Loading ...

Play interactive tourEdit tour

Windows Analysis Report REVGKXx6Ns.exe

Overview

General Information

Sample Name:REVGKXx6Ns.exe
Analysis ID:527899
MD5:7c91db57c98a1f0e38ba65ed651b4779
SHA1:28cb0d40a73c1a421a9720808d49da010f9ff4ef
SHA256:12992fe3f998693d92625c53bf5aa6723e87c8c3fb7057dbba4b334742cab376
Infos:

Most interesting Screenshot:

Detection

GuLoader
Score:76
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected GuLoader
C2 URLs / IPs found in malware configuration
Found potential dummy code loops (likely to delay analysis)
Machine Learning detection for sample
Uses 32bit PE files
Sample file is different than original file name gathered from version info
PE file contains strange resources
Contains functionality to read the PEB
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Program does not show much activity (idle)
Contains functionality for execution timing, often used to detect debuggers
Abnormal high CPU Usage

Classification

Process Tree

  • System is w10x64
  • REVGKXx6Ns.exe (PID: 7160 cmdline: "C:\Users\user\Desktop\REVGKXx6Ns.exe" MD5: 7C91DB57C98A1F0E38BA65ED651B4779)
  • cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=downlo_"}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmpJoeSecurity_GuLoader_2Yara detected GuLoaderJoe Security

    Sigma Overview

    No Sigma rule has matched

    Jbx Signature Overview

    Click to jump to signature section

    Show All Signature Results

    AV Detection:

    barindex
    Found malware configurationShow sources
    Source: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmpMalware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=downlo_"}
    Multi AV Scanner detection for submitted fileShow sources
    Source: REVGKXx6Ns.exeVirustotal: Detection: 62%Perma Link
    Source: REVGKXx6Ns.exeMetadefender: Detection: 34%Perma Link
    Source: REVGKXx6Ns.exeReversingLabs: Detection: 71%
    Machine Learning detection for sampleShow sources
    Source: REVGKXx6Ns.exeJoe Sandbox ML: detected
    Source: REVGKXx6Ns.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

    Networking:

    barindex
    C2 URLs / IPs found in malware configurationShow sources
    Source: Malware configuration extractorURLs: https://drive.google.com/uc?export=downlo_
    Source: REVGKXx6Ns.exeString found in binary or memory: http://topqualityfreeware.com
    Source: REVGKXx6Ns.exeString found in binary or memory: http://www.topqualityfreeware.com/
    Source: REVGKXx6Ns.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    Source: REVGKXx6Ns.exe, 00000000.00000002.1187905826.0000000000426000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameObumbration1.exe vs REVGKXx6Ns.exe
    Source: REVGKXx6Ns.exeBinary or memory string: OriginalFilenameObumbration1.exe vs REVGKXx6Ns.exe
    Source: REVGKXx6Ns.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: REVGKXx6Ns.exeStatic PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_004090A60_2_004090A6
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02196B590_2_02196B59
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218E22D0_2_0218E22D
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02189E780_2_02189E78
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_021892A80_2_021892A8
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02189AAB0_2_02189AAB
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218AED80_2_0218AED8
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218AADB0_2_0218AADB
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02194AF50_2_02194AF5
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_021893140_2_02189314
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02180B330_2_02180B33
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218A3200_2_0218A320
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218A75D0_2_0218A75D
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218A3640_2_0218A364
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02189FAC0_2_02189FAC
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02189BD30_2_02189BD3
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_021898360_2_02189836
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218AC2E0_2_0218AC2E
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_021898580_2_02189858
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218B0440_2_0218B044
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218A8780_2_0218A878
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218D4B30_2_0218D4B3
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218A4CC0_2_0218A4CC
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218A0EF0_2_0218A0EF
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02192D070_2_02192D07
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_021899500_2_02189950
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02189D500_2_02189D50
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218AD6F0_2_0218AD6F
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218B1860_2_0218B186
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218A9B70_2_0218A9B7
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeProcess Stats: CPU usage > 98%
    Source: REVGKXx6Ns.exeVirustotal: Detection: 62%
    Source: REVGKXx6Ns.exeMetadefender: Detection: 34%
    Source: REVGKXx6Ns.exeReversingLabs: Detection: 71%
    Source: REVGKXx6Ns.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeSection loaded: C:\Windows\SysWOW64\msvbvm60.dllJump to behavior
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeFile created: C:\Users\user\AppData\Local\Temp\~DF6497174BCC55AD21.TMPJump to behavior
    Source: classification engineClassification label: mal76.troj.evad.winEXE@1/1@0/0

    Data Obfuscation:

    barindex
    Yara detected GuLoaderShow sources
    Source: Yara matchFile source: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, type: MEMORY
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_00404401 pushfd ; retf 0_2_0040441E
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_00403826 push es; ret 0_2_00403828
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_004044E5 pushfd ; retf 0_2_004044E6
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_00404584 pushfd ; retf 0_2_00404596
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_00404599 pushfd ; retf 0_2_004045AA
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_004051BE push dword ptr [esi]; iretd 0_2_004051C5
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0040665D pushfd ; retf 0_2_0040665E
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_00404279 pushfd ; retf 0_2_0040427A
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_004062C1 pushfd ; retf 0_2_004062C2
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_004072E1 pushfd ; retf 0_2_0040730E
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_004096FC push eax; iretd 0_2_004096FF
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_00404349 pushfd ; retf 0_2_0040434A
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_00404335 pushfd ; retf 0_2_00404346
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0040633D pushfd ; retf 0_2_0040634A
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_004067DE pushfd ; retf 0_2_004067E6
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0040A784 push 18165C0Eh; iretd 0_2_0040A789
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218423B push 81528D88h; ret 0_2_02184240
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02182644 push ss; retf 0_2_02182645
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02186E73 push E8000002h; retf 0_2_02186E78
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02185ECB push edi; ret 0_2_02185EC2
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02180EF4 push eax; retf 0_2_02180F07
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02185C22 push edi; ret 0_2_02185EC2
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02181447 push ds; ret 0_2_02181449
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_021848A7 pushfd ; ret 0_2_02184A0D
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218191A push ebx; retf 0_2_02181920
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218491D pushfd ; ret 0_2_02184A0D
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02184924 pushfd ; ret 0_2_02184A0D
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02185DDC push edi; ret 0_2_02185EC2
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02185DC1 push edi; ret 0_2_02185EC2
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218CAA8 rdtsc 0_2_0218CAA8

    Anti Debugging:

    barindex
    Found potential dummy code loops (likely to delay analysis)Show sources
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeProcess Stats: CPU usage > 90% for more than 60s
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218C664 mov eax, dword ptr fs:[00000030h]0_2_0218C664
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_021932C9 mov eax, dword ptr fs:[00000030h]0_2_021932C9
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02188730 mov eax, dword ptr fs:[00000030h]0_2_02188730
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0219286B mov eax, dword ptr fs:[00000030h]0_2_0219286B
    Source: all processesThread injection, dropped files, key value created, disk infection and DNS query: no activity detected
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_0218CAA8 rdtsc 0_2_0218CAA8
    Source: C:\Users\user\Desktop\REVGKXx6Ns.exeCode function: 0_2_02196B59 RtlAddVectoredExceptionHandler,0_2_02196B59
    Source: REVGKXx6Ns.exe, 00000000.00000002.1188147366.0000000000CD0000.00000002.00020000.sdmpBinary or memory string: Program Manager
    Source: REVGKXx6Ns.exe, 00000000.00000002.1188147366.0000000000CD0000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
    Source: REVGKXx6Ns.exe, 00000000.00000002.1188147366.0000000000CD0000.00000002.00020000.sdmpBinary or memory string: Progman
    Source: REVGKXx6Ns.exe, 00000000.00000002.1188147366.0000000000CD0000.00000002.00020000.sdmpBinary or memory string: Progmanlock

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid AccountsWindows Management InstrumentationPath InterceptionProcess Injection1Virtualization/Sandbox Evasion11OS Credential DumpingSecurity Software Discovery11Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsProcess Injection1LSASS MemoryVirtualization/Sandbox Evasion11Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or Information1Security Account ManagerProcess Discovery1SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSSystem Information Discovery1Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Is Windows Process
    • Number of created Registry Values
    • Number of created Files
    • Visual Basic
    • Delphi
    • Java
    • .Net C# or VB.NET
    • C, C++ or other language
    • Is malicious
    • Internet

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.

    windows-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    SourceDetectionScannerLabelLink
    REVGKXx6Ns.exe63%VirustotalBrowse
    REVGKXx6Ns.exe34%MetadefenderBrowse
    REVGKXx6Ns.exe71%ReversingLabsWin32.Trojan.GuLoader
    REVGKXx6Ns.exe100%Joe Sandbox ML

    Dropped Files

    No Antivirus matches

    Unpacked PE Files

    No Antivirus matches

    Domains

    No Antivirus matches

    URLs

    SourceDetectionScannerLabelLink
    http://topqualityfreeware.com0%VirustotalBrowse
    http://topqualityfreeware.com0%Avira URL Cloudsafe
    http://www.topqualityfreeware.com/0%VirustotalBrowse
    http://www.topqualityfreeware.com/0%Avira URL Cloudsafe

    Domains and IPs

    Contacted Domains

    No contacted domains info

    URLs from Memory and Binaries

    NameSourceMaliciousAntivirus DetectionReputation
    http://topqualityfreeware.comREVGKXx6Ns.exefalse
    • 0%, Virustotal, Browse
    • Avira URL Cloud: safe
    unknown
    http://www.topqualityfreeware.com/REVGKXx6Ns.exefalse
    • 0%, Virustotal, Browse
    • Avira URL Cloud: safe
    unknown

    Contacted IPs

    No contacted IP infos

    General Information

    Joe Sandbox Version:34.0.0 Boulder Opal
    Analysis ID:527899
    Start date:24.11.2021
    Start time:15:05:14
    Joe Sandbox Product:CloudBasic
    Overall analysis duration:0h 7m 29s
    Hypervisor based Inspection enabled:false
    Report type:full
    Sample file name:REVGKXx6Ns.exe
    Cookbook file name:default.jbs
    Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
    Number of analysed new started processes analysed:15
    Number of new started drivers analysed:0
    Number of existing processes analysed:0
    Number of existing drivers analysed:0
    Number of injected processes analysed:0
    Technologies:
    • HCA enabled
    • EGA enabled
    • HDC enabled
    • AMSI enabled
    Analysis Mode:default
    Analysis stop reason:Timeout
    Detection:MAL
    Classification:mal76.troj.evad.winEXE@1/1@0/0
    EGA Information:
    • Successful, ratio: 100%
    HDC Information:
    • Successful, ratio: 54.1% (good quality ratio 41%)
    • Quality average: 47.9%
    • Quality standard deviation: 35%
    HCA Information:Failed
    Cookbook Comments:
    • Adjust boot time
    • Enable AMSI
    • Found application associated with file extension: .exe
    • Override analysis time to 240s for sample files taking high CPU consumption
    Warnings:
    Show All
    • Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe
    • Excluded IPs from analysis (whitelisted): 92.122.145.220
    • Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, store-images.s-microsoft.com-c.edgekey.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com

    Simulations

    Behavior and APIs

    No simulations

    Joe Sandbox View / Context

    IPs

    No context

    Domains

    No context

    ASN

    No context

    JA3 Fingerprints

    No context

    Dropped Files

    No context

    Created / dropped Files

    C:\Users\user\AppData\Local\Temp\~DF6497174BCC55AD21.TMP
    Process:C:\Users\user\Desktop\REVGKXx6Ns.exe
    File Type:Unknown
    Category:dropped
    Size (bytes):32768
    Entropy (8bit):4.01191323271951
    Encrypted:false
    SSDEEP:384:wcZ0tADSVlx6JQhynrV7Vr9wrCIM/ZUYVPzBAPN:wcZeADSV/6qhynrV7VxwrrMvqPN
    MD5:6C4C01A4316CD9338DE51EC175EBF11D
    SHA1:8C5D5B07E0ED6AAC72705F516E25BEAEA891EFA0
    SHA-256:95876F7C1242672418DB201C02D70276EE9CC4345394DEAD3500619A39DA28F0
    SHA-512:9F60729E865B0414DB4792F76465EDCE1595D22E884D01C07389A312474D1CE916E4CF73275D5AA0CB411D8EBB0617EF661CD10467AD838FD1B0B388C44823D5
    Malicious:false
    Reputation:low
    Preview: ......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

    Static File Info

    General

    File type:PE32 executable (GUI) Intel 80386, for MS Windows
    Entropy (8bit):4.926810109816392
    TrID:
    • Win32 Executable (generic) a (10002005/4) 99.15%
    • Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81%
    • Generic Win/DOS Executable (2004/3) 0.02%
    • DOS Executable Generic (2002/1) 0.02%
    • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
    File name:REVGKXx6Ns.exe
    File size:192512
    MD5:7c91db57c98a1f0e38ba65ed651b4779
    SHA1:28cb0d40a73c1a421a9720808d49da010f9ff4ef
    SHA256:12992fe3f998693d92625c53bf5aa6723e87c8c3fb7057dbba4b334742cab376
    SHA512:2ca3ac7de708b85262bd7e9d42b0cd78cd0af4f92c1da9c7be9d2e473bcc238a5935030eff688049d8c75fd3c3fd8fd80a5703eca4ab112e3a0997e74d6ac58a
    SSDEEP:3072:tdejCYyLGrRDAfor5hlNZI71PAMrc0yvhXeJ:tdeiGrRDAfA5XXMrcbeJ
    File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i.......................*..............Rich....................PE..L.....&T.................0..........L........@....@........

    File Icon

    Icon Hash:0ceefedec6f67c0c

    Static PE Info

    General

    Entrypoint:0x40134c
    Entrypoint Section:.text
    Digitally signed:false
    Imagebase:0x400000
    Subsystem:windows gui
    Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
    DLL Characteristics:
    Time Stamp:0x54260EAF [Sat Sep 27 01:11:11 2014 UTC]
    TLS Callbacks:
    CLR (.Net) Version:
    OS Version Major:4
    OS Version Minor:0
    File Version Major:4
    File Version Minor:0
    Subsystem Version Major:4
    Subsystem Version Minor:0
    Import Hash:f27a613fda76c14f4eab7dc0085d799e

    Entrypoint Preview

    Instruction
    push 00407F64h
    call 00007F3CD8F8BE63h
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    xor byte ptr [eax], al
    add byte ptr [eax], al
    inc eax
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [edi+6Eh], ch
    jl 00007F3CD8F8BE9Fh
    iretd
    je 00007F3CD8F8BE50h
    inc edi
    mov ebp, 13705FC0h
    ror byte ptr [eax+00000034h], 00000000h
    add byte ptr [eax], al
    add dword ptr [eax], eax
    add byte ptr [eax], al
    sub byte ptr [ebp-2B77FF20h], bh
    jne 00007F3CD8F8BED6h
    jo 00007F3CD8F8BED7h
    outsb
    jnc 00007F3CD8F8BEDEh
    outsb
    add cl, bl
    add byte ptr [esi], al
    mov byte ptr [eax], al
    add byte ptr [eax], al
    add bh, bh
    int3
    xor dword ptr [eax], eax
    add eax, 79A2685Bh
    out B9h, eax
    mov eax, dword ptr [A56F894Ah]
    sbb dword ptr [esi+33505045h], ebp
    in eax, ABh
    movsd
    pushfd
    push ds
    inc edi
    inc eax
    scasd
    push edi
    jc 00007F3CD8F8BE0Bh
    je 00007F3CD8F8BE8Ah
    push ebx
    jnle 00007F3CD8F8BEACh
    dec edi
    lodsd
    xor ebx, dword ptr [ecx-48EE309Ah]
    or al, 00h
    stosb
    add byte ptr [eax-2Dh], ah
    xchg eax, ebx
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    add byte ptr [eax], al
    je 00007F3CD8F8BEDBh
    add byte ptr [eax], al
    call far 0009h : 00000068h
    push ebp
    outsb
    jo 00007F3CD8F8BEE7h
    jnc 00007F3CD8F8BEDAh
    xor eax, dword ptr fs:[eax]
    or eax, 51000901h
    jne 00007F3CD8F8BED7h
    jc 00007F3CD8F8BEDCh

    Data Directories

    NameVirtual AddressVirtual Size Is in Section
    IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_IMPORT0x235540x28.text
    IMAGE_DIRECTORY_ENTRY_RESOURCE0x260000x90d5.rsrc
    IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
    IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
    IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
    IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
    IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
    IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
    IMAGE_DIRECTORY_ENTRY_TLS0x00x0
    IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
    IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x2300x20
    IMAGE_DIRECTORY_ENTRY_IAT0x10000x100.text
    IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
    IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
    IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

    Sections

    NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
    .text0x10000x229ac0x23000False0.354959542411data5.0849300681IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
    .data0x240000x13f00x1000False0.00634765625data0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
    .rsrc0x260000x90d50xa000False0.346411132813data4.35437576998IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

    Resources

    NameRVASizeTypeLanguageCountry
    CUSTOM0x2e8170x8beMS Windows icon resource - 1 icon, 32x32, 8 bits/pixelEnglishUnited States
    INSTALL0x2d39d0x8beMS Windows icon resource - 1 icon, 32x32EnglishUnited States
    INSTALL0x2ce9a0x503ISO-8859 text, with CRLF line terminatorsEnglishUnited States
    SETUP0x2e5190x2feMS Windows icon resource - 1 icon, 32x32, 16 colorsEnglishUnited States
    SETUP0x2dc5b0x8beMS Windows icon resource - 1 icon, 32x32EnglishUnited States
    RT_ICON0x2bff20xea8data
    RT_ICON0x2b74a0x8a8data
    RT_ICON0x2b0820x6c8data
    RT_ICON0x2ab1a0x568GLS_BINARY_LSB_FIRST
    RT_ICON0x285720x25a8dBase III DBT, version number 0, next free block index 40
    RT_ICON0x274ca0x10a8dBase III DBT, version number 0, next free block index 40
    RT_ICON0x26b420x988dBase III DBT, version number 0, next free block index 40
    RT_ICON0x266da0x468GLS_BINARY_LSB_FIRST
    RT_GROUP_ICON0x266640x76data
    RT_VERSION0x263a00x2c4dataTurkmenTurkmenistan

    Imports

    DLLImport
    MSVBVM60.DLL_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaAryMove, __vbaStrVarMove, __vbaFreeVarList, __vbaVarIdiv, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFPFix, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaVar2Vec, __vbaR8Str, _adj_fdiv_m32i, _adj_fdivr_m32i, _adj_fdivr_m32, _adj_fdiv_r, __vbaI4Var, __vbaVarDup, __vbaFpI4, _CIatan, __vbaStrMove, _allmul, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

    Version Infos

    DescriptionData
    Translation0x0442 0x04b0
    LegalCopyrightIdentiv
    InternalNameObumbration1
    FileVersion1.00
    CompanyNameIdentiv
    LegalTrademarksIdentiv
    ProductNameIdentiv
    ProductVersion1.00
    FileDescriptionIdentiv
    OriginalFilenameObumbration1.exe

    Possible Origin

    Language of compilation systemCountry where language is spokenMap
    EnglishUnited States
    TurkmenTurkmenistan

    Network Behavior

    No network behavior found

    Code Manipulations

    Statistics

    CPU Usage

    Click to jump to process

    Memory Usage

    Click to jump to process

    System Behavior

    General

    Start time:15:06:10
    Start date:24/11/2021
    Path:C:\Users\user\Desktop\REVGKXx6Ns.exe
    Wow64 process (32bit):true
    Commandline:"C:\Users\user\Desktop\REVGKXx6Ns.exe"
    Imagebase:0x400000
    File size:192512 bytes
    MD5 hash:7C91DB57C98A1F0E38BA65ED651B4779
    Has elevated privileges:true
    Has administrator privileges:true
    Programmed in:Visual Basic
    Yara matches:
    • Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Author: Joe Security
    Reputation:low

    Disassembly

    Code Analysis

    Reset < >

      Execution Graph

      Execution Coverage:2.4%
      Dynamic/Decrypted Code Coverage:51.7%
      Signature Coverage:22.8%
      Total number of Nodes:377
      Total number of Limit Nodes:13

      Graph

      execution_graph 7072 422d43 __vbaChkstk 7073 422d83 #572 __vbaStrMove __vbaStrCmp __vbaFreeStr __vbaFreeVar 7072->7073 7074 423037 __vbaFreeStr __vbaFreeStr 7073->7074 7075 422dd7 #690 #598 7073->7075 7077 422e16 7075->7077 7078 422dfe __vbaNew2 7075->7078 7079 422e3f __vbaHresultCheckObj 7077->7079 7080 422e56 7077->7080 7078->7077 7079->7080 7081 422e91 7080->7081 7082 422e7a __vbaHresultCheckObj 7080->7082 7083 422e95 __vbaFreeObj 7081->7083 7082->7083 7084 422ec6 7083->7084 7085 422eae __vbaNew2 7083->7085 7086 422f06 7084->7086 7087 422eef __vbaHresultCheckObj 7084->7087 7085->7084 7088 422f4a 7086->7088 7089 422f2d __vbaHresultCheckObj 7086->7089 7087->7086 7090 422f51 __vbaStrMove __vbaFreeObj 7088->7090 7089->7090 7091 422f92 __vbaObjSet 7090->7091 7092 422f77 __vbaNew2 7090->7092 7094 422fd1 7091->7094 7092->7091 7095 422ff6 7094->7095 7096 422fdc __vbaHresultCheckObj 7094->7096 7097 422ffd #667 __vbaStrMove __vbaFreeObj __vbaFreeVar 7095->7097 7096->7097 7097->7074 6794 40134c #100 6795 401356 6794->6795 6840 2181200 6841 2181209 6840->6841 6841->6841 6844 219294d 6841->6844 6843 218130b 6845 219298d 6844->6845 6847 218c676 6844->6847 6848 2192a89 6845->6848 6849 21932c9 GetPEB 6845->6849 6847->6843 6848->6843 6850 218c676 6849->6850 6850->6848 7292 218b802 7294 218b819 7292->7294 7293 218b8ef 7296 2196b54 RtlAddVectoredExceptionHandler 7293->7296 7294->7293 7295 2196b54 RtlAddVectoredExceptionHandler 7294->7295 7298 218b8e1 7295->7298 7297 218b92b 7296->7297 7300 2196b54 RtlAddVectoredExceptionHandler 7297->7300 7299 2196b54 RtlAddVectoredExceptionHandler 7298->7299 7299->7293 7301 218ba2e 7300->7301 6851 2180a30 6852 2180a39 6851->6852 6853 219294d GetPEB 6852->6853 6854 2180b0c 6853->6854 6855 219294d GetPEB 6854->6855 6856 2180b24 6855->6856 6859 2180b33 6856->6859 6862 2196b54 6859->6862 6863 2196b59 RtlAddVectoredExceptionHandler 6862->6863 7098 2188730 7099 2188769 7098->7099 7099->7099 7100 2188844 GetPEB 7099->7100 7101 2188861 7100->7101 7101->7101 7478 218b930 7479 218b93d 7478->7479 7480 218ba2e 7479->7480 7481 2196b54 RtlAddVectoredExceptionHandler 7479->7481 7481->7480 7302 2189836 7303 2181a25 7302->7303 7303->7302 7304 218b8ce 7303->7304 7313 218c676 7303->7313 7314 2196b54 RtlAddVectoredExceptionHandler 7303->7314 7315 219294d 7303->7315 7317 218b4ff 7303->7317 7305 218b8e1 7304->7305 7306 2196b54 RtlAddVectoredExceptionHandler 7304->7306 7307 2196b54 RtlAddVectoredExceptionHandler 7305->7307 7306->7305 7308 218b8ef 7307->7308 7309 2196b54 RtlAddVectoredExceptionHandler 7308->7309 7310 218b92b 7309->7310 7311 2196b54 RtlAddVectoredExceptionHandler 7310->7311 7312 218ba2e 7311->7312 7314->7303 7315->7313 7316 21932c9 GetPEB 7315->7316 7316->7313 7317->7304 7318 2196b54 RtlAddVectoredExceptionHandler 7317->7318 7319 218b64c 7318->7319 7319->7304 7320 2196b54 RtlAddVectoredExceptionHandler 7319->7320 7321 218b6b4 7320->7321 7321->7304 7322 218b7b3 7321->7322 7323 2196b54 RtlAddVectoredExceptionHandler 7322->7323 7324 218b7e0 7323->7324 7325 2196b54 RtlAddVectoredExceptionHandler 7324->7325 7326 218b8cd 7325->7326 7482 2181d2a 7483 219294d GetPEB 7482->7483 7484 2181d4a 7483->7484 6864 218e22d 6865 219294d GetPEB 6864->6865 6866 218e23f 6865->6866 6867 219294d GetPEB 6866->6867 6868 218e255 6867->6868 6869 219294d GetPEB 6868->6869 6870 218e26b 6869->6870 6871 219294d GetPEB 6870->6871 6872 218e33c 6871->6872 6873 219294d GetPEB 6872->6873 6875 218e357 6873->6875 6874 2196b54 RtlAddVectoredExceptionHandler 6874->6875 6875->6874 6876 219294d 6875->6876 6879 218eca6 6875->6879 6894 2181a25 6875->6894 6877 21932c9 GetPEB 6876->6877 6882 218c676 6876->6882 6877->6882 6878 218b8ce 6880 218b8e1 6878->6880 6881 2196b54 RtlAddVectoredExceptionHandler 6878->6881 6884 2196b54 RtlAddVectoredExceptionHandler 6879->6884 6883 2196b54 RtlAddVectoredExceptionHandler 6880->6883 6881->6880 6886 218b8ef 6883->6886 6885 218ed8f 6884->6885 6887 2196b54 RtlAddVectoredExceptionHandler 6885->6887 6889 2196b54 RtlAddVectoredExceptionHandler 6886->6889 6888 218eda6 6887->6888 6890 218b92b 6889->6890 6891 2196b54 RtlAddVectoredExceptionHandler 6890->6891 6892 218ba2e 6891->6892 6893 2196b54 RtlAddVectoredExceptionHandler 6893->6894 6894->6876 6894->6878 6894->6882 6894->6893 6895 218b4ff 6894->6895 6895->6878 6896 2196b54 RtlAddVectoredExceptionHandler 6895->6896 6897 218b64c 6896->6897 6897->6878 6898 2196b54 RtlAddVectoredExceptionHandler 6897->6898 6899 218b6b4 6898->6899 6899->6878 6900 218b7b3 6899->6900 6901 2196b54 RtlAddVectoredExceptionHandler 6900->6901 6902 218b7e0 6901->6902 6903 2196b54 RtlAddVectoredExceptionHandler 6902->6903 6904 218b8cd 6903->6904 7680 2182da1 7681 2182e9c 7680->7681 7686 218c664 GetPEB 7681->7686 7683 2182ede 7684 219294d GetPEB 7683->7684 7685 2182f21 7684->7685 7686->7683 7485 2181923 7496 2181a13 7485->7496 7486 218b8ce 7487 218b8e1 7486->7487 7488 2196b54 RtlAddVectoredExceptionHandler 7486->7488 7489 2196b54 RtlAddVectoredExceptionHandler 7487->7489 7488->7487 7490 218b8ef 7489->7490 7491 2196b54 RtlAddVectoredExceptionHandler 7490->7491 7492 218b92b 7491->7492 7493 2196b54 RtlAddVectoredExceptionHandler 7492->7493 7494 218ba2e 7493->7494 7495 2196b54 RtlAddVectoredExceptionHandler 7495->7496 7496->7486 7496->7495 7497 219294d 7496->7497 7499 218c676 7496->7499 7500 218b4ff 7496->7500 7498 21932c9 GetPEB 7497->7498 7497->7499 7498->7499 7500->7486 7501 2196b54 RtlAddVectoredExceptionHandler 7500->7501 7502 218b64c 7501->7502 7502->7486 7503 2196b54 RtlAddVectoredExceptionHandler 7502->7503 7504 218b6b4 7503->7504 7504->7486 7505 218b7b3 7504->7505 7506 2196b54 RtlAddVectoredExceptionHandler 7505->7506 7507 218b7e0 7506->7507 7508 2196b54 RtlAddVectoredExceptionHandler 7507->7508 7509 218b8cd 7508->7509 6724 421c84 __vbaChkstk 6725 421ccf 6724->6725 6755 4224bc __vbaChkstk 6725->6755 6726 421d15 6727 421d38 6726->6727 6728 421d1e __vbaHresultCheckObj 6726->6728 6729 421d73 6727->6729 6730 421d59 __vbaHresultCheckObj 6727->6730 6728->6727 6731 421da8 6729->6731 6732 421d8e __vbaHresultCheckObj 6729->6732 6730->6729 6733 421db5 __vbaNew2 6731->6733 6734 421dcd __vbaObjSet 6731->6734 6732->6731 6733->6734 6736 421e06 6734->6736 6737 421e11 __vbaHresultCheckObj 6736->6737 6738 421e2b 6736->6738 6737->6738 6739 421e50 __vbaObjSet 6738->6739 6740 421e38 __vbaNew2 6738->6740 6742 421e86 6739->6742 6740->6739 6743 421e91 __vbaHresultCheckObj 6742->6743 6744 421ea8 6742->6744 6743->6744 6745 421ee1 __vbaHresultCheckObj 6744->6745 6746 421efb 6744->6746 6747 421eff __vbaFreeObjList 6745->6747 6746->6747 6780 423087 __vbaChkstk 6747->6780 6756 422505 __vbaVarDup #557 __vbaFreeVar 6755->6756 6757 422822 __vbaAryDestruct __vbaFreeStr __vbaFreeStr 6756->6757 6758 422558 6 API calls 6756->6758 6757->6726 6760 4225d0 6758->6760 6761 4225b5 __vbaNew2 6758->6761 6762 422619 6760->6762 6763 4225ff __vbaHresultCheckObj 6760->6763 6761->6760 6764 422643 __vbaHresultCheckObj 6762->6764 6765 422660 6762->6765 6763->6762 6766 422667 __vbaStrMove __vbaFreeObj 6764->6766 6765->6766 6767 4226a1 __vbaNew2 6766->6767 6768 4226bc __vbaObjSet 6766->6768 6767->6768 6770 4226fe 6768->6770 6771 422726 6770->6771 6772 422709 __vbaHresultCheckObj 6770->6772 6773 422751 6771->6773 6774 422736 __vbaNew2 6771->6774 6772->6771 6775 42275b __vbaChkstk __vbaChkstk 6773->6775 6774->6775 6776 4227c2 6775->6776 6777 4227e7 6776->6777 6778 4227cd __vbaHresultCheckObj 6776->6778 6779 4227ee __vbaVar2Vec __vbaAryMove __vbaFreeObj __vbaFreeVarList 6777->6779 6778->6779 6779->6757 6781 4230c7 6780->6781 6782 423100 6781->6782 6783 4230e6 __vbaHresultCheckObj 6781->6783 6789 4234b0 __vbaChkstk #644 6782->6789 6783->6782 6785 423109 __vbaVarMove __vbaVarMove __vbaVarIdiv __vbaI4Var 6790 4090a6 6785->6790 6789->6785 6791 4091a8 VirtualAlloc 6790->6791 6793 4093b2 6791->6793 7687 21811d3 7688 21811f2 7687->7688 7688->7688 7689 219294d GetPEB 7688->7689 7690 218130b 7689->7690 6796 2196b54 6798 2196b59 6796->6798 6800 2196b64 6798->6800 6799 219792a 6800->6799 6801 2197913 RtlAddVectoredExceptionHandler 6800->6801 6801->6799 6909 2181648 6910 2181672 6909->6910 6911 219294d GetPEB 6910->6911 6912 2181782 6910->6912 6911->6910 7017 218b6cf 7018 218b6e1 7017->7018 7019 218b8ce 7018->7019 7020 218b7b3 7018->7020 7021 218b8e1 7019->7021 7022 2196b54 RtlAddVectoredExceptionHandler 7019->7022 7023 2196b54 RtlAddVectoredExceptionHandler 7020->7023 7025 2196b54 RtlAddVectoredExceptionHandler 7021->7025 7022->7021 7024 218b7e0 7023->7024 7027 2196b54 RtlAddVectoredExceptionHandler 7024->7027 7026 218b8ef 7025->7026 7029 2196b54 RtlAddVectoredExceptionHandler 7026->7029 7028 218b8cd 7027->7028 7030 218b92b 7029->7030 7031 2196b54 RtlAddVectoredExceptionHandler 7030->7031 7032 218ba2e 7031->7032 7231 2184fc5 7232 2196b54 RtlAddVectoredExceptionHandler 7231->7232 7233 2184fdc 7232->7233 7691 421fa2 __vbaChkstk 7692 421fe3 7691->7692 7693 42200b 7692->7693 7694 421fee __vbaHresultCheckObj 7692->7694 7695 422012 7 API calls 7693->7695 7694->7695 7696 422078 7695->7696 7697 4223ad 7695->7697 7698 422081 __vbaNew2 7696->7698 7699 42209c 7696->7699 7700 4223d1 __vbaObjSet 7697->7700 7701 4223b6 __vbaNew2 7697->7701 7698->7699 7703 4220d1 __vbaHresultCheckObj 7699->7703 7704 4220ee 7699->7704 7705 422413 7700->7705 7701->7700 7703->7704 7710 422144 7704->7710 7711 422124 __vbaHresultCheckObj 7704->7711 7706 422444 7705->7706 7707 422424 __vbaHresultCheckObj 7705->7707 7708 42244b __vbaFreeObj 7706->7708 7707->7708 7709 422486 __vbaFreeStr __vbaFreeStr __vbaFreeVar 7708->7709 7712 42214b __vbaFreeObj 7710->7712 7711->7712 7713 422164 __vbaNew2 7712->7713 7714 42217f 7712->7714 7713->7714 7715 4221d1 7714->7715 7716 4221b4 __vbaHresultCheckObj 7714->7716 7717 42220a __vbaHresultCheckObj 7715->7717 7718 42222d 7715->7718 7716->7715 7719 422234 __vbaStrMove __vbaFreeObj 7717->7719 7718->7719 7720 422260 __vbaNew2 7719->7720 7721 42227b 7719->7721 7720->7721 7722 4222b0 __vbaHresultCheckObj 7721->7722 7723 4222cd 7721->7723 7722->7723 7724 422306 __vbaHresultCheckObj 7723->7724 7725 422329 7723->7725 7726 422330 9 API calls 7724->7726 7725->7726 7726->7697 7033 4228a8 __vbaChkstk 7034 4228e8 #707 __vbaStrMove 7033->7034 7035 422904 __vbaNew2 7034->7035 7036 42291c __vbaObjSet 7034->7036 7035->7036 7038 422951 7036->7038 7039 422976 7038->7039 7040 42295c __vbaHresultCheckObj 7038->7040 7041 42297a __vbaFreeObj 7039->7041 7040->7041 7042 422992 __vbaFreeStr 7041->7042 7068 2183eea 7069 218c53c 7068->7069 7070 2196b54 RtlAddVectoredExceptionHandler 7069->7070 7071 218c662 7070->7071 7427 219286b GetPEB 7234 4229ba __vbaChkstk 7235 4229fa __vbaR8Str __vbaFPFix __vbaFpR8 7234->7235 7236 422d02 __vbaFreeStr 7235->7236 7237 422a1d 7235->7237 7238 422a26 __vbaNew2 7237->7238 7239 422a3e 7237->7239 7238->7239 7241 422a67 __vbaHresultCheckObj 7239->7241 7242 422a7e 7239->7242 7241->7242 7243 422aa5 __vbaHresultCheckObj 7242->7243 7244 422abf 7242->7244 7245 422ac3 __vbaFreeObj 7243->7245 7244->7245 7246 422af4 7245->7246 7247 422adc __vbaNew2 7245->7247 7248 422b34 7246->7248 7249 422b1d __vbaHresultCheckObj 7246->7249 7247->7246 7250 422b75 7248->7250 7251 422b5b __vbaHresultCheckObj 7248->7251 7249->7248 7252 422b79 __vbaFreeObj 7250->7252 7251->7252 7253 422b92 __vbaNew2 7252->7253 7254 422baa 7252->7254 7253->7254 7255 422bd3 __vbaHresultCheckObj 7254->7255 7256 422bea 7254->7256 7255->7256 7257 422c11 __vbaHresultCheckObj 7256->7257 7258 422c2b 7256->7258 7259 422c2f __vbaStrMove __vbaFreeObj 7257->7259 7258->7259 7260 422c55 __vbaNew2 7259->7260 7261 422c6d 7259->7261 7260->7261 7262 422c96 __vbaHresultCheckObj 7261->7262 7263 422cad 7261->7263 7262->7263 7264 422cd4 __vbaHresultCheckObj 7263->7264 7265 422cee 7263->7265 7266 422cf2 __vbaFreeObj 7264->7266 7265->7266 7266->7236 7610 218b561 7611 218b56d 7610->7611 7612 218b64c 7611->7612 7613 2196b54 RtlAddVectoredExceptionHandler 7611->7613 7614 218b8ce 7612->7614 7617 2196b54 RtlAddVectoredExceptionHandler 7612->7617 7613->7612 7615 218b8e1 7614->7615 7616 2196b54 RtlAddVectoredExceptionHandler 7614->7616 7618 2196b54 RtlAddVectoredExceptionHandler 7615->7618 7616->7615 7619 218b6b4 7617->7619 7620 218b8ef 7618->7620 7619->7614 7621 218b7b3 7619->7621 7623 2196b54 RtlAddVectoredExceptionHandler 7620->7623 7622 2196b54 RtlAddVectoredExceptionHandler 7621->7622 7625 218b7e0 7622->7625 7624 218b92b 7623->7624 7626 2196b54 RtlAddVectoredExceptionHandler 7624->7626 7627 2196b54 RtlAddVectoredExceptionHandler 7625->7627 7628 218ba2e 7626->7628 7629 218b8cd 7627->7629 6802 4231bd __vbaChkstk __vbaObjSetAddref 6803 423205 6802->6803 6804 423210 __vbaHresultCheckObj 6803->6804 6805 423227 6803->6805 6806 42322b __vbaObjSetAddref #644 6804->6806 6805->6806 6817 42343e __vbaChkstk 6806->6817 6809 42343e 5 API calls 6810 42325f 6809->6810 6825 42337d __vbaChkstk 6810->6825 6812 423272 __vbaChkstk __vbaChkstk 6813 4232be 6812->6813 6814 4232c9 __vbaHresultCheckObj 6813->6814 6815 4232e3 __vbaFreeObj 6813->6815 6814->6815 6818 42324c __vbaFreeObj 6817->6818 6819 423454 6817->6819 6818->6809 6827 4233d7 __vbaChkstk 6819->6827 6822 4233d7 3 API calls 6823 42346b 6822->6823 6835 423355 __vbaChkstk 6823->6835 6826 423394 6825->6826 6826->6812 6828 4233ed 6827->6828 6834 42340b 6827->6834 6836 42347e __vbaChkstk 6828->6836 6831 42347e __vbaChkstk 6832 423402 6831->6832 6838 423500 __vbaChkstk 6832->6838 6834->6822 6835->6818 6837 4233f5 6836->6837 6837->6831 6839 42351b 6838->6839 6839->6834

      Executed Functions

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 121 2196b59-2196b63 122 2196b64-2196d64 121->122 126 2196d6a-2196f25 call 21949b7 122->126 131 2196f2b-2197013 126->131 133 2197019-21971d0 131->133 136 21971d6-21972e5 133->136 138 21972eb-219769c call 219794d 136->138 146 219793e-219794a 138->146 147 21976a2-21976cf 138->147 147->146 148 21976d5-21976e7 147->148 148->146 149 21976ed-21976ff 148->149 149->146 150 2197705-2197804 149->150 150->146 152 219780a-219781c 150->152 152->146 153 2197822-2197834 152->153 153->146 154 219783a-2197924 call 219794d RtlAddVectoredExceptionHandler 153->154 158 219792a-2197934 154->158 158->158 159 2197936 158->159 159->146
      APIs
      • RtlAddVectoredExceptionHandler.NTDLL ref: 02197913
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID: ExceptionHandlerVectored
      • String ID: vI^^
      • API String ID: 3310709589-3098581562
      • Opcode ID: 39b878f89f5b8c3569eb505e92ba11154311da5e125d226ee74c7d4780dcd4e4
      • Instruction ID: 4b3871058260eaae373f57145e305202997f66e5af122f0095594e726abcc0d6
      • Opcode Fuzzy Hash: 39b878f89f5b8c3569eb505e92ba11154311da5e125d226ee74c7d4780dcd4e4
      • Instruction Fuzzy Hash: D761BFB0594388CFDF79DE24C9957EB77A2FF45310F51812ACC5A8B698D3309A42CB61
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 160 4090a6-409230 163 409234-409250 160->163 163->163 164 409252-4093ad VirtualAlloc call 40948c 163->164 166 4093b2-4093be 164->166 167 4093c2-409453 166->167 167->167 168 409459-409464 167->168
      C-Code - Quality: 41%
      			E004090A6() {
      				void* _t95;
      
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				asm("invalid");
      				 *((intOrPtr*)(_t95 - 1))(_t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95, _t95);
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				 *((intOrPtr*)(_t95 - 1))();
      				asm("arpl [ebp+0x31], sp");
      			}




      0x004090a6
      0x004090a9
      0x004090ac
      0x004090af
      0x004090b2
      0x004090b5
      0x004090b8
      0x004090ba
      0x004090bd
      0x004090c0
      0x004090c3
      0x004090c6
      0x004090c9
      0x004090cc
      0x004090cf
      0x004090d2
      0x004090d5
      0x004090d8
      0x004090db
      0x004090de
      0x004090e1
      0x004090e4
      0x004090e7
      0x004090ea
      0x004090ed
      0x004090f0
      0x004090f3
      0x004090f6
      0x004090f9
      0x004090fc
      0x004090ff
      0x00409102
      0x00409105
      0x00409108
      0x0040910b
      0x0040910e
      0x00409111
      0x00409114
      0x00409117
      0x0040911a
      0x0040911d
      0x00409120
      0x00409123
      0x00409126
      0x00409129
      0x0040912c
      0x0040912f
      0x00409130
      0x00409133
      0x00409136
      0x00409139
      0x0040913c
      0x0040913f
      0x00409142
      0x00409145
      0x00409148
      0x0040914b
      0x0040914e
      0x00409151
      0x00409154
      0x00409157
      0x0040915a
      0x0040915d
      0x00409160
      0x00409163
      0x00409166
      0x00409169
      0x0040916c
      0x0040916f
      0x00409172
      0x00409175
      0x00409178
      0x0040917b
      0x0040917e
      0x00409181
      0x00409184
      0x00409187
      0x0040918a
      0x0040918d
      0x00409190
      0x00409193
      0x00409196
      0x00409199
      0x0040919c
      0x0040919f
      0x004091a2
      0x004091a5
      0x004091a8

      APIs
      • VirtualAlloc.KERNELBASE(00000000,-760665F9,-D2FD2477,-457D82B5), ref: 004093A1
      Memory Dump Source
      • Source File: 00000000.00000002.1187873898.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1187867422.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187894169.0000000000424000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187905826.0000000000426000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_REVGKXx6Ns.jbxd
      Similarity
      • API ID: AllocVirtual
      • String ID:
      • API String ID: 4275171209-0
      • Opcode ID: 9af425cb16f488050c1cee96c630ccc42989450789e9ccd9fec85aba6ce82fda
      • Instruction ID: 83c7e78455ad517ca35449e9a4c06ec8ae45d743bf9e7ff757a8edb1f19fab3b
      • Opcode Fuzzy Hash: 9af425cb16f488050c1cee96c630ccc42989450789e9ccd9fec85aba6ce82fda
      • Instruction Fuzzy Hash: 6A9168B2804718AFEBC45F60D58A79E7BF0FF143A9F926409FC8252091D7BC89C58B81
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      C-Code - Quality: 55%
      			E004224BC(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
      				intOrPtr _v8;
      				intOrPtr _v16;
      				intOrPtr _v20;
      				intOrPtr _v24;
      				intOrPtr _v28;
      				char _v40;
      				void* _v44;
      				intOrPtr _v48;
      				void* _v52;
      				signed int _v56;
      				char _v60;
      				intOrPtr _v68;
      				char _v76;
      				char _v92;
      				char _v96;
      				char* _v104;
      				char _v112;
      				void* _v116;
      				signed int _v120;
      				intOrPtr* _v124;
      				signed int _v128;
      				signed int _v152;
      				signed int _v156;
      				intOrPtr* _v160;
      				signed int _v164;
      				signed int _v168;
      				intOrPtr* _v172;
      				signed int _v176;
      				intOrPtr* _v180;
      				signed int _v184;
      				char* _t126;
      				char* _t128;
      				signed int _t136;
      				signed int _t141;
      				char* _t146;
      				signed int _t150;
      				signed int _t160;
      				void* _t192;
      				void* _t194;
      				intOrPtr _t195;
      
      				_t195 = _t194 - 0x18;
      				 *[fs:0x0] = _t195;
      				L004011D0();
      				_v28 = _t195;
      				_v24 = 0x401120;
      				_v20 = 0;
      				_v16 = 0;
      				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4011d6, _t192);
      				_v8 = 1;
      				_v8 = 2;
      				_v104 = L"1-1-1";
      				_v112 = 8;
      				L004012F6();
      				_t126 =  &_v76;
      				_push(_t126); // executed
      				L004012C6(); // executed
      				_v116 =  ~(0 | _t126 != 0x0000ffff);
      				L00401314();
      				if(_v116 != 0) {
      					_v8 = 3;
      					_push(0);
      					L004012C0();
      					_v8 = 4;
      					_push(1);
      					_push(1);
      					_push(1);
      					_push( &_v76);
      					L004012B4();
      					_push( &_v76);
      					L004012BA();
      					L00401302();
      					L00401314();
      					_v8 = 5;
      					_push(0xffffffff);
      					L004012C0();
      					_v8 = 6;
      					if( *0x4245b4 != 0) {
      						_v160 = 0x4245b4;
      					} else {
      						_push(0x4245b4);
      						_push(0x408c9c);
      						L00401320();
      						_v160 = 0x4245b4;
      					}
      					_v116 =  *_v160;
      					_t136 =  *((intOrPtr*)( *_v116 + 0x14))(_v116,  &_v60);
      					asm("fclex");
      					_v120 = _t136;
      					if(_v120 >= 0) {
      						_v164 = _v164 & 0x00000000;
      					} else {
      						_push(0x14);
      						_push(0x408c8c);
      						_push(_v116);
      						_push(_v120);
      						L0040132C();
      						_v164 = _t136;
      					}
      					_v124 = _v60;
      					_t141 =  *((intOrPtr*)( *_v124 + 0xe8))(_v124,  &_v56);
      					asm("fclex");
      					_v128 = _t141;
      					if(_v128 >= 0) {
      						_v168 = _v168 & 0x00000000;
      					} else {
      						_push(0xe8);
      						_push(0x408cac);
      						_push(_v124);
      						_push(_v128);
      						L0040132C();
      						_v168 = _t141;
      					}
      					_v152 = _v56;
      					_v56 = _v56 & 0x00000000;
      					L00401302();
      					L004012EA();
      					_v8 = 7;
      					_v8 = 8;
      					if( *0x424010 != 0) {
      						_v172 = 0x424010;
      					} else {
      						_push(0x424010);
      						_push(0x4083f0);
      						L00401320();
      						_v172 = 0x424010;
      					}
      					_t146 =  &_v60;
      					L00401326();
      					_v116 = _t146;
      					_t150 =  *((intOrPtr*)( *_v116 + 0x170))(_v116,  &_v56, _t146,  *((intOrPtr*)( *((intOrPtr*)( *_v172)) + 0x30c))( *_v172));
      					asm("fclex");
      					_v120 = _t150;
      					if(_v120 >= 0) {
      						_v176 = _v176 & 0x00000000;
      					} else {
      						_push(0x170);
      						_push(0x408ce0);
      						_push(_v116);
      						_push(_v120);
      						L0040132C();
      						_v176 = _t150;
      					}
      					if( *0x4245b4 != 0) {
      						_v180 = 0x4245b4;
      					} else {
      						_push(0x4245b4);
      						_push(0x408c9c);
      						L00401320();
      						_v180 = 0x4245b4;
      					}
      					_v124 =  *_v180;
      					_v156 = _v56;
      					_v56 = _v56 & 0x00000000;
      					_v68 = _v156;
      					_v76 = 8;
      					_v104 = 0xc4;
      					_v112 = 2;
      					L004011D0();
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					L004011D0();
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					asm("movsd");
      					_t160 =  *((intOrPtr*)( *_v124 + 0x38))(_v124, 0x10, 0x10,  &_v92);
      					asm("fclex");
      					_v128 = _t160;
      					if(_v128 >= 0) {
      						_v184 = _v184 & 0x00000000;
      					} else {
      						_push(0x38);
      						_push(0x408c8c);
      						_push(_v124);
      						_push(_v128);
      						L0040132C();
      						_v184 = _t160;
      					}
      					_push( &_v92);
      					_push( &_v96);
      					L004012A8();
      					_push( &_v96);
      					_push( &_v40);
      					L004012AE();
      					L004012EA();
      					_push( &_v92);
      					_push( &_v76);
      					_push(2);
      					L004012CC();
      				}
      				_v8 = 0xa;
      				_v48 = 0x78a6b3;
      				_push(0x422881);
      				_t128 =  &_v40;
      				_push(_t128);
      				_push(0);
      				L004012A2();
      				L004012F0();
      				L004012F0();
      				return _t128;
      			}











































      0x004224bf
      0x004224ce
      0x004224da
      0x004224e2
      0x004224e5
      0x004224ec
      0x004224f3
      0x00422502
      0x00422505
      0x0042250c
      0x00422513
      0x0042251a
      0x00422527
      0x0042252c
      0x0042252f
      0x00422530
      0x00422540
      0x00422547
      0x00422552
      0x00422558
      0x0042255f
      0x00422561
      0x00422566
      0x0042256d
      0x0042256f
      0x00422571
      0x00422576
      0x00422577
      0x0042257f
      0x00422580
      0x0042258a
      0x00422592
      0x00422597
      0x0042259e
      0x004225a0
      0x004225a5
      0x004225b3
      0x004225d0
      0x004225b5
      0x004225b5
      0x004225ba
      0x004225bf
      0x004225c4
      0x004225c4
      0x004225e2
      0x004225f1
      0x004225f4
      0x004225f6
      0x004225fd
      0x00422619
      0x004225ff
      0x004225ff
      0x00422601
      0x00422606
      0x00422609
      0x0042260c
      0x00422611
      0x00422611
      0x00422623
      0x00422632
      0x00422638
      0x0042263a
      0x00422641
      0x00422660
      0x00422643
      0x00422643
      0x00422648
      0x0042264d
      0x00422650
      0x00422653
      0x00422658
      0x00422658
      0x0042266a
      0x00422670
      0x0042267d
      0x00422685
      0x0042268a
      0x00422691
      0x0042269f
      0x004226bc
      0x004226a1
      0x004226a1
      0x004226a6
      0x004226ab
      0x004226b0
      0x004226b0
      0x004226e0
      0x004226e4
      0x004226e9
      0x004226f8
      0x004226fe
      0x00422700
      0x00422707
      0x00422726
      0x00422709
      0x00422709
      0x0042270e
      0x00422713
      0x00422716
      0x00422719
      0x0042271e
      0x0042271e
      0x00422734
      0x00422751
      0x00422736
      0x00422736
      0x0042273b
      0x00422740
      0x00422745
      0x00422745
      0x00422763
      0x00422769
      0x0042276f
      0x00422779
      0x0042277c
      0x00422783
      0x0042278a
      0x00422798
      0x004227a2
      0x004227a3
      0x004227a4
      0x004227a5
      0x004227a9
      0x004227b3
      0x004227b4
      0x004227b5
      0x004227b6
      0x004227bf
      0x004227c2
      0x004227c4
      0x004227cb
      0x004227e7
      0x004227cd
      0x004227cd
      0x004227cf
      0x004227d4
      0x004227d7
      0x004227da
      0x004227df
      0x004227df
      0x004227f1
      0x004227f5
      0x004227f6
      0x004227fe
      0x00422802
      0x00422803
      0x0042280b
      0x00422813
      0x00422817
      0x00422818
      0x0042281a
      0x0042281f
      0x00422822
      0x00422829
      0x00422830
      0x00422865
      0x00422868
      0x00422869
      0x0042286b
      0x00422873
      0x0042287b
      0x00422880

      APIs
      • __vbaChkstk.MSVBVM60(?,004011D6), ref: 004224DA
      • __vbaVarDup.MSVBVM60 ref: 00422527
      • #557.MSVBVM60(?), ref: 00422530
      • __vbaFreeVar.MSVBVM60(?), ref: 00422547
      • __vbaOnError.MSVBVM60(00000000,?), ref: 00422561
      • #539.MSVBVM60(?,00000001,00000001,00000001,00000000,?), ref: 00422577
      • __vbaStrVarMove.MSVBVM60(?,?,00000001,00000001,00000001,00000000,?), ref: 00422580
      • __vbaStrMove.MSVBVM60(?,?,00000001,00000001,00000001,00000000,?), ref: 0042258A
      • __vbaFreeVar.MSVBVM60(?,?,00000001,00000001,00000001,00000000,?), ref: 00422592
      • __vbaOnError.MSVBVM60(000000FF,?,?,00000001,00000001,00000001,00000000,?), ref: 004225A0
      • __vbaNew2.MSVBVM60(00408C9C,004245B4,000000FF,?,?,00000001,00000001,00000001,00000000,?), ref: 004225BF
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408C8C,00000014,?,?,?,?,000000FF,?,?,00000001,00000001,00000001,00000000,?), ref: 0042260C
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408CAC,000000E8,?,?,?,?,000000FF,?,?,00000001,00000001,00000001,00000000,?), ref: 00422653
      • __vbaStrMove.MSVBVM60(?,?,?,?,?,?,000000FF,?,?,00000001,00000001,00000001,00000000,?), ref: 0042267D
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,000000FF,?,?,00000001,00000001,00000001,00000000,?), ref: 00422685
      • __vbaNew2.MSVBVM60(004083F0,00424010,?,?,?,?,?,?,000000FF,?,?,00000001,00000001,00000001,00000000,?), ref: 004226AB
      • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,000000FF,?,?,00000001,00000001,00000001,00000000,?), ref: 004226E4
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408CE0,00000170,?,?,?,?,?,?,000000FF,?,?,00000001,00000001,00000001), ref: 00422719
      • __vbaNew2.MSVBVM60(00408C9C,004245B4,?,?,?,?,?,?,?,?,000000FF,?,?,00000001,00000001,00000001), ref: 00422740
      • __vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,000000FF,?,?,00000001,00000001,00000001,00000000), ref: 00422798
      • __vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,?,000000FF,?,?,00000001,00000001,00000001,00000000), ref: 004227A9
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408C8C,00000038,?,?,?,?,?,?,?,?,000000FF,?,?,00000001), ref: 004227DA
      • __vbaVar2Vec.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,000000FF,?,?,00000001), ref: 004227F6
      • __vbaAryMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF,?), ref: 00422803
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,000000FF,?), ref: 0042280B
      • __vbaFreeVarList.MSVBVM60(00000002,00000008,?,?,?,?,?), ref: 0042281A
      • __vbaAryDestruct.MSVBVM60(00000000,?,00422881,?), ref: 0042286B
      • __vbaFreeStr.MSVBVM60(00000000,?,00422881,?), ref: 00422873
      • __vbaFreeStr.MSVBVM60(00000000,?,00422881,?), ref: 0042287B
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1187873898.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1187867422.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187894169.0000000000424000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187905826.0000000000426000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_REVGKXx6Ns.jbxd
      Similarity
      • API ID: __vba$Free$CheckHresultMove$ChkstkNew2$Error$#539#557DestructListVar2
      • String ID: 1-1-1
      • API String ID: 3049740634-1550238906
      • Opcode ID: 387cd591570286525ff3356044a243cd23a5dad8bcf11dab72fc859641b9700b
      • Instruction ID: 266805509d46f1263df445320976800c9ec1b5ea9bc499dbbfa868dfaf758611
      • Opcode Fuzzy Hash: 387cd591570286525ff3356044a243cd23a5dad8bcf11dab72fc859641b9700b
      • Instruction Fuzzy Hash: 17B10A70A00218EFDB20EFA1D945BDDBBB4BF08304F50416EE505B72A1D7B95A85CF59
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      C-Code - Quality: 59%
      			E00421C84(void* __ebx, void* __edi, void* __esi, signed int _a4) {
      				signed int _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				short _v28;
      				signed int _v32;
      				char _v36;
      				char _v40;
      				char _v56;
      				char _v60;
      				char _v64;
      				signed int _v68;
      				char _v72;
      				signed int _v76;
      				signed int _v80;
      				intOrPtr* _v84;
      				signed int _v88;
      				signed int _v92;
      				signed int _v104;
      				signed int _v108;
      				signed int _v112;
      				intOrPtr* _v116;
      				signed int _v120;
      				intOrPtr* _v124;
      				signed int _v128;
      				signed int _v132;
      				signed int _v136;
      				signed int _t136;
      				signed int _t140;
      				signed int _t143;
      				signed int _t147;
      				signed int _t151;
      				char* _t155;
      				signed int _t159;
      				signed int _t165;
      				signed int _t171;
      				intOrPtr _t178;
      				void* _t182;
      				void* _t184;
      				intOrPtr _t185;
      
      				_t185 = _t184 - 0xc;
      				 *[fs:0x0] = _t185;
      				L004011D0();
      				_v16 = _t185;
      				_v12 = 0x401100;
      				_v8 = _a4 & 0x00000001;
      				_a4 = _a4 & 0xfffffffe;
      				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x70,  *[fs:0x0], 0x4011d6, _t182);
      				_v68 = 0x429ee4;
      				 *((intOrPtr*)( *_a4 + 0x710))(_a4, 0x3b28, 0xa572be70, 0x5b03,  &_v68,  &_v60);
      				_v28 = _v60;
      				_t136 =  *((intOrPtr*)( *_a4 + 0x6f8))(_a4,  &_v68);
      				_v76 = _t136;
      				if(_v76 >= 0) {
      					_v104 = _v104 & 0x00000000;
      				} else {
      					_push(0x6f8);
      					_push(0x408b14);
      					_push(_a4);
      					_push(_v76);
      					L0040132C();
      					_v104 = _t136;
      				}
      				_v32 = _v68;
      				_t140 =  *((intOrPtr*)( *_a4 + 0x6fc))(_a4);
      				_v76 = _t140;
      				if(_v76 >= 0) {
      					_v108 = _v108 & 0x00000000;
      				} else {
      					_push(0x6fc);
      					_push(0x408b14);
      					_push(_a4);
      					_push(_v76);
      					L0040132C();
      					_v108 = _t140;
      				}
      				_t143 =  *((intOrPtr*)( *_a4 + 0x700))(_a4);
      				_v76 = _t143;
      				if(_v76 >= 0) {
      					_v112 = _v112 & 0x00000000;
      				} else {
      					_push(0x700);
      					_push(0x408b14);
      					_push(_a4);
      					_push(_v76);
      					L0040132C();
      					_v112 = _t143;
      				}
      				if( *0x424010 != 0) {
      					_v116 = 0x424010;
      				} else {
      					_push(0x424010);
      					_push(0x4083f0);
      					L00401320();
      					_v116 = 0x424010;
      				}
      				_t147 =  &_v36;
      				L00401326();
      				_v76 = _t147;
      				_t151 =  *((intOrPtr*)( *_v76 + 0x1f0))(_v76,  &_v60, _t147,  *((intOrPtr*)( *((intOrPtr*)( *_v116)) + 0x300))( *_v116));
      				asm("fclex");
      				_v80 = _t151;
      				if(_v80 >= 0) {
      					_v120 = _v120 & 0x00000000;
      				} else {
      					_push(0x1f0);
      					_push(0x408c60);
      					_push(_v76);
      					_push(_v80);
      					L0040132C();
      					_v120 = _t151;
      				}
      				if( *0x424010 != 0) {
      					_v124 = 0x424010;
      				} else {
      					_push(0x424010);
      					_push(0x4083f0);
      					L00401320();
      					_v124 = 0x424010;
      				}
      				_t178 =  *((intOrPtr*)( *_v124));
      				_t155 =  &_v40;
      				L00401326();
      				_v84 = _t155;
      				_t159 =  *((intOrPtr*)( *_v84 + 0x68))(_v84,  &_v68, _t155,  *((intOrPtr*)(_t178 + 0x2fc))( *_v124));
      				asm("fclex");
      				_v88 = _t159;
      				if(_v88 >= 0) {
      					_v128 = _v128 & 0x00000000;
      				} else {
      					_push(0x68);
      					_push(0x408c60);
      					_push(_v84);
      					_push(_v88);
      					L0040132C();
      					_v128 = _t159;
      				}
      				_v72 = 1;
      				_v64 = _v60;
      				_v128 = _v68;
      				_t165 =  *((intOrPtr*)( *_a4 + 0x704))(_a4,  &_v64, _t178,  &_v72);
      				_v92 = _t165;
      				if(_v92 >= 0) {
      					_v132 = _v132 & 0x00000000;
      				} else {
      					_push(0x704);
      					_push(0x408b14);
      					_push(_a4);
      					_push(_v92);
      					L0040132C();
      					_v132 = _t165;
      				}
      				L0040131A();
      				_t171 =  *((intOrPtr*)( *_a4 + 0x708))(_a4,  &_v56, 2,  &_v36,  &_v40);
      				_v76 = _t171;
      				if(_v76 >= 0) {
      					_v136 = _v136 & 0x00000000;
      				} else {
      					_push(0x708);
      					_push(0x408b14);
      					_push(_a4);
      					_push(_v76);
      					L0040132C();
      					_v136 = _t171;
      				}
      				L00401314();
      				_v8 = 0;
      				asm("wait");
      				_push(0x421f83);
      				return _t171;
      			}










































      0x00421c87
      0x00421c96
      0x00421ca0
      0x00421ca8
      0x00421cab
      0x00421cb8
      0x00421cc1
      0x00421ccc
      0x00421ccf
      0x00421cf5
      0x00421cff
      0x00421d0f
      0x00421d15
      0x00421d1c
      0x00421d38
      0x00421d1e
      0x00421d1e
      0x00421d23
      0x00421d28
      0x00421d2b
      0x00421d2e
      0x00421d33
      0x00421d33
      0x00421d3f
      0x00421d4a
      0x00421d50
      0x00421d57
      0x00421d73
      0x00421d59
      0x00421d59
      0x00421d5e
      0x00421d63
      0x00421d66
      0x00421d69
      0x00421d6e
      0x00421d6e
      0x00421d7f
      0x00421d85
      0x00421d8c
      0x00421da8
      0x00421d8e
      0x00421d8e
      0x00421d93
      0x00421d98
      0x00421d9b
      0x00421d9e
      0x00421da3
      0x00421da3
      0x00421db3
      0x00421dcd
      0x00421db5
      0x00421db5
      0x00421dba
      0x00421dbf
      0x00421dc4
      0x00421dc4
      0x00421de8
      0x00421dec
      0x00421df1
      0x00421e00
      0x00421e06
      0x00421e08
      0x00421e0f
      0x00421e2b
      0x00421e11
      0x00421e11
      0x00421e16
      0x00421e1b
      0x00421e1e
      0x00421e21
      0x00421e26
      0x00421e26
      0x00421e36
      0x00421e50
      0x00421e38
      0x00421e38
      0x00421e3d
      0x00421e42
      0x00421e47
      0x00421e47
      0x00421e61
      0x00421e6b
      0x00421e6f
      0x00421e74
      0x00421e83
      0x00421e86
      0x00421e88
      0x00421e8f
      0x00421ea8
      0x00421e91
      0x00421e91
      0x00421e93
      0x00421e98
      0x00421e9b
      0x00421e9e
      0x00421ea3
      0x00421ea3
      0x00421eac
      0x00421eb7
      0x00421ec3
      0x00421ed2
      0x00421ed8
      0x00421edf
      0x00421efb
      0x00421ee1
      0x00421ee1
      0x00421ee6
      0x00421eeb
      0x00421eee
      0x00421ef1
      0x00421ef6
      0x00421ef6
      0x00421f09
      0x00421f1d
      0x00421f23
      0x00421f2a
      0x00421f49
      0x00421f2c
      0x00421f2c
      0x00421f31
      0x00421f36
      0x00421f39
      0x00421f3c
      0x00421f41
      0x00421f41
      0x00421f53
      0x00421f58
      0x00421f5f
      0x00421f60
      0x00000000

      APIs
      • __vbaChkstk.MSVBVM60(?,004011D6), ref: 00421CA0
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401100,00408B14,000006F8), ref: 00421D2E
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401100,00408B14,000006FC), ref: 00421D69
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401100,00408B14,00000700), ref: 00421D9E
      • __vbaNew2.MSVBVM60(004083F0,00424010), ref: 00421DBF
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00421DEC
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00408C60,000001F0), ref: 00421E21
      • __vbaNew2.MSVBVM60(004083F0,00424010), ref: 00421E42
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 00421E6F
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408C60,00000068), ref: 00421E9E
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401100,00408B14,00000704,?,00000001), ref: 00421EF1
      • __vbaFreeObjList.MSVBVM60(00000002,?,?,?,00000001), ref: 00421F09
      • __vbaHresultCheckObj.MSVBVM60(00000000,00401100,00408B14,00000708), ref: 00421F3C
      • __vbaFreeVar.MSVBVM60(00000000,00401100,00408B14,00000708), ref: 00421F53
      Memory Dump Source
      • Source File: 00000000.00000002.1187873898.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1187867422.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187894169.0000000000424000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187905826.0000000000426000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_REVGKXx6Ns.jbxd
      Similarity
      • API ID: __vba$CheckHresult$FreeNew2$ChkstkList
      • String ID:
      • API String ID: 3534970231-0
      • Opcode ID: 707647235cb12848e6cd1c5957e942822c3f41b481e16c23d9bccf602e0a0f14
      • Instruction ID: 06049ec593bd119c9c6b2436696638d336533f58f4fb0c678c9d0fb946c2e4c9
      • Opcode Fuzzy Hash: 707647235cb12848e6cd1c5957e942822c3f41b481e16c23d9bccf602e0a0f14
      • Instruction Fuzzy Hash: C9A1F174A00218EFDB10DFA0D849BDDBBB5FF08305F60406AF905AB2A1C779A985DF58
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      C-Code - Quality: 54%
      			E004231BD(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				char _v24;
      				intOrPtr _v28;
      				intOrPtr _v32;
      				char _v36;
      				intOrPtr _v44;
      				intOrPtr _v52;
      				intOrPtr _v60;
      				intOrPtr _v68;
      				char _v72;
      				signed int _v76;
      				signed int _v84;
      				signed int _v88;
      				signed int _t50;
      				signed int _t62;
      				void* _t67;
      				void* _t74;
      				intOrPtr _t76;
      
      				_t67 = __edx;
      				 *[fs:0x0] = _t76;
      				L004011D0();
      				_v12 = _t76;
      				_v8 = 0x4011b8;
      				L00401266();
      				_t50 =  *((intOrPtr*)( *_a4 + 0x58))(_a4,  &_v72,  &_v24, _a4, __edi, __esi, __ebx, 0x44,  *[fs:0x0], 0x4011d6, __ecx, __ecx, _t74);
      				asm("fclex");
      				_v76 = _t50;
      				if(_v76 >= 0) {
      					_v84 = _v84 & 0x00000000;
      				} else {
      					_push(0x58);
      					_push(0x408ae4);
      					_push(_a4);
      					_push(_v76);
      					L0040132C();
      					_v84 = _t50;
      				}
      				_v32 = _v72;
      				L00401266();
      				L00401260();
      				_v28 = E0042343E( &_v36);
      				L004012EA();
      				_v32 = E0042343E(_v28) + 0x2b0;
      				E0042337D(_t67, _v32, _a8);
      				_v60 = 0x80020004;
      				_v68 = 0xa;
      				_v44 = 0x80020004;
      				_v52 = 0xa;
      				L004011D0();
      				asm("movsd");
      				asm("movsd");
      				asm("movsd");
      				asm("movsd");
      				L004011D0();
      				asm("movsd");
      				asm("movsd");
      				asm("movsd");
      				asm("movsd");
      				_t62 =  *((intOrPtr*)( *_a4 + 0x2b0))(_a4, 0x10, 0x10,  &_v36,  &_v36, _a4);
      				asm("fclex");
      				_v76 = _t62;
      				if(_v76 >= 0) {
      					_v88 = _v88 & 0x00000000;
      				} else {
      					_push(0x2b0);
      					_push(0x408ae4);
      					_push(_a4);
      					_push(_v76);
      					L0040132C();
      					_v88 = _t62;
      				}
      				_push(0x423300);
      				L004012EA();
      				return _t62;
      			}






















      0x004231bd
      0x004231ce
      0x004231d8
      0x004231e0
      0x004231e3
      0x004231f1
      0x00423202
      0x00423205
      0x00423207
      0x0042320e
      0x00423227
      0x00423210
      0x00423210
      0x00423212
      0x00423217
      0x0042321a
      0x0042321d
      0x00423222
      0x00423222
      0x0042322e
      0x00423238
      0x00423241
      0x0042324c
      0x00423252
      0x00423264
      0x0042326d
      0x00423272
      0x00423279
      0x00423280
      0x00423287
      0x00423291
      0x0042329b
      0x0042329c
      0x0042329d
      0x0042329e
      0x004232a2
      0x004232ac
      0x004232ad
      0x004232ae
      0x004232af
      0x004232b8
      0x004232be
      0x004232c0
      0x004232c7
      0x004232e3
      0x004232c9
      0x004232c9
      0x004232ce
      0x004232d3
      0x004232d6
      0x004232d9
      0x004232de
      0x004232de
      0x004232e7
      0x004232fa
      0x004232ff

      APIs
      • __vbaChkstk.MSVBVM60(?,004011D6), ref: 004231D8
      • __vbaObjSetAddref.MSVBVM60(?,?,?,?,?,?,004011D6), ref: 004231F1
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408AE4,00000058), ref: 0042321D
      • __vbaObjSetAddref.MSVBVM60(?,?), ref: 00423238
      • #644.MSVBVM60(?,?,?), ref: 00423241
      • __vbaFreeObj.MSVBVM60(00000000,?,?,?), ref: 00423252
      • __vbaChkstk.MSVBVM60(?,?,?,00000000,?,?,?), ref: 00423291
      • __vbaChkstk.MSVBVM60(?,?,?,00000000,?,?,?), ref: 004232A2
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408AE4,000002B0), ref: 004232D9
      • __vbaFreeObj.MSVBVM60(00423300), ref: 004232FA
      Memory Dump Source
      • Source File: 00000000.00000002.1187873898.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1187867422.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187894169.0000000000424000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187905826.0000000000426000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_REVGKXx6Ns.jbxd
      Similarity
      • API ID: __vba$Chkstk$AddrefCheckFreeHresult$#644
      • String ID:
      • API String ID: 1032928638-0
      • Opcode ID: df93c6eebebb03e5c7ec028111eaf47f5a5ad80a155a08bf4a2f570f89c85dfa
      • Instruction ID: 35e3565e91d48bafe10480dd2871606d4474985bee7c760e1338b44c535c9c52
      • Opcode Fuzzy Hash: df93c6eebebb03e5c7ec028111eaf47f5a5ad80a155a08bf4a2f570f89c85dfa
      • Instruction Fuzzy Hash: 30413771900618EFDF01EFA1D846B9EBBB5FF08305F50042AF900BB1A0C7BD9A459B58
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      C-Code - Quality: 77%
      			E00423087(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int* _a8) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				char _v40;
      				char _v72;
      				char _v88;
      				intOrPtr _v96;
      				intOrPtr _v104;
      				signed int _v108;
      				signed int _v120;
      				signed int _t42;
      				char* _t46;
      				void* _t49;
      				void* _t59;
      				void* _t61;
      				intOrPtr _t62;
      
      				_t62 = _t61 - 0xc;
      				 *[fs:0x0] = _t62;
      				L004011D0();
      				_v16 = _t62;
      				_v12 = 0x4011a8;
      				_v8 = 0;
      				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x60,  *[fs:0x0], 0x4011d6, _t59);
      				 *_a8 =  *_a8 & 0x00000000;
      				_t42 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4);
      				asm("fclex");
      				_v108 = _t42;
      				if(_v108 >= 0) {
      					_v120 = _v120 & 0x00000000;
      				} else {
      					_push(0x2b4);
      					_push(0x408ae4);
      					_push(_a4);
      					_push(_v108);
      					L0040132C();
      					_v120 = _t42;
      				}
      				E004234B0();
      				_v96 = 2;
      				_v104 = 2;
      				L004012E4();
      				_v96 = 0x812358;
      				_v104 = 3;
      				L004012E4();
      				_t46 =  &_v88;
      				L0040126C();
      				L00401272();
      				_t49 =  *((intOrPtr*)( *_a4 + 0x714))(_a4, _t46, _t46, _t46,  &_v40,  &_v72);
      				_push(0x423194);
      				L00401314();
      				L00401314();
      				return _t49;
      			}



















      0x0042308a
      0x00423099
      0x004230a3
      0x004230ab
      0x004230ae
      0x004230b5
      0x004230c4
      0x004230ca
      0x004230d5
      0x004230db
      0x004230dd
      0x004230e4
      0x00423100
      0x004230e6
      0x004230e6
      0x004230eb
      0x004230f0
      0x004230f3
      0x004230f6
      0x004230fb
      0x004230fb
      0x00423104
      0x00423109
      0x00423110
      0x0042311d
      0x00423122
      0x00423129
      0x00423136
      0x00423143
      0x00423147
      0x0042314d
      0x0042315b
      0x00423161
      0x00423186
      0x0042318e
      0x00423193

      APIs
      • __vbaChkstk.MSVBVM60(?,004011D6), ref: 004230A3
      • __vbaHresultCheckObj.MSVBVM60(00000000,004011A8,00408AE4,000002B4), ref: 004230F6
      • __vbaVarMove.MSVBVM60(00000000,004011A8,00408AE4,000002B4), ref: 0042311D
      • __vbaVarMove.MSVBVM60(00000000,004011A8,00408AE4,000002B4), ref: 00423136
      • __vbaVarIdiv.MSVBVM60(?,?,?), ref: 00423147
      • __vbaI4Var.MSVBVM60(00000000,?,?,?), ref: 0042314D
      • __vbaFreeVar.MSVBVM60(00423194), ref: 00423186
      • __vbaFreeVar.MSVBVM60(00423194), ref: 0042318E
      Memory Dump Source
      • Source File: 00000000.00000002.1187873898.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1187867422.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187894169.0000000000424000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187905826.0000000000426000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_REVGKXx6Ns.jbxd
      Similarity
      • API ID: __vba$FreeMove$CheckChkstkHresultIdiv
      • String ID:
      • API String ID: 3577542843-0
      • Opcode ID: b2889f3ed02d0fc0c7166160f61c0f8569b10a4a35a12072140a15e3ea59228b
      • Instruction ID: 47a2f8ca0f5dd4149621c678aa3206a8ebfb250f515c7ac63d6253f28e915492
      • Opcode Fuzzy Hash: b2889f3ed02d0fc0c7166160f61c0f8569b10a4a35a12072140a15e3ea59228b
      • Instruction Fuzzy Hash: C831C971900208AFDB00EFA5C98ABDDBBB4FF04705F50406AF509BB1A1D779AA55CF58
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 100 40134c-401351 #100 101 401356-40136a 100->101 102 401399-4013bb 101->102 103 40136c 101->103 102->101 104 4013bd-4013c0 102->104 106 4013c2-4013f5 104->106 107 4013fc-401402 104->107 108 401460-40146d 106->108 109 4013f7 106->109 110 401404 107->110 111 401479-40147c 107->111 114 40146e-401474 108->114 109->107 113 401406-40140f 110->113 110->114 112 40147d 111->112 115 40147e-4014ef 112->115 116 401411 113->116 117 401476-401478 113->117 114->117 116->112 118 401414 116->118 117->111 118->115 119 401416-40145e 118->119 119->108
      APIs
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1187873898.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1187867422.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187894169.0000000000424000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187905826.0000000000426000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_REVGKXx6Ns.jbxd
      Similarity
      • API ID: #100
      • String ID: VB5!6&*
      • API String ID: 1341478452-3593831657
      • Opcode ID: 947d84dd350a229915c56cfc55d153a84666ebd25babe5bdad98e3a3005d6114
      • Instruction ID: 111a99d32bcfc37a4f4cdf578b0a46f67812d941b1e43c4b2dc6784c35cfbcd7
      • Opcode Fuzzy Hash: 947d84dd350a229915c56cfc55d153a84666ebd25babe5bdad98e3a3005d6114
      • Instruction Fuzzy Hash: B15165A249E7C15FD3435BB498255923FB0AE5326471B44EBC4C1DF4B3E2684D0AC736
      Uniqueness

      Uniqueness Score: -1.00%

      Non-executed Functions

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 314 218e22d-218e36c call 219294d * 5 326 218e372-218e5e5 call 2196b54 314->326 332 218e5eb-218e75d call 2196b54 326->332 333 218edaf-218edcf call 2196b54 326->333 332->333 343 218e763-218e9e2 call 2196b54 332->343 338 218edd5-218eed7 call 2196b54 * 2 333->338 339 2189836-218a0bd call 2194e4e call 218ba49 call 2196b54 333->339 338->326 387 218b8ce-218b8d9 339->387 388 218a0c3-218a47d call 218c287 call 2192759 339->388 343->333 358 218e9e8-218eaf5 343->358 362 218eaff-218eb46 358->362 365 218eb48 362->365 366 218eb4e-218ec37 362->366 365->366 370 219294d-2192987 366->370 371 218ec3d-218ec86 call 2196b54 366->371 374 219298d-21929b4 370->374 375 218c676-218c67a 370->375 371->333 383 218ec8c-218ec99 371->383 379 2192a98-2192aa8 call 2192aac 374->379 380 21929ba-2192a96 call 21932c9 call 2192aac 374->380 376 218c67b-218c78e 375->376 386 218c794-218c796 376->386 380->379 390 218ec9b-218eca1 383->390 391 218eca6-218edac call 2196b54 * 2 383->391 392 218b8e1-218ba46 call 2196b54 * 3 387->392 393 218b8dc call 2196b54 387->393 388->339 418 218a483-218a49f 388->418 390->362 393->392 418->375 420 218a4a5-218a72c call 2196b54 418->420 420->387 425 218a732-218aa88 call 2196b54 420->425 425->387 433 218aa8e-218abac 425->433 433->370 436 218abb2-218ae80 call 2196b54 433->436 436->387 442 218ae86-218aeb0 436->442 442->387 443 218aeb6-218afba 442->443 445 218afbc-218afde 443->445 446 218b001-218b02e 443->446 447 218afe4-218affb 445->447 448 2181a25-2181a4b call 218178b 445->448 446->387 449 218b034-218b3c4 call 21930b4 446->449 447->387 447->446 448->339 449->387 457 218b3ca-218b4f9 call 218c676 449->457 457->339 462 218b4ff-218b52b 457->462 462->387 463 218b531-218b67c call 2196b54 462->463 463->387 467 218b682-218b7ad call 2196b54 463->467 467->387 471 218b7b3-218b8cd call 2196b54 * 2 467->471
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: *0X5$?[d)$L$QXj4$lYf.$m,
      • API String ID: 0-1186540388
      • Opcode ID: 6e8ff2c4e00e26d5a852359f3af432e4b7046cecce3c1a1a5d3428f1ffff04aa
      • Instruction ID: 077dca91d40fed2794861350886d23c9141c8c3b6efe4ca655d9abcea8b661c1
      • Opcode Fuzzy Hash: 6e8ff2c4e00e26d5a852359f3af432e4b7046cecce3c1a1a5d3428f1ffff04aa
      • Instruction Fuzzy Hash: 9C92EEB1644389DFDB74AF28CD85BEA7BA2FF54340F55812ADC999B210D3309A81CF52
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 477 2189836-218a0bd call 2194e4e call 218ba49 call 2196b54 493 218b8ce-218b8d9 477->493 494 218a0c3-218a47d call 218c287 call 2192759 477->494 495 218b8e1-218ba46 call 2196b54 * 3 493->495 496 218b8dc call 2196b54 493->496 494->477 511 218a483-218a49f 494->511 496->495 513 218a4a5-218a72c call 2196b54 511->513 514 218c676-218c67a 511->514 513->493 522 218a732-218aa88 call 2196b54 513->522 516 218c67b-218c78e 514->516 520 218c794-218c796 516->520 522->493 530 218aa8e-218abac 522->530 533 219294d-2192987 530->533 534 218abb2-218ae80 call 2196b54 530->534 533->514 536 219298d-21929b4 533->536 534->493 549 218ae86-218aeb0 534->549 538 2192a98-2192aa8 call 2192aac 536->538 539 21929ba-2192a96 call 21932c9 call 2192aac 536->539 539->538 549->493 552 218aeb6-218afba 549->552 554 218afbc-218afde 552->554 555 218b001-218b02e 552->555 556 218afe4-218affb 554->556 557 2181a25-2181a4b call 218178b 554->557 555->493 558 218b034-218b3c4 call 21930b4 555->558 556->493 556->555 557->477 558->493 566 218b3ca-218b4f9 call 218c676 558->566 566->477 571 218b4ff-218b52b 566->571 571->493 572 218b531-218b67c call 2196b54 571->572 572->493 576 218b682-218b7ad call 2196b54 572->576 576->493 580 218b7b3-218b8cd call 2196b54 * 2 576->580
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: L$QXj4$m,
      • API String ID: 0-2799479184
      • Opcode ID: b7e5ce26afefa02bcfb089cbf1b3f3559fe1d47208fb253ff1b3dc5542b250df
      • Instruction ID: da7e2ff39f7c31f4c0ea714c1e9e9fcbdc9d177799f03993c3b581c9e6b3beb4
      • Opcode Fuzzy Hash: b7e5ce26afefa02bcfb089cbf1b3f3559fe1d47208fb253ff1b3dc5542b250df
      • Instruction Fuzzy Hash: D1720FB26443899FDB749F29CD857DA7BB2FF94300F56812ADC899B214D3309A81CF52
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 586 2189858-218985f 587 2189861 586->587 588 2189863-218986b 586->588 587->588 589 218986d 588->589 590 218986f-2189877 588->590 589->590 591 2189879 590->591 592 218987b-2189883 590->592 591->592 593 2189885 592->593 594 2189887-218988f 592->594 593->594 595 2189891 594->595 596 2189893-218989b 594->596 595->596 597 218989d 596->597 598 218989f-21898a7 596->598 597->598 599 21898a9 598->599 600 21898ab-21898b3 598->600 599->600 601 21898b5 600->601 602 21898b7-21898bf 600->602 601->602 603 21898c1 602->603 604 21898c3-21898cb 602->604 603->604 605 21898cd 604->605 606 21898cf-21898d7 604->606 605->606 607 21898d9 606->607 608 21898db-21898e3 606->608 607->608 609 21898e5 608->609 610 21898e7-21898ef 608->610 609->610 611 21898f1 610->611 612 21898f3-21898fb 610->612 611->612 613 21898fd 612->613 614 21898ff-2189907 612->614 613->614 615 2189909 614->615 616 218990b-2189913 614->616 615->616 617 2189915 616->617 618 2189917-218991f 616->618 617->618 619 2189921 618->619 620 2189923-218994b 618->620 619->620 621 2189a18-218a0bd call 2194e4e call 218ba49 call 2196b54 620->621 635 218b8ce-218b8d9 621->635 636 218a0c3-218a47d call 218c287 call 2192759 621->636 637 218b8e1-218ba46 call 2196b54 * 3 635->637 638 218b8dc call 2196b54 635->638 653 218a483-218a49f 636->653 654 2189836-218994b 636->654 638->637 657 218a4a5-218a72c call 2196b54 653->657 658 218c676-218c67a 653->658 654->621 657->635 666 218a732-218aa88 call 2196b54 657->666 660 218c67b-218c78e 658->660 664 218c794-218c796 660->664 666->635 674 218aa8e-218abac 666->674 677 219294d-2192987 674->677 678 218abb2-218ae80 call 2196b54 674->678 677->658 680 219298d-21929b4 677->680 678->635 693 218ae86-218aeb0 678->693 682 2192a98-2192aa8 call 2192aac 680->682 683 21929ba-2192a96 call 21932c9 call 2192aac 680->683 683->682 693->635 696 218aeb6-218afba 693->696 698 218afbc-218afde 696->698 699 218b001-218b02e 696->699 700 218afe4-218affb 698->700 701 2181a25-2181a4b call 218178b 698->701 699->635 702 218b034-218b3c4 call 21930b4 699->702 700->635 700->699 701->654 702->635 710 218b3ca-218b4f9 call 218c676 702->710 710->654 715 218b4ff-218b52b 710->715 715->635 716 218b531-218b67c call 2196b54 715->716 716->635 720 218b682-218b7ad call 2196b54 716->720 720->635 724 218b7b3-218b8cd call 2196b54 * 2 720->724
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: L$QXj4
      • API String ID: 0-1386316327
      • Opcode ID: 8ab2d652c02f913347cf21fa33989ffd17a8fef73622957fb064d6d27db994b3
      • Instruction ID: c35e016091e1b416cd814414ace068db4501fae44154e726a491622da1a08b68
      • Opcode Fuzzy Hash: 8ab2d652c02f913347cf21fa33989ffd17a8fef73622957fb064d6d27db994b3
      • Instruction Fuzzy Hash: 06620FB1A4438ADFDB74AF28C9897EA7BB2FF44300F414529DC999B214D3319A95CF42
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 730 2189950-218995f 731 2189961 730->731 732 2189963-218996b 730->732 731->732 733 218996d 732->733 734 218996f-2189977 732->734 733->734 735 2189979 734->735 736 218997b-2189983 734->736 735->736 737 2189985 736->737 738 2189987-218998f 736->738 737->738 739 2189991 738->739 740 2189993-218999b 738->740 739->740 741 218999d 740->741 742 218999f-21899a7 740->742 741->742 743 21899a9 742->743 744 21899ab-21899b3 742->744 743->744 745 21899b5 744->745 746 21899b7-21899bf 744->746 745->746 747 21899c1 746->747 748 21899c3-21899cb 746->748 747->748 749 21899cd 748->749 750 21899cf-21899d7 748->750 749->750 751 21899d9 750->751 752 21899db-21899e3 750->752 751->752 753 21899e5 752->753 754 21899e7-21899ef 752->754 753->754 755 21899f1 754->755 756 21899f3-21899fb 754->756 755->756 757 21899fd 756->757 758 21899ff-2189a07 756->758 757->758 759 2189a09 758->759 760 2189a0b-2189a13 758->760 759->760 761 2189a15 760->761 762 2189a17 760->762 761->762 763 2189a18-218a0bd call 2194e4e call 218ba49 call 2196b54 762->763 777 218b8ce-218b8d9 763->777 778 218a0c3-218a47d call 218c287 call 2192759 763->778 779 218b8e1-218ba46 call 2196b54 * 3 777->779 780 218b8dc call 2196b54 777->780 795 218a483-218a49f 778->795 796 2189836-218994b 778->796 780->779 799 218a4a5-218a72c call 2196b54 795->799 800 218c676-218c67a 795->800 796->763 799->777 808 218a732-218aa88 call 2196b54 799->808 802 218c67b-218c78e 800->802 806 218c794-218c796 802->806 808->777 816 218aa8e-218abac 808->816 819 219294d-2192987 816->819 820 218abb2-218ae80 call 2196b54 816->820 819->800 822 219298d-21929b4 819->822 820->777 835 218ae86-218aeb0 820->835 824 2192a98-2192aa8 call 2192aac 822->824 825 21929ba-2192a96 call 21932c9 call 2192aac 822->825 825->824 835->777 838 218aeb6-218afba 835->838 840 218afbc-218afde 838->840 841 218b001-218b02e 838->841 842 218afe4-218affb 840->842 843 2181a25-2181a4b call 218178b 840->843 841->777 844 218b034-218b3c4 call 21930b4 841->844 842->777 842->841 843->796 844->777 852 218b3ca-218b4f9 call 218c676 844->852 852->796 857 218b4ff-218b52b 852->857 857->777 858 218b531-218b67c call 2196b54 857->858 858->777 862 218b682-218b7ad call 2196b54 858->862 862->777 866 218b7b3-218b8cd call 2196b54 * 2 862->866
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: L$QXj4
      • API String ID: 0-1386316327
      • Opcode ID: 3ec236bfad5f39cc219da13bf627d433e05cc4938c3d2ad5c8536a5683148219
      • Instruction ID: 59d6cd87eb2f1c3efcc6f40e5e5403a52b7a029c2b7e900c71aa9f646ddcf45c
      • Opcode Fuzzy Hash: 3ec236bfad5f39cc219da13bf627d433e05cc4938c3d2ad5c8536a5683148219
      • Instruction Fuzzy Hash: 6362FEB1A44389DFDB74AF28C9897EA7BB2FF44300F424529DC999B214D3319A95CF42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: L$QXj4
      • API String ID: 0-1386316327
      • Opcode ID: 93ffbbaaf83685123de453fba580a58abe0d6d3757a4f21331d172d5b6b998c8
      • Instruction ID: 18189f7dcb89b10031351e7c485212aeb7e1cdae7fb58dcee93629b008b38073
      • Opcode Fuzzy Hash: 93ffbbaaf83685123de453fba580a58abe0d6d3757a4f21331d172d5b6b998c8
      • Instruction Fuzzy Hash: 845200B1A44389DFDB74AF28C9897EA7BB2FF44300F414529DC998B214D3719A95CF42
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: L$QXj4
      • API String ID: 0-1386316327
      • Opcode ID: 2d5d57e16b2ddf8295d743236ac1a44f6bb1d074828c85a9472e7f4cac8d4357
      • Instruction ID: 80abba773c105011c9b1c99ad7403228988fcea0e061fa56d80a4f4a389b83cf
      • Opcode Fuzzy Hash: 2d5d57e16b2ddf8295d743236ac1a44f6bb1d074828c85a9472e7f4cac8d4357
      • Instruction Fuzzy Hash: F8521FB1A44389CFDB74AF28C9897EA7BB2FF44300F414529DC998B214D3719A55CF82
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: L$QXj4
      • API String ID: 0-1386316327
      • Opcode ID: 2c3c0e0da26673123c7eeb87a21a0f1ffd42afe4abaa7c71fffad86e6cf6aaa3
      • Instruction ID: 1c2e868ccef64791c0ee45a18bc7534d49949fe7e5fc41aba9318456f0dd2833
      • Opcode Fuzzy Hash: 2c3c0e0da26673123c7eeb87a21a0f1ffd42afe4abaa7c71fffad86e6cf6aaa3
      • Instruction Fuzzy Hash: 3942FEB2A443898FDF74AF28C9897EA7BA2FF44300F414529DC998B214D3719A55CF92
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: L$QXj4
      • API String ID: 0-1386316327
      • Opcode ID: 1e2d93d1e6e816346497ea2f943e28d6d9178c1f8463271a083d1478e81c487a
      • Instruction ID: 5118e9dee3e24505f53aa25a9ad59d7abcd06327c06fb291a215a493f9ef70aa
      • Opcode Fuzzy Hash: 1e2d93d1e6e816346497ea2f943e28d6d9178c1f8463271a083d1478e81c487a
      • Instruction Fuzzy Hash: BC42EDB2A44389CFDF74AF68C9897EA7BA2FF44300F414529DC998B214D3719A54CF92
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: L$QXj4
      • API String ID: 0-1386316327
      • Opcode ID: f5893a7f1fad31939a8789963b6451a40a2e212028956141b2e7a7263d062b7b
      • Instruction ID: 072cf6a8f637172a657377cff0aeb964622d5b9ed942715fffbe3d21cb3bc7e7
      • Opcode Fuzzy Hash: f5893a7f1fad31939a8789963b6451a40a2e212028956141b2e7a7263d062b7b
      • Instruction Fuzzy Hash: 1542FEB2A843898FDF74AF28C9897DA7BA2FF44300F414529DC998B214D3715A95CF92
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: QXj4
      • API String ID: 0-2398928715
      • Opcode ID: 995695b6bf936a7a9d429bf72d89eca50dcbe4fc4e9da078a7ef9964303829ac
      • Instruction ID: 9608b10b41b8c0779c83fbd22540d820fb2513f71056d55bba275309b6337d60
      • Opcode Fuzzy Hash: 995695b6bf936a7a9d429bf72d89eca50dcbe4fc4e9da078a7ef9964303829ac
      • Instruction Fuzzy Hash: A332FCB2A44389CFCB74AF68C9897EA7BB2FF44300F414529DC998B214D3715A94CF92
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: QXj4
      • API String ID: 0-2398928715
      • Opcode ID: f5cac3b6c39496a227cfd2c2515bfec6a4b6a54a97bc6bedc3f9fe0e855d3fac
      • Instruction ID: aa060e0e8b465de2298c3e91c99a17748ac135866aa8999b8cc52c14fc7adfba
      • Opcode Fuzzy Hash: f5cac3b6c39496a227cfd2c2515bfec6a4b6a54a97bc6bedc3f9fe0e855d3fac
      • Instruction Fuzzy Hash: 12220FB1A84289CFCF74AF68C9897EA3BB2FF44300F414529DC998B214D3715A94CF92
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: QXj4
      • API String ID: 0-2398928715
      • Opcode ID: 6e15722088ed7bcc81bcb1c5b4c55731bb4bdd9890e40a1739ff61411e98d17c
      • Instruction ID: 555fb5e9768e34b4ab43136a033dbfaf5c301ae9071a3ebd9c16bf0b6d7b746a
      • Opcode Fuzzy Hash: 6e15722088ed7bcc81bcb1c5b4c55731bb4bdd9890e40a1739ff61411e98d17c
      • Instruction Fuzzy Hash: 2D120FB1984288CFCF74AF68D9897EA3BB2FF54300F424529DC998B214D3715A99CF52
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: QXj4
      • API String ID: 0-2398928715
      • Opcode ID: 91323befbb0d5eed078c5e5011ed1ef730662584b0931211546e56c04f73159b
      • Instruction ID: 4b086e9cfea0b10b09a476359d948635d62e893b4c6e1bc6acd5b588eafb6173
      • Opcode Fuzzy Hash: 91323befbb0d5eed078c5e5011ed1ef730662584b0931211546e56c04f73159b
      • Instruction Fuzzy Hash: 8312EDB2A443899FDB749F28CD857DA7BB2FF55310F468529DC899B210D3309A81CF92
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: QXj4
      • API String ID: 0-2398928715
      • Opcode ID: 5865564c2128b329233bcbf0eef2fad4e7e8a1aaedc39faef5f5062159280180
      • Instruction ID: b15f5d5e4df1ba5a6004b1b0dd1b4a15a492303b9faa79f3b1259e139224a461
      • Opcode Fuzzy Hash: 5865564c2128b329233bcbf0eef2fad4e7e8a1aaedc39faef5f5062159280180
      • Instruction Fuzzy Hash: 6F020EB1984288CFCF74AF68C9997EA37B2FF44304F414429DC998B214D3725A99CF92
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: QXj4
      • API String ID: 0-2398928715
      • Opcode ID: b03ef88d1ebb563ea696be7b206d9e0bbd8bfad133bdbcdcee99ea7cfdd0f428
      • Instruction ID: 751cd507c1a227997b2340f41c3f3b19fc9309cc95d75208b6e73ffd7543a182
      • Opcode Fuzzy Hash: b03ef88d1ebb563ea696be7b206d9e0bbd8bfad133bdbcdcee99ea7cfdd0f428
      • Instruction Fuzzy Hash: 28F1ECB1984288CFCF74AF68D9897EA37B2FF44300F464429DC998B214D3725A95CF92
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: QXj4
      • API String ID: 0-2398928715
      • Opcode ID: d697eaa29d656c7b0a268555a15079a9aec6c09f950ae2a2a8259d7cfcb85403
      • Instruction ID: 81d9505f1b0f7945c65f014cf5adf58d323fd1d1b856669db7aaf1bf97a7da77
      • Opcode Fuzzy Hash: d697eaa29d656c7b0a268555a15079a9aec6c09f950ae2a2a8259d7cfcb85403
      • Instruction Fuzzy Hash: 89F1EDB2984288CFCF74AF68D9C97EA37A2FF44304F464529DC998B214D3725A94CF51
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: QXj4
      • API String ID: 0-2398928715
      • Opcode ID: e3ebe9e53c491e3d6c12b53327fffda10ef46144b9a57d457e70a9ef38c41c83
      • Instruction ID: c714a965b3b47e785506056ac2e5b4963c79b9934fcfda15880af0c3adf31698
      • Opcode Fuzzy Hash: e3ebe9e53c491e3d6c12b53327fffda10ef46144b9a57d457e70a9ef38c41c83
      • Instruction Fuzzy Hash: BAE1EEB1984288CFDF74AF68D9C97EA37A2FF44304F454429DC998B214D3725A94CF91
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: QXj4
      • API String ID: 0-2398928715
      • Opcode ID: 41410bcc504d6b765aa4fe2187602bba448d2fd20d006c26059dfb0775449c9b
      • Instruction ID: 9049609b4c1d3014238da3b4651819528560bfb7e5724ff6de0ad173e1c3ebf1
      • Opcode Fuzzy Hash: 41410bcc504d6b765aa4fe2187602bba448d2fd20d006c26059dfb0775449c9b
      • Instruction Fuzzy Hash: 59D1D0B1980288CFDF74AF68D9C97EA37A2FF44304F454529DCA98B214D3725A68CF91
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: QXj4
      • API String ID: 0-2398928715
      • Opcode ID: 17ec5ddc4ad7cece7ab56687f38eb559aedf7be19eae994ca6d26c09c167b56e
      • Instruction ID: 2a4c8df6bf592f8d74b7773c66cb0d0e24b4c020f80dd3eca9c5336c6cd275e5
      • Opcode Fuzzy Hash: 17ec5ddc4ad7cece7ab56687f38eb559aedf7be19eae994ca6d26c09c167b56e
      • Instruction Fuzzy Hash: 96C1CFB1980288CFDF74AF68D9C97EA37A2FF44304F414529DCA98B214D7725A68CF91
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: QXj4
      • API String ID: 0-2398928715
      • Opcode ID: 509f950b1097f8de7b8824f5af1265ab751ea36561fe8786b3031e59612a54c7
      • Instruction ID: adc0eae891c3786245609fd2c4e9d9038b0497d096c36071b4ee946aeb693a78
      • Opcode Fuzzy Hash: 509f950b1097f8de7b8824f5af1265ab751ea36561fe8786b3031e59612a54c7
      • Instruction Fuzzy Hash: D6B1BEB2980284CFDF74AF68D8C97EE37A2FF44304F414529ECA98B254D3725A688F51
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: QXj4
      • API String ID: 0-2398928715
      • Opcode ID: b255ce4e08f0c6e64fafd6c0ece853f5aa121baf53764dea965ec26ffd1cec5e
      • Instruction ID: 872e909bc2c3cf4c636226c45fee257f6c43f3978b50f2923c1eb7ab9d06308f
      • Opcode Fuzzy Hash: b255ce4e08f0c6e64fafd6c0ece853f5aa121baf53764dea965ec26ffd1cec5e
      • Instruction Fuzzy Hash: FDA19CB1984284CBDF78AF68D9D97EE37B2FF44304F804528DCA98B259D37216688F51
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: 5}v
      • API String ID: 0-3834742670
      • Opcode ID: 8b0a111b3208f9a602bcfeb0f318beab8f0a39287bcfe57b5a7d87ae6cf90c11
      • Instruction ID: 55a9eed9c757dbd0bf89575654ec146ac030e79cb38a4f7612f9200aeadf31b8
      • Opcode Fuzzy Hash: 8b0a111b3208f9a602bcfeb0f318beab8f0a39287bcfe57b5a7d87ae6cf90c11
      • Instruction Fuzzy Hash: 2C51E9B0CA4645CFCF39AF6CA1D86993773BB41344B91099DDC620B28BD7A31139CB51
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: _2
      • API String ID: 0-3022848740
      • Opcode ID: eb3a249bbf13bbb25c1980c7aeb8a29e5af1fb5546f66fe61a9390f69dae562e
      • Instruction ID: 6bc1f91999bcdcc242a5038e1b3ff9b4dcb92e39965901a4a7d4185181450ba3
      • Opcode Fuzzy Hash: eb3a249bbf13bbb25c1980c7aeb8a29e5af1fb5546f66fe61a9390f69dae562e
      • Instruction Fuzzy Hash: 6C31067A244345CFDF349F28C9C47EB73A2BFA6710F55412D9C4A8B205E7748646CA51
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: _,Hm
      • API String ID: 0-2296293252
      • Opcode ID: ebe6a589a58e716a4717753ea7431e3d8f147f0e766e9083d3a1c32dcd434904
      • Instruction ID: fa29bf9419f48daa30d2ff7f3b68fe648af1d19c7e8f36a609cb21f04a9031cc
      • Opcode Fuzzy Hash: ebe6a589a58e716a4717753ea7431e3d8f147f0e766e9083d3a1c32dcd434904
      • Instruction Fuzzy Hash: 25313972640344ABDBB58E3889D53DBB6A27FA9300F95C92F9D89D7305D330CA41C744
      Uniqueness

      Uniqueness Score: -1.00%

      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID: m,
      • API String ID: 0-3298887948
      • Opcode ID: 6f8a5a56c160b4f27c1107a30f5d13374875f7530665e7636d12a4a71b5f537b
      • Instruction ID: 821d16c8c407dc0a1a85d5226b43c86b7f4f17a0424b56d6615e720cb93bc15c
      • Opcode Fuzzy Hash: 6f8a5a56c160b4f27c1107a30f5d13374875f7530665e7636d12a4a71b5f537b
      • Instruction Fuzzy Hash: 4B316774644688AFDB74EF28C988BDA37E2AF89710F518476E829CB251D7309A40CB11
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 759ac4f92187867b4596e7b45ca871aac3ff6130d2abf66560d4a9c8b5e92a7b
      • Instruction ID: fd6e75784472b74c23a20207eecf4403c3fea9f3a9e4c6998b09524cc74d760a
      • Opcode Fuzzy Hash: 759ac4f92187867b4596e7b45ca871aac3ff6130d2abf66560d4a9c8b5e92a7b
      • Instruction Fuzzy Hash: 36919DB0994684CFDF78AF68E9C97EE37A2BB44304F404528DC698B255D3725A68CF81
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 4c605604eb2c843ac7930e31ec2c31cd029b043e9fd1a27e8774b4231e0c5f24
      • Instruction ID: ae6a5875907d64f153b3986a218afecf6cd31de9778e47cb5f15fdc2341d1f16
      • Opcode Fuzzy Hash: 4c605604eb2c843ac7930e31ec2c31cd029b043e9fd1a27e8774b4231e0c5f24
      • Instruction Fuzzy Hash: 9251F9718A4789CFCB346F7CA1D96AA3BA6FF49340B50095DDCA10B65AD3A3012DCF42
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 2974f383a1f8782345de5fd74c64d863e3c2d1e810f743bfd29dcfde5ce1f3f4
      • Instruction ID: f18db8bcbfd8f7db8c156af600eb29fc96964bc2b0c974dfbe4afc2760b70dbb
      • Opcode Fuzzy Hash: 2974f383a1f8782345de5fd74c64d863e3c2d1e810f743bfd29dcfde5ce1f3f4
      • Instruction Fuzzy Hash: D0516F71990785CFDB78AF69A1D56FE37A2BB88304F800529CC6A0B389C7726529CB51
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: dc8f1c137f07904484c88c1217c00db2c40521dc7f3fc8b5c7c22cc5243a19de
      • Instruction ID: e36aa75dbe6382ebd607993d694df1ab2c00fa813585897182ea7d8895b200fe
      • Opcode Fuzzy Hash: dc8f1c137f07904484c88c1217c00db2c40521dc7f3fc8b5c7c22cc5243a19de
      • Instruction Fuzzy Hash: BD51DE72645389CFDBB89E6689E02EB73E2AF99600F55012FC94F5B740C734AA42CF45
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 58a526ef954f41ad5734385cc7ac758fa4b1f605979f415ddb884e5c3e2f0060
      • Instruction ID: 63efe7a96a7b204554c61f4ea4dbfdad5e6832931370255d112d18379d2e0e38
      • Opcode Fuzzy Hash: 58a526ef954f41ad5734385cc7ac758fa4b1f605979f415ddb884e5c3e2f0060
      • Instruction Fuzzy Hash: 7E11E1792083458FEB24AE75C955AAFB7F2AF80340F82891DD8DA87550C3709984CB03
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: 4881f776ef4f6a70351bc4c905b6b64301b5952d694321bdc965d66733012720
      • Instruction ID: 1a4768e9896e9bb1abc628ced8e9ead49006ab3006c6dea89849951798e229f8
      • Opcode Fuzzy Hash: 4881f776ef4f6a70351bc4c905b6b64301b5952d694321bdc965d66733012720
      • Instruction Fuzzy Hash: 69C08C029E62350F05DA6A34A34422F29038B81AEC30286851D1CFA58DEF24CF5918FA
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
      • Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
      • Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
      • Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04
      Uniqueness

      Uniqueness Score: -1.00%

      Memory Dump Source
      • Source File: 00000000.00000002.1188260352.0000000002180000.00000040.00000001.sdmp, Offset: 02180000, based on PE: false
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_2180000_REVGKXx6Ns.jbxd
      Yara matches
      Similarity
      • API ID:
      • String ID:
      • API String ID:
      • Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
      • Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
      • Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
      • Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 170 421fa2-421fec __vbaChkstk 172 42200b 170->172 173 421fee-422009 __vbaHresultCheckObj 170->173 174 422012-422072 __vbaFpI4 __vbaVarDup #667 __vbaStrMove __vbaStrCmp __vbaFreeStr __vbaFreeVar 172->174 173->174 175 422078-42207f 174->175 176 4223ad-4223b4 174->176 177 422081-42209a __vbaNew2 175->177 178 42209c 175->178 179 4223d1 176->179 180 4223b6-4223cf __vbaNew2 176->180 181 4220a6-4220cf 177->181 178->181 182 4223db-422422 __vbaObjSet 179->182 180->182 185 4220d1-4220ec __vbaHresultCheckObj 181->185 186 4220ee 181->186 189 422444 182->189 190 422424-422442 __vbaHresultCheckObj 182->190 187 4220f5-422122 185->187 186->187 194 422144 187->194 195 422124-422142 __vbaHresultCheckObj 187->195 191 42244b-42249e __vbaFreeObj __vbaFreeStr * 2 __vbaFreeVar 189->191 190->191 196 42214b-422162 __vbaFreeObj 194->196 195->196 197 422164-42217d __vbaNew2 196->197 198 42217f 196->198 199 422189-4221b2 197->199 198->199 201 4221d1 199->201 202 4221b4-4221cf __vbaHresultCheckObj 199->202 203 4221d8-422208 201->203 202->203 205 42220a-42222b __vbaHresultCheckObj 203->205 206 42222d 203->206 207 422234-42225e __vbaStrMove __vbaFreeObj 205->207 206->207 208 422260-422279 __vbaNew2 207->208 209 42227b 207->209 210 422285-4222ae 208->210 209->210 212 4222b0-4222cb __vbaHresultCheckObj 210->212 213 4222cd 210->213 214 4222d4-422304 212->214 213->214 216 422306-422327 __vbaHresultCheckObj 214->216 217 422329 214->217 218 422330-4223a8 __vbaStrMove __vbaFreeObj #610 #552 __vbaVarMove __vbaFreeVar __vbaVarDup #600 __vbaFreeVar 216->218 217->218 218->176
      C-Code - Quality: 57%
      			E00421FA2(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				void* _v24;
      				short _v28;
      				void* _v32;
      				void* _v48;
      				long long _v56;
      				signed int _v60;
      				short _v64;
      				signed int _v68;
      				char _v72;
      				char _v88;
      				char _v104;
      				char* _v112;
      				intOrPtr _v120;
      				void* _v124;
      				void* _v128;
      				signed int _v132;
      				signed int _v136;
      				void* _v140;
      				signed int _v144;
      				signed int _v152;
      				signed int _v156;
      				signed int _v160;
      				intOrPtr* _v164;
      				signed int _v168;
      				signed int _v172;
      				intOrPtr* _v176;
      				signed int _v180;
      				signed int _v184;
      				intOrPtr* _v188;
      				signed int _v192;
      				signed int _v196;
      				intOrPtr* _v200;
      				signed int _v204;
      				signed int _t169;
      				signed int _t170;
      				signed int _t178;
      				signed int _t182;
      				short _t183;
      				signed int _t189;
      				signed int _t194;
      				signed int _t201;
      				signed int _t206;
      				signed int _t213;
      				signed int _t218;
      				void* _t254;
      				intOrPtr _t256;
      				long long _t271;
      
      				 *[fs:0x0] = _t256;
      				L004011D0();
      				_v12 = _t256;
      				_v8 = 0x401110;
      				_t169 =  *((intOrPtr*)( *_a4 + 0xe8))(_a4,  &_v128, __edi, __esi, __ebx,  *[fs:0x0], 0x4011d6, __ecx, __ecx, _t254);
      				asm("fclex");
      				_v132 = _t169;
      				if(_v132 >= 0) {
      					_v160 = _v160 & 0x00000000;
      				} else {
      					_push(0xe8);
      					_push(0x408ae4);
      					_push(_a4);
      					_push(_v132);
      					L0040132C();
      					_v160 = _t169;
      				}
      				_t271 = _v128;
      				L0040130E();
      				_v60 = _t169;
      				_v112 = 0x408c74;
      				_v120 = 8;
      				L004012F6();
      				_t170 =  &_v88;
      				_push(_t170);
      				L004012FC();
      				L00401302();
      				_push(_t170);
      				_push(0);
      				L00401308();
      				asm("sbb eax, eax");
      				_v132 =  ~( ~_t170 + 1);
      				L004012F0();
      				L00401314();
      				if(_v132 != 0) {
      					if( *0x4245b4 != 0) {
      						_v164 = 0x4245b4;
      					} else {
      						_push(0x4245b4);
      						_push(0x408c9c);
      						L00401320();
      						_v164 = 0x4245b4;
      					}
      					_v132 =  *_v164;
      					_t189 =  *((intOrPtr*)( *_v132 + 0x14))(_v132,  &_v72);
      					asm("fclex");
      					_v136 = _t189;
      					if(_v136 >= 0) {
      						_v168 = _v168 & 0x00000000;
      					} else {
      						_push(0x14);
      						_push(0x408c8c);
      						_push(_v132);
      						_push(_v136);
      						L0040132C();
      						_v168 = _t189;
      					}
      					_v140 = _v72;
      					_t194 =  *((intOrPtr*)( *_v140 + 0x68))(_v140,  &_v124);
      					asm("fclex");
      					_v144 = _t194;
      					if(_v144 >= 0) {
      						_v172 = _v172 & 0x00000000;
      					} else {
      						_push(0x68);
      						_push(0x408cac);
      						_push(_v140);
      						_push(_v144);
      						L0040132C();
      						_v172 = _t194;
      					}
      					_v64 = _v124;
      					L004012EA();
      					if( *0x4245b4 != 0) {
      						_v176 = 0x4245b4;
      					} else {
      						_push(0x4245b4);
      						_push(0x408c9c);
      						L00401320();
      						_v176 = 0x4245b4;
      					}
      					_v132 =  *_v176;
      					_t201 =  *((intOrPtr*)( *_v132 + 0x14))(_v132,  &_v72);
      					asm("fclex");
      					_v136 = _t201;
      					if(_v136 >= 0) {
      						_v180 = _v180 & 0x00000000;
      					} else {
      						_push(0x14);
      						_push(0x408c8c);
      						_push(_v132);
      						_push(_v136);
      						L0040132C();
      						_v180 = _t201;
      					}
      					_v140 = _v72;
      					_t206 =  *((intOrPtr*)( *_v140 + 0xd0))(_v140,  &_v68);
      					asm("fclex");
      					_v144 = _t206;
      					if(_v144 >= 0) {
      						_v184 = _v184 & 0x00000000;
      					} else {
      						_push(0xd0);
      						_push(0x408cac);
      						_push(_v140);
      						_push(_v144);
      						L0040132C();
      						_v184 = _t206;
      					}
      					_v152 = _v68;
      					_v68 = _v68 & 0x00000000;
      					L00401302();
      					L004012EA();
      					if( *0x4245b4 != 0) {
      						_v188 = 0x4245b4;
      					} else {
      						_push(0x4245b4);
      						_push(0x408c9c);
      						L00401320();
      						_v188 = 0x4245b4;
      					}
      					_v132 =  *_v188;
      					_t213 =  *((intOrPtr*)( *_v132 + 0x14))(_v132,  &_v72);
      					asm("fclex");
      					_v136 = _t213;
      					if(_v136 >= 0) {
      						_v192 = _v192 & 0x00000000;
      					} else {
      						_push(0x14);
      						_push(0x408c8c);
      						_push(_v132);
      						_push(_v136);
      						L0040132C();
      						_v192 = _t213;
      					}
      					_v140 = _v72;
      					_t218 =  *((intOrPtr*)( *_v140 + 0x110))(_v140,  &_v68);
      					asm("fclex");
      					_v144 = _t218;
      					if(_v144 >= 0) {
      						_v196 = _v196 & 0x00000000;
      					} else {
      						_push(0x110);
      						_push(0x408cac);
      						_push(_v140);
      						_push(_v144);
      						L0040132C();
      						_v196 = _t218;
      					}
      					_v156 = _v68;
      					_v68 = _v68 & 0x00000000;
      					L00401302();
      					L004012EA();
      					_push( &_v88);
      					L004012D8();
      					_push(1);
      					_push( &_v88);
      					_push( &_v104);
      					L004012DE();
      					L004012E4();
      					L00401314();
      					_v112 = L"UNCHIC";
      					_v120 = 8;
      					L004012F6();
      					_push(2);
      					_push( &_v88);
      					L004012D2();
      					_v56 = _t271;
      					L00401314();
      				}
      				if( *0x424010 != 0) {
      					_v200 = 0x424010;
      				} else {
      					_push(0x424010);
      					_push(0x4083f0);
      					L00401320();
      					_v200 = 0x424010;
      				}
      				_t178 =  &_v72;
      				L00401326();
      				_v132 = _t178;
      				_t182 =  *((intOrPtr*)( *_v132 + 0xf8))(_v132,  &_v124, _t178,  *((intOrPtr*)( *((intOrPtr*)( *_v200)) + 0x2fc))( *_v200));
      				asm("fclex");
      				_v136 = _t182;
      				if(_v136 >= 0) {
      					_v204 = _v204 & 0x00000000;
      				} else {
      					_push(0xf8);
      					_push(0x408c60);
      					_push(_v132);
      					_push(_v136);
      					L0040132C();
      					_v204 = _t182;
      				}
      				_t183 = _v124;
      				_v28 = _t183;
      				L004012EA();
      				asm("wait");
      				_push(0x42249f);
      				L004012F0();
      				L004012F0();
      				L00401314();
      				return _t183;
      			}




















































      0x00421fb3
      0x00421fbf
      0x00421fc7
      0x00421fca
      0x00421fdd
      0x00421fe3
      0x00421fe5
      0x00421fec
      0x0042200b
      0x00421fee
      0x00421fee
      0x00421ff3
      0x00421ff8
      0x00421ffb
      0x00421ffe
      0x00422003
      0x00422003
      0x00422012
      0x00422015
      0x0042201a
      0x0042201d
      0x00422024
      0x00422031
      0x00422036
      0x00422039
      0x0042203a
      0x00422044
      0x00422049
      0x0042204a
      0x0042204c
      0x00422053
      0x00422058
      0x0042205f
      0x00422067
      0x00422072
      0x0042207f
      0x0042209c
      0x00422081
      0x00422081
      0x00422086
      0x0042208b
      0x00422090
      0x00422090
      0x004220ae
      0x004220bd
      0x004220c0
      0x004220c2
      0x004220cf
      0x004220ee
      0x004220d1
      0x004220d1
      0x004220d3
      0x004220d8
      0x004220db
      0x004220e1
      0x004220e6
      0x004220e6
      0x004220f8
      0x00422110
      0x00422113
      0x00422115
      0x00422122
      0x00422144
      0x00422124
      0x00422124
      0x00422126
      0x0042212b
      0x00422131
      0x00422137
      0x0042213c
      0x0042213c
      0x0042214f
      0x00422156
      0x00422162
      0x0042217f
      0x00422164
      0x00422164
      0x00422169
      0x0042216e
      0x00422173
      0x00422173
      0x00422191
      0x004221a0
      0x004221a3
      0x004221a5
      0x004221b2
      0x004221d1
      0x004221b4
      0x004221b4
      0x004221b6
      0x004221bb
      0x004221be
      0x004221c4
      0x004221c9
      0x004221c9
      0x004221db
      0x004221f3
      0x004221f9
      0x004221fb
      0x00422208
      0x0042222d
      0x0042220a
      0x0042220a
      0x0042220f
      0x00422214
      0x0042221a
      0x00422220
      0x00422225
      0x00422225
      0x00422237
      0x0042223d
      0x0042224a
      0x00422252
      0x0042225e
      0x0042227b
      0x00422260
      0x00422260
      0x00422265
      0x0042226a
      0x0042226f
      0x0042226f
      0x0042228d
      0x0042229c
      0x0042229f
      0x004222a1
      0x004222ae
      0x004222cd
      0x004222b0
      0x004222b0
      0x004222b2
      0x004222b7
      0x004222ba
      0x004222c0
      0x004222c5
      0x004222c5
      0x004222d7
      0x004222ef
      0x004222f5
      0x004222f7
      0x00422304
      0x00422329
      0x00422306
      0x00422306
      0x0042230b
      0x00422310
      0x00422316
      0x0042231c
      0x00422321
      0x00422321
      0x00422333
      0x00422339
      0x00422346
      0x0042234e
      0x00422356
      0x00422357
      0x0042235c
      0x00422361
      0x00422365
      0x00422366
      0x00422371
      0x00422379
      0x0042237e
      0x00422385
      0x00422392
      0x00422397
      0x0042239c
      0x0042239d
      0x004223a2
      0x004223a8
      0x004223a8
      0x004223b4
      0x004223d1
      0x004223b6
      0x004223b6
      0x004223bb
      0x004223c0
      0x004223c5
      0x004223c5
      0x004223f5
      0x004223f9
      0x004223fe
      0x0042240d
      0x00422413
      0x00422415
      0x00422422
      0x00422444
      0x00422424
      0x00422424
      0x00422429
      0x0042242e
      0x00422431
      0x00422437
      0x0042243c
      0x0042243c
      0x0042244b
      0x0042244f
      0x00422456
      0x0042245b
      0x0042245c
      0x00422489
      0x00422491
      0x00422499
      0x0042249e

      APIs
      • __vbaChkstk.MSVBVM60(?,004011D6), ref: 00421FBF
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408AE4,000000E8), ref: 00421FFE
      • __vbaFpI4.MSVBVM60(00000000,?,00408AE4,000000E8), ref: 00422015
      • __vbaVarDup.MSVBVM60(00000000,?,00408AE4,000000E8), ref: 00422031
      • #667.MSVBVM60(?), ref: 0042203A
      • __vbaStrMove.MSVBVM60(?), ref: 00422044
      • __vbaStrCmp.MSVBVM60(00000000,00000000,?), ref: 0042204C
      • __vbaFreeStr.MSVBVM60(00000000,00000000,?), ref: 0042205F
      • __vbaFreeVar.MSVBVM60(00000000,00000000,?), ref: 00422067
      • __vbaNew2.MSVBVM60(00408C9C,004245B4,00000000,00000000,?), ref: 0042208B
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00408C8C,00000014), ref: 004220E1
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408CAC,00000068), ref: 00422137
      • __vbaFreeObj.MSVBVM60(00000000,?,00408CAC,00000068), ref: 00422156
      • __vbaNew2.MSVBVM60(00408C9C,004245B4), ref: 0042216E
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00408C8C,00000014), ref: 004221C4
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408CAC,000000D0), ref: 00422220
      • __vbaStrMove.MSVBVM60(00000000,?,00408CAC,000000D0), ref: 0042224A
      • __vbaFreeObj.MSVBVM60(00000000,?,00408CAC,000000D0), ref: 00422252
      • __vbaNew2.MSVBVM60(00408C9C,004245B4), ref: 0042226A
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00408C8C,00000014), ref: 004222C0
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408CAC,00000110), ref: 0042231C
      • __vbaStrMove.MSVBVM60(00000000,?,00408CAC,00000110), ref: 00422346
      • __vbaFreeObj.MSVBVM60(00000000,?,00408CAC,00000110), ref: 0042234E
      • #610.MSVBVM60(?), ref: 00422357
      • #552.MSVBVM60(?,?,00000001,?), ref: 00422366
      • __vbaVarMove.MSVBVM60(?,?,00000001,?), ref: 00422371
      • __vbaFreeVar.MSVBVM60(?,?,00000001,?), ref: 00422379
      • __vbaVarDup.MSVBVM60(?,?,00000001,?), ref: 00422392
      • #600.MSVBVM60(?,00000002,?,?,00000001,?), ref: 0042239D
      • __vbaFreeVar.MSVBVM60(?,00000002,?,?,00000001,?), ref: 004223A8
      • __vbaNew2.MSVBVM60(004083F0,00424010,00000000,00000000,?), ref: 004223C0
      • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,00000000,00000000,?), ref: 004223F9
      • __vbaHresultCheckObj.MSVBVM60(00000000,00000000,00408C60,000000F8,?,?,?,?,?,?,?,00000000,00000000,?), ref: 00422437
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,00000000,00000000,?), ref: 00422456
      • __vbaFreeStr.MSVBVM60(0042249F,?,?,?,?,?,?,?,00000000,00000000,?), ref: 00422489
      • __vbaFreeStr.MSVBVM60(0042249F,?,?,?,?,?,?,?,00000000,00000000,?), ref: 00422491
      • __vbaFreeVar.MSVBVM60(0042249F,?,?,?,?,?,?,?,00000000,00000000,?), ref: 00422499
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1187873898.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1187867422.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187894169.0000000000424000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187905826.0000000000426000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_REVGKXx6Ns.jbxd
      Similarity
      • API ID: __vba$Free$CheckHresult$MoveNew2$#552#600#610#667Chkstk
      • String ID: UNCHIC$tmp
      • API String ID: 1871007200-2985027313
      • Opcode ID: 9ad8e065df39061f8e28265bc0f5dffd092d2080742a64c6a69feea9bdc9b07a
      • Instruction ID: 6fb35b097a5337e82dc70571f4ad1c4ccb1c2ccd9c26a615760a73bc172cc5ac
      • Opcode Fuzzy Hash: 9ad8e065df39061f8e28265bc0f5dffd092d2080742a64c6a69feea9bdc9b07a
      • Instruction Fuzzy Hash: 50E1F970A00228EFDB20EFA5DD45BDDB7B4BF04308F5080AAE549B71A1DB785A85DF19
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      C-Code - Quality: 59%
      			E00422D43(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				void* _v28;
      				short _v32;
      				void* _v36;
      				signed int _v40;
      				char _v44;
      				intOrPtr _v52;
      				char _v60;
      				void* _v80;
      				void* _v84;
      				signed int _v88;
      				void* _v92;
      				signed int _v96;
      				signed int _v108;
      				signed int _v112;
      				intOrPtr* _v116;
      				signed int _v120;
      				signed int _v124;
      				intOrPtr* _v128;
      				signed int _v132;
      				signed int _v136;
      				intOrPtr* _v140;
      				signed int _v144;
      				signed int _t117;
      				char* _t121;
      				signed int _t127;
      				signed int _t132;
      				signed int _t139;
      				signed int _t144;
      				char* _t149;
      				signed int _t153;
      				void* _t176;
      				void* _t178;
      				intOrPtr _t179;
      
      				_t179 = _t178 - 0xc;
      				 *[fs:0x0] = _t179;
      				L004011D0();
      				_v16 = _t179;
      				_v12 = 0x401198;
      				_v8 = 0;
      				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x78,  *[fs:0x0], 0x4011d6, _t176);
      				_v52 = 0x4b;
      				_v60 = 2;
      				_t117 =  &_v60;
      				_push(_t117);
      				L00401284();
      				L00401302();
      				_push(_t117);
      				_push(0x408cfc);
      				L00401308();
      				asm("sbb eax, eax");
      				_v84 =  ~( ~( ~_t117));
      				L004012F0();
      				L00401314();
      				_t121 = _v84;
      				if(_t121 != 0) {
      					_push(L"COINVENTORS");
      					_push(L"Teknologiseringers2");
      					_push(L"ACHOO");
      					_push(L"garantien");
      					L0040127E();
      					L00401278();
      					if( *0x4245b4 != 0) {
      						_v116 = 0x4245b4;
      					} else {
      						_push(0x4245b4);
      						_push(0x408c9c);
      						L00401320();
      						_v116 = 0x4245b4;
      					}
      					_v84 =  *_v116;
      					_t127 =  *((intOrPtr*)( *_v84 + 0x14))(_v84,  &_v44);
      					asm("fclex");
      					_v88 = _t127;
      					if(_v88 >= 0) {
      						_v120 = _v120 & 0x00000000;
      					} else {
      						_push(0x14);
      						_push(0x408c8c);
      						_push(_v84);
      						_push(_v88);
      						L0040132C();
      						_v120 = _t127;
      					}
      					_v92 = _v44;
      					_t132 =  *((intOrPtr*)( *_v92 + 0x78))(_v92,  &_v80);
      					asm("fclex");
      					_v96 = _t132;
      					if(_v96 >= 0) {
      						_v124 = _v124 & 0x00000000;
      					} else {
      						_push(0x78);
      						_push(0x408cac);
      						_push(_v92);
      						_push(_v96);
      						L0040132C();
      						_v124 = _t132;
      					}
      					_v32 = _v80;
      					L004012EA();
      					if( *0x4245b4 != 0) {
      						_v128 = 0x4245b4;
      					} else {
      						_push(0x4245b4);
      						_push(0x408c9c);
      						L00401320();
      						_v128 = 0x4245b4;
      					}
      					_v84 =  *_v128;
      					_t139 =  *((intOrPtr*)( *_v84 + 0x14))(_v84,  &_v44);
      					asm("fclex");
      					_v88 = _t139;
      					if(_v88 >= 0) {
      						_v132 = _v132 & 0x00000000;
      					} else {
      						_push(0x14);
      						_push(0x408c8c);
      						_push(_v84);
      						_push(_v88);
      						L0040132C();
      						_v132 = _t139;
      					}
      					_v92 = _v44;
      					_t144 =  *((intOrPtr*)( *_v92 + 0x110))(_v92,  &_v40);
      					asm("fclex");
      					_v96 = _t144;
      					if(_v96 >= 0) {
      						_v136 = _v136 & 0x00000000;
      					} else {
      						_push(0x110);
      						_push(0x408cac);
      						_push(_v92);
      						_push(_v96);
      						L0040132C();
      						_v136 = _t144;
      					}
      					_v108 = _v40;
      					_v40 = _v40 & 0x00000000;
      					L00401302();
      					L004012EA();
      					if( *0x424010 != 0) {
      						_v140 = 0x424010;
      					} else {
      						_push(0x424010);
      						_push(0x4083f0);
      						L00401320();
      						_v140 = 0x424010;
      					}
      					_t149 =  &_v44;
      					L00401326();
      					_v84 = _t149;
      					_t153 =  *((intOrPtr*)( *_v84 + 0x50))(_v84,  &_v40, _t149,  *((intOrPtr*)( *((intOrPtr*)( *_v140)) + 0x304))( *_v140));
      					asm("fclex");
      					_v88 = _t153;
      					if(_v88 >= 0) {
      						_v144 = _v144 & 0x00000000;
      					} else {
      						_push(0x50);
      						_push(0x408ce0);
      						_push(_v84);
      						_push(_v88);
      						L0040132C();
      						_v144 = _t153;
      					}
      					_v112 = _v40;
      					_v40 = _v40 & 0x00000000;
      					_v52 = _v112;
      					_v60 = 8;
      					_t121 =  &_v60;
      					_push(_t121);
      					L004012FC();
      					L00401302();
      					L004012EA();
      					L00401314();
      				}
      				_push(0x423068);
      				L004012F0();
      				L004012F0();
      				return _t121;
      			}







































      0x00422d46
      0x00422d55
      0x00422d5f
      0x00422d67
      0x00422d6a
      0x00422d71
      0x00422d80
      0x00422d83
      0x00422d8a
      0x00422d91
      0x00422d94
      0x00422d95
      0x00422d9f
      0x00422da4
      0x00422da5
      0x00422daa
      0x00422db1
      0x00422db7
      0x00422dbe
      0x00422dc6
      0x00422dcb
      0x00422dd1
      0x00422dd7
      0x00422ddc
      0x00422de1
      0x00422de6
      0x00422deb
      0x00422df0
      0x00422dfc
      0x00422e16
      0x00422dfe
      0x00422dfe
      0x00422e03
      0x00422e08
      0x00422e0d
      0x00422e0d
      0x00422e22
      0x00422e31
      0x00422e34
      0x00422e36
      0x00422e3d
      0x00422e56
      0x00422e3f
      0x00422e3f
      0x00422e41
      0x00422e46
      0x00422e49
      0x00422e4c
      0x00422e51
      0x00422e51
      0x00422e5d
      0x00422e6c
      0x00422e6f
      0x00422e71
      0x00422e78
      0x00422e91
      0x00422e7a
      0x00422e7a
      0x00422e7c
      0x00422e81
      0x00422e84
      0x00422e87
      0x00422e8c
      0x00422e8c
      0x00422e99
      0x00422ea0
      0x00422eac
      0x00422ec6
      0x00422eae
      0x00422eae
      0x00422eb3
      0x00422eb8
      0x00422ebd
      0x00422ebd
      0x00422ed2
      0x00422ee1
      0x00422ee4
      0x00422ee6
      0x00422eed
      0x00422f06
      0x00422eef
      0x00422eef
      0x00422ef1
      0x00422ef6
      0x00422ef9
      0x00422efc
      0x00422f01
      0x00422f01
      0x00422f0d
      0x00422f1c
      0x00422f22
      0x00422f24
      0x00422f2b
      0x00422f4a
      0x00422f2d
      0x00422f2d
      0x00422f32
      0x00422f37
      0x00422f3a
      0x00422f3d
      0x00422f42
      0x00422f42
      0x00422f54
      0x00422f57
      0x00422f61
      0x00422f69
      0x00422f75
      0x00422f92
      0x00422f77
      0x00422f77
      0x00422f7c
      0x00422f81
      0x00422f86
      0x00422f86
      0x00422fb6
      0x00422fba
      0x00422fbf
      0x00422fce
      0x00422fd1
      0x00422fd3
      0x00422fda
      0x00422ff6
      0x00422fdc
      0x00422fdc
      0x00422fde
      0x00422fe3
      0x00422fe6
      0x00422fe9
      0x00422fee
      0x00422fee
      0x00423000
      0x00423003
      0x0042300a
      0x0042300d
      0x00423014
      0x00423017
      0x00423018
      0x00423022
      0x0042302a
      0x00423032
      0x00423032
      0x00423037
      0x0042305a
      0x00423062
      0x00423067

      APIs
      • __vbaChkstk.MSVBVM60(?,004011D6), ref: 00422D5F
      • #572.MSVBVM60(00000002), ref: 00422D95
      • __vbaStrMove.MSVBVM60(00000002), ref: 00422D9F
      • __vbaStrCmp.MSVBVM60(00408CFC,00000000,00000002), ref: 00422DAA
      • __vbaFreeStr.MSVBVM60(00408CFC,00000000,00000002), ref: 00422DBE
      • __vbaFreeVar.MSVBVM60(00408CFC,00000000,00000002), ref: 00422DC6
      • #690.MSVBVM60(garantien,ACHOO,Teknologiseringers2,COINVENTORS,00408CFC,00000000,00000002), ref: 00422DEB
      • #598.MSVBVM60(garantien,ACHOO,Teknologiseringers2,COINVENTORS,00408CFC,00000000,00000002), ref: 00422DF0
      • __vbaNew2.MSVBVM60(00408C9C,004245B4,garantien,ACHOO,Teknologiseringers2,COINVENTORS,00408CFC,00000000,00000002), ref: 00422E08
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408C8C,00000014,?,?,?,?,?,?,?,garantien,ACHOO,Teknologiseringers2,COINVENTORS,00408CFC), ref: 00422E4C
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408CAC,00000078,?,?,?,?,?,?,?,garantien,ACHOO,Teknologiseringers2,COINVENTORS,00408CFC), ref: 00422E87
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,garantien,ACHOO,Teknologiseringers2,COINVENTORS,00408CFC,00000000,00000002), ref: 00422EA0
      • __vbaNew2.MSVBVM60(00408C9C,004245B4,?,?,?,?,?,?,?,?,?,garantien,ACHOO,Teknologiseringers2,COINVENTORS,00408CFC), ref: 00422EB8
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408C8C,00000014,?,?,?,?,?,?,?,?,?,garantien,ACHOO,Teknologiseringers2), ref: 00422EFC
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408CAC,00000110,?,?,?,?,?,?,?,?,?,?,?,garantien), ref: 00422F3D
      • __vbaStrMove.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,garantien,ACHOO,Teknologiseringers2,COINVENTORS,00408CFC), ref: 00422F61
      • __vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,garantien,ACHOO,Teknologiseringers2,COINVENTORS,00408CFC), ref: 00422F69
      • __vbaNew2.MSVBVM60(004083F0,00424010,?,?,?,?,?,?,?,?,?,?,?,garantien,ACHOO,Teknologiseringers2), ref: 00422F81
      • __vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,garantien), ref: 00422FBA
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408CE0,00000050), ref: 00422FE9
      • #667.MSVBVM60(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,garantien,ACHOO), ref: 00423018
      • __vbaStrMove.MSVBVM60(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,garantien,ACHOO), ref: 00423022
      • __vbaFreeObj.MSVBVM60(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,garantien,ACHOO), ref: 0042302A
      • __vbaFreeVar.MSVBVM60(00000008,?,?,?,?,?,?,?,?,?,?,?,?,?,garantien,ACHOO), ref: 00423032
      • __vbaFreeStr.MSVBVM60(00423068,00408CFC,00000000,00000002), ref: 0042305A
      • __vbaFreeStr.MSVBVM60(00423068,00408CFC,00000000,00000002), ref: 00423062
      Strings
      Memory Dump Source
      • Source File: 00000000.00000002.1187873898.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1187867422.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187894169.0000000000424000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187905826.0000000000426000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_REVGKXx6Ns.jbxd
      Similarity
      • API ID: __vba$Free$CheckHresult$MoveNew2$#572#598#667#690Chkstk
      • String ID: ACHOO$COINVENTORS$K$Teknologiseringers2$garantien
      • API String ID: 2768728735-653337235
      • Opcode ID: dc78c297acb85df2a6cfbe451764bcc9da44060729d2e0a31415743d495dfbe6
      • Instruction ID: be4dc866ebf3a2cd984e5d5d6b58c9c9169174c6ed46c65b5a6d7adf680101a2
      • Opcode Fuzzy Hash: dc78c297acb85df2a6cfbe451764bcc9da44060729d2e0a31415743d495dfbe6
      • Instruction Fuzzy Hash: 3EA1D370A00218EFDB10EFE5D945BDDBBB4BF18304F50406AE501BB2A5DBB85989DF68
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 254 4229ba-422a17 __vbaChkstk __vbaR8Str __vbaFPFix __vbaFpR8 256 422d02-422d23 __vbaFreeStr 254->256 257 422a1d-422a24 254->257 258 422a26-422a3c __vbaNew2 257->258 259 422a3e 257->259 261 422a45-422a65 258->261 259->261 263 422a67-422a7c __vbaHresultCheckObj 261->263 264 422a7e 261->264 265 422a82-422aa3 263->265 264->265 267 422aa5-422abd __vbaHresultCheckObj 265->267 268 422abf 265->268 269 422ac3-422ada __vbaFreeObj 267->269 268->269 270 422af4 269->270 271 422adc-422af2 __vbaNew2 269->271 272 422afb-422b1b 270->272 271->272 274 422b34 272->274 275 422b1d-422b32 __vbaHresultCheckObj 272->275 276 422b38-422b59 274->276 275->276 278 422b75 276->278 279 422b5b-422b73 __vbaHresultCheckObj 276->279 280 422b79-422b90 __vbaFreeObj 278->280 279->280 281 422b92-422ba8 __vbaNew2 280->281 282 422baa 280->282 283 422bb1-422bd1 281->283 282->283 285 422bd3-422be8 __vbaHresultCheckObj 283->285 286 422bea 283->286 287 422bee-422c0f 285->287 286->287 289 422c11-422c29 __vbaHresultCheckObj 287->289 290 422c2b 287->290 291 422c2f-422c53 __vbaStrMove __vbaFreeObj 289->291 290->291 292 422c55-422c6b __vbaNew2 291->292 293 422c6d 291->293 294 422c74-422c94 292->294 293->294 296 422c96-422cab __vbaHresultCheckObj 294->296 297 422cad 294->297 298 422cb1-422cd2 296->298 297->298 300 422cd4-422cec __vbaHresultCheckObj 298->300 301 422cee 298->301 302 422cf2-422cfd __vbaFreeObj 300->302 301->302 302->256
      C-Code - Quality: 59%
      			E004229BA(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				void* _v28;
      				short _v32;
      				short _v36;
      				short _v40;
      				signed int _v44;
      				char _v48;
      				void* _v52;
      				void* _v56;
      				intOrPtr* _v60;
      				signed int _v64;
      				void* _v68;
      				signed int _v72;
      				signed int _v84;
      				intOrPtr* _v88;
      				signed int _v92;
      				signed int _v96;
      				intOrPtr* _v100;
      				signed int _v104;
      				signed int _v108;
      				intOrPtr* _v112;
      				signed int _v116;
      				signed int _v120;
      				intOrPtr* _v124;
      				signed int _v128;
      				signed int _v132;
      				short _t140;
      				signed int _t146;
      				signed int _t151;
      				signed int _t158;
      				signed int _t163;
      				signed int _t170;
      				signed int _t175;
      				signed int _t182;
      				signed int _t187;
      				void* _t198;
      				void* _t200;
      				intOrPtr _t201;
      
      				_t201 = _t200 - 0xc;
      				 *[fs:0x0] = _t201;
      				L004011D0();
      				_v16 = _t201;
      				_v12 = 0x401188;
      				_v8 = 0;
      				_t140 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x6c,  *[fs:0x0], 0x4011d6, _t198);
      				_push(0x408cf4);
      				L0040128A();
      				L00401290();
      				L00401296();
      				asm("fcomp qword [0x401180]");
      				asm("fnstsw ax");
      				asm("sahf");
      				if(__eflags != 0) {
      					if( *0x4245b4 != 0) {
      						_v88 = 0x4245b4;
      					} else {
      						_push(0x4245b4);
      						_push(0x408c9c);
      						L00401320();
      						_v88 = 0x4245b4;
      					}
      					_v60 =  *_v88;
      					_t146 =  *((intOrPtr*)( *_v60 + 0x14))(_v60,  &_v48);
      					asm("fclex");
      					_v64 = _t146;
      					if(_v64 >= 0) {
      						_t20 =  &_v92;
      						 *_t20 = _v92 & 0x00000000;
      						__eflags =  *_t20;
      					} else {
      						_push(0x14);
      						_push(0x408c8c);
      						_push(_v60);
      						_push(_v64);
      						L0040132C();
      						_v92 = _t146;
      					}
      					_v68 = _v48;
      					_t151 =  *((intOrPtr*)( *_v68 + 0x140))(_v68,  &_v52);
      					asm("fclex");
      					_v72 = _t151;
      					if(_v72 >= 0) {
      						_t33 =  &_v96;
      						 *_t33 = _v96 & 0x00000000;
      						__eflags =  *_t33;
      					} else {
      						_push(0x140);
      						_push(0x408cac);
      						_push(_v68);
      						_push(_v72);
      						L0040132C();
      						_v96 = _t151;
      					}
      					_v36 = _v52;
      					L004012EA();
      					if( *0x4245b4 != 0) {
      						_v100 = 0x4245b4;
      					} else {
      						_push(0x4245b4);
      						_push(0x408c9c);
      						L00401320();
      						_v100 = 0x4245b4;
      					}
      					_v60 =  *_v100;
      					_t158 =  *((intOrPtr*)( *_v60 + 0x14))(_v60,  &_v48);
      					asm("fclex");
      					_v64 = _t158;
      					if(_v64 >= 0) {
      						_t51 =  &_v104;
      						 *_t51 = _v104 & 0x00000000;
      						__eflags =  *_t51;
      					} else {
      						_push(0x14);
      						_push(0x408c8c);
      						_push(_v60);
      						_push(_v64);
      						L0040132C();
      						_v104 = _t158;
      					}
      					_v68 = _v48;
      					_t163 =  *((intOrPtr*)( *_v68 + 0x108))(_v68,  &_v52);
      					asm("fclex");
      					_v72 = _t163;
      					if(_v72 >= 0) {
      						_t64 =  &_v108;
      						 *_t64 = _v108 & 0x00000000;
      						__eflags =  *_t64;
      					} else {
      						_push(0x108);
      						_push(0x408cac);
      						_push(_v68);
      						_push(_v72);
      						L0040132C();
      						_v108 = _t163;
      					}
      					_v32 = _v52;
      					L004012EA();
      					if( *0x4245b4 != 0) {
      						_v112 = 0x4245b4;
      					} else {
      						_push(0x4245b4);
      						_push(0x408c9c);
      						L00401320();
      						_v112 = 0x4245b4;
      					}
      					_v60 =  *_v112;
      					_t170 =  *((intOrPtr*)( *_v60 + 0x14))(_v60,  &_v48);
      					asm("fclex");
      					_v64 = _t170;
      					if(_v64 >= 0) {
      						_t82 =  &_v116;
      						 *_t82 = _v116 & 0x00000000;
      						__eflags =  *_t82;
      					} else {
      						_push(0x14);
      						_push(0x408c8c);
      						_push(_v60);
      						_push(_v64);
      						L0040132C();
      						_v116 = _t170;
      					}
      					_v68 = _v48;
      					_t175 =  *((intOrPtr*)( *_v68 + 0xf0))(_v68,  &_v44);
      					asm("fclex");
      					_v72 = _t175;
      					if(_v72 >= 0) {
      						_t95 =  &_v120;
      						 *_t95 = _v120 & 0x00000000;
      						__eflags =  *_t95;
      					} else {
      						_push(0xf0);
      						_push(0x408cac);
      						_push(_v68);
      						_push(_v72);
      						L0040132C();
      						_v120 = _t175;
      					}
      					_v84 = _v44;
      					_v44 = _v44 & 0x00000000;
      					L00401302();
      					L004012EA();
      					if( *0x4245b4 != 0) {
      						_v124 = 0x4245b4;
      					} else {
      						_push(0x4245b4);
      						_push(0x408c9c);
      						L00401320();
      						_v124 = 0x4245b4;
      					}
      					_v60 =  *_v124;
      					_t182 =  *((intOrPtr*)( *_v60 + 0x14))(_v60,  &_v48);
      					asm("fclex");
      					_v64 = _t182;
      					if(_v64 >= 0) {
      						_t117 =  &_v128;
      						 *_t117 = _v128 & 0x00000000;
      						__eflags =  *_t117;
      					} else {
      						_push(0x14);
      						_push(0x408c8c);
      						_push(_v60);
      						_push(_v64);
      						L0040132C();
      						_v128 = _t182;
      					}
      					_v68 = _v48;
      					_t187 =  *((intOrPtr*)( *_v68 + 0x118))(_v68,  &_v56);
      					asm("fclex");
      					_v72 = _t187;
      					if(_v72 >= 0) {
      						_t130 =  &_v132;
      						 *_t130 = _v132 & 0x00000000;
      						__eflags =  *_t130;
      					} else {
      						_push(0x118);
      						_push(0x408cac);
      						_push(_v68);
      						_push(_v72);
      						L0040132C();
      						_v132 = _t187;
      					}
      					_t140 = _v56;
      					_v40 = _t140;
      					L004012EA();
      				}
      				asm("wait");
      				_push(0x422d24);
      				L004012F0();
      				return _t140;
      			}











































      0x004229bd
      0x004229cc
      0x004229d6
      0x004229de
      0x004229e1
      0x004229e8
      0x004229f7
      0x004229fa
      0x004229ff
      0x00422a04
      0x00422a09
      0x00422a0e
      0x00422a14
      0x00422a16
      0x00422a17
      0x00422a24
      0x00422a3e
      0x00422a26
      0x00422a26
      0x00422a2b
      0x00422a30
      0x00422a35
      0x00422a35
      0x00422a4a
      0x00422a59
      0x00422a5c
      0x00422a5e
      0x00422a65
      0x00422a7e
      0x00422a7e
      0x00422a7e
      0x00422a67
      0x00422a67
      0x00422a69
      0x00422a6e
      0x00422a71
      0x00422a74
      0x00422a79
      0x00422a79
      0x00422a85
      0x00422a94
      0x00422a9a
      0x00422a9c
      0x00422aa3
      0x00422abf
      0x00422abf
      0x00422abf
      0x00422aa5
      0x00422aa5
      0x00422aaa
      0x00422aaf
      0x00422ab2
      0x00422ab5
      0x00422aba
      0x00422aba
      0x00422ac7
      0x00422ace
      0x00422ada
      0x00422af4
      0x00422adc
      0x00422adc
      0x00422ae1
      0x00422ae6
      0x00422aeb
      0x00422aeb
      0x00422b00
      0x00422b0f
      0x00422b12
      0x00422b14
      0x00422b1b
      0x00422b34
      0x00422b34
      0x00422b34
      0x00422b1d
      0x00422b1d
      0x00422b1f
      0x00422b24
      0x00422b27
      0x00422b2a
      0x00422b2f
      0x00422b2f
      0x00422b3b
      0x00422b4a
      0x00422b50
      0x00422b52
      0x00422b59
      0x00422b75
      0x00422b75
      0x00422b75
      0x00422b5b
      0x00422b5b
      0x00422b60
      0x00422b65
      0x00422b68
      0x00422b6b
      0x00422b70
      0x00422b70
      0x00422b7d
      0x00422b84
      0x00422b90
      0x00422baa
      0x00422b92
      0x00422b92
      0x00422b97
      0x00422b9c
      0x00422ba1
      0x00422ba1
      0x00422bb6
      0x00422bc5
      0x00422bc8
      0x00422bca
      0x00422bd1
      0x00422bea
      0x00422bea
      0x00422bea
      0x00422bd3
      0x00422bd3
      0x00422bd5
      0x00422bda
      0x00422bdd
      0x00422be0
      0x00422be5
      0x00422be5
      0x00422bf1
      0x00422c00
      0x00422c06
      0x00422c08
      0x00422c0f
      0x00422c2b
      0x00422c2b
      0x00422c2b
      0x00422c11
      0x00422c11
      0x00422c16
      0x00422c1b
      0x00422c1e
      0x00422c21
      0x00422c26
      0x00422c26
      0x00422c32
      0x00422c35
      0x00422c3f
      0x00422c47
      0x00422c53
      0x00422c6d
      0x00422c55
      0x00422c55
      0x00422c5a
      0x00422c5f
      0x00422c64
      0x00422c64
      0x00422c79
      0x00422c88
      0x00422c8b
      0x00422c8d
      0x00422c94
      0x00422cad
      0x00422cad
      0x00422cad
      0x00422c96
      0x00422c96
      0x00422c98
      0x00422c9d
      0x00422ca0
      0x00422ca3
      0x00422ca8
      0x00422ca8
      0x00422cb4
      0x00422cc3
      0x00422cc9
      0x00422ccb
      0x00422cd2
      0x00422cee
      0x00422cee
      0x00422cee
      0x00422cd4
      0x00422cd4
      0x00422cd9
      0x00422cde
      0x00422ce1
      0x00422ce4
      0x00422ce9
      0x00422ce9
      0x00422cf2
      0x00422cf6
      0x00422cfd
      0x00422cfd
      0x00422d02
      0x00422d03
      0x00422d1e
      0x00422d23

      APIs
      • __vbaChkstk.MSVBVM60(?,004011D6), ref: 004229D6
      • __vbaR8Str.MSVBVM60(00408CF4,?,?,?,?,004011D6), ref: 004229FF
      • __vbaFPFix.MSVBVM60(00408CF4,?,?,?,?,004011D6), ref: 00422A04
      • __vbaFpR8.MSVBVM60(00408CF4,?,?,?,?,004011D6), ref: 00422A09
      • __vbaNew2.MSVBVM60(00408C9C,004245B4,00408CF4,?,?,?,?,004011D6), ref: 00422A30
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408C8C,00000014), ref: 00422A74
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408CAC,00000140), ref: 00422AB5
      • __vbaFreeObj.MSVBVM60(00000000,?,00408CAC,00000140), ref: 00422ACE
      • __vbaNew2.MSVBVM60(00408C9C,004245B4), ref: 00422AE6
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408C8C,00000014), ref: 00422B2A
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408CAC,00000108), ref: 00422B6B
      • __vbaFreeObj.MSVBVM60(00000000,?,00408CAC,00000108), ref: 00422B84
      • __vbaNew2.MSVBVM60(00408C9C,004245B4), ref: 00422B9C
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408C8C,00000014), ref: 00422BE0
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408CAC,000000F0), ref: 00422C21
      • __vbaStrMove.MSVBVM60(00000000,?,00408CAC,000000F0), ref: 00422C3F
      • __vbaFreeObj.MSVBVM60(00000000,?,00408CAC,000000F0), ref: 00422C47
      • __vbaNew2.MSVBVM60(00408C9C,004245B4), ref: 00422C5F
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408C8C,00000014), ref: 00422CA3
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408CAC,00000118), ref: 00422CE4
      • __vbaFreeObj.MSVBVM60(00000000,?,00408CAC,00000118), ref: 00422CFD
      • __vbaFreeStr.MSVBVM60(00422D24,00408CF4,?,?,?,?,004011D6), ref: 00422D1E
      Memory Dump Source
      • Source File: 00000000.00000002.1187873898.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1187867422.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187894169.0000000000424000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187905826.0000000000426000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_REVGKXx6Ns.jbxd
      Similarity
      • API ID: __vba$CheckHresult$Free$New2$ChkstkMove
      • String ID:
      • API String ID: 1793851610-0
      • Opcode ID: 7e0df380d090418d9509ed22c99bf63253f20394923bb3f368a29979e36a73d1
      • Instruction ID: 3d28d080b8bd81d36fe6634af16f100ee60e42bcac585c1635f36a8f1b8202d9
      • Opcode Fuzzy Hash: 7e0df380d090418d9509ed22c99bf63253f20394923bb3f368a29979e36a73d1
      • Instruction Fuzzy Hash: 8BB1AF74E01218EFDB10EFA5EA45BDDBBB0BF18304F50402AE541BB2A1DBB85946DF58
      Uniqueness

      Uniqueness Score: -1.00%

      Control-flow Graph

      • Executed
      • Not Executed
      control_flow_graph 303 4228a8-422902 __vbaChkstk #707 __vbaStrMove 305 422904-42291a __vbaNew2 303->305 306 42291c 303->306 307 422923-42295a __vbaObjSet 305->307 306->307 310 422976 307->310 311 42295c-422974 __vbaHresultCheckObj 307->311 312 42297a-42299a __vbaFreeObj __vbaFreeStr 310->312 311->312
      C-Code - Quality: 64%
      			E004228A8(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
      				intOrPtr _v8;
      				intOrPtr _v12;
      				intOrPtr _v16;
      				void* _v28;
      				char _v32;
      				intOrPtr* _v36;
      				signed int _v40;
      				intOrPtr* _v52;
      				signed int _v56;
      				char* _t35;
      				signed int _t38;
      				void* _t49;
      				void* _t51;
      				intOrPtr _t52;
      
      				_t52 = _t51 - 0xc;
      				 *[fs:0x0] = _t52;
      				L004011D0();
      				_v16 = _t52;
      				_v12 = 0x401170;
      				_v8 = 0;
      				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x20,  *[fs:0x0], 0x4011d6, _t49);
      				_push(0);
      				_push(1);
      				L0040129C();
      				L00401302();
      				if( *0x424010 != 0) {
      					_v52 = 0x424010;
      				} else {
      					_push(0x424010);
      					_push(0x4083f0);
      					L00401320();
      					_v52 = 0x424010;
      				}
      				_t35 =  &_v32;
      				L00401326();
      				_v36 = _t35;
      				_t38 =  *((intOrPtr*)( *_v36 + 0x218))(_v36, _t35,  *((intOrPtr*)( *((intOrPtr*)( *_v52)) + 0x2fc))( *_v52));
      				asm("fclex");
      				_v40 = _t38;
      				if(_v40 >= 0) {
      					_v56 = _v56 & 0x00000000;
      				} else {
      					_push(0x218);
      					_push(0x408c60);
      					_push(_v36);
      					_push(_v40);
      					L0040132C();
      					_v56 = _t38;
      				}
      				L004012EA();
      				_push(0x42299b);
      				L004012F0();
      				return _t38;
      			}

















      0x004228ab
      0x004228ba
      0x004228c4
      0x004228cc
      0x004228cf
      0x004228d6
      0x004228e5
      0x004228e8
      0x004228ea
      0x004228ec
      0x004228f6
      0x00422902
      0x0042291c
      0x00422904
      0x00422904
      0x00422909
      0x0042290e
      0x00422913
      0x00422913
      0x00422937
      0x0042293b
      0x00422940
      0x0042294b
      0x00422951
      0x00422953
      0x0042295a
      0x00422976
      0x0042295c
      0x0042295c
      0x00422961
      0x00422966
      0x00422969
      0x0042296c
      0x00422971
      0x00422971
      0x0042297d
      0x00422982
      0x00422995
      0x0042299a

      APIs
      • __vbaChkstk.MSVBVM60(?,004011D6), ref: 004228C4
      • #707.MSVBVM60(00000001,00000000,?,?,?,?,004011D6), ref: 004228EC
      • __vbaStrMove.MSVBVM60(00000001,00000000,?,?,?,?,004011D6), ref: 004228F6
      • __vbaNew2.MSVBVM60(004083F0,00424010,00000001,00000000,?,?,?,?,004011D6), ref: 0042290E
      • __vbaObjSet.MSVBVM60(?,00000000), ref: 0042293B
      • __vbaHresultCheckObj.MSVBVM60(00000000,?,00408C60,00000218), ref: 0042296C
      • __vbaFreeObj.MSVBVM60(00000000,?,00408C60,00000218), ref: 0042297D
      • __vbaFreeStr.MSVBVM60(0042299B), ref: 00422995
      Memory Dump Source
      • Source File: 00000000.00000002.1187873898.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true
      • Associated: 00000000.00000002.1187867422.0000000000400000.00000002.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187894169.0000000000424000.00000004.00020000.sdmp Download File
      • Associated: 00000000.00000002.1187905826.0000000000426000.00000002.00020000.sdmp Download File
      Joe Sandbox IDA Plugin
      • Snapshot File: hcaresult_0_2_400000_REVGKXx6Ns.jbxd
      Similarity
      • API ID: __vba$Free$#707CheckChkstkHresultMoveNew2
      • String ID:
      • API String ID: 842392621-0
      • Opcode ID: d16ed440eaadd8c40da4fea09658e6e088f821eb80ba90642ce52d236c498301
      • Instruction ID: 74f8a0f32ca4d6b006657015dbe817ef52888bec368b78b4cea8220e144c7134
      • Opcode Fuzzy Hash: d16ed440eaadd8c40da4fea09658e6e088f821eb80ba90642ce52d236c498301
      • Instruction Fuzzy Hash: 2C213B70A40218EFCB00EFA5E94AF9DBBB4FF08704F50406AF501BB2A1CBB95945DB58
      Uniqueness

      Uniqueness Score: -1.00%