Play interactive tour

Edit tour

Windows Analysis Report Contract and PI of 1500W.exe

Overview

General Information

Sample Name:	Contract and PI of 1500W.exe
Analysis ID:	502545
MD5:	dbceab5b0f79168ffea64f16bf7f1263
SHA1:	c5c25d75233ea8523111b1f964fbd482be973cd7
SHA256:	7d6174dce4980e71b083ae63d3b165b50b20855edb40ffa10a06a8e46e765cab
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Potential malicious icon found

Yara detected GuLoader

Found potential dummy code loops (likely to delay analysis)

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Found inlined nop instructions (likely shell or obfuscated code)

Contains functionality to call native functions

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Program does not show much activity (idle)

Uses code obfuscation techniques (call, push, ret)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Detected potential crypto function

Found potential string decryption / allocating functions

Classification

Process Tree

System is w10x64

Contract and PI of 1500W.exe (PID: 6180 cmdline: 'C:\Users\user\Desktop\Contract and PI of 1500W.exe' MD5: DBCEAB5B0F79168FFEA64F16BF7F1263)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=downl"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: Contract and PI of 1500W.exe

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=downl"}

Source: Contract and PI of 1500W.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe

Code function: 4x nop then fsincos

1_2_004022C3

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=downl

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Source: Contract and PI of 1500W.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C7F56 NtAllocateVirtualMemory,	1_2_020C7F56
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C8004 NtAllocateVirtualMemory,	1_2_020C8004
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C7F52 NtAllocateVirtualMemory,	1_2_020C7F52

Source: Contract and PI of 1500W.exe, 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFocalisi.exe vs Contract and PI of 1500W.exe
Source: Contract and PI of 1500W.exe, 00000001.00000002.810458713.0000000002920000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameFocalisi.exeFE2X vs Contract and PI of 1500W.exe
Source: Contract and PI of 1500W.exe	Binary or memory string: OriginalFilenameFocalisi.exe vs Contract and PI of 1500W.exe

Source: Contract and PI of 1500W.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_004022C3	1_2_004022C3
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_00403249	1_2_00403249
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_004032CA	1_2_004032CA
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_004031E2	1_2_004031E2
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C7F56	1_2_020C7F56
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C60BB	1_2_020C60BB
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020CA8D9	1_2_020CA8D9
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C60E8	1_2_020C60E8
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C6946	1_2_020C6946
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C7F52	1_2_020C7F52
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C5D7F	1_2_020C5D7F
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C6D7A	1_2_020C6D7A
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C81AE	1_2_020C81AE
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C5DC2	1_2_020C5DC2
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C65C2	1_2_020C65C2
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C61D8	1_2_020C61D8
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C69D8	1_2_020C69D8
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020CA9ED	1_2_020CA9ED
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C7DF8	1_2_020C7DF8
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C01F6	1_2_020C01F6

Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe

Code function: String function: 0040177E appears 94 times

Source: Contract and PI of 1500W.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: classification engine

Classification label: mal72.rans.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_0040205A push cs; retf	1_2_004020FD
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_0040705F push edi; retf	1_2_004071E8
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_00408200 push FF3F4922h; retf	1_2_00408205
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_00406C0D pushad ; iretd	1_2_00406C1B
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_00407145 push edi; retf	1_2_004071E8
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_0040630D pushfd ; ret	1_2_00406318
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_004059F3 push esi; iretd	1_2_004059F7
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C547A push esp; ret	1_2_020C547B
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C18E3 push esi; retf	1_2_020C18E6
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C4B15 push ebp; ret	1_2_020C4B18
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C1740 pushfd ; retf	1_2_020C1841
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C71BF push eax; ret	1_2_020C71C0
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C3DD5 push ss; ret	1_2_020C3DD9

Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe

Code function: 1_2_020C7C0D rdtsc

1_2_020C7C0D

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_004022C3 mov ebx, dword ptr fs:[00000030h]	1_2_004022C3
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_004031E2 mov ebx, dword ptr fs:[00000030h]	1_2_004031E2
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C9B0D mov eax, dword ptr fs:[00000030h]	1_2_020C9B0D
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C9F4A mov eax, dword ptr fs:[00000030h]	1_2_020C9F4A
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020CA9ED mov eax, dword ptr fs:[00000030h]	1_2_020CA9ED
Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe	Code function: 1_2_020C77E5 mov eax, dword ptr fs:[00000030h]	1_2_020C77E5

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Contract and PI of 1500W.exe

Code function: 1_2_020C7C0D rdtsc

1_2_020C7C0D

Source: Contract and PI of 1500W.exe, 00000001.00000002.809904221.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: Contract and PI of 1500W.exe, 00000001.00000002.809904221.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Contract and PI of 1500W.exe, 00000001.00000002.809904221.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Contract and PI of 1500W.exe, 00000001.00000002.809904221.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery11	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Deobfuscate/Decode Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information3	NTDS	System Information Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	502545
Start date:	14.10.2021
Start time:	03:17:29
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Contract and PI of 1500W.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.rans.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 1% (good quality ratio 1%) Quality average: 47% Quality standard deviation: 8.2%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 95.100.218.79, 20.82.210.154, 20.54.110.249, 2.20.178.10, 2.20.178.56, 20.199.120.151, 20.199.120.182, 40.112.88.60, 2.20.178.24, 2.20.178.33, 20.199.120.85 Excluded domains from analysis (whitelisted): client.wns.windows.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, wu-shim.trafficmanager.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, store-images.s-microsoft.com-c.edgekey.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dspw65.akamai.net, a1449.dscg2.akamai.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.277540298871474
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Contract and PI of 1500W.exe
File size:	135168
MD5:	dbceab5b0f79168ffea64f16bf7f1263
SHA1:	c5c25d75233ea8523111b1f964fbd482be973cd7
SHA256:	7d6174dce4980e71b083ae63d3b165b50b20855edb40ffa10a06a8e46e765cab
SHA512:	d13aa6e928f70d8051d0db5bd8e7a263567846b38f3817122db988f0d0230852579bd9c038f750a793dd5cc5cca14bf839c73a7cdb20bdc8a6b09caca76097f3
SSDEEP:	1536:gFA4c6Hdpd+KpVl+R9ATkcbu/nW9qUUWxeoQ4vk8VcYGczNYGJM94oiGUASFUEv9:mc6HHdvpsSRbuRqA4/Zp9v3H
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...d..O.....................`......h.............@.............B..

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x401868
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4FFBD264 [Tue Jul 10 06:57:40 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c727a98e677fb7bd25bb06d2a2d956f1

Entrypoint Preview

Instruction
push 0041031Ch
call 00007F321CB3AED5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
jecxz AF04h
inc eax
sbb dh, dl
pop esp
inc ebp
scasb
cmp dword ptr [C1103C1Fh], eax
mov dword ptr [eax], 00000000h
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+6Ch], bl
and eax, 67754B03h
insb
add byte ptr [eax], dl
add eax, dword ptr [eax]
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
and esi, dword ptr [edi-5D95551Eh]
dec ebp
push ss
inc ebx
mov ebx, 2D8810B4h
add eax, B3757B7Ch
sbb dl, ah
push ds
mov ebx, 87924B54h
int3
arpl word ptr [edx+3A441B60h], dx
dec edi
lodsd
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop ss
jmp 00007F321CF5AEE5h
add byte ptr [eax], al
add byte ptr [eax+eax], al
inc edx
inc ebp
push ebx
inc ebx
add byte ptr [43000801h], cl
push 6164726Fh
arpl word ptr [ebp+00h], sp
sbb dword ptr [ecx], eax
add byte ptr [edx+00h], al
and al, byte ptr [eax]
and al, 08h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1a8a4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c000	0x456a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x154	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x19de0	0x1a000	False	0.567514272837	data	6.73754725529	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x1b000	0xaf0	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1c000	0x456a	0x5000	False	0.396240234375	data	4.60962667095	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
DATA	0x1ca7c	0x3aee	MS Windows icon resource - 3 icons, 48x48, 32 bits/pixel, 32x32, 32 bits/pixel	English	United States
RT_ICON	0x1c94c	0x130	data
RT_ICON	0x1c664	0x2e8	data
RT_ICON	0x1c53c	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x1c50c	0x30	data
RT_VERSION	0x1c1a0	0x36c	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaSetSystemError, __vbaHresultCheckObj, __vbaLenBstrB, _adj_fdiv_m32, __vbaAryDestruct, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaObjVar, DllFunctionCall, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaI2Str, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaDerefAry1, _adj_fdivr_m32, _adj_fdiv_r, __vbaStrToAnsi, __vbaVarDup, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	RealNetworks, Inc.
InternalName	Focalisi
FileVersion	66.00
CompanyName	RealNetworks, Inc.
LegalTrademarks	RealNetworks, Inc.
Comments	RealNetworks, Inc.
ProductName	RealNetworks, Inc.
ProductVersion	66.00
FileDescription	RealNetworks, Inc.
OriginalFilename	Focalisi.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: Contract and PI of 1500W.exe PID: 6180 Parent PID: 2804

General

Start time:	03:18:22
Start date:	14/10/2021
Path:	C:\Users\user\Desktop\Contract and PI of 1500W.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Contract and PI of 1500W.exe'
Imagebase:	0x400000
File size:	135168 bytes
MD5 hash:	DBCEAB5B0F79168FFEA64F16BF7F1263
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Contract and PI of 1500W.exe PID: 6180 Parent PID: 2804 Contract and PI of 1500W.exeCOMMON

Executed Functions

Function 004022C3, Relevance: 6.1, APIs: 1, Strings: 1, Instructions: 3094COMMON

Download Yara Rule

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Gz(
API String ID: 0-1794210769
Opcode ID: 6297cebd78e7f4ed32d022477c47be70767ef78de320ce3eade74b0627c4c312
Instruction ID: fd85145ebb169aa6a8b16b154cbd9a226b5dc5cf5df54520c65b41f2512b4e2e
Opcode Fuzzy Hash: 6297cebd78e7f4ed32d022477c47be70767ef78de320ce3eade74b0627c4c312
Instruction Fuzzy Hash: 530370137CE3C087CF564679A4A04E17FA25F9F12933D79ED90F8AA276D77688058B04

Uniqueness

Uniqueness Score: -1.00%

Function 004031E2, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 571COMMON

Download Yara Rule

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Gz(
API String ID: 0-1794210769
Opcode ID: da1f42fcd783d68411edde2b0977998da67b3b11a05e6bfa852280191b13487f
Instruction ID: a362e4b9e19093b46e533251f04568160fc83bbc1b9e7785604e2923f07f621e
Opcode Fuzzy Hash: da1f42fcd783d68411edde2b0977998da67b3b11a05e6bfa852280191b13487f
Instruction Fuzzy Hash: 14D19B22B1A3000B876A98BE49D0952D5C79FDF221339F63A652DF7365FDB9CD0B1208

Uniqueness

Uniqueness Score: -1.00%

Function 00403249, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 565COMMON

Download Yara Rule

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Gz(
API String ID: 0-1794210769
Opcode ID: 96e0eef78cf4bc625ace4b1818a74050eb7a7cf432e4e259e5486b32a4ef5dcb
Instruction ID: 364e73d4a040ad50fc81844dff5354786ff8f8607ec986095cfb759da42cec76
Opcode Fuzzy Hash: 96e0eef78cf4bc625ace4b1818a74050eb7a7cf432e4e259e5486b32a4ef5dcb
Instruction Fuzzy Hash: AEC18B22B1A3000B976A98BE49D0952D4C79FDF221329F63A652DF7365FDB9CD4B1208

Uniqueness

Uniqueness Score: -1.00%

Function 004032CA, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 522COMMON

Download Yara Rule

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Gz(
API String ID: 0-1794210769
Opcode ID: ca6f008f38bb8e672748a1026987d971da808537230fdbe32fc3800d90f6b63c
Instruction ID: 1c4ff241868d1061ad06a023ff6fdcb5994a7d20bfaa48898b49ddd7883f4b50
Opcode Fuzzy Hash: ca6f008f38bb8e672748a1026987d971da808537230fdbe32fc3800d90f6b63c
Instruction Fuzzy Hash: ADB19D22B1A3000B976A98BE49D0952D4C79FDF221329F639652DF7365FD79CD4B120C

Uniqueness

Uniqueness Score: -1.00%

Function 020C8004, Relevance: 1.6, APIs: 1, Instructions: 136memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(2A22B0C5,?,-17C89F76,00000008), ref: 020C813C

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 058c2d6e2a8867b74ec1e08fd11f3ed3dfb22dcf11c691e057528d1d602dcf1e
Instruction ID: a14e5da5d5a6246b55cc9b5a9405a3f16aac7df7a036d6c23b428ad39fc0fdc7
Opcode Fuzzy Hash: 058c2d6e2a8867b74ec1e08fd11f3ed3dfb22dcf11c691e057528d1d602dcf1e
Instruction Fuzzy Hash: 68419DB2A0062B9BDB29DE29DCC2BCE37E2EF99740F01453DDD489B655C73299058A81

Uniqueness

Uniqueness Score: -1.00%

Function 020C7F56, Relevance: 1.6, APIs: 1, Instructions: 117memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(2A22B0C5,?,-17C89F76,00000008), ref: 020C813C

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 4e4f090a7992eb0950be27cd8eca10a4c09b380a2bb2b9822b2721a7ef1ae8c9
Instruction ID: efbfd1f2fab5f9db9d59f49d6b33987f100b73f0130cfe27e655c4c5b35bd12d
Opcode Fuzzy Hash: 4e4f090a7992eb0950be27cd8eca10a4c09b380a2bb2b9822b2721a7ef1ae8c9
Instruction Fuzzy Hash: AD4134B5A04346CFEB349F64CC907DE77A2BF5A350F86402EDD899B210D7348A80CB02

Uniqueness

Uniqueness Score: -1.00%

Function 020C7F52, Relevance: 1.6, APIs: 1, Instructions: 117memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(2A22B0C5,?,-17C89F76,00000008), ref: 020C813C

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 247e4efd5c75f3708641f0349b88c3cb190cb5e45611e512c27fd1188cd6d650
Instruction ID: 92b672bae3e836ccdfa01f8f9a3925a8ac8ffdc41b4bbcd9169baa26c45ef537
Opcode Fuzzy Hash: 247e4efd5c75f3708641f0349b88c3cb190cb5e45611e512c27fd1188cd6d650
Instruction Fuzzy Hash: 6E4100B1A0434A8FEF349E648C907DE73A2BF5A350F86412EDD899B310D7358A81CB02

Uniqueness

Uniqueness Score: -1.00%

Function 00401868, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 0040186D

Strings

VB5!6&*, xrefs: 00401868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 4127099c9cf69988b1f235bbb994795184c53c018c9373458bd590a6fbe3d45e
Instruction ID: e848721764fa4596c7cf8c7c70bcf7f4a596fedb61bfb93382aaf6154ac5a304
Opcode Fuzzy Hash: 4127099c9cf69988b1f235bbb994795184c53c018c9373458bd590a6fbe3d45e
Instruction Fuzzy Hash: BA11446A45E3C89FD3038BB58CA62843FB09E07245B1B41EBC6A5CF4B3D2195C4DDB22

Uniqueness

Uniqueness Score: -1.00%

Function 004033CC, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 494COMMON

Download Yara Rule

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Gz(
API String ID: 0-1794210769
Opcode ID: b072f57a936f9734c1269b491ce233b7568bdf710ab50487f683a3c38a3d5396
Instruction ID: bd65e883bdb3f60610cf09602ea8dc9d9d8b11bd6948bd68ea70d770775ad0ac
Opcode Fuzzy Hash: b072f57a936f9734c1269b491ce233b7568bdf710ab50487f683a3c38a3d5396
Instruction Fuzzy Hash: 19A19B22B1A3000B876A98BE49D0952D4C79FDF261329F63A652DF7365FDB9CD4B120C

Uniqueness

Uniqueness Score: -1.00%

Function 0040334D, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 492COMMON

Download Yara Rule

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Gz(
API String ID: 0-1794210769
Opcode ID: 8091dc4dd2102377e2e351d4d01694c960fe882255d890c4fdaa0f911f668143
Instruction ID: fe5a76452259a393af02edc7919f9db84aeebd06d4978e6b547c3750bec9ccdb
Opcode Fuzzy Hash: 8091dc4dd2102377e2e351d4d01694c960fe882255d890c4fdaa0f911f668143
Instruction Fuzzy Hash: 97B18D22B1A3000B975A98BE48D0952D4C79FDF221329F63A652DF73A5FDB9CD4B120C

Uniqueness

Uniqueness Score: -1.00%

Function 004034E7, Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 426memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-000000018467C166,-60744456), ref: 00403855

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: Gz(
API String ID: 4275171209-1794210769
Opcode ID: 9d30e45e42fab85e1e0e7db25323ac19b87287d1480ad6792f3b307c5af20c15
Instruction ID: 75d269a47b88dc3c8880f31d806f10b78c1690d7f487e2210614dc7c6cdcec0c
Opcode Fuzzy Hash: 9d30e45e42fab85e1e0e7db25323ac19b87287d1480ad6792f3b307c5af20c15
Instruction Fuzzy Hash: 43817922B1A3000B876A98BE49D0952C4C79FDF261379F639652DF33A5FDB9CD4A120C

Uniqueness

Uniqueness Score: -1.00%

Function 0040345C, Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 425memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-000000018467C166,-60744456), ref: 00403855

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: Gz(
API String ID: 4275171209-1794210769
Opcode ID: 117731d13e23bd28de53faf505e38873b36fdb7ccc42ecf54bd43754e7cecc60
Instruction ID: e553e7fff3b85868b84f460730026d22dc6acc40c1a5bb47f20a3028449d0b84
Opcode Fuzzy Hash: 117731d13e23bd28de53faf505e38873b36fdb7ccc42ecf54bd43754e7cecc60
Instruction Fuzzy Hash: 2991AA22B1A3000B876A98BE49D0956C4C79FDF22132AF639652DF3365FDB9CD4B120C

Uniqueness

Uniqueness Score: -1.00%

Function 00403579, Relevance: 3.4, APIs: 1, Strings: 1, Instructions: 381memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-000000018467C166,-60744456), ref: 00403855

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: Gz(
API String ID: 4275171209-1794210769
Opcode ID: ff70a8e60f39d9a50de4785017b2e6032a13b3bab432762254f9d910958922cd
Instruction ID: a84d658fd5f3c8284a23cff50dfe80f13b35e9b50663b51fa3ef0ebab380656b
Opcode Fuzzy Hash: ff70a8e60f39d9a50de4785017b2e6032a13b3bab432762254f9d910958922cd
Instruction Fuzzy Hash: 82719922B1A3000B976A98BE49D0852D4C7DFDF261369F639652DF33A5EDB9CD4B110C

Uniqueness

Uniqueness Score: -1.00%

Function 00403608, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 346memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-000000018467C166,-60744456), ref: 00403855

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: Gz(
API String ID: 4275171209-1794210769
Opcode ID: 303c33a44dec348b0a3f34f85622a5145cbe880518c125f2771603ea57dc346b
Instruction ID: ac6ee736b7ebf97927eb05cd44fb298f5735d98c1f6128646d7f41e09fc6078a
Opcode Fuzzy Hash: 303c33a44dec348b0a3f34f85622a5145cbe880518c125f2771603ea57dc346b
Instruction Fuzzy Hash: 7F618A22B1A3000B875A98BE88D0866C5C7DFDF261369F639652DF33A5EDB9CD4B114C

Uniqueness

Uniqueness Score: -1.00%

Function 004036BA, Relevance: 3.3, APIs: 1, Strings: 1, Instructions: 257memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-000000018467C166,-60744456), ref: 00403855

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: Gz(
API String ID: 4275171209-1794210769
Opcode ID: 3c9afb0d55d405f0f80cf3ee655fe23218642f781a801ce266c39a9920c670f6
Instruction ID: 5b72e4045139535dfd8f90757906aa859d6e5080d7c1750ad43d1f6e39208a38
Opcode Fuzzy Hash: 3c9afb0d55d405f0f80cf3ee655fe23218642f781a801ce266c39a9920c670f6
Instruction Fuzzy Hash: 16518922B1A3000B875A98BE99D086284C3DFDF261369F639652DF73A5EDBDCD4E114C

Uniqueness

Uniqueness Score: -1.00%

Function 00403785, Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 221memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-000000018467C166,-60744456), ref: 00403855

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: Gz(
API String ID: 4275171209-1794210769
Opcode ID: 8a09eb4b6e48028786c22af189b2e1ff66893407bfd2bdbe774706bcf39c7907
Instruction ID: 92addb35e79c4583591c71448f263dcaf899b0c7240f11d97ddbd4a618a8a34b
Opcode Fuzzy Hash: 8a09eb4b6e48028786c22af189b2e1ff66893407bfd2bdbe774706bcf39c7907
Instruction Fuzzy Hash: 44415822B0A3000B8B5A98BE99908A685D7CFDF261339F539612DF3365ED7ACD4B114C

Uniqueness

Uniqueness Score: -1.00%

Function 00403810, Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-000000018467C166,-60744456), ref: 00403855

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: Gz(
API String ID: 4275171209-1794210769
Opcode ID: 3082e79d2c659ba7634fbf403f57cb297980ffb77d12c2345e5076dbba1a5665
Instruction ID: 9d6d45965773d247d91d9bf9ce28ca465965a9d1ce3488112b867dc3e69c4e68
Opcode Fuzzy Hash: 3082e79d2c659ba7634fbf403f57cb297980ffb77d12c2345e5076dbba1a5665
Instruction Fuzzy Hash: C7318B22B093000B8B5998BE94D089685C7CBDF261379F53D602DF3365EDB9CC0B114C

Uniqueness

Uniqueness Score: -1.00%

Function 004038A9, Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 185memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00011000,-000000018467C166,-60744456), ref: 00403855

Strings

Gz(, xrefs: 00403868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID: Gz(
API String ID: 4275171209-1794210769
Opcode ID: 9610f6f8636f359742b28dee1ff430cc849309ed1e608e070869cde2472b2808
Instruction ID: 66c000eade25ff68b7d4f0bac09503d36a209d33a0e355be34c44c42e75041e1
Opcode Fuzzy Hash: 9610f6f8636f359742b28dee1ff430cc849309ed1e608e070869cde2472b2808
Instruction Fuzzy Hash: FA318D22B093000B8B5998BE94D086695C7CBDF262379F53DA52DF7365ED79CD0B124C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 020CA9ED, Relevance: 12.8, Strings: 9, Instructions: 1515COMMON

Download Yara Rule

Strings

J, xrefs: 020C6F1F
!ln, xrefs: 020C6521
iG, xrefs: 020CB36F
{R, xrefs: 020C6784
tz$, xrefs: 020C6E33
s7${, xrefs: 020C6E10
-NI, xrefs: 020C780D
3&JT, xrefs: 020C9B77
u1, xrefs: 020C6D52

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: iG$!ln$3&JT$s7${$tz$$-NI$u1${R$J
API String ID: 0-2879335433
Opcode ID: 72d68380d839e9221e3d793dee165bff0e5c9ec2afb5fe4b4eecbd613aa5b8c7
Instruction ID: 340b298e1626051e844fbb929d855d762117fbe0dfdd1b8ab602af2cee51cf62
Opcode Fuzzy Hash: 72d68380d839e9221e3d793dee165bff0e5c9ec2afb5fe4b4eecbd613aa5b8c7
Instruction Fuzzy Hash: 26D244B160438ACFDB359F38CDA57DE7BA2AF56350F95822ECC898B255D3318546CB02

Uniqueness

Uniqueness Score: -1.00%

Function 020C60E8, Relevance: 10.9, Strings: 8, Instructions: 941COMMON

Download Yara Rule

Strings

J, xrefs: 020C6F1F
!ln, xrefs: 020C6521
{R, xrefs: 020C6784
tz$, xrefs: 020C6E33
s7${, xrefs: 020C6E10
-NI, xrefs: 020C780D
3&JT, xrefs: 020C9B77
u1, xrefs: 020C6D52

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !ln$3&JT$s7${$tz$$-NI$u1${R$J
API String ID: 0-3442542675
Opcode ID: b48199b2285ccf398dcf468b242f6606233e7d53cbd9f65805ead2aa899f3b54
Instruction ID: 72bd86e45c281753e9fdd54464630c9acb5ffe1f2cd694800febebed3020f438
Opcode Fuzzy Hash: b48199b2285ccf398dcf468b242f6606233e7d53cbd9f65805ead2aa899f3b54
Instruction Fuzzy Hash: 0782FEB160038ADFDB759F28CDA57DE7BA2BF55390F51812DDC8A9B214C3318A85CB42

Uniqueness

Uniqueness Score: -1.00%

Function 020C81AE, Relevance: 9.7, Strings: 7, Instructions: 904COMMON

Download Yara Rule

Strings

J, xrefs: 020C6F1F
!ln, xrefs: 020C6521
{R, xrefs: 020C6784
tz$, xrefs: 020C6E33
s7${, xrefs: 020C6E10
-NI, xrefs: 020C780D
u1, xrefs: 020C6D52

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !ln$s7${$tz$$-NI$u1${R$J
API String ID: 0-3924621736
Opcode ID: 96e8fdd6bee4ad83a0959eecd0990dbc03f4131d991391f7b19143fdad51f250
Instruction ID: 93e61246a448d357f670c450c56f10880b4ef98dd2afb90890dcec6b90511509
Opcode Fuzzy Hash: 96e8fdd6bee4ad83a0959eecd0990dbc03f4131d991391f7b19143fdad51f250
Instruction Fuzzy Hash: 4872FDB160438ADFDB759F28CDA57DE7BA2BF55350F61812DDC8A9B210C3318A85CB42

Uniqueness

Uniqueness Score: -1.00%

Function 020C61D8, Relevance: 8.3, Strings: 6, Instructions: 783COMMON

Download Yara Rule

Strings

!ln, xrefs: 020C6521
J, xrefs: 020C6F1F
{R, xrefs: 020C6784
tz$, xrefs: 020C6E33
s7${, xrefs: 020C6E10
u1, xrefs: 020C6D52

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !ln$s7${$tz$$u1${R$J
API String ID: 0-1420385253
Opcode ID: 44cb97dcb6527a793a22cd2dd33faffb87fea326e80506e0d54ffde79b2e2750
Instruction ID: 954ffb0430e379187f6ae226fa024cfc03d1705785ca3cf61e2af2cc569e301a
Opcode Fuzzy Hash: 44cb97dcb6527a793a22cd2dd33faffb87fea326e80506e0d54ffde79b2e2750
Instruction Fuzzy Hash: 5E62DDB160038ADFDB759F28CD96BDE7BA2BF55350F51822DDC899B214C3314A85CB42

Uniqueness

Uniqueness Score: -1.00%

Function 020C65C2, Relevance: 6.8, Strings: 5, Instructions: 572COMMON

Download Yara Rule

Strings

J, xrefs: 020C6F1F
{R, xrefs: 020C6784
tz$, xrefs: 020C6E33
s7${, xrefs: 020C6E10
u1, xrefs: 020C6D52

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: s7${$tz$$u1${R$J
API String ID: 0-2199225291
Opcode ID: ab2c9926e86eb5c66fe75d7215a53d63ed6d749b817c545479d73373ccf1f35e
Instruction ID: 9ba1531ff7107395b1c65f539604de362aaaf8ddadc13fed02a070777b4fd9d4
Opcode Fuzzy Hash: ab2c9926e86eb5c66fe75d7215a53d63ed6d749b817c545479d73373ccf1f35e
Instruction Fuzzy Hash: 1722DCB160078ADFDB759F28CD92BDE7BA2BF55340F51812DDC899B214C7324A898F42

Uniqueness

Uniqueness Score: -1.00%

Function 020C69D8, Relevance: 5.4, Strings: 4, Instructions: 378COMMON

Download Yara Rule

Strings

J, xrefs: 020C6F1F
tz$, xrefs: 020C6E33
s7${, xrefs: 020C6E10
u1, xrefs: 020C6D52

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: s7${$tz$$u1$J
API String ID: 0-3788150741
Opcode ID: e1192c12446163e12389309f52b5bcda863aed497d25749aaa626e2ac29a882e
Instruction ID: 109a353f0a1e742e386ccbd01723252c28348aac8e11b51ac391d8dd9e636d8f
Opcode Fuzzy Hash: e1192c12446163e12389309f52b5bcda863aed497d25749aaa626e2ac29a882e
Instruction Fuzzy Hash: A5E1DDB160078ADFDF759E28CCD6BCE77A2BF55340F50812DDD899B214C7325A8A8B42

Uniqueness

Uniqueness Score: -1.00%

Function 020C6946, Relevance: 5.4, Strings: 4, Instructions: 352COMMON

Download Yara Rule

Strings

J, xrefs: 020C6F1F
tz$, xrefs: 020C6E33
s7${, xrefs: 020C6E10
u1, xrefs: 020C6D52

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: s7${$tz$$u1$J
API String ID: 0-3788150741
Opcode ID: 50bc79d8f9035f1e708167196a6cec46d8da11e6372c7f01320b906208e4f0fc
Instruction ID: 2793b9bc9ea40f817964155d0821e2a21a618dc6be808cf82c900a88fd10765f
Opcode Fuzzy Hash: 50bc79d8f9035f1e708167196a6cec46d8da11e6372c7f01320b906208e4f0fc
Instruction Fuzzy Hash: 96E1CDB1600789DFDB759F24CDA6BDE77A2BF55380F61812DDD899B220C3324A85CB42

Uniqueness

Uniqueness Score: -1.00%

Function 020C6D7A, Relevance: 3.9, Strings: 3, Instructions: 153COMMON

Download Yara Rule

Strings

J, xrefs: 020C6F1F
tz$, xrefs: 020C6E33
s7${, xrefs: 020C6E10

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: s7${$tz$$J
API String ID: 0-1687712441
Opcode ID: 2a515b4d3f5e51595727f8d3c30753a2848f82abab40fd6be16e39508066fc05
Instruction ID: a950b38c33c2d9e3e353755d7c91d0d3b1a4d4f43112295d2d8a45dde5cb076b
Opcode Fuzzy Hash: 2a515b4d3f5e51595727f8d3c30753a2848f82abab40fd6be16e39508066fc05
Instruction Fuzzy Hash: 7A51DCB160078A9FCF768F28CCA57DE7BA6BF46354F24412DDD898B150D33249868B42

Uniqueness

Uniqueness Score: -1.00%

Function 020C5DC2, Relevance: 1.4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

Strings

T%, xrefs: 020C5FD7

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: T%
API String ID: 0-2631034503
Opcode ID: 24dd9717d34db1940b0eaaee95c89cc9cddc46c59224bcd6baced7fa2e6e736b
Instruction ID: eb07b744b46321b71a6956f579e21f331407b4e9f34a039b661e3cb836eec94a
Opcode Fuzzy Hash: 24dd9717d34db1940b0eaaee95c89cc9cddc46c59224bcd6baced7fa2e6e736b
Instruction Fuzzy Hash: E851E3B160471ADBDB78CE29C8D2BDF73E2EF84650F15463DCC4D9B645CB32A5858A40

Uniqueness

Uniqueness Score: -1.00%

Function 020C5D7F, Relevance: 1.4, Strings: 1, Instructions: 145COMMON

Download Yara Rule

Strings

T%, xrefs: 020C5FD7

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: T%
API String ID: 0-2631034503
Opcode ID: 4070f2e114288809feb6beb0bacebbd64f7abf9ebe4ffb2808c4d255d3c6197f
Instruction ID: 37d7dd8cb86545a5e9e17d5d9ad7459d80dc0c1fe64f60a44f0f0974fb06ba04
Opcode Fuzzy Hash: 4070f2e114288809feb6beb0bacebbd64f7abf9ebe4ffb2808c4d255d3c6197f
Instruction Fuzzy Hash: 955114B5604748CBDB74CF2A89D57DF73F6AF88350F69422E8C4D9B642C732A9818B01

Uniqueness

Uniqueness Score: -1.00%

Function 020C01F6, Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

-NI, xrefs: 020C780D

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: -NI
API String ID: 2167126740-2049986426
Opcode ID: 2344fefb6f524519bdaa925d439e48e48634e6cf38c05286037692fe57e5bfbe
Instruction ID: 8039e11159203d1a6dac468657f8776bcd75ba1f6e9651c578c390459f037184
Opcode Fuzzy Hash: 2344fefb6f524519bdaa925d439e48e48634e6cf38c05286037692fe57e5bfbe
Instruction Fuzzy Hash: FB4155B02443028FEB648F7985E47EB63D7AF51254FA8C12EDC8D8B295D735888ACB01

Uniqueness

Uniqueness Score: -1.00%

Function 020C60BB, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bccc436661341f314196e54303c9f8504de811f4bd509e007414ea4a9ae1462
Instruction ID: d2bafad5ac5a64523963d1452d63547b578d3e042f53ff363976b8edafd189ba
Opcode Fuzzy Hash: 0bccc436661341f314196e54303c9f8504de811f4bd509e007414ea4a9ae1462
Instruction Fuzzy Hash: 934164B20083459FDB229F78C9A97EE7BE2EF95244F22091CDCC59B522C7718880CB02

Uniqueness

Uniqueness Score: -1.00%

Function 020CA8D9, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b73c012068ae3f4ee64cf19e4860cfb9c54ce50d2d7a5d1db62d25624521ba7b
Instruction ID: ebd9d81115779de7b7448cd1237bab172bd65f12a17db8f0e69c219dc7721a46
Opcode Fuzzy Hash: b73c012068ae3f4ee64cf19e4860cfb9c54ce50d2d7a5d1db62d25624521ba7b
Instruction Fuzzy Hash: 5F21C575B0430A8FC7249F6889E57EB67A2FF5B780F59422DDD8A8B242F7314805CB01

Uniqueness

Uniqueness Score: -1.00%

Function 020C7DF8, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec766aa57ccb9f8a4a6df171ff695b1b8ee1e7064b35deefbb4d780e6c59ad85
Instruction ID: f14b995057352b29a5e68c29d0782335347597057a4a2392ee7eeefee544644d
Opcode Fuzzy Hash: ec766aa57ccb9f8a4a6df171ff695b1b8ee1e7064b35deefbb4d780e6c59ad85
Instruction Fuzzy Hash: 1D11D331A48349CFDBA8AE7899957EE77E1AF91340F42492DDCCAC6264D7308581CB02

Uniqueness

Uniqueness Score: -1.00%

Function 020C9F4A, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28c4b2c22bf3f54bd104a20e7509c5f451d051b3afa53e2d1310ae9978442e53
Instruction ID: cde7031c314c0b58cde92e47c0194551fe10ba9743da00584cbd4cd781c0665e
Opcode Fuzzy Hash: 28c4b2c22bf3f54bd104a20e7509c5f451d051b3afa53e2d1310ae9978442e53
Instruction Fuzzy Hash: EB012DB4200745DFCB65DF25C994BDA77E2EF99750F158129EC098B664D730D902DB10

Uniqueness

Uniqueness Score: -1.00%

Function 020C77E5, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54258de88772dc80d4969c8d980a4165252aac070ea0a745769cdf30331e368e
Instruction ID: 7497704ddda2381c57dd70b8030cb3840573ab93bbdd4be45f2b13c1021911e3
Opcode Fuzzy Hash: 54258de88772dc80d4969c8d980a4165252aac070ea0a745769cdf30331e368e
Instruction Fuzzy Hash: 8EC048B22406828FFE02DA0AD991B8073A5FB29A48B880890E002CB716C224E900CA00

Uniqueness

Uniqueness Score: -1.00%

Function 020C7C0D, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction ID: f1647c15dfe5582e2114d8b48c9dc7a79c4e1b76aa7bcc19d5d00c5bce2ac4c7
Opcode Fuzzy Hash: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 020C9B0D, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.810237307.00000000020C0000.00000040.00000001.sdmp, Offset: 020C0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2044a5f0b449b7137b1fa5a4685c7cb7c13d86ba796a09aaea3dd4415b91f228
Instruction ID: 008089062edd54e814c616723d64d3324b278143cea6815a028295c813e0950a
Opcode Fuzzy Hash: 2044a5f0b449b7137b1fa5a4685c7cb7c13d86ba796a09aaea3dd4415b91f228
Instruction Fuzzy Hash: D8B092712106408FCA41CE08D2E0F8173A0FB14B40F814480E441C7B11C224E804CA00

Uniqueness

Uniqueness Score: -1.00%

Function 0041A50B, Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 220
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E0041A50B(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char _v32;
				char _v36;
				void* _v44;
				intOrPtr _v52;
				char _v60;
				intOrPtr _v68;
				char _v76;
				char _v80;
				char* _t56;
				void* _t58;
				intOrPtr* _t59;
				void* _t60;
				void* _t62;
				intOrPtr* _t63;
				void* _t64;
				void* _t66;
				intOrPtr* _t67;
				void* _t68;
				void* _t71;
				intOrPtr* _t72;
				void* _t73;
				char _t75;
				intOrPtr _t76;
				void* _t107;
				intOrPtr* _t109;
				intOrPtr* _t111;
				intOrPtr* _t112;
				intOrPtr* _t113;
				intOrPtr* _t114;
				intOrPtr* _t115;
				intOrPtr* _t116;
				intOrPtr* _t117;
				intOrPtr* _t118;
				void* _t119;
				void* _t121;
				intOrPtr _t122;
				void* _t126;
				void* _t135;

				_t122 = _t121 - 0xc;
				 *[fs:0x0] = _t122;
				_v16 = _t122 - 0x50;
				_v12 = 0x401650;
				_t75 = 0;
				_v8 = 0;
				_t109 = _a4;
				 *((intOrPtr*)( *_t109 + 4))(_t109, __edi, __esi, __ebx,  *[fs:0x0], 0x401676, _t119);
				_v28 = 0;
				_v32 = 0;
				_v36 = 0;
				_v44 = 0;
				_v60 = 0;
				_v76 = 0;
				_v80 = 0;
				L0040177E();
				_v68 = _t109;
				_v76 = 9;
				L00401760();
				_t56 =  &_v60;
				_push(_t56);
				L0040170C();
				L00401802();
				if( ~(0 | _t56 != 0x0000ffff) == 0) {
					_t107 = 0x411fb4;
				} else {
					_t126 =  *0x41b380 - _t75; // 0x2b1e8cc
					if(_t126 == 0) {
						_push(0x41b380);
						_push(0x411fc4);
						L00401838();
					}
					_t113 =  *0x41b380; // 0x2b1e8cc
					_t62 =  *((intOrPtr*)( *_t113 + 0x14))(_t113,  &_v44);
					asm("fclex");
					if(_t62 >= _t75) {
						_t107 = 0x411fb4;
					} else {
						_t107 = 0x411fb4;
						_push(0x14);
						_push(0x411fb4);
						_push(_t113);
						_push(_t62);
						L00401832();
					}
					_t63 = _v44;
					_t76 = 1;
					_t114 = _t63;
					_t64 =  *((intOrPtr*)( *_t63 + 0x138))(_t63, L"Sprinkelvrkernes", _t76);
					asm("fclex");
					if(_t64 < 0) {
						_push(0x138);
						_push(0x411fd4);
						_push(_t114);
						_push(_t64);
						L00401832();
					}
					L0040182C();
					if( *0x41b380 == 0) {
						_push(0x41b380);
						_push(0x411fc4);
						L00401838();
					}
					_t115 =  *0x41b380; // 0x2b1e8cc
					_t66 =  *((intOrPtr*)( *_t115 + 0x14))(_t115,  &_v44);
					asm("fclex");
					if(_t66 < 0) {
						_push(0x14);
						_push(_t107);
						_push(_t115);
						_push(_t66);
						L00401832();
					}
					_t67 = _v44;
					_t116 = _t67;
					_t68 =  *((intOrPtr*)( *_t67 + 0x138))(_t67, L"Inferencing", _t76);
					asm("fclex");
					if(_t68 < 0) {
						_push(0x138);
						_push(0x411fd4);
						_push(_t116);
						_push(_t68);
						L00401832();
					}
					L0040182C();
					_push(0);
					_push( &_v60);
					_v52 = _t76;
					_v60 = 2;
					L0040171E();
					L0040183E();
					L00401802();
					if( *0x41b380 == 0) {
						_push(0x41b380);
						_push(0x411fc4);
						L00401838();
					}
					_t117 =  *0x41b380; // 0x2b1e8cc
					_t71 =  *((intOrPtr*)( *_t117 + 0x1c))(_t117,  &_v44);
					asm("fclex");
					if(_t71 < 0) {
						_push(0x1c);
						_push(_t107);
						_push(_t117);
						_push(_t71);
						L00401832();
					}
					_t72 = _v44;
					_t118 = _t72;
					_t73 =  *((intOrPtr*)( *_t72 + 0x50))(_t72);
					asm("fclex");
					if(_t73 < 0) {
						_push(0x50);
						_push(0x412008);
						_push(_t118);
						_push(_t73);
						L00401832();
					}
					L0040182C();
					_t75 = 0;
				}
				_t135 =  *0x41b380 - _t75; // 0x2b1e8cc
				if(_t135 == 0) {
					_push(0x41b380);
					_push(0x411fc4);
					L00401838();
				}
				_t111 =  *0x41b380; // 0x2b1e8cc
				_t58 =  *((intOrPtr*)( *_t111 + 0x14))(_t111,  &_v44);
				asm("fclex");
				if(_t58 < _t75) {
					_push(0x14);
					_push(_t107);
					_push(_t111);
					_push(_t58);
					L00401832();
				}
				_t59 = _v44;
				_t112 = _t59;
				_t60 =  *((intOrPtr*)( *_t59 + 0x68))(_t59,  &_v80);
				asm("fclex");
				if(_t60 < _t75) {
					_push(0x68);
					_push(0x411fd4);
					_push(_t112);
					_push(_t60);
					L00401832();
				}
				L0040182C();
				L00401706();
				L0040183E();
				_push(0x41a7b4);
				L004017E4();
				L004017E4();
				L004017E4();
				return _t60;
			}

0x0041a50e
0x0041a51d
0x0041a52a
0x0041a52d
0x0041a534
0x0041a536
0x0041a539
0x0041a53f
0x0041a548
0x0041a54b
0x0041a54e
0x0041a551
0x0041a554
0x0041a557
0x0041a55a
0x0041a55d
0x0041a568
0x0041a56b
0x0041a572
0x0041a577
0x0041a57a
0x0041a57b
0x0041a591
0x0041a599
0x0041a70d
0x0041a59f
0x0041a59f
0x0041a5a5
0x0041a5a7
0x0041a5ac
0x0041a5b1
0x0041a5b1
0x0041a5b6
0x0041a5c3
0x0041a5c8
0x0041a5ca
0x0041a5dd
0x0041a5cc
0x0041a5cc
0x0041a5d1
0x0041a5d3
0x0041a5d4
0x0041a5d5
0x0041a5d6
0x0041a5d6
0x0041a5e2
0x0041a5e7
0x0041a5e8
0x0041a5f3
0x0041a5fb
0x0041a5fd
0x0041a5ff
0x0041a604
0x0041a609
0x0041a60a
0x0041a60b
0x0041a60b
0x0041a613
0x0041a61f
0x0041a621
0x0041a626
0x0041a62b
0x0041a62b
0x0041a630
0x0041a63d
0x0041a642
0x0041a644
0x0041a646
0x0041a648
0x0041a649
0x0041a64a
0x0041a64b
0x0041a64b
0x0041a650
0x0041a65c
0x0041a65e
0x0041a666
0x0041a668
0x0041a66a
0x0041a66f
0x0041a674
0x0041a675
0x0041a676
0x0041a676
0x0041a67e
0x0041a686
0x0041a688
0x0041a689
0x0041a68c
0x0041a693
0x0041a69d
0x0041a6a5
0x0041a6b1
0x0041a6b3
0x0041a6b8
0x0041a6bd
0x0041a6bd
0x0041a6c2
0x0041a6cf
0x0041a6d4
0x0041a6d6
0x0041a6d8
0x0041a6da
0x0041a6db
0x0041a6dc
0x0041a6dd
0x0041a6dd
0x0041a6e2
0x0041a6e6
0x0041a6ea
0x0041a6ef
0x0041a6f1
0x0041a6f3
0x0041a6f5
0x0041a6fa
0x0041a6fb
0x0041a6fc
0x0041a6fc
0x0041a704
0x0041a709
0x0041a709
0x0041a712
0x0041a718
0x0041a71a
0x0041a71f
0x0041a724
0x0041a724
0x0041a729
0x0041a736
0x0041a73b
0x0041a73d
0x0041a73f
0x0041a741
0x0041a742
0x0041a743
0x0041a744
0x0041a744
0x0041a749
0x0041a753
0x0041a755
0x0041a75a
0x0041a75c
0x0041a75e
0x0041a760
0x0041a765
0x0041a766
0x0041a767
0x0041a767
0x0041a76f
0x0041a774
0x0041a77e
0x0041a783
0x0041a79e
0x0041a7a6
0x0041a7ae
0x0041a7b3

APIs

__vbaStrCopy.MSVBVM60 ref: 0041A55D
__vbaVarDup.MSVBVM60 ref: 0041A572
#562.MSVBVM60(?), ref: 0041A57B
__vbaFreeVar.MSVBVM60(?), ref: 0041A591
__vbaNew2.MSVBVM60(00411FC4,0041B380,?), ref: 0041A5B1
__vbaHresultCheckObj.MSVBVM60(00000000,02B1E8CC,00411FB4,00000014), ref: 0041A5D6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FD4,00000138), ref: 0041A60B
__vbaFreeObj.MSVBVM60(00000000,?,00411FD4,00000138), ref: 0041A613
__vbaNew2.MSVBVM60(00411FC4,0041B380), ref: 0041A62B
__vbaHresultCheckObj.MSVBVM60(00000000,02B1E8CC,00411FB4,00000014), ref: 0041A64B
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FD4,00000138), ref: 0041A676
__vbaFreeObj.MSVBVM60(00000000,?,00411FD4,00000138), ref: 0041A67E
#705.MSVBVM60(?,00000000), ref: 0041A693
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A69D
__vbaFreeVar.MSVBVM60(?,00000000), ref: 0041A6A5
__vbaNew2.MSVBVM60(00411FC4,0041B380,?,00000000), ref: 0041A6BD
__vbaHresultCheckObj.MSVBVM60(00000000,02B1E8CC,00411FB4,0000001C), ref: 0041A6DD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00412008,00000050), ref: 0041A6FC
__vbaFreeObj.MSVBVM60(00000000,?,00412008,00000050), ref: 0041A704
__vbaNew2.MSVBVM60(00411FC4,0041B380,?), ref: 0041A724
__vbaHresultCheckObj.MSVBVM60(00000000,02B1E8CC,00411FB4,00000014), ref: 0041A744
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FD4,00000068), ref: 0041A767
__vbaFreeObj.MSVBVM60(00000000,?,00411FD4,00000068), ref: 0041A76F
#611.MSVBVM60(00000000,?,00411FD4,00000068), ref: 0041A774
__vbaStrMove.MSVBVM60(00000000,?,00411FD4,00000068), ref: 0041A77E
__vbaFreeStr.MSVBVM60(0041A7B4), ref: 0041A79E
__vbaFreeStr.MSVBVM60(0041A7B4), ref: 0041A7A6
__vbaFreeStr.MSVBVM60(0041A7B4), ref: 0041A7AE

Strings

Sprinkelvrkernes, xrefs: 0041A5ED
Inferencing, xrefs: 0041A654

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$Move$#562#611#705Copy
String ID: Inferencing$Sprinkelvrkernes
API String ID: 3821766861-2317132577
Opcode ID: cb2c6b617b98f3f059380a9b065ec7247450f0e8f234022ce386752c04884ca2
Instruction ID: 84f9900d4837f28849dedcdd3af0c1f1f4e5353fce792857ab84c6a89fd4ec15
Opcode Fuzzy Hash: cb2c6b617b98f3f059380a9b065ec7247450f0e8f234022ce386752c04884ca2
Instruction Fuzzy Hash: 9A718471940208ABCB10EFA5C885EDEBBB8EF18704F54413EF541B31E1D7789986CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041A2A3, Relevance: 31.7, APIs: 21, Instructions: 181
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0041A2A3(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0) {
				intOrPtr _v8;
				long long* _v12;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				char _v44;
				intOrPtr _v52;
				char _v60;
				intOrPtr _v68;
				char _v76;
				intOrPtr _v84;
				char _v92;
				intOrPtr _v100;
				char _v108;
				char _v176;
				char* _t54;
				void* _t57;
				intOrPtr* _t58;
				void* _t59;
				void* _t61;
				intOrPtr* _t62;
				void* _t63;
				intOrPtr* _t64;
				char _t65;
				void* _t67;
				intOrPtr* _t97;
				intOrPtr* _t98;
				intOrPtr* _t99;
				intOrPtr* _t100;
				intOrPtr* _t101;
				intOrPtr _t104;
				long long* _t105;
				intOrPtr _t108;
				intOrPtr _t111;

				_push(0x401676);
				_t54 =  *[fs:0x0];
				_push(_t54);
				 *[fs:0x0] = _t104;
				_t105 = _t104 - 0xb4;
				_v12 = _t105;
				_v8 = 0x401640;
				asm("fldz");
				 *_t105 = __fp0;
				_v28 = 0;
				_v36 = 0;
				_v40 = 0;
				_v44 = 0;
				_v60 = 0;
				_v76 = 0;
				_v92 = 0;
				_v108 = 0;
				_v176 = 0;
				L00401724();
				L0040172A();
				asm("fcomp qword [0x401638]");
				asm("fnstsw ax");
				asm("sahf");
				if(0 != 0) {
					_push(0);
					_push( &_v60);
					_v52 = 1;
					_v60 = 2;
					L0040171E();
					L0040183E();
					L00401802();
					_t108 =  *0x41b380; // 0x2b1e8cc
					if(_t108 == 0) {
						_push(0x41b380);
						_push(0x411fc4);
						L00401838();
					}
					_t97 =  *0x41b380; // 0x2b1e8cc
					_t57 =  *((intOrPtr*)( *_t97 + 0x14))(_t97,  &_v44);
					asm("fclex");
					if(_t57 < 0) {
						_push(0x14);
						_push(0x411fb4);
						_push(_t97);
						_push(_t57);
						L00401832();
					}
					_t58 = _v44;
					_t98 = _t58;
					_t59 =  *((intOrPtr*)( *_t58 + 0xd0))(_t58,  &_v40);
					asm("fclex");
					if(_t59 < 0) {
						_push(0xd0);
						_push(0x411fd4);
						_push(_t98);
						_push(_t59);
						L00401832();
					}
					_v40 = 0;
					L0040183E();
					L0040182C();
					_t111 =  *0x41b380; // 0x2b1e8cc
					if(_t111 == 0) {
						_push(0x41b380);
						_push(0x411fc4);
						L00401838();
					}
					_t99 =  *0x41b380; // 0x2b1e8cc
					_t61 =  *((intOrPtr*)( *_t99 + 0x14))(_t99,  &_v44);
					asm("fclex");
					if(_t61 < 0) {
						_push(0x14);
						_push(0x411fb4);
						_push(_t99);
						_push(_t61);
						L00401832();
					}
					_t62 = _v44;
					_t100 = _t62;
					_t63 =  *((intOrPtr*)( *_t62 + 0xb8))(_t62,  &_v176);
					asm("fclex");
					if(_t63 < 0) {
						_push(0xb8);
						_push(0x411fd4);
						_push(_t100);
						_push(_t63);
						L00401832();
					}
					L0040182C();
					L00401712();
					_t64 =  &_v44;
					L00401718();
					_t101 = _t64;
					_v100 = 0x80020004;
					_v84 = 0x80020004;
					_v68 = 0x80020004;
					_v52 = 0x80020004;
					_t65 = 0xa;
					_v108 = _t65;
					_v92 = _t65;
					_v76 = _t65;
					_v60 = _t65;
					_t67 =  *((intOrPtr*)( *_t101 + 0x44))(_t101, 0x7304,  &_v60,  &_v76,  &_v92,  &_v108, _t64, _t63);
					asm("fclex");
					if(_t67 < 0) {
						_push(0x44);
						_push(0x4140c8);
						_push(_t101);
						_push(_t67);
						L00401832();
					}
					L0040182C();
					_push( &_v108);
					_push( &_v92);
					_push( &_v76);
					_t54 =  &_v60;
					_push(_t54);
					_push(4);
					L0040181A();
				}
				asm("wait");
				_push(0x41a4f0);
				_v32 =  *0x401630;
				L004017E4();
				L004017E4();
				return _t54;
			}

0x0041a2a8
0x0041a2ad
0x0041a2b3
0x0041a2b4
0x0041a2bb
0x0041a2c4
0x0041a2c7
0x0041a2d0
0x0041a2d4
0x0041a2d7
0x0041a2da
0x0041a2dd
0x0041a2e0
0x0041a2e3
0x0041a2e6
0x0041a2e9
0x0041a2ec
0x0041a2ef
0x0041a2f5
0x0041a2fa
0x0041a2ff
0x0041a305
0x0041a307
0x0041a308
0x0041a311
0x0041a312
0x0041a313
0x0041a31a
0x0041a321
0x0041a32b
0x0041a333
0x0041a338
0x0041a33e
0x0041a340
0x0041a345
0x0041a34a
0x0041a34a
0x0041a34f
0x0041a35c
0x0041a361
0x0041a363
0x0041a365
0x0041a367
0x0041a36c
0x0041a36d
0x0041a36e
0x0041a36e
0x0041a373
0x0041a37d
0x0041a37f
0x0041a387
0x0041a389
0x0041a38b
0x0041a390
0x0041a395
0x0041a396
0x0041a397
0x0041a397
0x0041a3a2
0x0041a3a5
0x0041a3ad
0x0041a3b2
0x0041a3b8
0x0041a3ba
0x0041a3bf
0x0041a3c4
0x0041a3c4
0x0041a3c9
0x0041a3d6
0x0041a3db
0x0041a3dd
0x0041a3df
0x0041a3e1
0x0041a3e6
0x0041a3e7
0x0041a3e8
0x0041a3e8
0x0041a3ed
0x0041a3fa
0x0041a3fc
0x0041a404
0x0041a406
0x0041a408
0x0041a40d
0x0041a412
0x0041a413
0x0041a414
0x0041a414
0x0041a41c
0x0041a421
0x0041a427
0x0041a42b
0x0041a437
0x0041a439
0x0041a43c
0x0041a43f
0x0041a442
0x0041a445
0x0041a449
0x0041a458
0x0041a45b
0x0041a45e
0x0041a46a
0x0041a46f
0x0041a471
0x0041a473
0x0041a475
0x0041a47a
0x0041a47b
0x0041a47c
0x0041a47c
0x0041a484
0x0041a48c
0x0041a490
0x0041a494
0x0041a495
0x0041a498
0x0041a499
0x0041a49b
0x0041a4a0
0x0041a4a9
0x0041a4aa
0x0041a4af
0x0041a4e2
0x0041a4ea
0x0041a4ef

APIs

#585.MSVBVM60 ref: 0041A2F5
__vbaFpR8.MSVBVM60 ref: 0041A2FA
#705.MSVBVM60(?,00000000), ref: 0041A321
__vbaStrMove.MSVBVM60(?,00000000), ref: 0041A32B
__vbaFreeVar.MSVBVM60(?,00000000), ref: 0041A333
__vbaNew2.MSVBVM60(00411FC4,0041B380,?,00000000), ref: 0041A34A
__vbaHresultCheckObj.MSVBVM60(00000000,02B1E8CC,00411FB4,00000014), ref: 0041A36E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FD4,000000D0), ref: 0041A397
__vbaStrMove.MSVBVM60(00000000,?,00411FD4,000000D0), ref: 0041A3A5
__vbaFreeObj.MSVBVM60(00000000,?,00411FD4,000000D0), ref: 0041A3AD
__vbaNew2.MSVBVM60(00411FC4,0041B380), ref: 0041A3C4
__vbaHresultCheckObj.MSVBVM60(00000000,02B1E8CC,00411FB4,00000014), ref: 0041A3E8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FD4,000000B8), ref: 0041A414
__vbaFreeObj.MSVBVM60(00000000,?,00411FD4,000000B8), ref: 0041A41C
#685.MSVBVM60(00000000,?,00411FD4,000000B8), ref: 0041A421
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041A42B
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004140C8,00000044), ref: 0041A47C
__vbaFreeObj.MSVBVM60(00000000,00000000,004140C8,00000044), ref: 0041A484
__vbaFreeVarList.MSVBVM60(00000004,00000002,?,?,?), ref: 0041A49B
__vbaFreeStr.MSVBVM60(0041A4F0), ref: 0041A4E2
__vbaFreeStr.MSVBVM60(0041A4F0), ref: 0041A4EA

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$MoveNew2$#585#685#705List
String ID:
API String ID: 1883905597-0
Opcode ID: bdc6ec22f3bca83792517dd24ed718343ab2465a7f3251d6f1c1d46d5b6c864e
Instruction ID: 7ff684b4e7ab6f421be5c49088af0792ef7219e05174f93e6178063be4c96933
Opcode Fuzzy Hash: bdc6ec22f3bca83792517dd24ed718343ab2465a7f3251d6f1c1d46d5b6c864e
Instruction Fuzzy Hash: C4516C71D00208AFCB00EF95C886EEEBBB8EF58704F14412BF505B71A1DB785985CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0E8, Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0041A0E8(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v40;
				void* _v44;
				void* _v48;
				signed int _v56;
				char _v64;
				intOrPtr _v72;
				char _v80;
				intOrPtr _v88;
				char _v96;
				intOrPtr _v104;
				char _v112;
				char* _v120;
				intOrPtr _v128;
				char* _t48;
				void* _t69;
				void* _t71;
				intOrPtr _t72;

				_t72 = _t71 - 0x18;
				 *[fs:0x0] = _t72;
				L00401670();
				_v28 = _t72;
				_v24 = 0x4015e8;
				_v20 = 0;
				_v16 = 0;
				_t48 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x401676, _t69);
				_v8 = 1;
				_v8 = 2;
				_push(0x4140a8);
				L0040173C();
				if(_t48 != 2) {
					_v8 = 3;
					_v56 = _v56 & 0x00000000;
					_v64 = 2;
					_push(0xfffffffe);
					_push(0xfffffffe);
					_push(0xfffffffe);
					_push(0xffffffff);
					_push( &_v64);
					L00401736();
					L0040183E();
					L00401802();
					_v8 = 4;
					_push(0);
					L00401814();
					_v8 = 5;
					_push(0);
					_push(0);
					_push(1);
					L00401730();
					L0040183E();
					_v8 = 6;
					_v104 = 0x80020004;
					_v112 = 0xa;
					_v88 = 0x80020004;
					_v96 = 0xa;
					_v72 = 0x80020004;
					_v80 = 0xa;
					_v120 = L"Gregarinian";
					_v128 = 8;
					L00401760();
					_push( &_v112);
					_push( &_v96);
					_push( &_v80);
					_push(0);
					_push( &_v64);
					L00401772();
					_push( &_v112);
					_push( &_v96);
					_push( &_v80);
					_t48 =  &_v64;
					_push(_t48);
					_push(4);
					L0040181A();
				}
				_v8 = 8;
				_push(0xffffffff);
				L00401814();
				_v8 = 9;
				_v40 = 0x74be;
				_push(0x41a27a);
				L004017E4();
				L004017E4();
				return _t48;
			}

0x0041a0eb
0x0041a0fa
0x0041a106
0x0041a10e
0x0041a111
0x0041a118
0x0041a11f
0x0041a12e
0x0041a131
0x0041a138
0x0041a13f
0x0041a144
0x0041a14c
0x0041a152
0x0041a159
0x0041a15d
0x0041a164
0x0041a166
0x0041a168
0x0041a16a
0x0041a16f
0x0041a170
0x0041a17a
0x0041a182
0x0041a187
0x0041a18e
0x0041a190
0x0041a195
0x0041a19c
0x0041a19e
0x0041a1a0
0x0041a1a2
0x0041a1ac
0x0041a1b1
0x0041a1b8
0x0041a1bf
0x0041a1c6
0x0041a1cd
0x0041a1d4
0x0041a1db
0x0041a1e2
0x0041a1e9
0x0041a1f6
0x0041a1fe
0x0041a202
0x0041a206
0x0041a207
0x0041a20c
0x0041a20d
0x0041a215
0x0041a219
0x0041a21d
0x0041a21e
0x0041a221
0x0041a222
0x0041a224
0x0041a229
0x0041a22c
0x0041a233
0x0041a235
0x0041a23a
0x0041a241
0x0041a247
0x0041a26c
0x0041a274
0x0041a279

APIs

__vbaChkstk.MSVBVM60(?,00401676), ref: 0041A106
__vbaI4Str.MSVBVM60(004140A8,?,?,?,?,00401676), ref: 0041A144
#704.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A170
__vbaStrMove.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A17A
__vbaFreeVar.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A182
__vbaOnError.MSVBVM60(00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A190
#706.MSVBVM60(00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A1A2
__vbaStrMove.MSVBVM60(00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A1AC
__vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,00000001,00000000,00000000,00000000,00000002,000000FF,000000FE,000000FE,000000FE), ref: 0041A1F6
#595.MSVBVM60(00000002,00000000,0000000A,0000000A,0000000A,?,?,?,?,?,?,?,00000001,00000000,00000000,00000000), ref: 0041A20D
__vbaFreeVarList.MSVBVM60(00000004,00000002,0000000A,0000000A,0000000A,00000002,00000000,0000000A,0000000A,0000000A), ref: 0041A224
__vbaOnError.MSVBVM60(000000FF,004140A8,?,?,?,?,00401676), ref: 0041A235
__vbaFreeStr.MSVBVM60(0041A27A,000000FF,004140A8), ref: 0041A26C
__vbaFreeStr.MSVBVM60(0041A27A,000000FF,004140A8), ref: 0041A274

Strings

Gregarinian, xrefs: 0041A1E2

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$ErrorMove$#595#704#706ChkstkList
String ID: Gregarinian
API String ID: 2605556234-529014253
Opcode ID: 4f7c424228cab1e51d1d167032784cef6fe672d6d09f43beafbe77f6e37e0a1d
Instruction ID: dd4dc11740ab99ba03a10b0ebd200b74ab9521cc8b5647c18a4f0a5ef89716eb
Opcode Fuzzy Hash: 4f7c424228cab1e51d1d167032784cef6fe672d6d09f43beafbe77f6e37e0a1d
Instruction Fuzzy Hash: 6241FCB1D01208ABDB10EFD5C945BDDBBB9AF04314F60812AF1217B2E1DBB95A09CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041A7D1, Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00411FC4,0041B380), ref: 0041A813
__vbaHresultCheckObj.MSVBVM60(00000000,02B1E8CC,00411FB4,00000014), ref: 0041A837
__vbaHresultCheckObj.MSVBVM60(00000000,?,00411FD4,000000C8), ref: 0041A860
__vbaFreeObj.MSVBVM60 ref: 0041A868

Memory Dump Source

Source File: 00000001.00000002.809534969.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.809520422.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.809565178.000000000041B000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.809579266.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2
String ID:
API String ID: 4261391273-0
Opcode ID: 46275d9a660308c4efc5d544af3ab7af1da2b833ce7ddcc7b65c28230d670aee
Instruction ID: 4dd694af57ad1b0f96b52139acf5417f1eafc8d913782cc297880cedaff66815
Opcode Fuzzy Hash: 46275d9a660308c4efc5d544af3ab7af1da2b833ce7ddcc7b65c28230d670aee
Instruction Fuzzy Hash: 51118671981208BFD700EB96CC46FEFBAA8EB54B04F14452AF141B31E1D7B859468BE9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Contract and PI of 1500W.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Contract and PI of 1500W.exe PID: 6180 Parent PID: 2804

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Contract and PI of 1500W.exe PID: 6180 Parent PID: 2804 Contract and PI of 1500W.exeCOMMON

Executed Functions

Function 004022C3, Relevance: 6.1, APIs: 1, Strings: 1, Instructions: 3094COMMON

Function 004031E2, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 571COMMON

Function 0041A50B, Relevance: 52.7, APIs: 28, Strings: 2, Instructions: 220
COMMON

Function 0041A2A3, Relevance: 31.7, APIs: 21, Instructions: 181
COMMON

Function 0041A0E8, Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 97
COMMON