Play interactive tour

Edit tour

Windows Analysis Report Orden de compra M244545.exe

Overview

General Information

Sample Name:	Orden de compra M244545.exe
Analysis ID:	502566
MD5:	7c04ecf5dc6999877e87cf9c1c933a3f
SHA1:	905c177e8ea3a2173e322c13b25cd156bd6dea39
SHA256:	cf7bd1c802c044a777529246743d3a5c907e4c02a29525afe2c48daee9b2fd9d
Tags:	exeguloader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected GuLoader

Found potential dummy code loops (likely to delay analysis)

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Contains functionality to call native functions

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Program does not show much activity (idle)

Uses code obfuscation techniques (call, push, ret)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Detected potential crypto function

Classification

Process Tree

System is w10x64

Orden de compra M244545.exe (PID: 7096 cmdline: 'C:\Users\user\Desktop\Orden de compra M244545.exe' MD5: 7C04ECF5DC6999877E87CF9C1C933A3F)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=13CKgFgBbMK4vER"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=13CKgFgBbMK4vER"}

Source: Orden de compra M244545.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=13CKgFgBbMK4vER

Source: Orden de compra M244545.exe, 00000000.00000002.815031426.00000000005EA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: Orden de compra M244545.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021774BA NtAllocateVirtualMemory,	0_2_021774BA
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021774BD NtAllocateVirtualMemory,	0_2_021774BD
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021774A7 NtAllocateVirtualMemory,	0_2_021774A7
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021775BF NtAllocateVirtualMemory,	0_2_021775BF

Source: Orden de compra M244545.exe, 00000000.00000000.287814092.0000000000416000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameREMEMBERER.exe vs Orden de compra M244545.exe
Source: Orden de compra M244545.exe	Binary or memory string: OriginalFilenameREMEMBERER.exe vs Orden de compra M244545.exe

Source: C:\Users\user\Desktop\Orden de compra M244545.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0040166E	0_2_0040166E
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_00401621	0_2_00401621
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_00401432	0_2_00401432
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021774BA	0_2_021774BA
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217B9C4	0_2_0217B9C4
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02179E11	0_2_02179E11
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02176605	0_2_02176605
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217AA3B	0_2_0217AA3B
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02175E47	0_2_02175E47
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217564F	0_2_0217564F
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02179E4C	0_2_02179E4C
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217566E	0_2_0217566E
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217BA8B	0_2_0217BA8B
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217BAA3	0_2_0217BAA3
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021772D9	0_2_021772D9
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217AAC7	0_2_0217AAC7
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02175AEB	0_2_02175AEB
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02174F14	0_2_02174F14
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02175B13	0_2_02175B13
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02175703	0_2_02175703
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02179F0C	0_2_02179F0C
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217BB08	0_2_0217BB08
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02175B36	0_2_02175B36
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02177B25	0_2_02177B25
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217BF53	0_2_0217BF53
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02175F40	0_2_02175F40
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217BB73	0_2_0217BB73
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217A788	0_2_0217A788
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217ABA7	0_2_0217ABA7
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02177BAE	0_2_02177BAE
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02175BF0	0_2_02175BF0
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02170000	0_2_02170000
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217A00F	0_2_0217A00F
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217540C	0_2_0217540C
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217800C	0_2_0217800C
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02175426	0_2_02175426
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217BC42	0_2_0217BC42
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217604F	0_2_0217604F
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217584A	0_2_0217584A
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02175473	0_2_02175473
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02175083	0_2_02175083
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02177C8D	0_2_02177C8D
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021760B7	0_2_021760B7
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021774BD	0_2_021774BD
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021774A7	0_2_021774A7
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021760A5	0_2_021760A5
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217ACDB	0_2_0217ACDB
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021750D8	0_2_021750D8
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021718EB	0_2_021718EB
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02170CEB	0_2_02170CEB
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02175D17	0_2_02175D17
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02170D15	0_2_02170D15
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217B137	0_2_0217B137
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217AD3D	0_2_0217AD3D
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217594C	0_2_0217594C
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217A977	0_2_0217A977
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02175587	0_2_02175587
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021779B4	0_2_021779B4
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217ADCB	0_2_0217ADCB
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021779F7	0_2_021779F7
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217B9F0	0_2_0217B9F0

Source: C:\Users\user\Desktop\Orden de compra M244545.exe

File created: C:\Users\user\AppData\Local\Temp\~DF69F4FFD7A5AEEA59.TMP

Jump to behavior

Source: Orden de compra M244545.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Orden de compra M244545.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Orden de compra M244545.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: classification engine

Classification label: mal68.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_004059C4 push AEED1A63h; ret	0_2_004059CF
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02171E34 push FFFFFF92h; ret	0_2_02171F4A
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217866B push esi; retf	0_2_0217866C
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02172AC3 push 1B7863C3h; ret	0_2_02172ADE
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02171C34 push FFFFFF92h; ret	0_2_02171F4A
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02174C38 push esi; ret	0_2_02174C3F
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02170099 push ebp; ret	0_2_0217009A
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021718EB push FFFFFF92h; ret	0_2_02171F4A
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02170CEB push 810A7C4Fh; ret	0_2_02170D06
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02171D1A push FFFFFF92h; ret	0_2_02171F4A
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02170100 push ebp; ret	0_2_02170101
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02172531 push ecx; retf	0_2_02172532

Source: C:\Users\user\Desktop\Orden de compra M244545.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\Orden de compra M244545.exe	RDTSC instruction interceptor: First address: 000000000040F114 second address: 000000000040F114 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 popfd 0x00000004 pushfd 0x00000005 popfd 0x00000006 popad 0x00000007 cmp ecx, 68h 0x0000000a pushfd 0x0000000b popfd 0x0000000c dec edi 0x0000000d mfence 0x00000010 lfence 0x00000013 cmp edi, 00000000h 0x00000016 jne 00007FA9FC372830h 0x00000018 mfence 0x0000001b cmp eax, 2Bh 0x0000001e pushad 0x0000001f pushfd 0x00000020 popfd 0x00000021 nop 0x00000022 rdtsc
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	RDTSC instruction interceptor: First address: 0000000002176E32 second address: 0000000002176E32 instructions: 0x00000000 rdtsc 0x00000002 mov eax, D4B2F1E2h 0x00000007 xor eax, 08C7D238h 0x0000000c xor eax, AF5C0C90h 0x00000011 xor eax, 73292F4Bh 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007FA9FC39B8BAh 0x0000001e lfence 0x00000021 mov edx, F0957472h 0x00000026 sub edx, C21253E8h 0x0000002c xor edx, 9CB6DCC2h 0x00000032 xor edx, CDCBFC5Ch 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 pop ecx 0x00000042 cmp ax, cx 0x00000045 add edi, edx 0x00000047 dec ecx 0x00000048 mov dword ptr [ebp+000001EAh], ecx 0x0000004e mov ecx, AED5C45Ah 0x00000053 jmp 00007FA9FC39B8DAh 0x00000055 xor ecx, 64BFF28Ch 0x0000005b sub ecx, 10CB0807h 0x00000061 xor ecx, B99F2ECFh 0x00000067 cmp dword ptr [ebp+000001EAh], ecx 0x0000006d mov ecx, dword ptr [ebp+000001EAh] 0x00000073 jne 00007FA9FC39B842h 0x00000075 mov dword ptr [ebp+000001A8h], eax 0x0000007b mov eax, ecx 0x0000007d push eax 0x0000007e mov eax, dword ptr [ebp+000001A8h] 0x00000084 call 00007FA9FC39B995h 0x00000089 call 00007FA9FC39B8DBh 0x0000008e lfence 0x00000091 mov edx, F0957472h 0x00000096 sub edx, C21253E8h 0x0000009c xor edx, 9CB6DCC2h 0x000000a2 xor edx, CDCBFC5Ch 0x000000a8 mov edx, dword ptr [edx] 0x000000aa lfence 0x000000ad ret 0x000000ae mov esi, edx 0x000000b0 pushad 0x000000b1 rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Orden de compra M244545.exe

Code function: 0_2_02176E2A rdtsc

0_2_02176E2A

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\Orden de compra M244545.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_021797C9 mov eax, dword ptr fs:[00000030h]	0_2_021797C9
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02176C45 mov eax, dword ptr fs:[00000030h]	0_2_02176C45
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_02179CD8 mov eax, dword ptr fs:[00000030h]	0_2_02179CD8
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217A977 mov eax, dword ptr fs:[00000030h]	0_2_0217A977

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Orden de compra M244545.exe

Code function: 0_2_02176E2A rdtsc

0_2_02176E2A

Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217B9C4 RtlAddVectoredExceptionHandler,	0_2_0217B9C4
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217BE98 RtlAddVectoredExceptionHandler,	0_2_0217BE98
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217BA8B RtlAddVectoredExceptionHandler,	0_2_0217BA8B
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217BAA3 RtlAddVectoredExceptionHandler,	0_2_0217BAA3
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217BB08 RtlAddVectoredExceptionHandler,	0_2_0217BB08
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217BB73 RtlAddVectoredExceptionHandler,	0_2_0217BB73
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217BC42 RtlAddVectoredExceptionHandler,	0_2_0217BC42
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217BD78 RtlAddVectoredExceptionHandler,	0_2_0217BD78
Source: C:\Users\user\Desktop\Orden de compra M244545.exe	Code function: 0_2_0217B9F0 RtlAddVectoredExceptionHandler,	0_2_0217B9F0

Source: Orden de compra M244545.exe, 00000000.00000002.815107680.0000000000C70000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: Orden de compra M244545.exe, 00000000.00000002.815107680.0000000000C70000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: Orden de compra M244545.exe, 00000000.00000002.815107680.0000000000C70000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: Orden de compra M244545.exe, 00000000.00000002.815107680.0000000000C70000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	Input Capture1	Security Software Discovery21	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	502566
Start date:	14.10.2021
Start time:	04:05:24
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Orden de compra M244545.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 21% (good quality ratio 11.9%) Quality average: 38% Quality standard deviation: 38.1%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, HxTsr.exe, RuntimeBroker.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 20.49.157.6, 67.27.159.254, 67.26.137.254, 8.253.95.120, 67.27.157.126, 67.27.233.126, 20.199.120.151, 2.20.178.33, 2.20.178.24, 20.54.110.249, 40.112.88.60, 20.199.120.85, 20.50.102.62, 20.199.120.182 Excluded domains from analysis (whitelisted): fg.download.windowsupdate.com.c.footprint.net, client.wns.windows.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, a1449.dscg2.akamai.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, arc.msn.com, ris.api.iris.microsoft.com, wns.notify.trafficmanager.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, iris-de-ppe-azsc-uks.uksouth.cloudapp.azure.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.7855993258224325
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Orden de compra M244545.exe
File size:	98304
MD5:	7c04ecf5dc6999877e87cf9c1c933a3f
SHA1:	905c177e8ea3a2173e322c13b25cd156bd6dea39
SHA256:	cf7bd1c802c044a777529246743d3a5c907e4c02a29525afe2c48daee9b2fd9d
SHA512:	125d0c2e70138bac0c6fb7416085b993c24ed67a8881be2b5f6a9361f4814dbd0084b99b182d7275d02ee0dcb877b8ad5c04f7711a454abf7359c5ef4aaf8459
SSDEEP:	1536:tNDLZynUIR5qVCSbwmNYDsbYFSrZbQFsnD+IjDlD:tNB7U5qVC8wkkFg73jDl
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L......K.................@...0...............P....@........

File Icon


Icon Hash:	69e1c892f664c884

Static PE Info

General
Entrypoint:	0x4012b4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4BCDC590 [Tue Apr 20 15:17:36 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3d3cd1bd8dcc611a5734bf41f4e1a6a6

Entrypoint Preview

Instruction
push 0041051Ch
call 00007FA9FCD60383h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
ror dword ptr [ebp+esi-10ACEBBCh], 1
dec ebx
call far A5DAh : 696DB9C0h
stc
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
inc ecx
dec ecx
dec esi
inc esi
dec edi
push edx
pop edx
imul esp, dword ptr [ebp+72h], 0A003473h
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
xor dword ptr [eax], eax
cmp byte ptr [58E9EFEDh], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x14124	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x1c2a	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xf0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x13518	0x14000	False	0.510925292969	data	6.24325085767	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x15000	0xcc4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x1c2a	0x2000	False	0.346069335938	data	3.69516488298	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CUSTOM	0x1792c	0x2fe	MS Windows icon resource - 1 icon, 32x32, 16 colors	English	United States
CUSTOM	0x1706e	0x8be	MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel	English	United States
CUSTOM	0x16d70	0x2fe	MS Windows icon resource - 1 icon, 32x32, 16 colors, 4 bits/pixel	English	United States
RT_ICON	0x164c8	0x8a8	data
RT_GROUP_ICON	0x164b4	0x14	data
RT_VERSION	0x161a0	0x314	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaVarAdd, __vbaVarDup, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	ExpressVPN
InternalName	REMEMBERER
FileVersion	4.00
CompanyName	ExpressVPN
LegalTrademarks	ExpressVPN
Comments	ExpressVPN
ProductName	ExpressVPN
ProductVersion	4.00
FileDescription	ExpressVPN
OriginalFilename	REMEMBERER.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: Orden de compra M244545.exe PID: 7096 Parent PID: 5104

General

Start time:	04:06:20
Start date:	14/10/2021
Path:	C:\Users\user\Desktop\Orden de compra M244545.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Orden de compra M244545.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	7C04ECF5DC6999877E87CF9C1C933A3F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Orden de compra M244545.exe PID: 7096 Parent PID: 5104 Orden de compra M244545.exeCOMMON

Executed Functions

Function 0217BAA3, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 188COMMON

Download Yara Rule

Strings

5zN, xrefs: 0217BBC6
G=f, xrefs: 0217BD18
j, xrefs: 0217BAF7

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 5zN$G=f$j
API String ID: 0-2682776909
Opcode ID: b33749a4d8d08d2de821f69a5ad2da3f33fd6d2feebc5fe28177181d4af4b563
Instruction ID: 3c7d29bbabaf18b9b401887ab4dc76b7f29f993837de6ada9ace8bee7afb34d9
Opcode Fuzzy Hash: b33749a4d8d08d2de821f69a5ad2da3f33fd6d2feebc5fe28177181d4af4b563
Instruction Fuzzy Hash: 18710E726843888FEF34EF24C9E4BDA37B2EF9A718F55411AD8099F250C7349A49CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0217B9C4, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 262COMMON

Download Yara Rule

Strings

5zN, xrefs: 0217BBC6
G=f, xrefs: 0217BD18

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 5zN$G=f
API String ID: 0-71786358
Opcode ID: 5e03da9c12eeb189be426ca8c72083904a86f606baaf59f2f87b7a7768bec619
Instruction ID: 8c2047db580c31c9d62e6e4afa03fe703841e63f295b096bcac0ce5849b8b66b
Opcode Fuzzy Hash: 5e03da9c12eeb189be426ca8c72083904a86f606baaf59f2f87b7a7768bec619
Instruction Fuzzy Hash: 6AA153715893888FDF35DE28C9A47EA7BB2AF8A314F15416ACC0A8F355C7359B49CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0217B9F0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

5zN, xrefs: 0217BBC6
G=f, xrefs: 0217BD18

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 5zN$G=f
API String ID: 0-71786358
Opcode ID: c402fd9fd0b679c85a58b6802a445591f78b2978a9872a92cd5e39339876c6e3
Instruction ID: b86ba5cbf27e9a04e1110bb28708f5805c8777e7bc32deca993c6c3e625f8679
Opcode Fuzzy Hash: c402fd9fd0b679c85a58b6802a445591f78b2978a9872a92cd5e39339876c6e3
Instruction Fuzzy Hash: 387111716843888FDF35DE24C9E4BDA37B2AF96714F55411ADC0A9F250CB359B45CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0217BB08, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 188COMMON

Download Yara Rule

Strings

5zN, xrefs: 0217BBC6
G=f, xrefs: 0217BD18

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 5zN$G=f
API String ID: 0-71786358
Opcode ID: bda31d099a639d924008345289ed9253101b355642e8c300cff97bc9f3ac5f5a
Instruction ID: 5bd806ebf4cdcbe281abb78b528732ef4fd1055593d1afea6cfd3c79c8934102
Opcode Fuzzy Hash: bda31d099a639d924008345289ed9253101b355642e8c300cff97bc9f3ac5f5a
Instruction Fuzzy Hash: 89710D726843888FEB34DE24C9E4BDA37B2AF8A718F51411ADC099F210CB349A49CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0217BB73, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 175COMMON

Download Yara Rule

Strings

5zN, xrefs: 0217BBC6
G=f, xrefs: 0217BD18

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 5zN$G=f
API String ID: 0-71786358
Opcode ID: a7c00fc74e92c3977eed921bffde8696b33d8ff69e9a830f5210c77e8e59b087
Instruction ID: 1412ba7832a376fb11a70787525526404cb1a93aead15d4608df3bb75b77337d
Opcode Fuzzy Hash: a7c00fc74e92c3977eed921bffde8696b33d8ff69e9a830f5210c77e8e59b087
Instruction Fuzzy Hash: 61711D726843888FEF34DF28C9E4BDA3BB2AF86724F51411AD8099F254CB359B45CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0217BA8B, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 165COMMON

Download Yara Rule

Strings

5zN, xrefs: 0217BBC6
G=f, xrefs: 0217BD18

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 5zN$G=f
API String ID: 0-71786358
Opcode ID: ea36862078087d69be733d016af3e8ca11bbf3ce06c4085be062b278dbdd8b54
Instruction ID: e83a26aa306ef411e46c97f07caba904c3f7dda1e0de5ba1cd93014b79ada961
Opcode Fuzzy Hash: ea36862078087d69be733d016af3e8ca11bbf3ce06c4085be062b278dbdd8b54
Instruction Fuzzy Hash: 0361FF716443888FDF799E28C9A4BEE37B2AF95314F56412ACD0A9F354CB359B41CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0217BC42, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 152COMMON

Download Yara Rule

Strings

G=f, xrefs: 0217BD18

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: G=f
API String ID: 0-1337291813
Opcode ID: 3c73dc1d05cff6bef164e908fc2a053b3cbee4d8036b84174cf06b0ad92d636f
Instruction ID: 03fd220b9ce0615bd139b915d15dbec9f310102eb697bbb0a001b5ba46347f08
Opcode Fuzzy Hash: 3c73dc1d05cff6bef164e908fc2a053b3cbee4d8036b84174cf06b0ad92d636f
Instruction Fuzzy Hash: 015123726853888FEB31DF24C9D0BDA37B2EFD6718F65415AD8099F210CB359A4ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 021774A7, Relevance: 1.6, APIs: 1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0544f223892a03b3e8316c9f2e7ed17d105dab3fb6a45508149d466da7078fde
Instruction ID: 991a199c3735867ec1b802f2ba0b658ae3eee560e9956d0bd1ddc842fb7f3aa3
Opcode Fuzzy Hash: 0544f223892a03b3e8316c9f2e7ed17d105dab3fb6a45508149d466da7078fde
Instruction Fuzzy Hash: 30510432A88359CFEB70DF74C8807DABBB2EF99354F45046ED9889B110D770499ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 021774BD, Relevance: 1.6, APIs: 1, Instructions: 124memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(AD3E26F8), ref: 021776B9

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 846ddc5841f89dce1e6c792c1f48edb81598ad680940dbfe9d94789853c8bf5a
Instruction ID: f119d20ce832a3bf09e916ced3ea343387e9ead93678278caea63d1918b4ddd4
Opcode Fuzzy Hash: 846ddc5841f89dce1e6c792c1f48edb81598ad680940dbfe9d94789853c8bf5a
Instruction Fuzzy Hash: D241F632988359CFEB60DF64C8817DABBF2EF99354F450429DD885B220D770599ACB42

Uniqueness

Uniqueness Score: -1.00%

Function 0217BD78, Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 0217BF10

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: a8e37d7493368dcf90af83b7bf5d7434d1a0adb3e621c7c70b86fc38831d25d3
Instruction ID: 197d9f7907dcd122ccc9452c2722e518e5616e39e415c173415c6ca99d565258
Opcode Fuzzy Hash: a8e37d7493368dcf90af83b7bf5d7434d1a0adb3e621c7c70b86fc38831d25d3
Instruction Fuzzy Hash: 1A41BE356942588FEB35EF14CAE4BDA37B2EFC5718F614255E8085F210CB70AA99CB90

Uniqueness

Uniqueness Score: -1.00%

Function 021774BA, Relevance: 1.6, APIs: 1, Instructions: 102memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(AD3E26F8), ref: 021776B9

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: c6b49dfe8667ba48ab5b17cda7323a9f082627be8fef0ce73b767e12c1022659
Instruction ID: c83c978ccb611d6cf1df136082efcb7198e51bea45d9ec8ce80d2bf6b33054a8
Opcode Fuzzy Hash: c6b49dfe8667ba48ab5b17cda7323a9f082627be8fef0ce73b767e12c1022659
Instruction Fuzzy Hash: 9F41CF72544358CFEF749E74CC857EAB7A2AF58344F46042EDD899B214D7304A81CF42

Uniqueness

Uniqueness Score: -1.00%

Function 021775BF, Relevance: 1.6, APIs: 1, Instructions: 89memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(AD3E26F8), ref: 021776B9

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 85d6a0a7e9e835ce2b9ca975ef2c05a5216e628fb4b74cafabde712a07028e6c
Instruction ID: 897ed6b35b6ed4bf5484655165c0955045bd46f19e4bcf1740c42dd3ad274f60
Opcode Fuzzy Hash: 85d6a0a7e9e835ce2b9ca975ef2c05a5216e628fb4b74cafabde712a07028e6c
Instruction Fuzzy Hash: FA31D03668839CCFEF21DF24C8C4BCA7BB2EF8A314F850159E8484B260D770595ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 0217BE98, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 0217BF10

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 10a55b3c848ec4a97dd8d9be9745d1315bb465fa5d849bdc88d6572479fcfc55
Instruction ID: 4005afa654c776635da348976183ab233c473e41fd2ca38c9f0e9a4e0e60cb1a
Opcode Fuzzy Hash: 10a55b3c848ec4a97dd8d9be9745d1315bb465fa5d849bdc88d6572479fcfc55
Instruction Fuzzy Hash: 79118F35684259CFEB25EF14CAD47DA3773EFC6718F600155D8044F200CB709A99CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00413A60, Relevance: 112.5, APIs: 59, Strings: 5, Instructions: 479COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00411064,p.`), ref: 00413AF9
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413B18
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410E9C,000000F8), ref: 00413B3E
__vbaNew2.MSVBVM60(00411064,p.`), ref: 00413B57
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413B70
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410E9C,000001B4), ref: 00413C20
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413C30
#606.MSVBVM60(00000001,?), ref: 00413C4D
__vbaStrMove.MSVBVM60 ref: 00413C58
__vbaStrCmp.MSVBVM60(00410ED0,00000000), ref: 00413C6A
__vbaFreeStr.MSVBVM60 ref: 00413C79
__vbaFreeVar.MSVBVM60 ref: 00413C88
#706.MSVBVM60(00000001,00000000,00000000), ref: 00413C99
__vbaStrMove.MSVBVM60 ref: 00413CA4
__vbaNew2.MSVBVM60(00410E7C,00415590), ref: 00413CBD
__vbaHresultCheckObj.MSVBVM60(00000000,02A1004C,00410E6C,00000014), ref: 00413CE2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410E8C,00000070), ref: 00413D09
__vbaFreeObj.MSVBVM60 ref: 00413D12
#580.MSVBVM60(Stalakitter,00000001), ref: 00413D1F
#574.MSVBVM60(00000002), ref: 00413D37
__vbaStrMove.MSVBVM60 ref: 00413D42
__vbaStrCmp.MSVBVM60(00410EF4,00000000), ref: 00413D4E
__vbaFreeStr.MSVBVM60 ref: 00413D5D
__vbaFreeVar.MSVBVM60 ref: 00413D66
#594.MSVBVM60(00000002), ref: 00413D81
__vbaFreeVar.MSVBVM60 ref: 00413D8A
#648.MSVBVM60(00000002), ref: 00413D96
__vbaFreeVar.MSVBVM60 ref: 00413D9F
__vbaVarDup.MSVBVM60 ref: 00413DBB
#666.MSVBVM60(?,00000002), ref: 00413DC9
__vbaVarMove.MSVBVM60 ref: 00413DD5
__vbaFreeVar.MSVBVM60 ref: 00413DDE
__vbaNew2.MSVBVM60(00411064,p.`), ref: 00413E1A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413E33
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410E9C,000000F8), ref: 00413E5D
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410A8C,000006F8), ref: 00413E94
__vbaFreeObj.MSVBVM60 ref: 00413E9D
__vbaNew2.MSVBVM60(00411064,p.`), ref: 00413EB6
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413ECF
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410E9C,00000130), ref: 00413EF6
__vbaLateIdCallLd.MSVBVM60(00000002,?,00000000,00000000), ref: 00413F08
__vbaStrVarMove.MSVBVM60(00000000), ref: 00413F12
__vbaStrMove.MSVBVM60 ref: 00413F1D
__vbaFreeStr.MSVBVM60 ref: 00413F44
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413F54
__vbaFreeVar.MSVBVM60 ref: 00413F60
__vbaNew2.MSVBVM60(00411064,p.`), ref: 00413F75
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413F8E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410E9C,00000078), ref: 00413FB8
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410A8C,000006FC), ref: 00414009
__vbaFreeObj.MSVBVM60 ref: 0041400E
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410A5C,000002B4), ref: 0041402F
__vbaVarAdd.MSVBVM60(00000002,?,?), ref: 0041405D
__vbaVarMove.MSVBVM60 ref: 00414064
#598.MSVBVM60 ref: 0041406A
__vbaVarTstLt.MSVBVM60(00000002,?), ref: 00414088
__vbaFreeVar.MSVBVM60(004140F2), ref: 004140E1
__vbaFreeStr.MSVBVM60 ref: 004140E6
__vbaFreeVar.MSVBVM60 ref: 004140EF

Strings

p.`, xrefs: 00413AA2, 00413AEF, 00413AFF, 00413B44, 00413B4D, 00413B5D, 00413E07, 00413E10, 00413E20, 00413EA3, 00413EAC, 00413EBC, 00413F62, 00413F6B, 00413F7B
zk:K&6, xrefs: 00413F96, 00413F9C
, xrefs: 00413C3C
Mallorcinerens, xrefs: 00413DAA
Stalakitter, xrefs: 00413D1A

Memory Dump Source

Source File: 00000000.00000002.814928527.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.814922532.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.814952124.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.814960849.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$Move$New2$List$#574#580#594#598#606#648#666#706CallLate
String ID: $Mallorcinerens$Stalakitter$p.`$zk:K&6
API String ID: 1003127262-246707462
Opcode ID: b71ad9a302614693cc4143ca2f5d9b18a1bf1e3f416f9ce30331b280bb6b1dd3
Instruction ID: 31342ccf4fc34faa475af20bd56955d7a9fd4b189232353e9d129f41bf0d3271
Opcode Fuzzy Hash: b71ad9a302614693cc4143ca2f5d9b18a1bf1e3f416f9ce30331b280bb6b1dd3
Instruction Fuzzy Hash: A0124A70A003199FDB10DFA5DD88BDEBBB8FF48704F10816AE549A7260DB746A85CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004012B4, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6"*), ref: 004012B9

Strings

VB5!6"*, xrefs: 004012B4

Memory Dump Source

Source File: 00000000.00000002.814928527.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.814922532.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.814952124.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.814960849.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6"*
API String ID: 1341478452-2992194029
Opcode ID: 469c89939cef8e6f53890b4b3ea478becd9e523327737d55b27c121949767884
Instruction ID: 7629933c65c8ae616a90b809ea14ab6aa51becaf66a0b0dbd647d4db3bd46d68
Opcode Fuzzy Hash: 469c89939cef8e6f53890b4b3ea478becd9e523327737d55b27c121949767884
Instruction Fuzzy Hash: 61F06F6040E7C45FE70B9B7148225253FB09E8321030A84EBC482DF0F3C2A90C8DCBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0217A977, Relevance: 10.0, Strings: 7, Instructions: 1291COMMON

Download Yara Rule

Strings

J^/, xrefs: 02175620
z52?, xrefs: 021759CA
w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281
aXO/, xrefs: 021758D7
vKT, xrefs: 0217AF6E
B!Q, xrefs: 0217B35B

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$B!Q$J^/$aXO/$vKT$w5LV$z52?
API String ID: 0-2526314963
Opcode ID: cd8db03c05d73c6880d151fcdb704720f53bf44dc1c1dbb01299da234e2b95d1
Instruction ID: 3ef7ac088a6e172dbf6729948c0bceae7c3132d0bc44e3f5f627fb92d0f1a63d
Opcode Fuzzy Hash: cd8db03c05d73c6880d151fcdb704720f53bf44dc1c1dbb01299da234e2b95d1
Instruction Fuzzy Hash: 4EC212B16483898FDB74CF38CC847DABBF2AF95310F45816ADC898B255D3349A85CB52

Uniqueness

Uniqueness Score: -1.00%

Function 021779B4, Relevance: 9.7, Strings: 7, Instructions: 908COMMON

Download Yara Rule

Strings

+dB, xrefs: 02177E55
J^/, xrefs: 02175620
z52?, xrefs: 021759CA
w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281
aXO/, xrefs: 021758D7
b+vc, xrefs: 02177A6D

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +dB$<~1$J^/$aXO/$b+vc$w5LV$z52?
API String ID: 0-2108950591
Opcode ID: 4a910f6530bd3061d0efc229fb630e009f0e0ea6e1a590d9be163e8e87cd0080
Instruction ID: 2c938fc8f22f9c5bc0e3460ab79bc0e5d4ed2a16975494c0202b30efdb60bb55
Opcode Fuzzy Hash: 4a910f6530bd3061d0efc229fb630e009f0e0ea6e1a590d9be163e8e87cd0080
Instruction Fuzzy Hash: 3D82EDB16443899FDB789F28CD857EA7BB2FF98300F45452ADD899B210D7709A81CF42

Uniqueness

Uniqueness Score: -1.00%

Function 02176605, Relevance: 7.0, Strings: 5, Instructions: 779COMMON

Download Yara Rule

Strings

J^/, xrefs: 02175620
z52?, xrefs: 021759CA
w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281
aXO/, xrefs: 021758D7

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: <~1$J^/$aXO/$w5LV$z52?
API String ID: 2167126740-109696285
Opcode ID: 5f7535577ceabb014fe0f53319a9995526dc863b2842cd9f0c9553b216b79bd5
Instruction ID: 8f52f35ad4ae2d8249a0e95f401fab8b22ce4ee72bd73cc3931c865991317690
Opcode Fuzzy Hash: 5f7535577ceabb014fe0f53319a9995526dc863b2842cd9f0c9553b216b79bd5
Instruction Fuzzy Hash: 9172EDB16443899FDB789F38CD857DA7BB2FF98300F45812ADD899B210D3349A85CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0217540C, Relevance: 6.9, Strings: 5, Instructions: 673COMMON

Download Yara Rule

Strings

J^/, xrefs: 02175620
z52?, xrefs: 021759CA
w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281
aXO/, xrefs: 021758D7

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$J^/$aXO/$w5LV$z52?
API String ID: 0-109696285
Opcode ID: 63e9878648c5273385b78a4627606095cacfc2208ee3bad0a326eda8c46fee46
Instruction ID: 7305223ea98600988d27584e26e2c1e555d62b79298dba90e7f333db860fc791
Opcode Fuzzy Hash: 63e9878648c5273385b78a4627606095cacfc2208ee3bad0a326eda8c46fee46
Instruction Fuzzy Hash: 05521DB16443899FDB789F38CD847DABBB2FF94300F858229DC899B210D3745A95CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02175426, Relevance: 6.9, Strings: 5, Instructions: 642COMMON

Download Yara Rule

Strings

J^/, xrefs: 02175620
z52?, xrefs: 021759CA
w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281
aXO/, xrefs: 021758D7

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$J^/$aXO/$w5LV$z52?
API String ID: 0-109696285
Opcode ID: e553416850f02759b0cd9caa25923a764f62df1c0dc1ee4bf98dc79f8926b8aa
Instruction ID: 1159c0a74f2313feed7bb8beb7e962900befd590845b5e4d475ba976261cdd3d
Opcode Fuzzy Hash: e553416850f02759b0cd9caa25923a764f62df1c0dc1ee4bf98dc79f8926b8aa
Instruction Fuzzy Hash: 7A52DDB16443899FDB789F28CD857EABBB2FF94300F45812ADD899B210D3745A91CF42

Uniqueness

Uniqueness Score: -1.00%

Function 02175473, Relevance: 6.9, Strings: 5, Instructions: 626COMMON

Download Yara Rule

Strings

J^/, xrefs: 02175620
z52?, xrefs: 021759CA
w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281
aXO/, xrefs: 021758D7

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$J^/$aXO/$w5LV$z52?
API String ID: 0-109696285
Opcode ID: aca4774cfaefe8051a1c78b75050bee520e081fca1df22a0405b594b48a32d8a
Instruction ID: 5951fcc63fcd38554e0ea347cee4c8fd9febefdf55baa62192fa0b9254db28fb
Opcode Fuzzy Hash: aca4774cfaefe8051a1c78b75050bee520e081fca1df22a0405b594b48a32d8a
Instruction Fuzzy Hash: 29520DB16443899FDB789F28CD847DABBB2FF98300F45812ADC899B210D3745A95CF42

Uniqueness

Uniqueness Score: -1.00%

Function 02175587, Relevance: 6.8, Strings: 5, Instructions: 591COMMON

Download Yara Rule

Strings

J^/, xrefs: 02175620
z52?, xrefs: 021759CA
w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281
aXO/, xrefs: 021758D7

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$J^/$aXO/$w5LV$z52?
API String ID: 0-109696285
Opcode ID: c7e72cbff086813e634e69961711e5155005ade71bc015bb3c3d0e25a00d1bb2
Instruction ID: 6333b8558bf0a92065ffed474a7b84aed825c59ed60f5ccc0aa68a1e8f3044d1
Opcode Fuzzy Hash: c7e72cbff086813e634e69961711e5155005ade71bc015bb3c3d0e25a00d1bb2
Instruction Fuzzy Hash: 2C42DDB16443899FDB789F28CD857DABBB2FF98300F45812ADC899B210D3745A95CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0217564F, Relevance: 6.8, Strings: 5, Instructions: 568COMMON

Download Yara Rule

Strings

J^/, xrefs: 02175620
z52?, xrefs: 021759CA
w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281
aXO/, xrefs: 021758D7

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$J^/$aXO/$w5LV$z52?
API String ID: 0-109696285
Opcode ID: a686cbf36bda70d2832af882cf250e4bfb9b003b1619c2264e09a1ff40ae6ca9
Instruction ID: 02e6174928ef91592982e3f76f7b92fb6420578efb4695cb80468aca0d83ed73
Opcode Fuzzy Hash: a686cbf36bda70d2832af882cf250e4bfb9b003b1619c2264e09a1ff40ae6ca9
Instruction Fuzzy Hash: 9742DDB16443899FCB789F38CD457EABBB2FF98300F45812ADD899B210D3745A91CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0217566E, Relevance: 5.6, Strings: 4, Instructions: 563COMMON

Download Yara Rule

Strings

z52?, xrefs: 021759CA
w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281
aXO/, xrefs: 021758D7

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$aXO/$w5LV$z52?
API String ID: 0-3633356875
Opcode ID: b25981fb0ee5494753c830cb3d27c7c09665f3864000b0fb6b167ac88b40f575
Instruction ID: e00660dc3d414b2128dd2607cdcdba976ffd9c0fb4248714070e6df85e03bee6
Opcode Fuzzy Hash: b25981fb0ee5494753c830cb3d27c7c09665f3864000b0fb6b167ac88b40f575
Instruction Fuzzy Hash: E532DDB16443899FDB789F38CD857EABBB2FF94300F45812ADC899B214D3745A81CB46

Uniqueness

Uniqueness Score: -1.00%

Function 02175703, Relevance: 5.5, Strings: 4, Instructions: 548COMMON

Download Yara Rule

Strings

z52?, xrefs: 021759CA
w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281
aXO/, xrefs: 021758D7

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$aXO/$w5LV$z52?
API String ID: 0-3633356875
Opcode ID: 2eb97e46f97e77f0090510049401afa386b1a41627c2f4144cf004d8a67ffcbc
Instruction ID: cb5a114754b7313322e87d27993b41c08e746ab3bdd7096426b0c821666d6c31
Opcode Fuzzy Hash: 2eb97e46f97e77f0090510049401afa386b1a41627c2f4144cf004d8a67ffcbc
Instruction Fuzzy Hash: D832DDB16443899FDB78DF28CD857DA7BB2FF99300F85412ADC899B210D3705A95CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0217584A, Relevance: 5.5, Strings: 4, Instructions: 483COMMON

Download Yara Rule

Strings

z52?, xrefs: 021759CA
w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281
aXO/, xrefs: 021758D7

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$aXO/$w5LV$z52?
API String ID: 0-3633356875
Opcode ID: 61bc34cdd45a2453769d529f135813dfe9b605051e11af2e044c5b07f34688b4
Instruction ID: 863ca8786f3c0eabe511cb2779629ca4fbb5f0199e8d2d93023d6e22a0866e6e
Opcode Fuzzy Hash: 61bc34cdd45a2453769d529f135813dfe9b605051e11af2e044c5b07f34688b4
Instruction Fuzzy Hash: 9522FEB26443899FDB78DF28CD857DA7BB2FF98300F45412ADC899B210D3745A95CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0217594C, Relevance: 4.2, Strings: 3, Instructions: 445COMMON

Download Yara Rule

Strings

z52?, xrefs: 021759CA
w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$w5LV$z52?
API String ID: 0-1940608587
Opcode ID: 1b2786a3293da142f56c60a770430937fe13cdb8b01b3f5bd9def7a0f949da22
Instruction ID: 91949b4aff6bd91de412d9834f8fbc6e4b5863dca6d89b1be20d92ff28eea80d
Opcode Fuzzy Hash: 1b2786a3293da142f56c60a770430937fe13cdb8b01b3f5bd9def7a0f949da22
Instruction Fuzzy Hash: 9B12EDB26443899FDB78DF28CD947DA7BB2FF99300F45412ADC899B214D3705A85CB81

Uniqueness

Uniqueness Score: -1.00%

Function 021718EB, Relevance: 3.9, Strings: 3, Instructions: 169COMMON

Download Yara Rule

Strings

=w", xrefs: 02171E92
$Kj*, xrefs: 02171E84
dbY, xrefs: 02171989

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: dbY$$Kj*$=w"
API String ID: 0-3442407021
Opcode ID: 20ef6e903c0448cf28a2d0156a25b842970a5c22cd41c7c209b50ea04293aa59
Instruction ID: 728b0d7031aaed16e80782d0b34fd37abc1ca9ab8f74a949fdba0c914cdfa4ee
Opcode Fuzzy Hash: 20ef6e903c0448cf28a2d0156a25b842970a5c22cd41c7c209b50ea04293aa59
Instruction Fuzzy Hash: BD51BC769886889FDB24CF24CC943C53BB2EFC2310F35468AD9984BE61D7700927CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02175AEB, Relevance: 2.9, Strings: 2, Instructions: 421COMMON

Download Yara Rule

Strings

w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$w5LV
API String ID: 0-2355741680
Opcode ID: 0edbde768d096631300a37876a76052af301a15052e18c3074392f71ccdc235c
Instruction ID: 93f8fdebb5ca6fa2c43930f06832ee76b52d1b1e578e7d39b60e4ae014bcecde
Opcode Fuzzy Hash: 0edbde768d096631300a37876a76052af301a15052e18c3074392f71ccdc235c
Instruction Fuzzy Hash: E202EEB26842899FDB78DF28CD957DA3BB2FF99300F85412ADD899B210D3705A85CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02175B13, Relevance: 2.9, Strings: 2, Instructions: 413COMMON

Download Yara Rule

Strings

w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$w5LV
API String ID: 0-2355741680
Opcode ID: 990042d0acc76addf8ff17aaa3c3e541fc42a1e912671871f35e8b6b9f1bda7b
Instruction ID: eb77f642c5726598377d8c9213531fbbad5c86d8c5f63dcf6d5623029c3ef874
Opcode Fuzzy Hash: 990042d0acc76addf8ff17aaa3c3e541fc42a1e912671871f35e8b6b9f1bda7b
Instruction Fuzzy Hash: 8302FDB16442899FCB789F28CD947EE7BB2FF98300F45412ADD8D9B210D3705A85CB85

Uniqueness

Uniqueness Score: -1.00%

Function 02175B36, Relevance: 2.9, Strings: 2, Instructions: 370COMMON

Download Yara Rule

Strings

w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$w5LV
API String ID: 0-2355741680
Opcode ID: cd6f48d9bfcefc3fab30d995dc0359c64fb3584374ee9d2a658adf7bc48fe8e5
Instruction ID: 43e044ffb6c6d1765fa92ee94ca704cba6c60d6e32e765b4c8e66ec02ef6ff35
Opcode Fuzzy Hash: cd6f48d9bfcefc3fab30d995dc0359c64fb3584374ee9d2a658adf7bc48fe8e5
Instruction Fuzzy Hash: 1EF1EBB26442889FCB789F28CD947EE7BB6FF98300F45412AED8D9B210D3744A81CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02175BF0, Relevance: 2.9, Strings: 2, Instructions: 363COMMON

Download Yara Rule

Strings

w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$w5LV
API String ID: 0-2355741680
Opcode ID: ea939104fd6322f130154adcefff672b8c2038fe51cad89d81634ab84e636250
Instruction ID: 4699465d0516ac3eac151d77a7401acb742ee9a6a7ee3cb280b44d5a67c0d7d1
Opcode Fuzzy Hash: ea939104fd6322f130154adcefff672b8c2038fe51cad89d81634ab84e636250
Instruction Fuzzy Hash: A4F1DDB26843889FDB78DF28CD947DA3BB6FF99300F45412ADD899B210D3705A85CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02175D17, Relevance: 2.8, Strings: 2, Instructions: 315COMMON

Download Yara Rule

Strings

w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$w5LV
API String ID: 0-2355741680
Opcode ID: 8b067705e56d73d8a2737e3ae127e797346ed0553ad5bc5fa324a34f89e141de
Instruction ID: a5676b284184d6a4e3ecee85d65ced6cff40025ec8f5506859b10e9b6e816a79
Opcode Fuzzy Hash: 8b067705e56d73d8a2737e3ae127e797346ed0553ad5bc5fa324a34f89e141de
Instruction Fuzzy Hash: D7D1CAB26842889FDB78DF28CD887DA3BB6FF99300F45412ADD8D9B214D3705A85CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02175E47, Relevance: 2.8, Strings: 2, Instructions: 261COMMON

Download Yara Rule

Strings

w5LV, xrefs: 02175E8F
<~1, xrefs: 02176281

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1$w5LV
API String ID: 0-2355741680
Opcode ID: a4c6bf2b1ece740fce0465d077a248f77b1ac35dba115c894dfafd9ed038a841
Instruction ID: 40f330aacd7d03053b343f80292f03e1930103fbc2ab8ee5dee8da61fe7125ea
Opcode Fuzzy Hash: a4c6bf2b1ece740fce0465d077a248f77b1ac35dba115c894dfafd9ed038a841
Instruction Fuzzy Hash: 6FC1DBB2A842889FDB74DF28CD847DE7BB6FFA9300F55412ADD899B210D3705A85CB41

Uniqueness

Uniqueness Score: -1.00%

Function 021779F7, Relevance: 2.7, Strings: 2, Instructions: 242COMMON

Download Yara Rule

Strings

+dB, xrefs: 02177E55
b+vc, xrefs: 02177A6D

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +dB$b+vc
API String ID: 0-2996551607
Opcode ID: 0ec2f9e8cdc69d6e8f6b152c9dbe6c46c376537da5119b8eef1c50abeeb2179c
Instruction ID: 36f95b4da3549cc51f7f1c53ac9794ecc2376402ad558861a3587f31b31870c3
Opcode Fuzzy Hash: 0ec2f9e8cdc69d6e8f6b152c9dbe6c46c376537da5119b8eef1c50abeeb2179c
Instruction Fuzzy Hash: 79A1BFB6684389CFEB348F28DD547EA77B6EF99300F95052ADC4D9B240E7309A46CB11

Uniqueness

Uniqueness Score: -1.00%

Function 0217A788, Relevance: 2.7, Strings: 2, Instructions: 161COMMON

Download Yara Rule

Strings

Mz) , xrefs: 0217A89D
Mz) , xrefs: 0217A898

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Mz) $Mz)
API String ID: 0-3535560542
Opcode ID: 1a6e6c03801eba1f08e09b432d79b88c15cf4dac471120c6c9638dc335164f76
Instruction ID: 3b5c21ef1ba75d8be7c8e68391856688234dd4db4fde8c5e66333f8f30011594
Opcode Fuzzy Hash: 1a6e6c03801eba1f08e09b432d79b88c15cf4dac471120c6c9638dc335164f76
Instruction Fuzzy Hash: 6D51577558938ACFCB35DF28C8E07EA77B1EF9A300F1545AAC94A8B702D730995AC741

Uniqueness

Uniqueness Score: -1.00%

Function 0217AA3B, Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

vKT, xrefs: 0217AF6E

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: vKT
API String ID: 0-3033817737
Opcode ID: 716e2e13945a09381298616281cd7d39fc0d01fba148c63e8c65f9ba687edf09
Instruction ID: de6dea32e5b02151dc10d130bf134c5f8d058779ad640370e2ed78975e6d06d1
Opcode Fuzzy Hash: 716e2e13945a09381298616281cd7d39fc0d01fba148c63e8c65f9ba687edf09
Instruction Fuzzy Hash: BAC1E6715483C48EDB36CF38CC9879A7AE25F96320F1AC29AC89D8F2E6D3758545C712

Uniqueness

Uniqueness Score: -1.00%

Function 02179E11, Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

pF~x, xrefs: 0217A211

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: pF~x
API String ID: 0-3507364740
Opcode ID: c6d6187f858142e3e8471623ff4aea6260eb1d5e190e83f84805b12b086cc282
Instruction ID: aeed5064193d61cba294300cbe0c3a97960e17d97dc2e2d343527727e9aeaff3
Opcode Fuzzy Hash: c6d6187f858142e3e8471623ff4aea6260eb1d5e190e83f84805b12b086cc282
Instruction Fuzzy Hash: 8DA1C172948399DFDB74CE28C9993EE77B2AF98340F52402EDC49AB640D7305A85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0217AAC7, Relevance: 1.5, Strings: 1, Instructions: 254COMMON

Download Yara Rule

Strings

vKT, xrefs: 0217AF6E

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: vKT
API String ID: 0-3033817737
Opcode ID: fea3dcfa9b6cfec659944e7e3c0045d1e0c3b7f9e25931e1027b6367913aac81
Instruction ID: faa64e2efe38b9178470b3f435c6ead4851f1679b3493318e9be29fc74b11934
Opcode Fuzzy Hash: fea3dcfa9b6cfec659944e7e3c0045d1e0c3b7f9e25931e1027b6367913aac81
Instruction Fuzzy Hash: C1B1E5725883C88FEB31CF38C9887DA7BE2AF96310F19C19AC8984F296D3749549C711

Uniqueness

Uniqueness Score: -1.00%

Function 0217800C, Relevance: 1.5, Strings: 1, Instructions: 229COMMON

Download Yara Rule

Strings

+dB, xrefs: 02177E55

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +dB
API String ID: 0-2121605343
Opcode ID: 5940b081c5ab9cf699b3d11e2f28b1257e1c04691da4b15b095ba6a41e4e3bf7
Instruction ID: fa4babeafc587c926887a52b28b96246b4820b04bc56cccdbd4c33008212d082
Opcode Fuzzy Hash: 5940b081c5ab9cf699b3d11e2f28b1257e1c04691da4b15b095ba6a41e4e3bf7
Instruction Fuzzy Hash: 92A1D0B6684389CFEB348F28DE55BEA77B6EF99300F45051ADC5D9B240E7308A46CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02175F40, Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

<~1, xrefs: 02176281

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1
API String ID: 0-3090959812
Opcode ID: b011ae089dabbf803e13e46ccfc4188ceaa89406ae6cd542caeb5734101eb1ed
Instruction ID: fccfe4affc1a9acc7fd4777280b34d7988e97d6d2ba4436ab876933c8f9c4335
Opcode Fuzzy Hash: b011ae089dabbf803e13e46ccfc4188ceaa89406ae6cd542caeb5734101eb1ed
Instruction Fuzzy Hash: 7BA1BBB1A842989FDB74DF28CD947DA3BB6FF99300F85412ADD8D9B210D3705A95CB40

Uniqueness

Uniqueness Score: -1.00%

Function 02177BAE, Relevance: 1.5, Strings: 1, Instructions: 225COMMON

Download Yara Rule

Strings

+dB, xrefs: 02177E55

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +dB
API String ID: 0-2121605343
Opcode ID: bc8680567f666269699e9e98b33ff9138749d2a77a56fd090fce18996fdbd70b
Instruction ID: a5f0937bf31e881fd2f162e146c4669ad02f72e6414ab947fa1362f7add3968c
Opcode Fuzzy Hash: bc8680567f666269699e9e98b33ff9138749d2a77a56fd090fce18996fdbd70b
Instruction Fuzzy Hash: 0291477258838ACFEB34CF24DE907EA77B2EF55300F85052ADD899B281E7314A46CB11

Uniqueness

Uniqueness Score: -1.00%

Function 0217ABA7, Relevance: 1.5, Strings: 1, Instructions: 219COMMON

Download Yara Rule

Strings

vKT, xrefs: 0217AF6E

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: vKT
API String ID: 0-3033817737
Opcode ID: 94701cc1265b4db8d21850a9a3cae1a413893db2b5d64ed826abd25ef4ad76f4
Instruction ID: d442293dbb6a88ee760078103878ce26eb041c88d07b56fed6fe068caeb5ad64
Opcode Fuzzy Hash: 94701cc1265b4db8d21850a9a3cae1a413893db2b5d64ed826abd25ef4ad76f4
Instruction Fuzzy Hash: A891F4729882888FEF31CF38C9847DE7BF2AF96310F59815AC8498F249D7355549CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02177B25, Relevance: 1.4, Strings: 1, Instructions: 194COMMON

Download Yara Rule

Strings

+dB, xrefs: 02177E55

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +dB
API String ID: 0-2121605343
Opcode ID: eaab57d6c61614c7aeb982558f455cd9386d23a379b33b5d8778c21fda543c31
Instruction ID: a9bee9a3402a38b028f674e48559d61789dd4472bf9e0422f2715f1601c61901
Opcode Fuzzy Hash: eaab57d6c61614c7aeb982558f455cd9386d23a379b33b5d8778c21fda543c31
Instruction Fuzzy Hash: D381D27658438ACFEF348F24DE95BEA77B2EF99304F45011ADC499B281E7305A46CB11

Uniqueness

Uniqueness Score: -1.00%

Function 021760A5, Relevance: 1.4, Strings: 1, Instructions: 189COMMON

Download Yara Rule

Strings

<~1, xrefs: 02176281

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1
API String ID: 0-3090959812
Opcode ID: f1a01008ded8841ce6e7f18232810723c2ab4a4f339065e80401b18a4d5b1abf
Instruction ID: 9f609ffeb394a1e2cddb30a45fdfa8c619ace3c90d66d543dda19cdb634d3e53
Opcode Fuzzy Hash: f1a01008ded8841ce6e7f18232810723c2ab4a4f339065e80401b18a4d5b1abf
Instruction Fuzzy Hash: 6981DCB16846899FDB74DF28CD847DE3BB6FFA9300F45412ADD899B210C3711A95CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0217604F, Relevance: 1.4, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

<~1, xrefs: 02176281

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1
API String ID: 0-3090959812
Opcode ID: b1d1caae3831d8a4692907b31a77ab6b631bdd9c6113785bc9ffd29edb15a113
Instruction ID: 59e1c2282b2c106217694b39bc5b90401b8526a3972d9a46b7a0dd016cd058ca
Opcode Fuzzy Hash: b1d1caae3831d8a4692907b31a77ab6b631bdd9c6113785bc9ffd29edb15a113
Instruction Fuzzy Hash: F381CCB16846999FDB74DF24CD947DE3BB6FFA9300F454129ED899B210C3701A95CB80

Uniqueness

Uniqueness Score: -1.00%

Function 021760B7, Relevance: 1.4, Strings: 1, Instructions: 182COMMON

Download Yara Rule

Strings

<~1, xrefs: 02176281

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: <~1
API String ID: 0-3090959812
Opcode ID: 8b21d0e6a3fbd49c85617d1b186621160f08cca1dbc45709bd789c561484d51e
Instruction ID: 12279024d2061fd6de2ed110b772e53591409949fb9119fbf1a97795a99c1386
Opcode Fuzzy Hash: 8b21d0e6a3fbd49c85617d1b186621160f08cca1dbc45709bd789c561484d51e
Instruction Fuzzy Hash: 7F81ECB16846889FCB74DF28CD847DE3BB6FFA9300F45412ADE899B210C3711A95CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0217ACDB, Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

vKT, xrefs: 0217AF6E

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: vKT
API String ID: 0-3033817737
Opcode ID: afba4a58547154599ebc308e1b1fae47922a0432486966ab5705509adf6a12f9
Instruction ID: a6e75895bb415b1449957f288879f293fd986150c1e7b8348ab7e063ae7af5be
Opcode Fuzzy Hash: afba4a58547154599ebc308e1b1fae47922a0432486966ab5705509adf6a12f9
Instruction Fuzzy Hash: CF51E2729882888FDF35DF38C9847DABBF2AF96310F56C16AC8488F249D3314549CB11

Uniqueness

Uniqueness Score: -1.00%

Function 02177C8D, Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

+dB, xrefs: 02177E55

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: +dB
API String ID: 0-2121605343
Opcode ID: d5975e45ce20a32a1cb7be321b599a1624d5ecd81398ea0359515c69319579f7
Instruction ID: 8798100356975d9107465354b69acd7a6973983526c16d1147a79e92733f4d25
Opcode Fuzzy Hash: d5975e45ce20a32a1cb7be321b599a1624d5ecd81398ea0359515c69319579f7
Instruction Fuzzy Hash: E951C07569438ECFEB349F24DE55BEA77B2EF99700F410129EC499B241E7305A46CB10

Uniqueness

Uniqueness Score: -1.00%

Function 0217AD3D, Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

vKT, xrefs: 0217AF6E

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: vKT
API String ID: 0-3033817737
Opcode ID: 7c9ca27cc9eaf3179a802804c4fa881262fa75f42d3fb2689d29eb17c5441aac
Instruction ID: 8dd65c19a4bae4b817afd8fb404c2cfa088656c7eb9e730809fbae4b08fe2368
Opcode Fuzzy Hash: 7c9ca27cc9eaf3179a802804c4fa881262fa75f42d3fb2689d29eb17c5441aac
Instruction Fuzzy Hash: D8519172A482848EDF75CE38CD847DABAE2AF96350F55C16AC84C8F649D3354545CB22

Uniqueness

Uniqueness Score: -1.00%

Function 0217BF53, Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

,i, xrefs: 0217BFEC

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: ,i
API String ID: 0-1283891373
Opcode ID: 26d29581997dbd4dbaf3162bc5984e6276169dc730ae78b333e5c8d7949415db
Instruction ID: 0c0bc84afba6e6a15ba958d345ec95cf83e4e2b60a9deae53832de49007b67ed
Opcode Fuzzy Hash: 26d29581997dbd4dbaf3162bc5984e6276169dc730ae78b333e5c8d7949415db
Instruction Fuzzy Hash: 184156358883C98FD736DF38C8A13EA3BB0EF5A300F55459ACC598B212E731468AC741

Uniqueness

Uniqueness Score: -1.00%

Function 0217ADCB, Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

vKT, xrefs: 0217AF6E

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID: vKT
API String ID: 0-3033817737
Opcode ID: 573a977890a3180e0e10314a653293608ef4f880344f64f85a4443b0d11c6808
Instruction ID: 6cb56294f2f8f75d382d5cf2c3fb4558a9036ce182538e75636af15a23fc947d
Opcode Fuzzy Hash: 573a977890a3180e0e10314a653293608ef4f880344f64f85a4443b0d11c6808
Instruction Fuzzy Hash: 5641E172A882888FDF35DE38C9947DB7BF2AF9A310F56815AC84C8F609E7714549CB11

Uniqueness

Uniqueness Score: -1.00%

Function 021750D8, Relevance: .2, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbb95fcd9dd6aabe2f614f9522737c53c7c9388a08fc70b27e6501306c84119b
Instruction ID: 36948a43b4ffd9a3a868439b38297451f5dc1369d5d1f022ea615028d17d4498
Opcode Fuzzy Hash: bbb95fcd9dd6aabe2f614f9522737c53c7c9388a08fc70b27e6501306c84119b
Instruction Fuzzy Hash: 428110B2684388EFDB74CE2988E07DB77B2AF99304F95492ACD4D8B611D331A945CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02170D15, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c3a497e1aa5b33f3b8d7d1fc875106fc8d09294597858a326de12acbe936f85
Instruction ID: a58df3499072c5193a93ea77147aebf8b071f44e625cd58aa19cd3d4c05154b2
Opcode Fuzzy Hash: 2c3a497e1aa5b33f3b8d7d1fc875106fc8d09294597858a326de12acbe936f85
Instruction Fuzzy Hash: 6B51AD3294C7809FC725CF3488A56D6BFB0BF8A300F29099EC99A8FA57D7311586CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00401432, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.814928527.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.814922532.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.814952124.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.814960849.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58187ee0e133b0b48bb3efed7ac890b15464e5e05c24970065dea5c804966976
Instruction ID: d394a65342a6a254380257ba0734a19f866dc21ad068f5b1ddaac111a7468d93
Opcode Fuzzy Hash: 58187ee0e133b0b48bb3efed7ac890b15464e5e05c24970065dea5c804966976
Instruction Fuzzy Hash: F641279025E2D4EFC71B47B64CBA2813FE1AE07108B1A88EFD6D54B8A3E555241FC727

Uniqueness

Uniqueness Score: -1.00%

Function 0217A00F, Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ace6b40f5eefa085a6d28801e90b2d13af75c9ae90009ca4d64d5b005bb043c
Instruction ID: 8936442f534079422488dc4546f72cdad1f7fc2a45267df4e9dc1fe152e85f9c
Opcode Fuzzy Hash: 7ace6b40f5eefa085a6d28801e90b2d13af75c9ae90009ca4d64d5b005bb043c
Instruction Fuzzy Hash: 4551F176A843A9DFEB70DF24C9597DA77B2BF89340F424519DC48AB200D3306A99CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02179E4C, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11ebc27cd87b07aa921c5aa0e1208111564d71323c4d8374c166418f6c453c7d
Instruction ID: c787261224322869ac662713f541e2bc99dfa60ddbce474f17acbd696bb79956
Opcode Fuzzy Hash: 11ebc27cd87b07aa921c5aa0e1208111564d71323c4d8374c166418f6c453c7d
Instruction Fuzzy Hash: DE5123769843A9DFEB70DF24C9493DE77B2BF85340F56411ADC48AB200D7306A99CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02179F0C, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea4ec296db90b6a087bd84d3ebd27fa170759d02938f62fdaa5f7982980d03be
Instruction ID: 24873e927b3786da520f67cc3c983aad48bb215ea0cb1f67198316d5f31c0937
Opcode Fuzzy Hash: ea4ec296db90b6a087bd84d3ebd27fa170759d02938f62fdaa5f7982980d03be
Instruction Fuzzy Hash: DF5103769943A9DFEB70DF24C9593DA7BF2BF85340F46401ADC48AB200D3306A99CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02170000, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08e2205e7892f1585d08cea9d4449bdb1739bd282ec30371a9162c973a9b1a74
Instruction ID: 1e1502eb70e610cebba3eff957a7186e8f865ed4a3f8e3edd1de5bb1dd19e99d
Opcode Fuzzy Hash: 08e2205e7892f1585d08cea9d4449bdb1739bd282ec30371a9162c973a9b1a74
Instruction Fuzzy Hash: 8B514670945388DFCB36DF2888A17DA3BB0EF8E200F51459EDD59CB616E730994ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 02175083, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137835b2468a97757282e90c393be85f740d0c8d642c8f19b9fba358796e10e9
Instruction ID: 54594358eab4509f77ef598a2322778a9d4c6854c75a773164ad084bf19fade4
Opcode Fuzzy Hash: 137835b2468a97757282e90c393be85f740d0c8d642c8f19b9fba358796e10e9
Instruction Fuzzy Hash: BF51BBB2684348EFEB30CF29C9D47CA77F7AB99708F95062AC8498F610C371A955CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02170CEB, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc5d44aaf197f3e4ccc2ed3a3fc1c21ccf7ac73e19ff172f45f07101dbd7bc68
Instruction ID: a04a7da4fa68441188230049210b440a59c38d2b9201e9d27817fb09ab44b683
Opcode Fuzzy Hash: fc5d44aaf197f3e4ccc2ed3a3fc1c21ccf7ac73e19ff172f45f07101dbd7bc68
Instruction Fuzzy Hash: 8B41AB32C48384AFC3198F348C25596BFB0FF86300F2A094ECA968BE66D7300985CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0217B137, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca6d2da2ec3199d80b8706c452b8f618caf0b5a24e4f7508ef8244dfcae90184
Instruction ID: 31954da3e57e549e21e9a3fdf924d95afa8873630e76eab32d0b1ba23dde43b4
Opcode Fuzzy Hash: ca6d2da2ec3199d80b8706c452b8f618caf0b5a24e4f7508ef8244dfcae90184
Instruction Fuzzy Hash: 8D41F279A9C38DCBEB20DF20C9C93CA7BB2AFE6318F45826AD4458F444D370665AC711

Uniqueness

Uniqueness Score: -1.00%

Function 02174F14, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b83cb8bba90b362d8d9bc4f4dceacfb370fdd4a71090ee3750ed86709b2d8af
Instruction ID: d0f0137c8080057a6fef4c6a7df4b12f3c2c193710b48f7ca8766e18dcea43d6
Opcode Fuzzy Hash: 2b83cb8bba90b362d8d9bc4f4dceacfb370fdd4a71090ee3750ed86709b2d8af
Instruction Fuzzy Hash: 8031B4212487818BDB71CEBCC9C4BC67B91AF46224F4883ACCC998B2EBE7358146C741

Uniqueness

Uniqueness Score: -1.00%

Function 0040166E, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.814928527.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.814922532.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.814952124.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.814960849.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e24cef5b52d058c6559a4647f5f96652dbae51e6763f7f5d8b23a4fe3d590a8
Instruction ID: 0ef76ab4ed2bcdf07a831812e9108315abc5032b0251afc9fc56c28be75d868b
Opcode Fuzzy Hash: 9e24cef5b52d058c6559a4647f5f96652dbae51e6763f7f5d8b23a4fe3d590a8
Instruction Fuzzy Hash: 5E11DAB150E3E59FCB174B748CB52527FB0AF1B20070A44EBD4819F8A7E268281ED727

Uniqueness

Uniqueness Score: -1.00%

Function 021772D9, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d94f26e1d8b88e9647323a7ef63529170ea25f1b3e6dfb927107597edc2fd34
Instruction ID: bc668fb1fd4befe0c1c8be2f2d70799f47259db78f424f4879ba7887b9988135
Opcode Fuzzy Hash: 5d94f26e1d8b88e9647323a7ef63529170ea25f1b3e6dfb927107597edc2fd34
Instruction Fuzzy Hash: F111B272948365CFDB646E348E06BAAB6F0EF54760F46080D9CC993250D7795982CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02179CD8, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6da7720f1efb195ca265b1caa66d49703974d9228b2e2ba6075af1310660b5f6
Instruction ID: bccf4fd8dc1c6e6c02795f23db5cf07e5fb64de1b536f23bdda87769e95cdf10
Opcode Fuzzy Hash: 6da7720f1efb195ca265b1caa66d49703974d9228b2e2ba6075af1310660b5f6
Instruction Fuzzy Hash: B6011A717006469FCB28DF08CAE5AEA73B2BB98700F518069E91E8F315D731AE44CB20

Uniqueness

Uniqueness Score: -1.00%

Function 00401621, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.814928527.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.814922532.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.814952124.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.814960849.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction ID: 3a4f40afd7daac755765d0dbc513794409bb1d663c47dbf88c845af7c1cdfe86
Opcode Fuzzy Hash: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction Fuzzy Hash: CBF07A70124154EFCB06CF74D8A5A063BE1AF5B3407451CDAD9108F475D736B865EB12

Uniqueness

Uniqueness Score: -1.00%

Function 02176E2A, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5aa179696c6b170f9013c23c73a1393648cbbf3aa7b89c2965e9ec752d48cb3f
Instruction ID: 03ec67edf93b3ef23ff7332ac4584d19450efdfcaa35046cac6bcbe38ffb2117
Opcode Fuzzy Hash: 5aa179696c6b170f9013c23c73a1393648cbbf3aa7b89c2965e9ec752d48cb3f
Instruction Fuzzy Hash: F5C02B418304F80C17F5A030FA0411B4A135BC0920F318A50350DF500EFC44CF4204B1

Uniqueness

Uniqueness Score: -1.00%

Function 02176C45, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94823fc894e2417ad4b87964cf9fc2db40589e4138777819fc7661fb730c9516
Instruction ID: 129ffca72def6c5bef52aca11ae22c686bed1b435740807f8dd95c69a52b4ef3
Opcode Fuzzy Hash: 94823fc894e2417ad4b87964cf9fc2db40589e4138777819fc7661fb730c9516
Instruction Fuzzy Hash: CFB092F62026818FFB81DF08C481B4073B0FB10A88B0804A0E402CB716C224E900CA10

Uniqueness

Uniqueness Score: -1.00%

Function 021797C9, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.815267418.0000000002170000.00000040.00000001.sdmp, Offset: 02170000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10

Uniqueness

Uniqueness Score: -1.00%

Function 004135F0, Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 282COMMON

Download Yara Rule

APIs

#685.MSVBVM60 ref: 00413642
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413653
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EAC,0000001C), ref: 00413670
__vbaFreeObj.MSVBVM60 ref: 00413688
__vbaNew2.MSVBVM60(00410E7C,00415590), ref: 004136A9
__vbaHresultCheckObj.MSVBVM60(00000000,02A1004C,00410E6C,00000014), ref: 004136CE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410E8C,000000D0), ref: 004136F8
__vbaStrMove.MSVBVM60 ref: 0041370D
__vbaFreeObj.MSVBVM60 ref: 00413712
#539.MSVBVM60(?,00000001,00000001,00000001), ref: 00413722
__vbaStrVarMove.MSVBVM60(?), ref: 0041372C
__vbaStrMove.MSVBVM60 ref: 00413737
__vbaFreeVar.MSVBVM60 ref: 0041373C
#568.MSVBVM60(00000063), ref: 00413744
__vbaNew2.MSVBVM60(00411064,p.`), ref: 0041375D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413776
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410EBC,00000178), ref: 004137F7
__vbaFreeObj.MSVBVM60 ref: 00413800
__vbaNew2.MSVBVM60(00411064,p.`), ref: 00413819
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413838
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410E9C,000000F8), ref: 0041385B
__vbaNew2.MSVBVM60(00411064,p.`), ref: 00413874
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041388D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410E9C,000001B4), ref: 00413928
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413938
__vbaFreeStr.MSVBVM60(00413980), ref: 00413978
__vbaFreeStr.MSVBVM60 ref: 0041397D

Strings

p.`, xrefs: 0041374A, 00413753, 00413763, 00413806, 0041380F, 0041381F, 00413861, 0041386A, 0041387A

Memory Dump Source

Source File: 00000000.00000002.814928527.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.814922532.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.814952124.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.814960849.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$Move$#539#568#685List
String ID: p.`
API String ID: 342513763-3976583478
Opcode ID: c6bd7f9af8cefabff7c6e676470fd1cf09c494c93342f1c142e42c4f567a57c1
Instruction ID: f792b7ebcbcb625830671be0bc27f21cc3ec9c69a30b265348179efaeecac593
Opcode Fuzzy Hash: c6bd7f9af8cefabff7c6e676470fd1cf09c494c93342f1c142e42c4f567a57c1
Instruction Fuzzy Hash: C6B14C74A00304EFCB14DFA9C988ADABBF9FF48700F14856AE509E72A1D7749981CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00413280, Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00411064,p.`), ref: 004132D3
__vbaObjSet.MSVBVM60(?,00000000), ref: 004132F2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410E9C,000001B0), ref: 00413331
__vbaFreeObj.MSVBVM60 ref: 0041333A
__vbaNew2.MSVBVM60(00411064,p.`), ref: 00413353
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041336C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410E9C,00000098), ref: 0041338F
__vbaNew2.MSVBVM60(00411064,p.`), ref: 004133A8
__vbaObjSet.MSVBVM60(?,00000000), ref: 004133C1
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410E9C,000001B4), ref: 00413450
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413460
__vbaNew2.MSVBVM60(00411064,p.`), ref: 0041347C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413495
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410E9C,000001A8), ref: 004134B8
__vbaFreeObj.MSVBVM60 ref: 004134C1

Strings

p.`, xrefs: 004132B7, 004132C9, 004132D9, 00413340, 00413349, 00413359, 00413395, 0041339E, 004133AE, 00413466, 00413472, 00413482

Memory Dump Source

Source File: 00000000.00000002.814928527.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.814922532.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.814952124.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.814960849.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresultNew2$Free$List
String ID: p.`
API String ID: 191279167-3976583478
Opcode ID: af9ef84a80d228475bad546c46447d4b0ec826e344e8ce2f01407274b1e61a57
Instruction ID: e2bf45a01232e38564c91f4aa144bbf560ca6d733d5f6e29a6809b8b24295894
Opcode Fuzzy Hash: af9ef84a80d228475bad546c46447d4b0ec826e344e8ce2f01407274b1e61a57
Instruction Fuzzy Hash: 3F711C74A10304DFCB10EFA9C989ADABBF8FF4C701B10856AE949E7361D7749841CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00413060, Relevance: 22.7, APIs: 15, Instructions: 154COMMON

Download Yara Rule

APIs

#714.MSVBVM60(?,?,00000000), ref: 004130B8
__vbaVarTstNe.MSVBVM60(?,?), ref: 004130D4
__vbaFreeVarList.MSVBVM60(00000002,00000005,?), ref: 004130E7
__vbaNew2.MSVBVM60(00410E7C,00415590), ref: 0041310B
__vbaHresultCheckObj.MSVBVM60(00000000,02A1004C,00410E6C,00000014), ref: 00413136
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410E8C,000000C0), ref: 00413164
__vbaFreeObj.MSVBVM60 ref: 0041316F
__vbaNew2.MSVBVM60(00410E7C,00415590), ref: 00413184
__vbaHresultCheckObj.MSVBVM60(00000000,02A1004C,00410E6C,00000014), ref: 004131A9
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410E8C,000000B8), ref: 004131CF
__vbaFreeObj.MSVBVM60 ref: 004131D4
__vbaNew2.MSVBVM60(00410E7C,00415590), ref: 004131E9
__vbaObjSetAddref.MSVBVM60(?,?), ref: 004131FF
__vbaHresultCheckObj.MSVBVM60(00000000,02A1004C,00410E6C,00000010), ref: 00413219
__vbaFreeObj.MSVBVM60 ref: 0041321E

Memory Dump Source

Source File: 00000000.00000002.814928527.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.814922532.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.814952124.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.814960849.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$New2$#714AddrefList
String ID:
API String ID: 169271594-0
Opcode ID: 2771ed1edade32e75d1b6bd7256fbca93c97bb7e79d66e3ad3fe38f0d4649862
Instruction ID: b9c9a7392339d7e53cb5298d7f7b5d488d836d75e56d77982184f20f97566c4c
Opcode Fuzzy Hash: 2771ed1edade32e75d1b6bd7256fbca93c97bb7e79d66e3ad3fe38f0d4649862
Instruction Fuzzy Hash: 23515070A00208EBDB10DFA5DD85BDEBBB9FB48701F20452AE545B31A1D7786A85CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00413510, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00411064,p.`), ref: 00413553
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041356C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410E9C,000001B0), ref: 004135AF
__vbaFreeObj.MSVBVM60 ref: 004135B8

Strings

p.`, xrefs: 00413539, 00413549, 00413559

Memory Dump Source

Source File: 00000000.00000002.814928527.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.814922532.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.814952124.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.814960849.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID: p.`
API String ID: 1645334062-3976583478
Opcode ID: e8865ce886463921ee99acaccb5b3cc0d5bd117e47fd61107e8ff86a523f0f69
Instruction ID: 54b58749a863500e885ab0de34733081e730dbadc3fe16c905a1656fd622b6ce
Opcode Fuzzy Hash: e8865ce886463921ee99acaccb5b3cc0d5bd117e47fd61107e8ff86a523f0f69
Instruction Fuzzy Hash: 3B116370A00305EBC700EFA9C949BDABBB9FB4CB01F108529F545E7790D778A940CBA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Orden de compra M244545.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Orden de compra M244545.exe PID: 7096 Parent PID: 5104

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: Orden de compra M244545.exe PID: 7096 Parent PID: 5104 Orden de compra M244545.exeCOMMON

Executed Functions

Function 0217BAA3, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 188COMMON

Function 0217B9C4, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 262COMMON