSVBVM60(00411290,00415590), ref: 004140CD
__vbaHresultCheckObj.MSVBVM60(00000000,020D004C,00411280,00000014), ref: 004140F2
__vbaHresultCheckObj.MSVBVM60(00000000,?,004112A0,00000070), ref: 00414119
__vbaFreeObj.MSVBVM60 ref: 00414122
#580.MSVBVM60(Stalakitter,00000001), ref: 0041412F
#574.MSVBVM60(00000002), ref: 00414147
__vbaStrMove.MSVBVM60 ref: 00414152
__vbaStrCmp.MSVBVM60(00411308,00000000), ref: 0041415E
__vbaFreeStr.MSVBVM60 ref: 0041416D
__vbaFreeVar.MSVBVM60 ref: 00414176
#594.MSVBVM60(00000002), ref: 00414191
__vbaFreeVar.MSVBVM60 ref: 0041419A
#648.MSVBVM60(00000002), ref: 004141A6
__vbaFreeVar.MSVBVM60 ref: 004141AF
__vbaVarDup.MSVBVM60 ref: 004141CB
#666.MSVBVM60(?,00000002), ref: 004141D9
__vbaVarMove.MSVBVM60 ref: 004141E5
__vbaFreeVar.MSVBVM60 ref: 004141EE
__vbaNew2.MSVBVM60(00411478,00415010), ref: 0041422A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00414243
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112B0,000000F8), ref: 0041426D
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410EB0,000006F8), ref: 004142A4
__vbaFreeObj.MSVBVM60 ref: 004142AD
__vbaNew2.MSVBVM60(00411478,00415010), ref: 004142C6
__vbaObjSet.MSVBVM60(?,00000000), ref: 004142DF
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112B0,00000130), ref: 00414306
__vbaLateIdCallLd.MSVBVM60(00000002,?,00000000,00000000), ref: 00414318
__vbaStrVarMove.MSVBVM60(00000000), ref: 00414322
__vbaStrMove.MSVBVM60 ref: 0041432D
__vbaFreeStr.MSVBVM60 ref: 00414354
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00414364
__vbaFreeVar.MSVBVM60 ref: 00414370
__vbaNew2.MSVBVM60(00411478,00415010), ref: 00414385
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041439E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112B0,00000078), ref: 004143C8
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410EB0,000006FC), ref: 00414419
__vbaFreeObj.MSVBVM60 ref: 0041441E
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410E80,000002B4), ref: 0041443F
__vbaVarAdd.MSVBVM60(00000002,?,?), ref: 0041446D
__vbaVarMove.MSVBVM60 ref: 00414474
#598.MSVBVM60 ref: 0041447A
__vbaVarTstLt.MSVBVM60(00000002,?), ref: 00414498
__vbaFreeVar.MSVBVM60(00414502), ref: 004144F1
__vbaFreeStr.MSVBVM60 ref: 004144F6
__vbaFreeVar.MSVBVM60 ref: 004144FF

Strings

Stalakitter, xrefs: 0041412A
zk:K&6, xrefs: 004143A6, 004143AC
, xrefs: 0041404C
Mallorcinerens, xrefs: 004141BA

Memory Dump Source

Source File: 00000000.00000002.771823511.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.771809668.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771886985.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771912024.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$Move$New2$List$#574#580#594#598#606#648#666#706CallLate
String ID: $Mallorcinerens$Stalakitter$zk:K&6
API String ID: 1003127262-3539258339
Opcode ID: 882719acc10f11bae0f58273dd2b682963f1f49bc7c303789de6c8151a6e63cc
Instruction ID: 4be2a4ca3b4f0dc5ed68ac114d826a6615121d2652ad436180e77b0796400f66
Opcode Fuzzy Hash: 882719acc10f11bae0f58273dd2b682963f1f49bc7c303789de6c8151a6e63cc
Instruction Fuzzy Hash: 86123B70A002199FDB10DFA5DD88BDEBBB8FF48704F10816AE549E7260DB746985CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004012B4, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6"*), ref: 004012B9

Strings

VB5!6"*, xrefs: 004012B4

Memory Dump Source

Source File: 00000000.00000002.771823511.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.771809668.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771886985.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771912024.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6"*
API String ID: 1341478452-2992194029
Opcode ID: 9949dfafd2fcf60de1fa229fc4618c401ce567c87180f727dbf676b4f0cb0df8
Instruction ID: 085a21b95220512e464bd1dd2e6d57d1164f7628e0847602b412626da5e368e6
Opcode Fuzzy Hash: 9949dfafd2fcf60de1fa229fc4618c401ce567c87180f727dbf676b4f0cb0df8
Instruction Fuzzy Hash: 19D0B65199E3C00EE34313750E212822F700D5362034B00EB80C1DE0B3849C088DC336

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 021D9F0C, Relevance: 9.4, Strings: 7, Instructions: 698COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
!^, xrefs: 021D5F8E
g9, xrefs: 021D62AE
&\, xrefs: 021D6189
iT, xrefs: 021D6946
9u^, xrefs: 021D6197
q=, xrefs: 021D5D48

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$g9$!^$&\$9u^$iT$q=
API String ID: 0-3971385843
Opcode ID: 24a4705466156978f8c37f70b73ad72793dbc375935f0801c70fbba356ea804b
Instruction ID: 4053f5b270510dc7176ef73e93e533ae746698d1f68d053906908c3996ad85cf
Opcode Fuzzy Hash: 24a4705466156978f8c37f70b73ad72793dbc375935f0801c70fbba356ea804b
Instruction Fuzzy Hash: 4C52DBB2644389DFDB789E38CD917EA7BB2FF58310F958129DC899B214D7309A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D5909, Relevance: 9.4, Strings: 7, Instructions: 687COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
!^, xrefs: 021D5F8E
g9, xrefs: 021D62AE
&\, xrefs: 021D6189
iT, xrefs: 021D6946
9u^, xrefs: 021D6197
q=, xrefs: 021D5D48

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$g9$!^$&\$9u^$iT$q=
API String ID: 0-3971385843
Opcode ID: 281859404dff900b4aa3067d38bf65310a458f2078fe4589e91078a4334ce65b
Instruction ID: 5d35768b4639dfd7058cb026a28187f7b542e55a5aa4dd6e84d6a6a024874aef
Opcode Fuzzy Hash: 281859404dff900b4aa3067d38bf65310a458f2078fe4589e91078a4334ce65b
Instruction Fuzzy Hash: 7652EAB2604789DFDB789E38CD957EA7BB2FF48310F958129DC899B214C7349A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D5A37, Relevance: 9.4, Strings: 7, Instructions: 645COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
!^, xrefs: 021D5F8E
g9, xrefs: 021D62AE
&\, xrefs: 021D6189
iT, xrefs: 021D6946
9u^, xrefs: 021D6197
q=, xrefs: 021D5D48

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$g9$!^$&\$9u^$iT$q=
API String ID: 0-3971385843
Opcode ID: 177c04fb9b285e1ab0f1c223fbd661330d34d4307b52603ff89f2a4fe44469ef
Instruction ID: 714ea618fdb931994864b5bc6396f22269c46ff47c122f976270c0ee65b753b4
Opcode Fuzzy Hash: 177c04fb9b285e1ab0f1c223fbd661330d34d4307b52603ff89f2a4fe44469ef
Instruction Fuzzy Hash: 1742EAB2604789DFDB789E38CD917EA7BB6FF48310F958129DC899B214D7309A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D5B5F, Relevance: 9.3, Strings: 7, Instructions: 594COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
!^, xrefs: 021D5F8E
g9, xrefs: 021D62AE
&\, xrefs: 021D6189
iT, xrefs: 021D6946
9u^, xrefs: 021D6197
q=, xrefs: 021D5D48

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$g9$!^$&\$9u^$iT$q=
API String ID: 0-3971385843
Opcode ID: d5c6cc8c3f478f59119e659625f655cc393b21020d51c251c892f2ab52b33354
Instruction ID: dbc6ef2430ab89792f95851f03d8c9c9058f7bd5d5df75fd5eb007b515064ce1
Opcode Fuzzy Hash: d5c6cc8c3f478f59119e659625f655cc393b21020d51c251c892f2ab52b33354
Instruction Fuzzy Hash: 1A32EAB2604789DFDB789F28CD857DABBB2FF48310F958129DC899B210D7349A91CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D5C6B, Relevance: 9.3, Strings: 7, Instructions: 542COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
!^, xrefs: 021D5F8E
g9, xrefs: 021D62AE
&\, xrefs: 021D6189
iT, xrefs: 021D6946
9u^, xrefs: 021D6197
q=, xrefs: 021D5D48

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$g9$!^$&\$9u^$iT$q=
API String ID: 0-3971385843
Opcode ID: 5204c34b73996804e6e350d8992b57149f73a1ed416195982a03e933ec3ae7c2
Instruction ID: e5b6cdff6f674e32aceaa47d2881c87daeecf8d2f4f39032b9ecc7d02ed5cacc
Opcode Fuzzy Hash: 5204c34b73996804e6e350d8992b57149f73a1ed416195982a03e933ec3ae7c2
Instruction Fuzzy Hash: 4C32FDB2604789DFDB789F38CD817DABBB2FF54310F958129D8899B220D7349A91CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D5D65, Relevance: 8.0, Strings: 6, Instructions: 505COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
!^, xrefs: 021D5F8E
g9, xrefs: 021D62AE
&\, xrefs: 021D6189
iT, xrefs: 021D6946
9u^, xrefs: 021D6197

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$g9$!^$&\$9u^$iT
API String ID: 0-2838985348
Opcode ID: e022a824489f2d061e0c3d638efdea7281aa00254ffd1704012529af3b0ee877
Instruction ID: 52006c2f92c0534b2d97af9e2540e42030d823d7fa4d64fcb6e856be4ec6a7b2
Opcode Fuzzy Hash: e022a824489f2d061e0c3d638efdea7281aa00254ffd1704012529af3b0ee877
Instruction Fuzzy Hash: 0D22DCB2604789DFDB789E38CD817EA7BB6FF54310F918129DC898B220D7349A91CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D5E6E, Relevance: 8.0, Strings: 6, Instructions: 474COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
!^, xrefs: 021D5F8E
g9, xrefs: 021D62AE
&\, xrefs: 021D6189
iT, xrefs: 021D6946
9u^, xrefs: 021D6197

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$g9$!^$&\$9u^$iT
API String ID: 0-2838985348
Opcode ID: 2dd0d697cd07c691a8285910f60e57acc4dcb0cb07013d876e3c0d9e7ce682a8
Instruction ID: 5220cf1785018df929da37140a8592370b9a2187001e385a35a1f4e02cab069a
Opcode Fuzzy Hash: 2dd0d697cd07c691a8285910f60e57acc4dcb0cb07013d876e3c0d9e7ce682a8
Instruction Fuzzy Hash: 4D12DCB2604389DFDB789E38DC857EA7BA6EF54310F95402ADC899B220D7358A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D5FB1, Relevance: 6.7, Strings: 5, Instructions: 412COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
g9, xrefs: 021D62AE
&\, xrefs: 021D6189
iT, xrefs: 021D6946
9u^, xrefs: 021D6197

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$g9$&\$9u^$iT
API String ID: 0-1899835625
Opcode ID: 05b5849c41f486f355d9a016032abaf5f2b882f932712f8dc5408f20d6d1040c
Instruction ID: 0679b5fb0843a46c423fa5d7ded946e1efd3ecacdfa09848f10ae5badd03a4c0
Opcode Fuzzy Hash: 05b5849c41f486f355d9a016032abaf5f2b882f932712f8dc5408f20d6d1040c
Instruction Fuzzy Hash: 8EF1DDB2644388DFDB789E38DD857EA7BB6FF54310F81402AD8899B260D7359A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D609E, Relevance: 6.6, Strings: 5, Instructions: 355COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
g9, xrefs: 021D62AE
&\, xrefs: 021D6189
iT, xrefs: 021D6946
9u^, xrefs: 021D6197

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$g9$&\$9u^$iT
API String ID: 0-1899835625
Opcode ID: efb1b3a58e7eac834cd308c7169b2ef408dfc58b8e03bc2f245b3ed1f54ce51a
Instruction ID: c0e3106fe897377eea9111b5ae5c2e69dc6d8f9e8dc1417442a1c5a69386b349
Opcode Fuzzy Hash: efb1b3a58e7eac834cd308c7169b2ef408dfc58b8e03bc2f245b3ed1f54ce51a
Instruction Fuzzy Hash: C3E1DD71644389DFCF789E78DC817EA7BB6FF08310F814029D88A8B220D7709A91CB42

Uniqueness

Uniqueness Score: -1.00%

Function 021D6104, Relevance: 6.6, Strings: 5, Instructions: 351COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
g9, xrefs: 021D62AE
&\, xrefs: 021D6189
iT, xrefs: 021D6946
9u^, xrefs: 021D6197

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$g9$&\$9u^$iT
API String ID: 0-1899835625
Opcode ID: ba39f51d2ceb79ca0592eba507be2dd2c21cfc0948f64d1ef9679b23c4cdaf2d
Instruction ID: 868be0333720fe07e220dfbd5d29ca39945aa5a37c5f3da01bdc71abf9e15817
Opcode Fuzzy Hash: ba39f51d2ceb79ca0592eba507be2dd2c21cfc0948f64d1ef9679b23c4cdaf2d
Instruction Fuzzy Hash: DCE1CBB1644688DFCF789E38DD857EA7BB6FF59310F804029DD8A8B220C7719A81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D6233, Relevance: 4.1, Strings: 3, Instructions: 318COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
g9, xrefs: 021D62AE
iT, xrefs: 021D6946

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$g9$iT
API String ID: 0-2781408159
Opcode ID: 8945a90acb3a01e757c4a60f8c03eeb6526ba8312c7662802ceabaf6443739ff
Instruction ID: ae4e65d50b8d2bd06cf54c6dda121e4648bdeb67bc424759f0d32296fa2c14de
Opcode Fuzzy Hash: 8945a90acb3a01e757c4a60f8c03eeb6526ba8312c7662802ceabaf6443739ff
Instruction Fuzzy Hash: 39D1C9B2644788DFDF799E38CD857DA7BB6FF58310F80402AE9499B260C7319A91CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D634E, Relevance: 2.8, Strings: 2, Instructions: 272COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
iT, xrefs: 021D6946

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$iT
API String ID: 0-3215995996
Opcode ID: 16df5c253275b5b72c7f085eddfa628cd7693c35faddb55300b8bc4acb506496
Instruction ID: 93ab3e5408b1ad5d0f0039546008e2571d303762cd3ab745d71bbf10507e1db3
Opcode Fuzzy Hash: 16df5c253275b5b72c7f085eddfa628cd7693c35faddb55300b8bc4acb506496
Instruction Fuzzy Hash: D0B1C8B2645688DFDF789E38CD857DA7BB6FF58310F80402AE95D8B260C7319A91CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D7EA0, Relevance: 2.7, Strings: 2, Instructions: 237COMMON

Download Yara Rule

Strings

3, xrefs: 021D7F86
,je, xrefs: 021D7F38

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ,je$3
API String ID: 0-3492791811
Opcode ID: a0d040097266dfacc304b8b8b124521a3682155966cd0f348ab5ae9b5c2030e9
Instruction ID: e8b4dad841985403848dc3da7a463de6f3dad6037cb5acd9b1e69cf49978ccec
Opcode Fuzzy Hash: a0d040097266dfacc304b8b8b124521a3682155966cd0f348ab5ae9b5c2030e9
Instruction Fuzzy Hash: 4AA1DE72248389CFDB389F34C9567EA7BA2EF54340F92442EDC9A9B651DB348641CF12

Uniqueness

Uniqueness Score: -1.00%

Function 021D7E75, Relevance: 2.7, Strings: 2, Instructions: 233COMMON

Download Yara Rule

Strings

3, xrefs: 021D7F86
,je, xrefs: 021D7F38

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ,je$3
API String ID: 0-3492791811
Opcode ID: c2a9f99795144ed9056d8dfc697e1ec8b66d1c2b3444d3d21dffac47e2c4794a
Instruction ID: 5dcb049ec2a91ebbbbd984021e53f0b24cfd8652c500dd5f3b05de98e6a579d1
Opcode Fuzzy Hash: c2a9f99795144ed9056d8dfc697e1ec8b66d1c2b3444d3d21dffac47e2c4794a
Instruction Fuzzy Hash: 0BA19C31284289DFCF78AF24CD557EE7BA2AF54340F42442E9C8A9B650D7314A81DF16

Uniqueness

Uniqueness Score: -1.00%

Function 021D64A0, Relevance: 2.7, Strings: 2, Instructions: 208COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
iT, xrefs: 021D6946

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$iT
API String ID: 0-3215995996
Opcode ID: 7c1bcb7b5c2db1480be820ae198efaec5361d2e55647bb5c4ec839a96e626fc7
Instruction ID: e8cea72c36287699882ee88790c9e5d2dc92845ff326de90f13f13bc7e9c2dce
Opcode Fuzzy Hash: 7c1bcb7b5c2db1480be820ae198efaec5361d2e55647bb5c4ec839a96e626fc7
Instruction Fuzzy Hash: 0591FBB2640688EFCB799F24DD857DA7BB6FF58314F844029ED4E8B210CB715A91CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021D659E, Relevance: 2.7, Strings: 2, Instructions: 183COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
iT, xrefs: 021D6946

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$iT
API String ID: 0-3215995996
Opcode ID: fb5de1bb1291cfb987766d7f155b72f7948348915590883c4e7cce88fa60303d
Instruction ID: 74d800752718b662b6cbe741fe7e83e12ea8ac331b0bac48de50d13b47263757
Opcode Fuzzy Hash: fb5de1bb1291cfb987766d7f155b72f7948348915590883c4e7cce88fa60303d
Instruction Fuzzy Hash: F661DEB2645689DFDF389F24CD967DA7BA7FF54310F904029E91E8B250CB358A51CB80

Uniqueness

Uniqueness Score: -1.00%

Function 021D64E5, Relevance: 2.7, Strings: 2, Instructions: 182COMMON

Download Yara Rule

Strings

+36e, xrefs: 021D6605
iT, xrefs: 021D6946

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +36e$iT
API String ID: 0-3215995996
Opcode ID: 797445ddd967121dd8df40bc70bf928c03c70c4fea42dd012f4fcf1949d70158
Instruction ID: 4a7e1f3bff2ce3a76a00c5eb7fa5a5cf655f9ef4c683678e471433a1f34a0f11
Opcode Fuzzy Hash: 797445ddd967121dd8df40bc70bf928c03c70c4fea42dd012f4fcf1949d70158
Instruction Fuzzy Hash: 5C71BAB2640689EFDF799F64DC857EA7BB6FF18310F444029ED4A9B220C7715A91CB40

Uniqueness

Uniqueness Score: -1.00%

Function 021D7F4C, Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

3, xrefs: 021D7F86

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 3
API String ID: 0-1842515611
Opcode ID: 4f2d5d381322cf66dac064b898bf835da0c4903e39e02d80856328febafcbb5e
Instruction ID: d7114bf6a50a5a094bd9c6c77041a307da4d9d6cc2861b341bfca382cbc8e98f
Opcode Fuzzy Hash: 4f2d5d381322cf66dac064b898bf835da0c4903e39e02d80856328febafcbb5e
Instruction Fuzzy Hash: DD81CC31248389DFCB789E38C9557EE77A2AF58340F42442E9C8A9B651E7318A81DF16

Uniqueness

Uniqueness Score: -1.00%

Function 021D66F2, Relevance: 1.4, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

iT, xrefs: 021D6946

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: iT
API String ID: 0-1007210911
Opcode ID: 6dbd9dce03071264d4d298516271df297767a094afe8999ab7069ee809e480d9
Instruction ID: 49b651dafd27fddce809ace90237dc87b55f7b0a52b031f87187794dc9ee4030
Opcode Fuzzy Hash: 6dbd9dce03071264d4d298516271df297767a094afe8999ab7069ee809e480d9
Instruction Fuzzy Hash: AF41ECB2285A88DFDF398F24C9867DA3BA6FF44700F90402DD91E9B261CB358611CB80

Uniqueness

Uniqueness Score: -1.00%

Function 021D042E, Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51bcaff5a6b1a7d697c21bda58e8df9f40ba07d2284e9bc37e81d4ea3fd5061c
Instruction ID: 5a0dac8e6ffa219808091441ccaede1584053917b3c492fa3142e343736ea3b9
Opcode Fuzzy Hash: 51bcaff5a6b1a7d697c21bda58e8df9f40ba07d2284e9bc37e81d4ea3fd5061c
Instruction Fuzzy Hash: DD61A9B2544784DFDB24CF38C884B9ABBA6FFDA314F58845DDC598B262C7319981CB80

Uniqueness

Uniqueness Score: -1.00%

Function 021D8022, Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bb2b4d96dcb55d1af9562939802f5a92955405d85f6ec7c569284e955408207
Instruction ID: ad429d543701757d9f91de3b9375209be7664dd8cd07ea1be68e174b0b632602
Opcode Fuzzy Hash: 3bb2b4d96dcb55d1af9562939802f5a92955405d85f6ec7c569284e955408207
Instruction Fuzzy Hash: B261CE72248389DFDB389F24C9467EA7BA2FF44340F82442DDD9A9B651E7318641DF12

Uniqueness

Uniqueness Score: -1.00%

Function 0040143E, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771823511.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.771809668.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771886985.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771912024.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58187ee0e133b0b48bb3efed7ac890b15464e5e05c24970065dea5c804966976
Instruction ID: d394a65342a6a254380257ba0734a19f866dc21ad068f5b1ddaac111a7468d93
Opcode Fuzzy Hash: 58187ee0e133b0b48bb3efed7ac890b15464e5e05c24970065dea5c804966976
Instruction Fuzzy Hash: F641279025E2D4EFC71B47B64CBA2813FE1AE07108B1A88EFD6D54B8A3E555241FC727

Uniqueness

Uniqueness Score: -1.00%

Function 021D588B, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6bd579d93de68f2fb84c4c09e62f14687b966bf54413bbb9ca9c667d0b7c45d
Instruction ID: 1b668eda5458075d1e5db7233c175d9753fe035bd0adb7932dae1dddd06654de
Opcode Fuzzy Hash: d6bd579d93de68f2fb84c4c09e62f14687b966bf54413bbb9ca9c667d0b7c45d
Instruction Fuzzy Hash: 58510FB5A003869FDB689F35CC90BEE7BA2FF54380F56811DDD89A7214C7305A81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 021D8113, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee4d9c276ff570539b09b51111e923208112d067a17844fe1e127aab7bd57129
Instruction ID: 9bb7e9fa5dd6613145ea84fac7042f0f5f181445d2dbd4d977b6946b23e4dbfb
Opcode Fuzzy Hash: ee4d9c276ff570539b09b51111e923208112d067a17844fe1e127aab7bd57129
Instruction Fuzzy Hash: DD51BE72248389CFDB389E24CA16BEA7BA2EF44340F82441DDD9A9B551E7318741DF12

Uniqueness

Uniqueness Score: -1.00%

Function 021D5505, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9bf45bf9430369803e1497a704116ddf045bbb6c799045f44463e542652ecf9
Instruction ID: edb41522c6e3ab9c537daff3d5edaff2b5797a1658eac9f6708ce6367d87fd13
Opcode Fuzzy Hash: e9bf45bf9430369803e1497a704116ddf045bbb6c799045f44463e542652ecf9
Instruction Fuzzy Hash: FA51DF72684389EFDB74CE2AC9D5BDA37E3AF59344F95052AC94E8B701D734AA00CB01

Uniqueness

Uniqueness Score: -1.00%

Function 021D5597, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e58aca5a36c9e4c5c21d5effbad54bb02ec0dbe482c3b92f998c45e6fbf16a9
Instruction ID: f4060ed6a61e7677fda7485e6b8818e29a8a9f140a84affd21c0cdeb52c4365a
Opcode Fuzzy Hash: 9e58aca5a36c9e4c5c21d5effbad54bb02ec0dbe482c3b92f998c45e6fbf16a9
Instruction Fuzzy Hash: 9741BD73649789DBDB34CE28C596BDA37E3EF48200FE1052EC56D8BA40D738AA00CB51

Uniqueness

Uniqueness Score: -1.00%

Function 021DAB24, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47c80cf99650e35981bc4c72790729256c36e0833a9ece2f6dd6f25c93992a1f
Instruction ID: 9304ac10d52e9fbb7f15964767f5628f1c547388986739cd93454fdb0e762899
Opcode Fuzzy Hash: 47c80cf99650e35981bc4c72790729256c36e0833a9ece2f6dd6f25c93992a1f
Instruction Fuzzy Hash: 19219F3528834ACBDF34CF68C9D47EA77B2BF6A714F4A4069DC898B211E3309A45CA44

Uniqueness

Uniqueness Score: -1.00%

Function 0040167A, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771823511.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.771809668.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771886985.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771912024.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e24cef5b52d058c6559a4647f5f96652dbae51e6763f7f5d8b23a4fe3d590a8
Instruction ID: 0ef76ab4ed2bcdf07a831812e9108315abc5032b0251afc9fc56c28be75d868b
Opcode Fuzzy Hash: 9e24cef5b52d058c6559a4647f5f96652dbae51e6763f7f5d8b23a4fe3d590a8
Instruction Fuzzy Hash: 5E11DAB150E3E59FCB174B748CB52527FB0AF1B20070A44EBD4819F8A7E268281ED727

Uniqueness

Uniqueness Score: -1.00%

Function 021DA05D, Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: afdad9b5c7e55204d4c2a6b7c2dcbbc6a82a51bb8e9a2de767cd4045b3a68a65
Instruction ID: 6f9be0ea8b5e6470fe8a2125ee64597a98aa442bdc09208ef68658267dec57f8
Opcode Fuzzy Hash: afdad9b5c7e55204d4c2a6b7c2dcbbc6a82a51bb8e9a2de767cd4045b3a68a65
Instruction Fuzzy Hash: 1F012875A51245CFCB34CF24C988BE877A2BF5D310F89812ADD198B391C734AE40DB11

Uniqueness

Uniqueness Score: -1.00%

Function 0040162D, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.771823511.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.771809668.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771886985.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771912024.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction ID: 3a4f40afd7daac755765d0dbc513794409bb1d663c47dbf88c845af7c1cdfe86
Opcode Fuzzy Hash: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction Fuzzy Hash: CBF07A70124154EFCB06CF74D8A5A063BE1AF5B3407451CDAD9108F475D736B865EB12

Uniqueness

Uniqueness Score: -1.00%

Function 021D7293, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 622975e124100929fe2ddccce706d96fd518f70f37935c581e70a2f484421b56
Instruction ID: cf7689f2593f72b827ee757fb699305b9813eba92c2b1a0cb598858d95d8a4c3
Opcode Fuzzy Hash: 622975e124100929fe2ddccce706d96fd518f70f37935c581e70a2f484421b56
Instruction Fuzzy Hash: E7C02BC74414A58D03E72438370817EBC4357C02D0318CB143418892CDD7088EC244A4

Uniqueness

Uniqueness Score: -1.00%

Function 021D70B2, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 021D9AF1, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.772210295.00000000021D0000.00000040.00000001.sdmp, Offset: 021D0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00413A00, Relevance: 40.8, APIs: 27, Instructions: 282COMMON

Download Yara Rule

APIs

#685.MSVBVM60 ref: 00413A52
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413A63
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112C0,0000001C), ref: 00413A80
__vbaFreeObj.MSVBVM60 ref: 00413A98
__vbaNew2.MSVBVM60(00411290,00415590), ref: 00413AB9
__vbaHresultCheckObj.MSVBVM60(00000000,020D004C,00411280,00000014), ref: 00413ADE
__vbaHresultCheckObj.MSVBVM60(00000000,?,004112A0,000000D0), ref: 00413B08
__vbaStrMove.MSVBVM60 ref: 00413B1D
__vbaFreeObj.MSVBVM60 ref: 00413B22
#539.MSVBVM60(?,00000001,00000001,00000001), ref: 00413B32
__vbaStrVarMove.MSVBVM60(?), ref: 00413B3C
__vbaStrMove.MSVBVM60 ref: 00413B47
__vbaFreeVar.MSVBVM60 ref: 00413B4C
#568.MSVBVM60(00000063), ref: 00413B54
__vbaNew2.MSVBVM60(00411478,00415010), ref: 00413B6D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413B86
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112D0,00000178), ref: 00413C07
__vbaFreeObj.MSVBVM60 ref: 00413C10
__vbaNew2.MSVBVM60(00411478,00415010), ref: 00413C29
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413C48
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112B0,000000F8), ref: 00413C6B
__vbaNew2.MSVBVM60(00411478,00415010), ref: 00413C84
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413C9D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112B0,000001B4), ref: 00413D38
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413D48
__vbaFreeStr.MSVBVM60(00413D90), ref: 00413D88
__vbaFreeStr.MSVBVM60 ref: 00413D8D

Memory Dump Source

Source File: 00000000.00000002.771823511.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.771809668.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771886985.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771912024.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$Move$#539#568#685List
String ID:
API String ID: 342513763-0
Opcode ID: 0c88b232aa88333a886347aace399d9c4ec3c838f58012d729cc35e472f6a9bc
Instruction ID: 0e643b9caeccd9d9730156818d384658efc65a193463b99635f22b03b89d1433
Opcode Fuzzy Hash: 0c88b232aa88333a886347aace399d9c4ec3c838f58012d729cc35e472f6a9bc
Instruction Fuzzy Hash: 6CB14C74A00204DFDB10DFA9D988AD9BBF9FF48700F14816AE549F72A1D7749981CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00413690, Relevance: 22.7, APIs: 15, Instructions: 192COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00411478,00415010), ref: 004136E3
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413702
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112B0,000001B0), ref: 00413741
__vbaFreeObj.MSVBVM60 ref: 0041374A
__vbaNew2.MSVBVM60(00411478,00415010), ref: 00413763
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041377C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112B0,00000098), ref: 0041379F
__vbaNew2.MSVBVM60(00411478,00415010), ref: 004137B8
__vbaObjSet.MSVBVM60(?,00000000), ref: 004137D1
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112B0,000001B4), ref: 00413860
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413870
__vbaNew2.MSVBVM60(00411478,00415010), ref: 0041388C
__vbaObjSet.MSVBVM60(?,00000000), ref: 004138A5
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112B0,000001A8), ref: 004138C8
__vbaFreeObj.MSVBVM60 ref: 004138D1

Memory Dump Source

Source File: 00000000.00000002.771823511.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.771809668.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771886985.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771912024.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresultNew2$Free$List
String ID:
API String ID: 191279167-0
Opcode ID: 24e7e2e3cba289aed7a208f157a2b493766ff96e8c4c820a7bba54cced0c36ee
Instruction ID: d82c211417a4b80176f3676600aaa52688afb4b0387e09894f726913f100ab54
Opcode Fuzzy Hash: 24e7e2e3cba289aed7a208f157a2b493766ff96e8c4c820a7bba54cced0c36ee
Instruction Fuzzy Hash: DC711C74A00204DFDB10EFA8C989ADABBF8FF4C701B10856AF945E7361D7749841CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00413470, Relevance: 22.7, APIs: 15, Instructions: 154COMMON

Download Yara Rule

APIs

#714.MSVBVM60(?,?,00000000), ref: 004134C8
__vbaVarTstNe.MSVBVM60(?,?), ref: 004134E4
__vbaFreeVarList.MSVBVM60(00000002,00000005,?), ref: 004134F7
__vbaNew2.MSVBVM60(00411290,00415590), ref: 0041351B
__vbaHresultCheckObj.MSVBVM60(00000000,020D004C,00411280,00000014), ref: 00413546
__vbaHresultCheckObj.MSVBVM60(00000000,?,004112A0,000000C0), ref: 00413574
__vbaFreeObj.MSVBVM60 ref: 0041357F
__vbaNew2.MSVBVM60(00411290,00415590), ref: 00413594
__vbaHresultCheckObj.MSVBVM60(00000000,020D004C,00411280,00000014), ref: 004135B9
__vbaHresultCheckObj.MSVBVM60(00000000,?,004112A0,000000B8), ref: 004135DF
__vbaFreeObj.MSVBVM60 ref: 004135E4
__vbaNew2.MSVBVM60(00411290,00415590), ref: 004135F9
__vbaObjSetAddref.MSVBVM60(?,?), ref: 0041360F
__vbaHresultCheckObj.MSVBVM60(00000000,020D004C,00411280,00000010), ref: 00413629
__vbaFreeObj.MSVBVM60 ref: 0041362E

Memory Dump Source

Source File: 00000000.00000002.771823511.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.771809668.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771886985.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771912024.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$New2$#714AddrefList
String ID:
API String ID: 169271594-0
Opcode ID: a9f993c0d50bf3d17f808603765d1392cce3d9b75e2b4865d534f54fbfed0134
Instruction ID: de9ae9f6294ddfc7df85f90231cb3487972cba352643eb96409ef9960edb057f
Opcode Fuzzy Hash: a9f993c0d50bf3d17f808603765d1392cce3d9b75e2b4865d534f54fbfed0134
Instruction Fuzzy Hash: 30516170900208FBDB10DFA5CD85BDEB7B9FB08741F20456AE545F32A1D6786A85CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00413920, Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00411478,00415010), ref: 00413963
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041397C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004112B0,000001B0), ref: 004139BF
__vbaFreeObj.MSVBVM60 ref: 004139C8

Memory Dump Source

Source File: 00000000.00000002.771823511.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.771809668.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.771886985.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.771912024.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID:
API String ID: 1645334062-0
Opcode ID: 8f66b116132c08cb661740054549db598f2ad9f564fcaa7881f50d977bd14d68
Instruction ID: 2756bc7abfb38507642941657c2366931ad6683dbd1d3acee2dfe5e584be3fc9
Opcode Fuzzy Hash: 8f66b116132c08cb661740054549db598f2ad9f564fcaa7881f50d977bd14d68
Instruction Fuzzy Hash: D91182B0A00305EBD700DFA9CA49BDABBB8FB4C701F108529F545E7390D778A940CBA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report ZAM#U00d3WIENIE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: ZAM#U00d3WIENIE.exe PID: 6008 Parent PID: 5184

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: ZAM#U00d3WIENIE.exe PID: 6008 Parent PID: 5184 ZAM#U00d3WIENIE.exeCOMMON

Executed Functions

Function 021DBDB9, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 190COMMON

Function 021D7A18, Relevance: 1.6, APIs: 1, Instructions: 137memorynativeCOMMON

Function 021D7AB7, Relevance: 1.6, APIs: 1, Instructions: 136memorynativeCOMMON