Play interactive tour

Edit tour

Windows Analysis Report PEDIDO.exe

Overview

General Information

Sample Name:	PEDIDO.exe
Analysis ID:	502709
MD5:	8bc016e5779262b772d16903af6e142c
SHA1:	5fa020fa3a63a481eff19fca06e11c424d346e9f
SHA256:	69a8e2fa9664dce4cb9ab2d1a2e7ba67bd0516b9e4c8608e9c246d614be3241f
Tags:	exeGuloader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected GuLoader

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Tries to detect virtualization through RDTSC time measurements

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Sample file is different than original file name gathered from version info

Contains functionality to read the PEB

Program does not show much activity (idle)

Uses code obfuscation techniques (call, push, ret)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Detected potential crypto function

Classification

Process Tree

System is w10x64

PEDIDO.exe (PID: 4724 cmdline: 'C:\Users\user\Desktop\PEDIDO.exe' MD5: 8BC016E5779262B772D16903AF6E142C)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1G3zuBgFp"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1G3zuBgFp"}

Machine Learning detection for sample

Show sources

Source: PEDIDO.exe

Joe Sandbox ML: detected

Source: PEDIDO.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1G3zuBgFp

Source: PEDIDO.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: PEDIDO.exe, 00000000.00000000.248785183.0000000000416000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameLurifaksernes.exe vs PEDIDO.exe
Source: PEDIDO.exe	Binary or memory string: OriginalFilenameLurifaksernes.exe vs PEDIDO.exe

Source: C:\Users\user\Desktop\PEDIDO.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_00401673	0_2_00401673
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_00401626	0_2_00401626
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_00401437	0_2_00401437
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F3002	0_2_020F3002
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F1210	0_2_020F1210
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020FA827	0_2_020FA827
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F4C35	0_2_020F4C35
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F226F	0_2_020F226F
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F208C	0_2_020F208C
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F029F	0_2_020F029F
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F1CA5	0_2_020F1CA5
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F00D5	0_2_020F00D5
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F4F38	0_2_020F4F38
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F0132	0_2_020F0132
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F6D4C	0_2_020F6D4C
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F2340	0_2_020F2340
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F1F7A	0_2_020F1F7A
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F0179	0_2_020F0179
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F4D92	0_2_020F4D92
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F53BE	0_2_020F53BE
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F4FF3	0_2_020F4FF3

Source: C:\Users\user\Desktop\PEDIDO.exe

File created: C:\Users\user~1\AppData\Local\Temp\~DFF079A81BD057904A.TMP

Jump to behavior

Source: PEDIDO.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PEDIDO.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\PEDIDO.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: classification engine

Classification label: mal72.troj.evad.winEXE@1/0@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_00405AC6 push esi; ret	0_2_00405ACD
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_004046A8 push es; ret	0_2_004046EF
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F0442 push FFFFFFFEh; ret	0_2_020F0444
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F2F71 pushad ; retn 0004h	0_2_020F2F8B
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F1781 push ds; retf	0_2_020F1787
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F27B0 pushfd ; iretd	0_2_020F27B1
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F09E3 push edi; iretd	0_2_020F09E4
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F0BF4 push edi; retf	0_2_020F0BF8

Source: C:\Users\user\Desktop\PEDIDO.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\PEDIDO.exe	RDTSC instruction interceptor: First address: 000000000040EFEE second address: 000000000040EFEE instructions: 0x00000000 rdtsc 0x00000002 nop 0x00000003 lfence 0x00000006 popad 0x00000007 lfence 0x0000000a cmp ecx, 0000009Fh 0x00000010 dec edi 0x00000011 pushfd 0x00000012 popfd 0x00000013 wait 0x00000014 cmp edi, 00000000h 0x00000017 jne 00007FA2BC937948h 0x00000019 mfence 0x0000001c cmp eax, 000000C2h 0x00000021 pushad 0x00000022 cmp eax, 000000EEh 0x00000027 mfence 0x0000002a rdtsc
Source: C:\Users\user\Desktop\PEDIDO.exe	RDTSC instruction interceptor: First address: 00000000020F6E7E second address: 00000000020F6E7E instructions: 0x00000000 rdtsc 0x00000002 mov eax, 5ECAEB07h 0x00000007 xor eax, E8969DE3h 0x0000000c xor eax, DEB35923h 0x00000011 add eax, 9710D03Ah 0x00000016 cpuid 0x00000018 popad 0x00000019 call 00007FA2BCDE0628h 0x0000001e lfence 0x00000021 mov edx, 03C503D6h 0x00000026 xor edx, A24BC650h 0x0000002c sub edx, AA10D02Ch 0x00000032 xor edx, 8883F54Eh 0x00000038 mov edx, dword ptr [edx] 0x0000003a lfence 0x0000003d ret 0x0000003e sub edx, esi 0x00000040 ret 0x00000041 cmp eax, 4C4E4F0Bh 0x00000046 pop ecx 0x00000047 add edi, edx 0x00000049 dec ecx 0x0000004a mov dword ptr [ebp+00000237h], EBF6D632h 0x00000054 xor dword ptr [ebp+00000237h], BEC846FDh 0x0000005e xor dword ptr [ebp+00000237h], 3DA10DDDh 0x00000068 add dword ptr [ebp+00000237h], 976062EEh 0x00000072 cmp ecx, dword ptr [ebp+00000237h] 0x00000078 jne 00007FA2BCDE0575h 0x0000007e mov dword ptr [ebp+00000245h], esi 0x00000084 mov esi, ecx 0x00000086 push esi 0x00000087 mov esi, dword ptr [ebp+00000245h] 0x0000008d jmp 00007FA2BCDE067Eh 0x0000008f test eax, ecx 0x00000091 call 00007FA2BCDE069Bh 0x00000096 call 00007FA2BCDE0649h 0x0000009b lfence 0x0000009e mov edx, 03C503D6h 0x000000a3 xor edx, A24BC650h 0x000000a9 sub edx, AA10D02Ch 0x000000af xor edx, 8883F54Eh 0x000000b5 mov edx, dword ptr [edx] 0x000000b7 lfence 0x000000ba ret 0x000000bb mov esi, edx 0x000000bd pushad 0x000000be rdtsc

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PEDIDO.exe

Code function: 0_2_020F6E76 rdtsc

0_2_020F6E76

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\PEDIDO.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F9612 mov eax, dword ptr fs:[00000030h]	0_2_020F9612
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020FA827 mov eax, dword ptr fs:[00000030h]	0_2_020FA827
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F6C6E mov eax, dword ptr fs:[00000030h]	0_2_020F6C6E
Source: C:\Users\user\Desktop\PEDIDO.exe	Code function: 0_2_020F9BB0 mov eax, dword ptr fs:[00000030h]	0_2_020F9BB0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PEDIDO.exe

Code function: 0_2_020F6E76 rdtsc

0_2_020F6E76

Source: PEDIDO.exe, 00000000.00000002.778371334.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: PEDIDO.exe, 00000000.00000002.778371334.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: PEDIDO.exe, 00000000.00000002.778371334.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: PEDIDO.exe, 00000000.00000002.778371334.0000000000C60000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery21	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery11	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PEDIDO.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	502709
Start date:	14.10.2021
Start time:	10:36:11
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PEDIDO.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.troj.evad.winEXE@1/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 37.7% (good quality ratio 21.6%) Quality average: 35.8% Quality standard deviation: 37.2%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 95.100.216.89, 20.82.209.183, 209.197.3.8, 20.54.110.249, 40.112.88.60, 2.20.178.24, 2.20.178.33, 20.82.210.154 Excluded domains from analysis (whitelisted): iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, ris.api.iris.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.79980248716969
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PEDIDO.exe
File size:	98304
MD5:	8bc016e5779262b772d16903af6e142c
SHA1:	5fa020fa3a63a481eff19fca06e11c424d346e9f
SHA256:	69a8e2fa9664dce4cb9ab2d1a2e7ba67bd0516b9e4c8608e9c246d614be3241f
SHA512:	75705b51a700371ab9211b81bf0e36aeae80825418a3e260c9b9e6610cb3f31833349b309ac88f6e67bf3f16a34d349802c617a25f9a52e8bcfb989bf7289a53
SSDEEP:	1536:tqD1R2xaclNLo4V4UQhH03JYVtKP2BlxS6pE5LD:tqPkNLo4VRQh8OKettS5L
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L...i..T.................@...0...............P....@........

File Icon


Icon Hash:	69e1c892f664c884

Static PE Info

General
Entrypoint:	0x4012b4
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x5402F169 [Sun Aug 31 09:56:57 2014 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3d3cd1bd8dcc611a5734bf41f4e1a6a6

Entrypoint Preview

Instruction
push 004102ECh
call 00007FA2BCBE6943h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ah, dl
adc ah, byte ptr [edx+4B4D12BAh]
cdq
mov ecx, 444C7E8Ah
in eax, dx
in al, dx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc ebp
outsb
insd
jc 00007FA2BCBE69BDh
xor dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
cmp bl, ah
sub al, BCh
out dx, eax
test al, D9h
inc ebp
inc ebx
mov ah, 7Bh
pop esp
sub al, 9Bh
mov byte ptr [ecx], al
test dword ptr [eax+11E72ED8h], 8B481779h
cmp bl, byte ptr [edi]
ret
nop
dec ecx
mov dword ptr [edx+33AD4F3Ah], ebx
cdq
iretw
adc dword ptr [edi+00AA000Ch], esi
pushad
rcl dword ptr [ebx+00000000h], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
lodsb
in eax, dx
add byte ptr [eax], al
or ecx, dword ptr [ecx]
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [esi+65h], dl
outsb
je 00007FA2BCBE69B7h
jc 00007FA2BCBE6952h
or eax, 51000601h
jne 00007FA2BCBE69B7h
jc 00007FA2BCBE69B7h
jnc 00007FA2BCBE6952h
sbb dword ptr [ecx], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x13f04	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x1c32	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0xf0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x132f8	0x14000	False	0.50859375	data	6.25990201424	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x15000	0xcc4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x16000	0x1c32	0x2000	False	0.346435546875	data	3.68560912734	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
CUSTOM	0x17934	0x2fe	MS Windows icon resource - 1 icon, 32x32, 16 colors	English	United States
CUSTOM	0x17076	0x8be	MS Windows icon resource - 1 icon, 32x32, 8 bits/pixel	English	United States
CUSTOM	0x16d78	0x2fe	MS Windows icon resource - 1 icon, 32x32, 16 colors, 4 bits/pixel	English	United States
RT_ICON	0x164d0	0x8a8	data
RT_GROUP_ICON	0x164bc	0x14	data
RT_VERSION	0x161a0	0x31c	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, _adj_fpatan, __vbaLateIdCallLd, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaVarAdd, __vbaVarDup, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	ExpressVPN
InternalName	Lurifaksernes
FileVersion	4.00
CompanyName	ExpressVPN
LegalTrademarks	ExpressVPN
Comments	ExpressVPN
ProductName	ExpressVPN
ProductVersion	4.00
FileDescription	ExpressVPN
OriginalFilename	Lurifaksernes.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: PEDIDO.exe PID: 4724 Parent PID: 6096

General

Start time:	10:37:12
Start date:	14/10/2021
Path:	C:\Users\user\Desktop\PEDIDO.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\PEDIDO.exe'
Imagebase:	0x400000
File size:	98304 bytes
MD5 hash:	8BC016E5779262B772D16903AF6E142C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PEDIDO.exe PID: 4724 Parent PID: 6096 PEDIDO.exeCOMMON

Executed Functions

Function 00413840, Relevance: 112.5, APIs: 59, Strings: 5, Instructions: 479COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410E40,8N), ref: 004138D9
__vbaObjSet.MSVBVM60(?,00000000), ref: 004138F8
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C78,000000F8), ref: 0041391E
__vbaNew2.MSVBVM60(00410E40,8N), ref: 00413937
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413950
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C78,000001B4), ref: 00413A00
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413A10
#606.MSVBVM60(00000001,?), ref: 00413A2D
__vbaStrMove.MSVBVM60 ref: 00413A38
__vbaStrCmp.MSVBVM60(00410CAC,00000000), ref: 00413A4A
__vbaFreeStr.MSVBVM60 ref: 00413A59
__vbaFreeVar.MSVBVM60 ref: 00413A68
#706.MSVBVM60(00000001,00000000,00000000), ref: 00413A79
__vbaStrMove.MSVBVM60 ref: 00413A84
__vbaNew2.MSVBVM60(00410C58,00415590), ref: 00413A9D
__vbaHresultCheckObj.MSVBVM60(00000000,0295004C,00410C48,00000014), ref: 00413AC2
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410C68,00000070), ref: 00413AE9
__vbaFreeObj.MSVBVM60 ref: 00413AF2
#580.MSVBVM60(Stalakitter,00000001), ref: 00413AFF
#574.MSVBVM60(00000002), ref: 00413B17
__vbaStrMove.MSVBVM60 ref: 00413B22
__vbaStrCmp.MSVBVM60(00410CD0,00000000), ref: 00413B2E
__vbaFreeStr.MSVBVM60 ref: 00413B3D
__vbaFreeVar.MSVBVM60 ref: 00413B46
#594.MSVBVM60(00000002), ref: 00413B61
__vbaFreeVar.MSVBVM60 ref: 00413B6A
#648.MSVBVM60(00000002), ref: 00413B76
__vbaFreeVar.MSVBVM60 ref: 00413B7F
__vbaVarDup.MSVBVM60 ref: 00413B9B
#666.MSVBVM60(?,00000002), ref: 00413BA9
__vbaVarMove.MSVBVM60 ref: 00413BB5
__vbaFreeVar.MSVBVM60 ref: 00413BBE
__vbaNew2.MSVBVM60(00410E40,8N), ref: 00413BFA
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413C13
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C78,000000F8), ref: 00413C3D
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410868,000006F8), ref: 00413C74
__vbaFreeObj.MSVBVM60 ref: 00413C7D
__vbaNew2.MSVBVM60(00410E40,8N), ref: 00413C96
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413CAF
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C78,00000130), ref: 00413CD6
__vbaLateIdCallLd.MSVBVM60(00000002,?,00000000,00000000), ref: 00413CE8
__vbaStrVarMove.MSVBVM60(00000000), ref: 00413CF2
__vbaStrMove.MSVBVM60 ref: 00413CFD
__vbaFreeStr.MSVBVM60 ref: 00413D24
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413D34
__vbaFreeVar.MSVBVM60 ref: 00413D40
__vbaNew2.MSVBVM60(00410E40,8N), ref: 00413D55
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413D6E
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C78,00000078), ref: 00413D98
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410868,000006FC), ref: 00413DE9
__vbaFreeObj.MSVBVM60 ref: 00413DEE
__vbaHresultCheckObj.MSVBVM60(00000000,00401140,00410838,000002B4), ref: 00413E0F
__vbaVarAdd.MSVBVM60(00000002,?,?), ref: 00413E3D
__vbaVarMove.MSVBVM60 ref: 00413E44
#598.MSVBVM60 ref: 00413E4A
__vbaVarTstLt.MSVBVM60(00000002,?), ref: 00413E68
__vbaFreeVar.MSVBVM60(00413ED2), ref: 00413EC1
__vbaFreeStr.MSVBVM60 ref: 00413EC6
__vbaFreeVar.MSVBVM60 ref: 00413ECF

Strings

zk:K&6, xrefs: 00413D76, 00413D7C
Mallorcinerens, xrefs: 00413B8A
Stalakitter, xrefs: 00413AFA
, xrefs: 00413A1C
8N, xrefs: 00413882, 004138CF, 004138DF, 00413924, 0041392D, 0041393D, 00413BE7, 00413BF0, 00413C00, 00413C83, 00413C8C, 00413C9C, 00413D42, 00413D4B, 00413D5B

Memory Dump Source

Source File: 00000000.00000002.777577281.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.777553082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.777684639.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.777721491.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$Move$New2$List$#574#580#594#598#606#648#666#706CallLate
String ID: $8N$Mallorcinerens$Stalakitter$zk:K&6
API String ID: 1003127262-2117810824
Opcode ID: be8cbf81e61342c0ec32068dda82ef68fecbf0d7e08d2160dde46d3883c5ee7d
Instruction ID: 6ed8bc8ef6ccad976f3369c2ed9ce1ba9c5cc5f8bda226041c329b3723087e2b
Opcode Fuzzy Hash: be8cbf81e61342c0ec32068dda82ef68fecbf0d7e08d2160dde46d3883c5ee7d
Instruction Fuzzy Hash: 32123A70A00219DFDB10DFA5CD88BDABBB8FF48705F10816AE549A7260DB745A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 004012B4, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 15%

			_entry_(signed int __eax, signed int* __ebx, intOrPtr* __edx, void* __edi) {
				intOrPtr* _t29;
				signed int _t30;
				intOrPtr* _t32;
				intOrPtr* _t33;
				signed int _t43;
				intOrPtr* _t45;
				signed int _t48;
				void* _t49;
				void* _t52;

				_t45 = __edx;
				_t38 = __ebx;
				_push("VB5!6\"*"); // executed
				L004012AC(); // executed
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax + __eax;
				 *__eax =  *__eax ^ __eax;
				 *__eax =  *__eax + __eax;
				_t29 = __eax + 1;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				_t30 = _t29 + __edx;
				asm("aam 0x12");
				asm("movsb");
				asm("bound edi, [edx-0x66b4b2ee]");
				asm("in eax, dx");
				asm("in al, dx");
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				asm("outsb");
				asm("gs insd");
				if(_t49 + 1 < 0) {
					_t43 = 0x444c7e8a |  *0x444c7e8a;
					 *_t30 =  *_t30 + _t30;
					 *_t48 =  *_t48 + _t30;
					_t6 = _t48 + 0x65;
					 *_t6 =  *(_t48 + 0x65) + __edx;
					__eflags =  *_t6;
					asm("outsb");
					if(__eflags == 0) {
						L9:
						 *_t30 =  *_t30;
						 *_t30 =  *_t30;
						_t18 = _t30 + 0x800080;
						 *_t18 =  *(_t30 + 0x800080) + _t30;
						__eflags =  *_t18;
						L10:
						_t20 = _t30 - 0x80000000;
						 *_t20 =  *(_t30 - 0x80000000) + _t30;
						__eflags =  *_t20;
						L11:
						 *_t30 =  *_t30 + _t30;
						 *((intOrPtr*)(_t30 - 0x7fff8000)) =  *((intOrPtr*)(_t30 - 0x7fff8000)) + _t30;
						 *_t30 =  *_t30;
						asm("rol al, 0xc0");
						_t32 = _t30 + _t30 + _t45;
						asm("retf 0xa6");
						asm("int3");
						asm("invalid");
						 *((intOrPtr*)(_t43 + 0x6600ffff)) =  *((intOrPtr*)(_t43 + 0x6600ffff)) + _t38;
						asm("invalid");
						 *_t38 =  *_t38 + _t45;
						__eflags =  *_t38;
						 *_t32 =  *_t32 + 1;
						 *_t32 =  *_t32 + 1;
						asm("int3");
						asm("int3");
						 *_t32 =  *_t32 + 1;
						asm("cdq");
						asm("int3");
						 *_t32 =  *_t32 + 1;
						asm("o16 int3");
						 *_t32 =  *_t32 + 1;
						 *_t32 =  *_t32 + 1;
						_t33 = _t32 + (_t43 ^ _t52 - 0x00000001);
						 *_t33 =  *_t33 + 1;
						[far dword [ecx-0x6633ff01]();
						 *_t33 =  *_t33 + 1;
						asm("cdq");
						asm("cdq");
						 *_t33 =  *_t33 + 1;
						asm("cwd");
						 *_t33 =  *_t33 + 1;
						 *_t33 =  *_t33 + 1;
						goto ( *((intOrPtr*)(_t48 - 1)));
					}
					if (__eflags < 0) goto L5;
					_t30 = _t30 | 0x51000601;
					__eflags = _t30;
					if(__eflags != 0) {
						goto L10;
					}
					if(__eflags < 0) {
						goto L11;
					}
					if (__eflags >= 0) goto L8;
					asm("sbb [ecx], eax");
					 *__edx =  *__edx + _t30;
					_t30 = _t30 &  *__ebx & _t48;
					 *_t30 =  *_t30 | _t30;
					 *((intOrPtr*)(_t52 + _t48 * 2)) =  *((intOrPtr*)(_t52 + _t48 * 2)) + _t43;
					 *((intOrPtr*)(_t48 + 8)) =  *((intOrPtr*)(_t48 + 8)) + __ebx;
					 *0x444c7e8a =  *0x444c7e8a + _t30;
					 *0x444c7e8a =  *0x444c7e8a + _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 & _t30;
					 *0x444c7e8a =  *0x444c7e8a + _t30;
					 *_t30 =  *_t30 + _t43;
					 *((intOrPtr*)(_t30 + 0x16000008)) =  *((intOrPtr*)(_t30 + 0x16000008)) + _t43;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t43;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 | _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					 *((char*)(_t30 + _t30)) =  *((char*)(_t30 + _t30));
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					 *0x444c7e8a =  *0x444c7e8a + _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					 *_t30 =  *_t30 + _t30;
					__eflags =  *_t30;
					goto L9;
				}
				 *[gs:eax] =  *[gs:eax] ^ _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				 *_t30 =  *_t30 + _t30;
				asm("int3");
				 *_t30 =  *_t30 ^ _t30;
				asm("out dx, eax");
				 *0x444c7e8a = 0xffffffffffffffe0;
				return 0xffffffffffffffe0;
			}

0x004012b4
0x004012b4
0x004012b4
0x004012b9
0x004012be
0x004012c0
0x004012c2
0x004012c4
0x004012c6
0x004012c8
0x004012c9
0x004012cb
0x004012cd
0x004012cf
0x004012d0
0x004012d2
0x004012d3
0x004012de
0x004012df
0x004012e0
0x004012e2
0x004012e4
0x004012e6
0x004012e8
0x004012ea
0x004012ec
0x004012ee
0x004012f1
0x004012f2
0x004012f4
0x00401361
0x00401363
0x00401365
0x00401367
0x00401367
0x00401367
0x0040136a
0x0040136b
0x004013d2
0x004013d2
0x004013d5
0x004013d8
0x004013d8
0x004013d8
0x004013db
0x004013db
0x004013db
0x004013db
0x004013dd
0x004013dd
0x004013df
0x004013e5
0x004013e8
0x004013ef
0x004013f1
0x004013f4
0x004013f5
0x004013f7
0x004013fd
0x004013ff
0x004013ff
0x00401402
0x00401406
0x00401408
0x00401409
0x0040140a
0x0040140c
0x0040140d
0x0040140e
0x00401410
0x00401412
0x00401416
0x00401418
0x0040141a
0x0040141c
0x00401422
0x00401424
0x00401425
0x00401426
0x00401428
0x0040142a
0x00401432
0x00401434
0x00401434
0x0040136d
0x0040136f
0x0040136f
0x00401374
0x00000000
0x00000000
0x00401376
0x00000000
0x00000000
0x00401378
0x0040137a
0x0040137c
0x00401381
0x00401383
0x00401385
0x00401389
0x0040138f
0x00401391
0x00401393
0x00401395
0x00401397
0x00401399
0x0040139b
0x004013a1
0x004013a3
0x004013a5
0x004013a7
0x004013a9
0x004013ab
0x004013ae
0x004013b0
0x004013b2
0x004013b4
0x004013b6
0x004013b8
0x004013bc
0x004013be
0x004013c0
0x004013c2
0x004013c4
0x004013c6
0x004013c8
0x004013ca
0x004013cc
0x004013ce
0x004013d0
0x004013d0
0x00000000
0x004013d0
0x004012f6
0x004012f9
0x004012fb
0x004012fd
0x004012ff
0x00401301
0x00401305
0x00401306
0x0040130c
0x00401316
0x00401324

APIs

#100.MSVBVM60(VB5!6"*), ref: 004012B9

Strings

VB5!6"*, xrefs: 004012B4

Memory Dump Source

Source File: 00000000.00000002.777577281.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.777553082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.777684639.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.777721491.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6"*
API String ID: 1341478452-2992194029
Opcode ID: 2f27070a756c7cb6602e88e5d3cd3550dd90e002093a926ca76a7792069f6044
Instruction ID: 01b7926d8d99bd504e62086666d79be5e05e372de08bf3f1363504ba2f34aedc
Opcode Fuzzy Hash: 2f27070a756c7cb6602e88e5d3cd3550dd90e002093a926ca76a7792069f6044
Instruction Fuzzy Hash: 084161A684E7C14FE703477458292817FB0AE13264B6E46DBC0D2CF5F3E66D484AC726

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 020FA827, Relevance: 5.5, Strings: 4, Instructions: 510COMMON

Download Yara Rule

Strings

"Qq, xrefs: 020FAC81
HMR&, xrefs: 020FA83B
!zf, xrefs: 020F6D35
/g`u, xrefs: 020FAB4B

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !zf$/g`u$HMR&$"Qq
API String ID: 0-82504512
Opcode ID: 3acfef58c3cb8f0b06363486414cea5e68ded759a2e893e3b049789da23b0b72
Instruction ID: 743c39784adaf4b2c2af0bb8d60657d4402c33ecaa114270b128353efa169a52
Opcode Fuzzy Hash: 3acfef58c3cb8f0b06363486414cea5e68ded759a2e893e3b049789da23b0b72
Instruction Fuzzy Hash: DF2225716483C58FDBB2CF38CC987DA7BE2AF56310F49829AC9998F696D3348505C712

Uniqueness

Uniqueness Score: -1.00%

Function 020F6D4C, Relevance: 1.3, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

!zf, xrefs: 020F6D35

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !zf
API String ID: 0-773865888
Opcode ID: ec3ee16055f1a28958fa18f8f5f160c708408c2341ca1fc4622ddb00af64a838
Instruction ID: 3180bb446a4d263fdfbf9c8fbf2026c4e9113bee911e5a4479b529e6dbe8df8f
Opcode Fuzzy Hash: ec3ee16055f1a28958fa18f8f5f160c708408c2341ca1fc4622ddb00af64a838
Instruction Fuzzy Hash: 23218B33444758CBDFFA8F6089943EA37AABF54350F11412EDC1FAB600CB310A45EA80

Uniqueness

Uniqueness Score: -1.00%

Function 020F3002, Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

Q^%, xrefs: 020F3050

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Q^%
API String ID: 0-2873288618
Opcode ID: e7e58b664577902efd558f2cbb2202898398d5fd70d52179b05f8158ac9fa196
Instruction ID: f45903cd0888244754c99c815d1545271d1aff9146c40147becc5c0b028de1d7
Opcode Fuzzy Hash: e7e58b664577902efd558f2cbb2202898398d5fd70d52179b05f8158ac9fa196
Instruction Fuzzy Hash: 39E00A6D2A53D25B577181F231A0D87DF71077F5057F5068056D2BBF1FC5138B569240

Uniqueness

Uniqueness Score: -1.00%

Function 00401437, Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.777577281.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.777553082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.777684639.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.777721491.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58187ee0e133b0b48bb3efed7ac890b15464e5e05c24970065dea5c804966976
Instruction ID: d394a65342a6a254380257ba0734a19f866dc21ad068f5b1ddaac111a7468d93
Opcode Fuzzy Hash: 58187ee0e133b0b48bb3efed7ac890b15464e5e05c24970065dea5c804966976
Instruction Fuzzy Hash: F641279025E2D4EFC71B47B64CBA2813FE1AE07108B1A88EFD6D54B8A3E555241FC727

Uniqueness

Uniqueness Score: -1.00%

Function 020F4C35, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b84d196249ef4146638c02b716c762f4e5a765b6c6607f199da5e57bc2143f8
Instruction ID: eb40d915719e68c0b3198fdf1797784c79c399b4c71b8611beb4d1829b19ae15
Opcode Fuzzy Hash: 1b84d196249ef4146638c02b716c762f4e5a765b6c6607f199da5e57bc2143f8
Instruction Fuzzy Hash: 0D41D8311883868FD7AA8F788C890DAFFF1FB5A304F55099DC7958BA56C7310602CB52

Uniqueness

Uniqueness Score: -1.00%

Function 020F226F, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f0a435f90ebbfc8ec2d70817c8dab193afa4f5cb459f52e14fbdd61431d6f8f
Instruction ID: d7b4a107fb22c1b3e5aa8cbce1d961b20351ce2b0fbeb68199dff44e008e91f9
Opcode Fuzzy Hash: 2f0a435f90ebbfc8ec2d70817c8dab193afa4f5cb459f52e14fbdd61431d6f8f
Instruction Fuzzy Hash: 313147751853C58FCB618F70A5A55CEBFB0AF1E300FE50569CA91ABF27C2364642DB40

Uniqueness

Uniqueness Score: -1.00%

Function 020F4D92, Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452a09e338ec8015b97516bee2f5b1abe57543a06ee762253606d13e89a99db6
Instruction ID: f1ce78d49e5025a81cd4eec60d4ebca5494decc9d5f868fd92f39af8f702cf38
Opcode Fuzzy Hash: 452a09e338ec8015b97516bee2f5b1abe57543a06ee762253606d13e89a99db6
Instruction Fuzzy Hash: F82178391993D68BD7A68AB438649C6FF715B5E208FE90A84D69097F07C2320A5BC700

Uniqueness

Uniqueness Score: -1.00%

Function 020F1CA5, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98979a2ea224e6d683f4fae6b2ffdfbd8ea68b9f4210ee8c074ed93b17d62a94
Instruction ID: 1c3df651283f627525334c9803257bddc43a65a5c7d26352310a0287f1579496
Opcode Fuzzy Hash: 98979a2ea224e6d683f4fae6b2ffdfbd8ea68b9f4210ee8c074ed93b17d62a94
Instruction Fuzzy Hash: 2A1159755193D6DBD7668A70B0606C9BFB19F5F300BA5059CD9904BB03CB31491BC740

Uniqueness

Uniqueness Score: -1.00%

Function 020F4F38, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 101d4bbfe3529b909611399230b512d48933daac8d9c775d582f6b753e4c7e10
Instruction ID: 0ee86d132147dc09b09ae6b606e265e4fced7d32c02a83b3674aac58098c7376
Opcode Fuzzy Hash: 101d4bbfe3529b909611399230b512d48933daac8d9c775d582f6b753e4c7e10
Instruction Fuzzy Hash: 593195750083C18BDB72CEB8A894B86BFA15F1A214F8883DDCD985F69BE7324107C741

Uniqueness

Uniqueness Score: -1.00%

Function 00401673, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.777577281.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.777553082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.777684639.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.777721491.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e24cef5b52d058c6559a4647f5f96652dbae51e6763f7f5d8b23a4fe3d590a8
Instruction ID: 0ef76ab4ed2bcdf07a831812e9108315abc5032b0251afc9fc56c28be75d868b
Opcode Fuzzy Hash: 9e24cef5b52d058c6559a4647f5f96652dbae51e6763f7f5d8b23a4fe3d590a8
Instruction Fuzzy Hash: 5E11DAB150E3E59FCB174B748CB52527FB0AF1B20070A44EBD4819F8A7E268281ED727

Uniqueness

Uniqueness Score: -1.00%

Function 020F1210, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c5c59e24d822a0ea808d4401f26b3d8186d2ccac320a2f760730bbdf9ce6032
Instruction ID: ab6e9f2d7eaf37a050980d4806f820ab7f58da7e29d72bc71611a0c8ba8b678a
Opcode Fuzzy Hash: 6c5c59e24d822a0ea808d4401f26b3d8186d2ccac320a2f760730bbdf9ce6032
Instruction Fuzzy Hash: D911C27915A3D18BC722C6B17160AC6FF714B2E215BE905D4D9C1ABB1BC1228B57C380

Uniqueness

Uniqueness Score: -1.00%

Function 020F00D5, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808257af6d601be05445266852be49709bd48aedf0a9bbff09c5a2daf5e126bd
Instruction ID: 940ecfc4a8f099bd7dd0439814c8738eba9d29f82d179cadaed1db526bd9cc10
Opcode Fuzzy Hash: 808257af6d601be05445266852be49709bd48aedf0a9bbff09c5a2daf5e126bd
Instruction Fuzzy Hash: 2611A57918838597DBF0A6B031A0BDEFBB35B3E741FE501404D9267B5FC622455BE281

Uniqueness

Uniqueness Score: -1.00%

Function 020F0132, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00e3b09f6b17e5336f97f75b25b50d3c9f8e02bb4bbec5cd9267165a70494e82
Instruction ID: 2e88148f14d8c2a526aca7da01b169ac55ef8c35b9b0f82127b68ac6d487c5c5
Opcode Fuzzy Hash: 00e3b09f6b17e5336f97f75b25b50d3c9f8e02bb4bbec5cd9267165a70494e82
Instruction Fuzzy Hash: 8A01B5784883859BDBF0AAA031A07DAFBB75F3E791FD500404D9163A5FC322455BD681

Uniqueness

Uniqueness Score: -1.00%

Function 020F0179, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edaecc52bfe1538e49e8c194da550af5e6893d6b68a4a76e3d57f1ca3b5a7f5d
Instruction ID: 0b3a44d4a678d900cd89513454ebe921a91ba66e1972bcec897a0bfb9e412bd6
Opcode Fuzzy Hash: edaecc52bfe1538e49e8c194da550af5e6893d6b68a4a76e3d57f1ca3b5a7f5d
Instruction Fuzzy Hash: 250192795883859BDBF0AAA131A0BDEFBB24B3E781FE500408D9167B5FC222454BD681

Uniqueness

Uniqueness Score: -1.00%

Function 020F208C, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c67bbcc976649aa6be7e57b42ca0c04b4303f119638541f14eb09f65eac414
Instruction ID: 74a225bcf1e36682bd9b9c9a39675e123a99f5bc1bf172b74362f10ebb7a64e1
Opcode Fuzzy Hash: a2c67bbcc976649aa6be7e57b42ca0c04b4303f119638541f14eb09f65eac414
Instruction Fuzzy Hash: FD116B391053C09BCB748B7075B16DABBB19B5E304FD4044CE9E667B1BCB324646E700

Uniqueness

Uniqueness Score: -1.00%

Function 020F2340, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86538ff87abbf2c7d18dfc94b70da1afdbbdbadcc058764bd4200639da1bf6e8
Instruction ID: 49e3a3042a7dec0ea6968b9e3421031fc943e828b6d2ae3738f7c746ec6f2ff3
Opcode Fuzzy Hash: 86538ff87abbf2c7d18dfc94b70da1afdbbdbadcc058764bd4200639da1bf6e8
Instruction Fuzzy Hash: 6001A46D1593D15B9721C1B131609CAEF71076F654BE5068881E2ABF6BC9138697D340

Uniqueness

Uniqueness Score: -1.00%

Function 020F9BB0, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a87d754a6174287da5d6212be4b372ae2fe6749d767238ab5becb1f2f3f91a6
Instruction ID: 424c5f8bba841302217e6818913e792e30f9cdbda9eb3a13256fb81a9660d20c
Opcode Fuzzy Hash: 3a87d754a6174287da5d6212be4b372ae2fe6749d767238ab5becb1f2f3f91a6
Instruction Fuzzy Hash: D101E2B4650788DFCBB4CF08C9E0BDA77E2AB99300F00802ADE098B711D7309A41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 020F4FF3, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ffe3a9afcfd36b2e99578e378ed176eb880471dd7547545824d845899906d208
Instruction ID: 91d4b9224540dc2881a424d1e6f16fec3c23fb336ebf139f96df07e37c9b475a
Opcode Fuzzy Hash: ffe3a9afcfd36b2e99578e378ed176eb880471dd7547545824d845899906d208
Instruction Fuzzy Hash: 8A016D290083D18ADB72CAB468A4BC6FF612B1E215FD947C9CDD82BA5BD3264247C301

Uniqueness

Uniqueness Score: -1.00%

Function 020F1F7A, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9ff468ef78a88ebbbb6c955d1b99998b065eda939f1a4b9ed3ca908c418fc24
Instruction ID: 314d9eff7fa2c75ec1701546e0966dfe4f46a0c2ae781fb08a7cdf39d47f6a01
Opcode Fuzzy Hash: f9ff468ef78a88ebbbb6c955d1b99998b065eda939f1a4b9ed3ca908c418fc24
Instruction Fuzzy Hash: FBF0C8AA44C3D29BD752877038A0AC6FFF15B6F604FE90AC9D9C167A16C2630697D381

Uniqueness

Uniqueness Score: -1.00%

Function 00401626, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.777577281.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.777553082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.777684639.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.777721491.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction ID: 3a4f40afd7daac755765d0dbc513794409bb1d663c47dbf88c845af7c1cdfe86
Opcode Fuzzy Hash: 072463a7c437865975a3864d9424ff10385e28a77ccb1411e9edc6cac81fba01
Instruction Fuzzy Hash: CBF07A70124154EFCB06CF74D8A5A063BE1AF5B3407451CDAD9108F475D736B865EB12

Uniqueness

Uniqueness Score: -1.00%

Function 020F029F, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5814206f7e008f3985d34c68bc91cdf2d927d593b1d4c161e05ab12f512e837
Instruction ID: 6735592459edd280f01b84fa3fa6d614052d59250321d87265c4bba73a22184f
Opcode Fuzzy Hash: b5814206f7e008f3985d34c68bc91cdf2d927d593b1d4c161e05ab12f512e837
Instruction Fuzzy Hash: 4FF0545D14A3D296E77192B135A0BC6EFF10B6F744FE9058099D1A7B1BC622465BC340

Uniqueness

Uniqueness Score: -1.00%

Function 020F53BE, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 180152b17a008f474f506b8e1cd948e89c7226aedc92ecefd9dd0cd699dc5af1
Instruction ID: 112b6616293b64bc7ccae6fe9d926325fbb11ad51b7a7580122349fa8504b1ea
Opcode Fuzzy Hash: 180152b17a008f474f506b8e1cd948e89c7226aedc92ecefd9dd0cd699dc5af1
Instruction Fuzzy Hash: 68E0B6991593D197967181B132A0ACBEFB2076F5097F505C056D167F1FC5234A56A380

Uniqueness

Uniqueness Score: -1.00%

Function 020F6E76, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7f46f81e86ec13eecb5484511b92013a960372d58b44804e3481a763d7af5a4
Instruction ID: 27b20b9b4321d5da4b63a8efe6acdff4e0f93332809da09cbff76a866829dc1d
Opcode Fuzzy Hash: a7f46f81e86ec13eecb5484511b92013a960372d58b44804e3481a763d7af5a4
Instruction Fuzzy Hash: 7CC02BA3E582262E01E13030F21D0EB64076F823B0311CA11215DA7D0EF803FC813885

Uniqueness

Uniqueness Score: -1.00%

Function 020F6C6E, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 020F9612, Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.779265380.00000000020F0000.00000040.00000001.sdmp, Offset: 020F0000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3308fd7d430788467753549bb30dc88d44733325deda077ad7fca4daae0227
Instruction ID: 828d7a82d5f245b029eb28c1b74ecb2419037b2363a055422eab935e2037b5a5
Opcode Fuzzy Hash: 2f3308fd7d430788467753549bb30dc88d44733325deda077ad7fca4daae0227
Instruction Fuzzy Hash: DDB002752526408FC755CA09C590E4473A5BB44651B615894E412C7A11C364E9509910

Uniqueness

Uniqueness Score: -1.00%

Function 004133D0, Relevance: 49.3, APIs: 27, Strings: 1, Instructions: 282COMMON

Download Yara Rule

APIs

#685.MSVBVM60 ref: 00413422
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413433
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C88,0000001C), ref: 00413450
__vbaFreeObj.MSVBVM60 ref: 00413468
__vbaNew2.MSVBVM60(00410C58,00415590), ref: 00413489
__vbaHresultCheckObj.MSVBVM60(00000000,0295004C,00410C48,00000014), ref: 004134AE
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410C68,000000D0), ref: 004134D8
__vbaStrMove.MSVBVM60 ref: 004134ED
__vbaFreeObj.MSVBVM60 ref: 004134F2
#539.MSVBVM60(?,00000001,00000001,00000001), ref: 00413502
__vbaStrVarMove.MSVBVM60(?), ref: 0041350C
__vbaStrMove.MSVBVM60 ref: 00413517
__vbaFreeVar.MSVBVM60 ref: 0041351C
#568.MSVBVM60(00000063), ref: 00413524
__vbaNew2.MSVBVM60(00410E40,8N), ref: 0041353D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413556
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C98,00000178), ref: 004135D7
__vbaFreeObj.MSVBVM60 ref: 004135E0
__vbaNew2.MSVBVM60(00410E40,8N), ref: 004135F9
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413618
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C78,000000F8), ref: 0041363B
__vbaNew2.MSVBVM60(00410E40,8N), ref: 00413654
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041366D
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C78,000001B4), ref: 00413708
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413718
__vbaFreeStr.MSVBVM60(00413760), ref: 00413758
__vbaFreeStr.MSVBVM60 ref: 0041375D

Strings

8N, xrefs: 0041352A, 00413533, 00413543, 004135E6, 004135EF, 004135FF, 00413641, 0041364A, 0041365A

Memory Dump Source

Source File: 00000000.00000002.777577281.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.777553082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.777684639.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.777721491.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$Move$#539#568#685List
String ID: 8N
API String ID: 342513763-3613544571
Opcode ID: b4e285281be3e67e939b4834155fae1d954b42c71300bbe968f6a1261a730aea
Instruction ID: b3ed57cb077e2328267bd5217b74f326fdd6505f18c0d0d39155a4639ba6d6e3
Opcode Fuzzy Hash: b4e285281be3e67e939b4834155fae1d954b42c71300bbe968f6a1261a730aea
Instruction Fuzzy Hash: CDB16B70A00204EFDB14DFA9C988ADEBBF9FF48700F14816AE509E72A1D7749985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00413060, Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410E40,8N), ref: 004130B3
__vbaObjSet.MSVBVM60(?,00000000), ref: 004130D2
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C78,000001B0), ref: 00413111
__vbaFreeObj.MSVBVM60 ref: 0041311A
__vbaNew2.MSVBVM60(00410E40,8N), ref: 00413133
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041314C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C78,00000098), ref: 0041316F
__vbaNew2.MSVBVM60(00410E40,8N), ref: 00413188
__vbaObjSet.MSVBVM60(?,00000000), ref: 004131A1
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C78,000001B4), ref: 00413230
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00413240
__vbaNew2.MSVBVM60(00410E40,8N), ref: 0041325C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00413275
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C78,000001A8), ref: 00413298
__vbaFreeObj.MSVBVM60 ref: 004132A1

Strings

8N, xrefs: 00413097, 004130A9, 004130B9, 00413120, 00413129, 00413139, 00413175, 0041317E, 0041318E, 00413246, 00413252, 00413262

Memory Dump Source

Source File: 00000000.00000002.777577281.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.777553082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.777684639.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.777721491.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresultNew2$Free$List
String ID: 8N
API String ID: 191279167-3613544571
Opcode ID: f807654e31785787ccd6c8ca6fe3eb34e8dde85dc50caed2f4acd228ef5a782d
Instruction ID: b20822ab019ed19f33e6ab81be432e2cdbf4104edc115574d013f7245990818d
Opcode Fuzzy Hash: f807654e31785787ccd6c8ca6fe3eb34e8dde85dc50caed2f4acd228ef5a782d
Instruction Fuzzy Hash: 76712A74A00204EBDB10DFA8C989AEABBF8BF4C701F10856AE949E7351D77498418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00412E40, Relevance: 22.7, APIs: 15, Instructions: 154COMMON

Download Yara Rule

APIs

#714.MSVBVM60(?,?,00000000), ref: 00412E98
__vbaVarTstNe.MSVBVM60(?,?), ref: 00412EB4
__vbaFreeVarList.MSVBVM60(00000002,00000005,?), ref: 00412EC7
__vbaNew2.MSVBVM60(00410C58,00415590), ref: 00412EEB
__vbaHresultCheckObj.MSVBVM60(00000000,0295004C,00410C48,00000014), ref: 00412F16
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410C68,000000C0), ref: 00412F44
__vbaFreeObj.MSVBVM60 ref: 00412F4F
__vbaNew2.MSVBVM60(00410C58,00415590), ref: 00412F64
__vbaHresultCheckObj.MSVBVM60(00000000,0295004C,00410C48,00000014), ref: 00412F89
__vbaHresultCheckObj.MSVBVM60(00000000,?,00410C68,000000B8), ref: 00412FAF
__vbaFreeObj.MSVBVM60 ref: 00412FB4
__vbaNew2.MSVBVM60(00410C58,00415590), ref: 00412FC9
__vbaObjSetAddref.MSVBVM60(?,?), ref: 00412FDF
__vbaHresultCheckObj.MSVBVM60(00000000,0295004C,00410C48,00000010), ref: 00412FF9
__vbaFreeObj.MSVBVM60 ref: 00412FFE

Memory Dump Source

Source File: 00000000.00000002.777577281.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.777553082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.777684639.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.777721491.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$New2$#714AddrefList
String ID:
API String ID: 169271594-0
Opcode ID: 59d76cee56d7c2df45d8730bd029779ae25a35e01821050571b3d0cc0a63a79f
Instruction ID: 6fd9c3250f067f15730fd40c388102b5026a71f1e7509d54bd98676f09f6e6f7
Opcode Fuzzy Hash: 59d76cee56d7c2df45d8730bd029779ae25a35e01821050571b3d0cc0a63a79f
Instruction Fuzzy Hash: 62518370900208EBDB10DFA5CE85BDEB7B9FB48701F204529F545F32A5D6B4A985CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 004132F0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

__vbaNew2.MSVBVM60(00410E40,8N), ref: 00413333
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041334C
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,00410C78,000001B0), ref: 0041338F
__vbaFreeObj.MSVBVM60 ref: 00413398

Strings

8N, xrefs: 00413319, 00413329, 00413339

Memory Dump Source

Source File: 00000000.00000002.777577281.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.777553082.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.777684639.0000000000415000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.777721491.0000000000416000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresultNew2
String ID: 8N
API String ID: 1645334062-3613544571
Opcode ID: 2b6291aa6f87e39fa5421b5f9a17224f3e7807197e0e577d4e7e11c07b198fb9
Instruction ID: 764fc12f40460370c68ff278df1c4c1911f0769114f3950369a27043853813d2
Opcode Fuzzy Hash: 2b6291aa6f87e39fa5421b5f9a17224f3e7807197e0e577d4e7e11c07b198fb9
Instruction Fuzzy Hash: 49116070A00305EBD700DFA9CA49BEABBB8FB4C701F108529F955E7790D77899448BA9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report PEDIDO.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: PEDIDO.exe PID: 4724 Parent PID: 6096

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: PEDIDO.exe PID: 4724 Parent PID: 6096 PEDIDO.exeCOMMON

Executed Functions

Function 00413840, Relevance: 112.5, APIs: 59, Strings: 5, Instructions: 479COMMON

Function 004012B4, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118COMMON

Non-executed Functions

Function 004012B4, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 118
COMMON