Play interactive tour

Edit tour

Windows Analysis Report Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Overview

General Information

Sample Name:	Hong Tak Engineering SB Payment Receipt 241121_PDF.exe
Analysis ID:	528205
MD5:	b2e24bc0f1f55f2ac9d8034098dfe32f
SHA1:	4a20778acf6d512792077dc339f23acfbdf22875
SHA256:	d5ace58c68d1ff767b284deb172b5ce0550e96023a509a171fa7b34f0929b8e0
Tags:	exesigned
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

GuLoader behavior detected

Yara detected GuLoader

Hides threads from debuggers

Initial sample is a PE file and has a suspicious name

Writes to foreign memory regions

Tries to detect Any.run

Executable has a suspicious name (potential lure to open the executable)

C2 URLs / IPs found in malware configuration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Found potential dummy code loops (likely to delay analysis)

Creates a DirectInput object (often for capturing keystrokes)

Uses 32bit PE files

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

PE / OLE file has an invalid certificate

Contains functionality to call native functions

Creates processes with suspicious names

Program does not show much activity (idle)

Creates a process in suspended mode (likely to inject code)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

Hong Tak Engineering SB Payment Receipt 241121_PDF.exe (PID: 6132 cmdline: "C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe" MD5: B2E24BC0F1F55F2AC9D8034098DFE32F)

ieinstal.exe (PID: 6676 cmdline: "C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe" MD5: DAD17AB737E680C47C8A44CBB95EE67E)

ieinstal.exe (PID: 672 cmdline: "C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe" MD5: DAD17AB737E680C47C8A44CBB95EE67E)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://onedrive.live.com/download?cid=7FA6B3"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000006.00000000.377067642.0000000000560000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security
00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000006.00000000.377067642.0000000000560000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://onedrive.live.com/download?cid=7FA6B3"}

Multi AV Scanner detection for submitted file

Show sources

Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Virustotal: Detection: 39%			Perma Link
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	ReversingLabs: Detection: 27%

Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://onedrive.live.com/download?cid=7FA6B3

Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000002.520449768.00000000007AA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample	Static PE information: Filename: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe
Source: initial sample	Static PE information: Filename: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Static file information: Suspicious name

Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000000.287520162.000000000041C000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameGRUDGEFULUNNOT.exe vs Hong Tak Engineering SB Payment Receipt 241121_PDF.exe
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Binary or memory string: OriginalFilenameGRUDGEFULUNNOT.exe vs Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00758863	1_2_00758863
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00757824	1_2_00757824
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D82A	1_2_0075D82A
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075FDCF	1_2_0075FDCF
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075B5A0	1_2_0075B5A0
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D863	1_2_0075D863
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075F063	1_2_0075F063
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075E053	1_2_0075E053
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075F032	1_2_0075F032
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00756820	1_2_00756820
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D82C	1_2_0075D82C
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075481B	1_2_0075481B
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007600F0	1_2_007600F0
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007508F9	1_2_007508F9
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007570DE	1_2_007570DE
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007548C3	1_2_007548C3
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D8CC	1_2_0075D8CC
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007600C8	1_2_007600C8
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D8BF	1_2_0075D8BF
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00757093	1_2_00757093
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00760083	1_2_00760083
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075E088	1_2_0075E088
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075E170	1_2_0075E170
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00754967	1_2_00754967
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0076016B	1_2_0076016B
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075495D	1_2_0075495D
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00750943	1_2_00750943
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00760132	1_2_00760132
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00754933	1_2_00754933
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D903	1_2_0075D903
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075E10E	1_2_0075E10E
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007541F7	1_2_007541F7
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007511F3	1_2_007511F3
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075E1FF	1_2_0075E1FF
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007541C0	1_2_007541C0
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007601CF	1_2_007601CF
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007511B1	1_2_007511B1
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075E1BB	1_2_0075E1BB
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00760195	1_2_00760195
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075498F	1_2_0075498F
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00751272	1_2_00751272
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EA42	1_2_0075EA42
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00760233	1_2_00760233
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075E22E	1_2_0075E22E
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EA2B	1_2_0075EA2B
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075E2BE	1_2_0075E2BE
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EABB	1_2_0075EABB
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075E287	1_2_0075E287
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075E369	1_2_0075E369
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075F342	1_2_0075F342
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075E333	1_2_0075E333
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EB03	1_2_0075EB03
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EBE3	1_2_0075EBE3
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075F3EF	1_2_0075F3EF
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075E3D2	1_2_0075E3D2
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EBB3	1_2_0075EBB3
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075F3A9	1_2_0075F3A9
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EC42	1_2_0075EC42
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075E428	1_2_0075E428
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EC0F	1_2_0075EC0F
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075ECD3	1_2_0075ECD3
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EC93	1_2_0075EC93
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075B48A	1_2_0075B48A
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075ED73	1_2_0075ED73
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075855D	1_2_0075855D
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075FDE7	1_2_0075FDE7
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EDB8	1_2_0075EDB8
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075B5AB	1_2_0075B5AB
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075ED8A	1_2_0075ED8A
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00751E67	1_2_00751E67
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00751E5C	1_2_00751E5C
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EE44	1_2_0075EE44
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075FE49	1_2_0075FE49
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075FE14	1_2_0075FE14
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075FEB3	1_2_0075FEB3
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00757EA0	1_2_00757EA0
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EEAF	1_2_0075EEAF
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DF76	1_2_0075DF76
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075FF67	1_2_0075FF67
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D76D	1_2_0075D76D
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EF53	1_2_0075EF53
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DF44	1_2_0075DF44
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00756F34	1_2_00756F34
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DF39	1_2_0075DF39
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EF13	1_2_0075EF13
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075FF0F	1_2_0075FF0F
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00756F0E	1_2_00756F0E
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00756FF3	1_2_00756FF3
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007547EF	1_2_007547EF
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DFD0	1_2_0075DFD0
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007567C6	1_2_007567C6
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DFA4	1_2_0075DFA4
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007567AF	1_2_007567AF
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075FF94	1_2_0075FF94
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EF93	1_2_0075EF93
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056D82A	6_2_0056D82A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056FDCF	6_2_0056FDCF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056B5A0	6_2_0056B5A0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056481B	6_2_0056481B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056F032	6_2_0056F032
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00567824	6_2_00567824
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00566820	6_2_00566820
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_005670DE	6_2_005670DE
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_005648C3	6_2_005648C3
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_005608F9	6_2_005608F9
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00567093	6_2_00567093
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056B48A	6_2_0056B48A
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00568556	6_2_00568556
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056495D	6_2_0056495D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00560943	6_2_00560943
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00564967	6_2_00564967
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00564933	6_2_00564933
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_005641C0	6_2_005641C0
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_005641F7	6_2_005641F7
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_005611F3	6_2_005611F3
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056498F	6_2_0056498F
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_005611B1	6_2_005611B1
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056B5AB	6_2_0056B5AB
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00561E5C	6_2_00561E5C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00561272	6_2_00561272
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00561E67	6_2_00561E67
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056EA2B	6_2_0056EA2B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056D76D	6_2_0056D76D
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00566F0E	6_2_00566F0E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00566F34	6_2_00566F34
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_005667C6	6_2_005667C6
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00566FF3	6_2_00566FF3
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_005647EF	6_2_005647EF
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_005667AF	6_2_005667AF

Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Static PE information: invalid certificate

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00758863 NtWriteVirtualMemory,Sleep,	1_2_00758863
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D82A NtAllocateVirtualMemory,	1_2_0075D82A
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075F8E2 NtProtectVirtualMemory,	1_2_0075F8E2
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075F872 NtProtectVirtualMemory,	1_2_0075F872
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075887B NtWriteVirtualMemory,	1_2_0075887B
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D863 NtAllocateVirtualMemory,	1_2_0075D863
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D82C NtAllocateVirtualMemory,	1_2_0075D82C
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D8CC NtAllocateVirtualMemory,	1_2_0075D8CC
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D8BF NtAllocateVirtualMemory,	1_2_0075D8BF
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075F8A8 NtProtectVirtualMemory,	1_2_0075F8A8
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075896B NtWriteVirtualMemory,	1_2_0075896B
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D93B NtAllocateVirtualMemory,	1_2_0075D93B
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D903 NtAllocateVirtualMemory,	1_2_0075D903
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D9E5 NtAllocateVirtualMemory,	1_2_0075D9E5
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D9B2 NtAllocateVirtualMemory,	1_2_0075D9B2
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D983 NtAllocateVirtualMemory,	1_2_0075D983
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DA6A NtAllocateVirtualMemory,	1_2_0075DA6A
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DA3B NtAllocateVirtualMemory,	1_2_0075DA3B
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DAD3 NtAllocateVirtualMemory,	1_2_0075DAD3
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DAA6 NtAllocateVirtualMemory,	1_2_0075DAA6
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DB76 NtAllocateVirtualMemory,	1_2_0075DB76
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DB38 NtAllocateVirtualMemory,	1_2_0075DB38
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DB00 NtAllocateVirtualMemory,	1_2_0075DB00
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DBC7 NtAllocateVirtualMemory,	1_2_0075DBC7
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075DC13 NtAllocateVirtualMemory,	1_2_0075DC13
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056F872 NtProtectVirtualMemory,	6_2_0056F872
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056D82A NtAllocateVirtualMemory,	6_2_0056D82A

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Process Stats: CPU usage > 98%
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Process Stats: CPU usage > 98%

Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Virustotal: Detection: 39%
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	ReversingLabs: Detection: 27%

Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe "C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe"
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe "C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe"
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe "C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe"
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe "C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe "C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

File created: C:\Users\user\AppData\Local\Temp\~DFEBA196672956C021.TMP

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/1@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match	File source: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.377067642.0000000000560000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00407484 push 1002C579h; iretd	1_2_00407491
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00404764 push esi; ret	1_2_0040488D
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075116B pushfd ; iretd	1_2_0075116C
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00755A4B pushad ; retf	1_2_00755A4E
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075037F push ds; ret	1_2_00750516
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007503BB push ds; ret	1_2_00750516
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00750383 push ds; ret	1_2_00750516
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075046F push ds; ret	1_2_00750516
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075043F push ds; ret	1_2_00750516
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00750403 push ds; ret	1_2_00750516
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007504EC push ds; ret	1_2_00750516
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00750CD1 push ds; ret	1_2_00750D73
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00750CD3 push ds; ret	1_2_00750D73
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007504A7 push ds; ret	1_2_00750516
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_007595F5 push es; iretd	1_2_00759615
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00759605 push es; iretd	1_2_00759615
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075A7FF push cs; iretd	1_2_0075A806
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056046F push ds; ret	6_2_00560516
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00560403 push ds; ret	6_2_00560516
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056043F push ds; ret	6_2_00560516
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00560CD3 push ds; ret	6_2_00560D73
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00560CD1 push ds; ret	6_2_00560D73
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_005604EC push ds; ret	6_2_00560516
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_005604A7 push ds; ret	6_2_00560516
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056116B pushfd ; iretd	6_2_0056116C
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_005695F5 push es; iretd	6_2_00569615
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00565A4B pushad ; retf	6_2_00565A4E
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00569605 push es; iretd	6_2_00569615
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056037F push ds; ret	6_2_00560516
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056A7FF push cs; iretd	6_2_0056A806
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00560383 push ds; ret	6_2_00560516

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	File created: \hong tak engineering sb payment receipt 241121_pdf.exe
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	File created: \hong tak engineering sb payment receipt 241121_pdf.exe
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	File created: \hong tak engineering sb payment receipt 241121_pdf.exe	Jump to behavior
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	File created: \hong tak engineering sb payment receipt 241121_pdf.exe	Jump to behavior

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: ieinstal.exe, 00000006.00000002.564386334.0000000000D70000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEUSER32PSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WIN64; X64) APPLEWEBKIT/537.36 (KHTML, LIKE GECKO) CHROME/91.0.4472.124 SAFARI/537.36SHELL32ADVAPI32TEMP=
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000002.520996387.00000000030E0000.00000004.00000001.sdmp	Binary or memory string: NTDLLKERNEL32C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXEC:\PROGRAM FILES\QGA\QGA.EXEUSER32PSAPI.DLLMSI.DLLPUBLISHERWININET.DLLMOZILLA/5.0 (WINDOWS NT 10.0; WIN64; X64) APPLEWEBKIT/537.36 (KHTML, LIKE GECKO) CHROME/91.0.4472.124 SAFARI/537.36SHELL32ADVAPI32TEMP=PROGRAMFILES=\INTERNET EXPLORER\IEINSTAL.EXEWINDIR=\SYSWOW64\MSVBVM60.DLLPROGRAMFILES=\INTERNET EXPLORER\IEINSTAL.EXEWINDIR=\SYSWOW64\MSVBVM60.DLL
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000002.520996387.00000000030E0000.00000004.00000001.sdmp, ieinstal.exe, 00000006.00000002.564386334.0000000000D70000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Code function: 1_2_00754123 rdtsc

1_2_00754123

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

System information queried: ModuleInformation

Jump to behavior

Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000002.521048300.00000000031AA000.00000004.00000001.sdmp, ieinstal.exe, 00000006.00000002.564969808.000000000435A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Shutdown Service
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000002.521048300.00000000031AA000.00000004.00000001.sdmp, ieinstal.exe, 00000006.00000002.564969808.000000000435A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Remote Desktop Virtualization Service
Source: ieinstal.exe, 00000006.00000002.564969808.000000000435A000.00000004.00000001.sdmp	Binary or memory string: vmicshutdown
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000002.521048300.00000000031AA000.00000004.00000001.sdmp, ieinstal.exe, 00000006.00000002.564969808.000000000435A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Volume Shadow Copy Requestor
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000002.521048300.00000000031AA000.00000004.00000001.sdmp, ieinstal.exe, 00000006.00000002.564969808.000000000435A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V PowerShell Direct Service
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000002.521048300.00000000031AA000.00000004.00000001.sdmp, ieinstal.exe, 00000006.00000002.564969808.000000000435A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Time Synchronization Service
Source: ieinstal.exe, 00000006.00000002.564386334.0000000000D70000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exeuser32psapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36shell32advapi32TEMP=
Source: ieinstal.exe, 00000006.00000002.564969808.000000000435A000.00000004.00000001.sdmp	Binary or memory string: vmicvss
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000002.520996387.00000000030E0000.00000004.00000001.sdmp, ieinstal.exe, 00000006.00000002.564386334.0000000000D70000.00000004.00000001.sdmp	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000002.521048300.00000000031AA000.00000004.00000001.sdmp, ieinstal.exe, 00000006.00000002.564969808.000000000435A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Data Exchange Service
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000002.521048300.00000000031AA000.00000004.00000001.sdmp, ieinstal.exe, 00000006.00000002.564969808.000000000435A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Heartbeat Service
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000002.521048300.00000000031AA000.00000004.00000001.sdmp, ieinstal.exe, 00000006.00000002.564969808.000000000435A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V Guest Service Interface
Source: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, 00000001.00000002.520996387.00000000030E0000.00000004.00000001.sdmp	Binary or memory string: ntdllkernel32C:\Program Files\Qemu-ga\qemu-ga.exeC:\Program Files\qga\qga.exeuser32psapi.dllMsi.dllPublisherwininet.dllMozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36shell32advapi32TEMP=ProgramFiles=\internet explorer\ieinstal.exewindir=\syswow64\msvbvm60.dllProgramFiles=\internet explorer\ieinstal.exewindir=\syswow64\msvbvm60.dll
Source: ieinstal.exe, 00000006.00000002.564969808.000000000435A000.00000004.00000001.sdmp	Binary or memory string: vmicheartbeat

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Thread information set: HideFromDebugger			Jump to behavior

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_00759889 mov eax, dword ptr fs:[00000030h]	1_2_00759889
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075D108 mov eax, dword ptr fs:[00000030h]	1_2_0075D108
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EA42 mov eax, dword ptr fs:[00000030h]	1_2_0075EA42
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075EA2B mov eax, dword ptr fs:[00000030h]	1_2_0075EA2B
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Code function: 1_2_0075C345 mov eax, dword ptr fs:[00000030h]	1_2_0075C345
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_00569889 mov eax, dword ptr fs:[00000030h]	6_2_00569889
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056D108 mov eax, dword ptr fs:[00000030h]	6_2_0056D108
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056EA2B mov eax, dword ptr fs:[00000030h]	6_2_0056EA2B
Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe	Code function: 6_2_0056C345 mov eax, dword ptr fs:[00000030h]	6_2_0056C345

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Code function: 1_2_00754123 rdtsc

1_2_00754123

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Code function: 1_2_0075AD16 LdrInitializeThunk,

1_2_0075AD16

Source: C:\Program Files (x86)\Internet Explorer\ieinstal.exe

Code function: 6_2_0056FDCF RtlAddVectoredExceptionHandler,

6_2_0056FDCF

HIPS / PFW / Operating System Protection Evasion:

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Memory written: C:\Program Files (x86)\Internet Explorer\ieinstal.exe base: 560000

Jump to behavior

Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe "C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe"			Jump to behavior
Source: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	Process created: C:\Program Files (x86)\Internet Explorer\ieinstal.exe "C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe"			Jump to behavior

Source: ieinstal.exe, 00000006.00000002.564837081.0000000002F00000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: ieinstal.exe, 00000006.00000002.564837081.0000000002F00000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: ieinstal.exe, 00000006.00000002.564837081.0000000002F00000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: ieinstal.exe, 00000006.00000002.564837081.0000000002F00000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Stealing of Sensitive Information:

GuLoader behavior detected

Show sources

Source: Initial file

Signature Results: GuLoader behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection112	Virtualization/Sandbox Evasion31	Input Capture1	Security Software Discovery411	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection112	LSASS Memory	Virtualization/Sandbox Evasion31	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Information Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	40%	Virustotal		Browse
Hong Tak Engineering SB Payment Receipt 241121_PDF.exe	27%	ReversingLabs	Win32.Downloader.GuLoader

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://onedrive.live.com/download?cid=7FA6B3	false		high

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	528205
Start date:	24.11.2021
Start time:	21:02:08
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Hong Tak Engineering SB Payment Receipt 241121_PDF.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/1@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 13.3% (good quality ratio 5.8%) Quality average: 28.9% Quality standard deviation: 36.3%
HCA Information:	Successful, ratio: 80% Number of executed functions: 109 Number of non-executed functions: 68
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\~DFEBA196672956C021.TMP Download File
Process:	C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	1.3863194741075688
Encrypted:	false
SSDEEP:	96:GaabmG8CL3uSTdfPBeQaabmG8CL3uSTdf:i93jJBeU93j
MD5:	B3A27F74C52AC98DDE14EA7A804ECFD6
SHA1:	5F6D3F7644E0973D8A059AC228042EA60C507836
SHA-256:	F6C6736ACA8B6A743732E216DBB62B59B65DCBB0B6308B2B28D67706ABBC7F0C
SHA-512:	F7129070C7133C63C57BE7724B322B2A8F3FB6624F35B7A4E730DECD418E488CBF53292E845255DEDCFBA1502A0332D7DB17EF29D0E2A2A4DD345F87EECB36BE
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.999498053134024
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Hong Tak Engineering SB Payment Receipt 241121_PDF.exe
File size:	128816
MD5:	b2e24bc0f1f55f2ac9d8034098dfe32f
SHA1:	4a20778acf6d512792077dc339f23acfbdf22875
SHA256:	d5ace58c68d1ff767b284deb172b5ce0550e96023a509a171fa7b34f0929b8e0
SHA512:	01dbc321743acf74ef5557f9429d26aa5892b196c695a5e4ed0342d626c4e98a650d01729975d20812653edaf5295fdc7484a43949738d9de5effdb1dcb7b896
SSDEEP:	1536:I+3sCKWgen7J84YCrMYpNxXeBwodguvRZkVT7yaBOJzFHKAgYX5:I1PX0JLHrJNvoPvoVT58JzFh5
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........u...&...&...&T..&...&...&...&...&...&Rich...&................PE..L......V.....................`...... .............@........

File Icon


Icon Hash:	42b97ce4f0e1f2e4

Static PE Info

General
Entrypoint:	0x401320
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x56BC1AFE [Thu Feb 11 05:24:14 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	995d60149de3040b4890e5871343f4eb

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=dykkerklokkeado@LOKALITET.Sk, CN=godkendelsesmil, OU=Iroquoianspri1, O=Klarissenobie, L=KEDECHRYSLEROVEREF, S=AFSPADSERING, C=SC
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	11/23/2021 8:20:15 PM 11/23/2022 8:20:15 PM
Subject Chain	E=dykkerklokkeado@LOKALITET.Sk, CN=godkendelsesmil, OU=Iroquoianspri1, O=Klarissenobie, L=KEDECHRYSLEROVEREF, S=AFSPADSERING, C=SC
Version:	3
Thumbprint MD5:	8ACCDE5BD3D9438F5ED6CE6C1979787E
Thumbprint SHA-1:	E6BE6E4C60B6588F4C337C033C6165C6914F3249
Thumbprint SHA-256:	A2E6DA055CC6C343D9251796595BC0A1882C21EC31DBD14C72A656EC419A4096
Serial:	00

Entrypoint Preview

Instruction
push 0040284Ch
call 00007F0EE0E8A123h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi-71919BE2h], al
inc esi
mov byte ptr [ecx-66h], cl
popfd
std
iretd
adc dword ptr [ebp+00003112h], eax
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
inc eax
add bh, byte ptr [eax]
or byte ptr [ecx+00h], al
inc esp
outsd
jnbe 00007F0EE0E8A1A0h
imul esp, dword ptr [ebp+73h], 6E6F6B74h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
add esp, ebx
mov byte ptr [DB0681D6h], al
mov eax, dword ptr [DCCA9944h]
clc
mov dword ptr [128312C7h], eax
sub eax, 4704A48Fh
scasd
dec ebp
test al, E0h
inc esi
xor eax, ecx
scasd
call 00007F0E8E37DBD1h
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
stosb
push cs
add byte ptr [eax], al
mov dword ptr [esi], ecx
add byte ptr [eax], al
add byte ptr [eax+eax], cl
push ebx
jne 00007F0EE0E8A1A0h
jbe 00007F0EE0E8A199h
jc 00007F0EE0E8A19Dh
xor dword ptr [eax], eax
or eax, 42000701h
popad

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x19264	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x1c000	0x373c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1f000	0x730	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x230	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x118	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x18728	0x19000	False	0.47935546875	data	6.37312654175	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x1a000	0x1a94	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x1c000	0x373c	0x4000	False	0.217163085938	data	3.71594095347	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
SET	0x1d296	0x24a6	MS Windows icon resource - 3 icons, 24x24, 16 colors, 4 bits/pixel, 24x24, 8 bits/pixel	English	United States
RT_ICON	0x1c9ee	0x8a8	data
RT_ICON	0x1c486	0x568	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x1c464	0x22	data
RT_VERSION	0x1c170	0x2f4	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFPFix, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaObjVar, DllFunctionCall, _adj_fpatan, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaR8Str, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaStrToAnsi, __vbaFpI4, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaR8IntI4, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0404 0x04b0
LegalCopyright	Clamore
InternalName	GRUDGEFULUNNOT
FileVersion	1.00
CompanyName	Clamore
LegalTrademarks	Clamore
Comments	Clamore
ProductName	Clamore
ProductVersion	1.00
FileDescription	Clamore
OriginalFilename	GRUDGEFULUNNOT.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Chinese	Taiwan

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe PID: 6132 Parent PID: 5256

General

Start time:	21:03:03
Start date:	24/11/2021
Path:	C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe"
Imagebase:	0x400000
File size:	128816 bytes
MD5 hash:	B2E24BC0F1F55F2AC9D8034098DFE32F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: ieinstal.exe PID: 6676 Parent PID: 6132

General

Start time:	21:03:44
Start date:	24/11/2021
Path:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe"
Imagebase:	0xe80000
File size:	480256 bytes
MD5 hash:	DAD17AB737E680C47C8A44CBB95EE67E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: ieinstal.exe PID: 672 Parent PID: 6132

General

Start time:	21:03:45
Start date:	24/11/2021
Path:	C:\Program Files (x86)\Internet Explorer\ieinstal.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe"
Imagebase:	0xe80000
File size:	480256 bytes
MD5 hash:	DAD17AB737E680C47C8A44CBB95EE67E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000006.00000000.377067642.0000000000560000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe PID: 6132 Parent PID: 5256 Hong Tak Engineering SB Payment Receipt 241121_PDF.exeCOMMON

Executed Functions

Function 0075FDCF, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 231processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: 4953383a7e29936e03b7e4777f89b767a2d2ed94d4d80edfd1f3836f351e1bae
Instruction ID: b056aae25ef623ee6f8b93cd4dc29bccde70d777013c506aadc5bba88ecfe818
Opcode Fuzzy Hash: 4953383a7e29936e03b7e4777f89b767a2d2ed94d4d80edfd1f3836f351e1bae
Instruction Fuzzy Hash: 18910471144388CFCF799E28C9A87EB37A1BF9A310F61412EDC4B8B655C7384A45CA92

Uniqueness

Uniqueness Score: -1.00%

Function 0075FF94, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 227COMMON

Download Yara Rule

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: uOIe
API String ID: 0-436217044
Opcode ID: f8ea4e18c879b3777ff0f7d245a2478f9f9461e7c9d856ee168051abf7b4ab7b
Instruction ID: 4482ce135c673825d74ca437a26993980169635ad0ad1dd99592e665e4332864
Opcode Fuzzy Hash: f8ea4e18c879b3777ff0f7d245a2478f9f9461e7c9d856ee168051abf7b4ab7b
Instruction Fuzzy Hash: 9F911436944255CFDB398F28C8A47DA7761BF59364F2540AECC0B9F311C73A4A468BC2

Uniqueness

Uniqueness Score: -1.00%

Function 0075FDE7, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 214processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: c881fcbfdb2f1cf9c6d4f6c4150b481e956c054b023f5d9d544583f365395d7b
Instruction ID: 579ecd3dcb928c6ea0c41a4c6d9fff57cc67ffffd9dc5bcf402713a3e2effcce
Opcode Fuzzy Hash: c881fcbfdb2f1cf9c6d4f6c4150b481e956c054b023f5d9d544583f365395d7b
Instruction Fuzzy Hash: 83810231544389CFCF398E28C9A87EB37A1BF5A350F61412ECC4B9B655C7384A45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0075FE14, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 212processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: 54a3eeb7e09150cf907ad4ff4578123a5b695be094853ddbcee50817c2022124
Instruction ID: fdcf8aa03bf25afbbdde41e35394b0204a667b062510f3345a6d3bbfe589f89b
Opcode Fuzzy Hash: 54a3eeb7e09150cf907ad4ff4578123a5b695be094853ddbcee50817c2022124
Instruction Fuzzy Hash: FB811332544289CFDB399E28C9A47EB37A1BF5A350F61402FCC0B9B655C7384A45CA92

Uniqueness

Uniqueness Score: -1.00%

Function 0075FE49, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 209processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: 2499840ba207f0162d3c83021bf07d297eb74e11c512ea0a25a613f16654fe79
Instruction ID: 0ab681cc7e39a62d15fdce517191a566ddc7190f5bd564783c214b6b99b01ad9
Opcode Fuzzy Hash: 2499840ba207f0162d3c83021bf07d297eb74e11c512ea0a25a613f16654fe79
Instruction Fuzzy Hash: EF810232544289CFDB399E28C9A4BEB37A1BF5A350F21406FCC0B9B655C7394A45CA92

Uniqueness

Uniqueness Score: -1.00%

Function 0075FF0F, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 202processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: edf40b7a7675de68e60171cdf175679ebdf98a60fee497e39984ff979732fd08
Instruction ID: d6c908fcc0401a62882805592ca3725802e1b6fa32d4b7e260cb4a8c24cff963
Opcode Fuzzy Hash: edf40b7a7675de68e60171cdf175679ebdf98a60fee497e39984ff979732fd08
Instruction Fuzzy Hash: E6810532544289CFDB398F28C9A4BEB3761BF99310F61406ECC0B9B251C7395A45CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 0075FEB3, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 193COMMON

Download Yara Rule

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: uOIe
API String ID: 0-436217044
Opcode ID: e48a63495e4b60da4b47d472b563360e9a79735c10365efb9733ea2bbcf9bb44
Instruction ID: 47f51b3c6bd306c26340cfe75101b554f37f5543df0d3f49f80ac20adfeb5dad
Opcode Fuzzy Hash: e48a63495e4b60da4b47d472b563360e9a79735c10365efb9733ea2bbcf9bb44
Instruction Fuzzy Hash: 0F710471144388CFDF39DE24C9A8BEB37A1BF9A310F21412ECC0B9B655C7384A45CA92

Uniqueness

Uniqueness Score: -1.00%

Function 0075FF67, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 189processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: 19a49ae9f9faca92b9c4a2725033456a10b6418b872c7770fb08fe64adfcabf7
Instruction ID: 28b04be426382ee68abf433aac32db67717b253fdf1426cec019e8933f96f90b
Opcode Fuzzy Hash: 19a49ae9f9faca92b9c4a2725033456a10b6418b872c7770fb08fe64adfcabf7
Instruction Fuzzy Hash: F4710532544249CFDB399F28C9A4BEB37A1BF99310F21406ECC0B9B251C7384A45CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00760083, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 162processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: 212e5fc760771e833fb8f8c1a68c2cdbfd194bc8a69fd15702d460ea73355062
Instruction ID: d6a7acad55d4df2e197ab2dafcf6cff09ba8ef8b9d1c26b3c06c1e0a35f36717
Opcode Fuzzy Hash: 212e5fc760771e833fb8f8c1a68c2cdbfd194bc8a69fd15702d460ea73355062
Instruction Fuzzy Hash: 8E510432544389CFDB399E28C9A4BEB3761BF99350F25405ECC0B9B255CB394A45CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 007600C8, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 151processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: b6631594701e36b2a71a4d4a1fa14d8edfb514b71147247472855b4827aadb66
Instruction ID: 7618ba6d94e209f8153f6e8cfcc6e5983ada8d9712c046772c71969b7f408212
Opcode Fuzzy Hash: b6631594701e36b2a71a4d4a1fa14d8edfb514b71147247472855b4827aadb66
Instruction Fuzzy Hash: 19512332544389CFDB399E28C9A8BEB3762BF99350F21405ECC0B9B251C7394A45CAD2

Uniqueness

Uniqueness Score: -1.00%

Function 007600F0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 149processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: f543d0439deb36940a5027a66ff9a694c95dbfa322306a4a269b9795d9d0222e
Instruction ID: 8da1e676f92f4ff8c2bdd91d65b79040f9ac4b5b4e2b337a3d11ebcd57447399
Opcode Fuzzy Hash: f543d0439deb36940a5027a66ff9a694c95dbfa322306a4a269b9795d9d0222e
Instruction Fuzzy Hash: 4D510432544349CFDB399E28C9A8BEB3762BF99350F21405EDC0B9B215C7395A45CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00760132, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 145processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: 3f0c62f6905e6fc9d54731a4a0898e1485717c885b12402720e6256cfe595dd6
Instruction ID: e2eac07ea0b5a30ec95b3c816f75d74a65e06756e267768dc0fb0d8f4bfa5a59
Opcode Fuzzy Hash: 3f0c62f6905e6fc9d54731a4a0898e1485717c885b12402720e6256cfe595dd6
Instruction Fuzzy Hash: C9510232544359CFDB39DE28C9A8BEF7762BF99350F21405ADC0B9B204C7399A458BD2

Uniqueness

Uniqueness Score: -1.00%

Function 0076016B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 137processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: 5524eb76ef3dac7697074ff3f714c53b25c88f9e92ca3527fae8560b7dc5485e
Instruction ID: bda6f56218e52af49eafb23b8007746aac873f29ee94c6a3d7d65b78bd5de7aa
Opcode Fuzzy Hash: 5524eb76ef3dac7697074ff3f714c53b25c88f9e92ca3527fae8560b7dc5485e
Instruction Fuzzy Hash: DC510432544359CFDB39DF28C9A8BEB7762BF99350F21405ACC0B9B215C7389A458BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00760195, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: uOIe
API String ID: 0-436217044
Opcode ID: 9fbce7bfebacdfb93ffe93d17c8ec6f62dfabfa3d247035f5e2a0ec12af740b9
Instruction ID: a1b3aa401df99fd05695bd7722409f7595d3888e83d7bf7bb024f939e1cdaf31
Opcode Fuzzy Hash: 9fbce7bfebacdfb93ffe93d17c8ec6f62dfabfa3d247035f5e2a0ec12af740b9
Instruction Fuzzy Hash: AD512132444259CFDB35DE18C9A8BEB3762BFA9350F21405ADC0BAB204C7394E458AC2

Uniqueness

Uniqueness Score: -1.00%

Function 00760233, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: uOIe
API String ID: 0-436217044
Opcode ID: 2998309c4740e86c007bea9013f942ee82cf598ae8875da9a1bed32c04e635b5
Instruction ID: 6c3716dd86254f7794532e51c5bb88cb6ac79f20cd658b60e3e03db13ea8fb16
Opcode Fuzzy Hash: 2998309c4740e86c007bea9013f942ee82cf598ae8875da9a1bed32c04e635b5
Instruction Fuzzy Hash: 7E51E132544255CFCB35CF18C9A8BEA7762BF99360F25406EDC0BAB305CB395A518BC2

Uniqueness

Uniqueness Score: -1.00%

Function 007601CF, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: 65ce7a4ca11b18950bb02d5a770b23ab11a3ee84bde4aaf51437bb9a6f1b0ee7
Instruction ID: 23b8dd9ffd37d103529ee42d9e7323c262406b5487e6472fbe3758ae753aabe8
Opcode Fuzzy Hash: 65ce7a4ca11b18950bb02d5a770b23ab11a3ee84bde4aaf51437bb9a6f1b0ee7
Instruction Fuzzy Hash: EB510532544249CFCB35CF28C9A8BEB7762BF95350F21405ADC0B9B215C7395A40CBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00758863, Relevance: 3.3, APIs: 2, Instructions: 313sleepnativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 007589CA
Sleep.KERNELBASE(000000DE), ref: 00758EDC

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: MemorySleepVirtualWrite
String ID:
API String ID: 1877509360-0
Opcode ID: 92df929be34e745ec173e372abaa9ff33dfcc604534d492ebaf8cbaf6d03fac0
Instruction ID: df9c91d28bffce3678560e587ba9442e78b6dad81fda239f0d900a8e7fa3562e
Opcode Fuzzy Hash: 92df929be34e745ec173e372abaa9ff33dfcc604534d492ebaf8cbaf6d03fac0
Instruction Fuzzy Hash: D4B15976508389DFC7668F38CC542D57BB2EF15315F2844AEDC889F212CB7A4A4ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 00757EA0, Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 187sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000000DE), ref: 00758EDC

Strings

l, xrefs: 00757FCF

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID: l
API String ID: 3472027048-2517025534
Opcode ID: 0825d30e8225803f85bba51a9374f81d688d130ce992b25b09b3ea7bbfe8ac07
Instruction ID: e5c72c4005ccd0eeabac7f87ec44bf87ec166180e409f07551f0755d9d3ae2c5
Opcode Fuzzy Hash: 0825d30e8225803f85bba51a9374f81d688d130ce992b25b09b3ea7bbfe8ac07
Instruction Fuzzy Hash: 05517B36508398DFC729CF38DC556D53F72EF15310F24856AED499B642D77A0A0ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 0075B5A0, Relevance: 1.9, APIs: 1, Instructions: 432fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0075B800

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 13dc80e0b6dd5e8d181377851f3f9be0fd93fa176959595985ab51a1b3eeec19
Instruction ID: d35091236cb3e78907b913133b361883b741b71ce00a8f211f05a2b7c173b373
Opcode Fuzzy Hash: 13dc80e0b6dd5e8d181377851f3f9be0fd93fa176959595985ab51a1b3eeec19
Instruction Fuzzy Hash: 33F1CF37908399CFC7259F38C8412E97BA0FF05312F5548AEDD899F651C3798A4ACB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075D82C, Relevance: 1.6, APIs: 1, Instructions: 135memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: ea6db28e27806ca6cd8bfda470c0d872c3b7e7b5ae90269ecda4ff3406a222f3
Instruction ID: 01c9ecc7fc6c2cd6851007714971c3a2c2de6c7ee1e7ab7d2ac4687dd1ac65b0
Opcode Fuzzy Hash: ea6db28e27806ca6cd8bfda470c0d872c3b7e7b5ae90269ecda4ff3406a222f3
Instruction Fuzzy Hash: F9513676608388DFDF345E2498503F937A1EF18346F21041EDC8A9B221D3F94E89DB02

Uniqueness

Uniqueness Score: -1.00%

Function 0075D863, Relevance: 1.6, APIs: 1, Instructions: 131memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 53604e2522392ee079a377c23c483f70fae33e91afecd6276269609d86cb5d9b
Instruction ID: 2c4d82985eaf5ddeac9b8caebf5d1fcfd49bcd72d453ab8e10066ad72367ff21
Opcode Fuzzy Hash: 53604e2522392ee079a377c23c483f70fae33e91afecd6276269609d86cb5d9b
Instruction Fuzzy Hash: 91413676608389DFDF345E2488503FA77A2EF08346F21041EDC8A9B221D3B95E89DB43

Uniqueness

Uniqueness Score: -1.00%

Function 0075D8BF, Relevance: 1.6, APIs: 1, Instructions: 131memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 89ce70b408aaa98b793584bcf1d0f409154e10111b4d8518af146aac3da44635
Instruction ID: 52f45d4e00f563509e1222b4414fd4f7d3f1fbb63cceec4e614a41691d896b72
Opcode Fuzzy Hash: 89ce70b408aaa98b793584bcf1d0f409154e10111b4d8518af146aac3da44635
Instruction Fuzzy Hash: D0412072608388DFDF345E6498557FA37A2AF08342F12051EDC8A96221D3F95E88DB02

Uniqueness

Uniqueness Score: -1.00%

Function 0075D82A, Relevance: 1.6, APIs: 1, Instructions: 125memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 99ae7cb452927182fd587f97af938bc41bc9f5d1197bf181e2d184a8de71c35b
Instruction ID: bac1d0c92f86344ace54616dca30594a27bc5c6bb5eaa786c18b098df307f622
Opcode Fuzzy Hash: 99ae7cb452927182fd587f97af938bc41bc9f5d1197bf181e2d184a8de71c35b
Instruction Fuzzy Hash: CA41E171608388DFDF745E6488557FA37A1AF18342F22051EDC8A96265D3F85E88DB03

Uniqueness

Uniqueness Score: -1.00%

Function 0075D8CC, Relevance: 1.6, APIs: 1, Instructions: 124memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e5b7e42c36138793b6b49b15f474a0c21d6d5f3e761afc0694aa7757278e47dd
Instruction ID: 7dbb6f1352b9aea1e20776fb9c852ffc9473e275ce1a411ec8e911ba9ec2e359
Opcode Fuzzy Hash: e5b7e42c36138793b6b49b15f474a0c21d6d5f3e761afc0694aa7757278e47dd
Instruction Fuzzy Hash: 85411376608389DFDB749E2488513FE77A2EF08346F21051EDC8A9B211D3B94E89DB42

Uniqueness

Uniqueness Score: -1.00%

Function 0075D903, Relevance: 1.6, APIs: 1, Instructions: 118memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 00f9e3c07155e47640fed3702c292f4461bcc3e2f382a9478a95160c2f0431b4
Instruction ID: a51ab6777fbc259750e2e6069d5812942697bd800df87379d883f85b27c5a9d2
Opcode Fuzzy Hash: 00f9e3c07155e47640fed3702c292f4461bcc3e2f382a9478a95160c2f0431b4
Instruction Fuzzy Hash: 0541E276608388DFDB349E2488513FE77A1EF48346F25041EDC8A97211D7B95E89DB42

Uniqueness

Uniqueness Score: -1.00%

Function 0075D93B, Relevance: 1.6, APIs: 1, Instructions: 117memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 5fdbf35f381b45d308fb60f402b8677677b2990845d364361fa5bae12b22eabf
Instruction ID: 6108b35244c68afd25716f71be6fcbf49e2fcb94827df6c31f4f3c008a4376d2
Opcode Fuzzy Hash: 5fdbf35f381b45d308fb60f402b8677677b2990845d364361fa5bae12b22eabf
Instruction Fuzzy Hash: 7E41F476A08384DFDB749F24D8507EA73A1EF48306F25442EDC8A9B311D7BA4E49DB42

Uniqueness

Uniqueness Score: -1.00%

Function 0075887B, Relevance: 1.6, APIs: 1, Instructions: 114sleepnativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 007589CA
Sleep.KERNELBASE(000000DE), ref: 00758EDC

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: MemorySleepVirtualWrite
String ID:
API String ID: 1877509360-0
Opcode ID: db9489780bdb895ffdfb09f271bf5b91a13fb39f096cbbc14b9fb8ab6e048c3e
Instruction ID: 528bd2344cd4ac69977fc148aa67111d93c944e6c3ac852b5f3db4fc5ba64bae
Opcode Fuzzy Hash: db9489780bdb895ffdfb09f271bf5b91a13fb39f096cbbc14b9fb8ab6e048c3e
Instruction Fuzzy Hash: 99415636514249DFDB699F28CC847D9B7A2FF08311F58846DDD09AB202D7769A0ACF82

Uniqueness

Uniqueness Score: -1.00%

Function 0075D983, Relevance: 1.6, APIs: 1, Instructions: 110memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e5a7d4363f60e724841c06c92e09ed153ed5951dcb633738024325448dd86c46
Instruction ID: a6ad6cf030523cc25a908bc513c4eb50e7e1d937a4d1a5453b3a5198469426a7
Opcode Fuzzy Hash: e5a7d4363f60e724841c06c92e09ed153ed5951dcb633738024325448dd86c46
Instruction Fuzzy Hash: 0B41E176608384DFDB349E24D8506EE73A1EF08346F25441EDC8A8B221D3BA4E89DB42

Uniqueness

Uniqueness Score: -1.00%

Function 0075D9B2, Relevance: 1.6, APIs: 1, Instructions: 107memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 2dbec543300c04d509bb5694497b9481bea015593dd32bfdd6e13ab16d221327
Instruction ID: acfba4ced492170e090c6e296053940a31ee816b3efd2d1e3ed35168c03a2a7e
Opcode Fuzzy Hash: 2dbec543300c04d509bb5694497b9481bea015593dd32bfdd6e13ab16d221327
Instruction Fuzzy Hash: 0341E176608384DFDB349E24C8507EE73A1EF48316F25441EDC8A9B321D7B94E499B42

Uniqueness

Uniqueness Score: -1.00%

Function 0075D9E5, Relevance: 1.6, APIs: 1, Instructions: 106memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 21600f7fe2ae17db5c2a676cd544cfe9aca71065cb80be793c04ae14e3007fed
Instruction ID: 298e28b7e3ab257aaafd23c51c3944816f1aa34d34d5391c5f1ebd338d50fbf9
Opcode Fuzzy Hash: 21600f7fe2ae17db5c2a676cd544cfe9aca71065cb80be793c04ae14e3007fed
Instruction Fuzzy Hash: 9741EF76608345DFDB349E24D8407FE73A1EF08356F25042EDC8A9B221D3BA4E89DB42

Uniqueness

Uniqueness Score: -1.00%

Function 0075DA3B, Relevance: 1.6, APIs: 1, Instructions: 92memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 9b44dc19acea4196c65714da3a529abd968dbbd46b1ef2aeccc5b98db6911cf1
Instruction ID: 29461ae9efd8d77070955c2e432e6b4c42e24f3f6c94985dc192959498662a94
Opcode Fuzzy Hash: 9b44dc19acea4196c65714da3a529abd968dbbd46b1ef2aeccc5b98db6911cf1
Instruction Fuzzy Hash: BE31D075609344DFDB389E24D8407EE37A1EF48346F25041EDC4A8B221D3BA4E899B02

Uniqueness

Uniqueness Score: -1.00%

Function 0075DA6A, Relevance: 1.6, APIs: 1, Instructions: 91memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: c547bee7bfe1a64edb383473d6b8f2fd09c67b7bf1374e8125bf49f268224949
Instruction ID: 046f93bcc8000dab665ab27c10cda84e207b77eafd87acedcbd2deb3ebb05e59
Opcode Fuzzy Hash: c547bee7bfe1a64edb383473d6b8f2fd09c67b7bf1374e8125bf49f268224949
Instruction Fuzzy Hash: B631CF75609385DFDB388F28C8507ED73A1EF48355F21002EDC4A9B211C7B94E49DB41

Uniqueness

Uniqueness Score: -1.00%

Function 0075DAA6, Relevance: 1.6, APIs: 1, Instructions: 85memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: e8a166fb55d9f949ccd164491a13f6464fb8d92f8d7467416b2226b80de65c2f
Instruction ID: 0d5eb3014457c5d7928c26f91f17953cf9652af063f49993c074613f8b0b6958
Opcode Fuzzy Hash: e8a166fb55d9f949ccd164491a13f6464fb8d92f8d7467416b2226b80de65c2f
Instruction Fuzzy Hash: BE31AA75609249DFDB388F18C8507ED33A2EF48359F20002EDC4A9B221C7BA8E499B41

Uniqueness

Uniqueness Score: -1.00%

Function 0075DAD3, Relevance: 1.6, APIs: 1, Instructions: 81memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6779db962ed20ac2433efff1072cbfb313531b763319fcdaee75d459e512fae2
Instruction ID: 03f7bf794358bb1716cfd7447e7a7dca21be22bf04111c64a2504cb781024f08
Opcode Fuzzy Hash: 6779db962ed20ac2433efff1072cbfb313531b763319fcdaee75d459e512fae2
Instruction Fuzzy Hash: 5631AD75605388DFDB389F14C8507ED37A2FF48345F24002EDC4A9B221C7B94A49DB41

Uniqueness

Uniqueness Score: -1.00%

Function 0075DB00, Relevance: 1.6, APIs: 1, Instructions: 80memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 6c3e03b0b0ddfc9f041730154b477fab3d6392b0f11a5ce7a107d881e63a79b1
Instruction ID: e5c91c72962d98b615536581f515d43c3a00ab631fe7af11ed6d74819ae0800d
Opcode Fuzzy Hash: 6c3e03b0b0ddfc9f041730154b477fab3d6392b0f11a5ce7a107d881e63a79b1
Instruction Fuzzy Hash: 05319C75609289DFDB389F18D8507ED77B2FF49349F24002EDC4A9B221C7BA4A49DB41

Uniqueness

Uniqueness Score: -1.00%

Function 0075DB38, Relevance: 1.6, APIs: 1, Instructions: 73memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 675f0a3d79e2f933ec088f35ef838a442e012d73535c8f1e524253bb1b866fce
Instruction ID: 6f1179d464bdf2f37a72abf9fe4ee2d3bf689caf533accb584cd815196d7e4d9
Opcode Fuzzy Hash: 675f0a3d79e2f933ec088f35ef838a442e012d73535c8f1e524253bb1b866fce
Instruction Fuzzy Hash: DF218D76609254DFDB389E14D8906ED37A2EF48359F24042EEC4E9B321C6BA4E499B01

Uniqueness

Uniqueness Score: -1.00%

Function 0075B5AB, Relevance: 1.6, APIs: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0075B800

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 15bcd2bf03b9aa6ae786f7025426ea7619de5362febe1ca5b3c4503fcf7e58f4
Instruction ID: 25bfaa6e2d89441fa23e5989b9cee914989a26df3c1d653704099786d50d3d7a
Opcode Fuzzy Hash: 15bcd2bf03b9aa6ae786f7025426ea7619de5362febe1ca5b3c4503fcf7e58f4
Instruction Fuzzy Hash: BD21773A908256CFD7745F38C9003EAB7E0FF54311F5648AEAC85EB201C7754A498B8A

Uniqueness

Uniqueness Score: -1.00%

Function 0075896B, Relevance: 1.6, APIs: 1, Instructions: 66nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,?,?,?,?,?), ref: 007589CA

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: da8988c0345a49ba91e71a6dfd98eea77ab0e14cec4c3dd20c739dcbf57cc8b1
Instruction ID: 0b7e9feb0050acccb88635e80f5ff02f097d70f1bf8a1864de69510da2dbff02
Opcode Fuzzy Hash: da8988c0345a49ba91e71a6dfd98eea77ab0e14cec4c3dd20c739dcbf57cc8b1
Instruction Fuzzy Hash: A511513B814059EBDB299F38CC046C8F762BF18322F14459EED08A7200C7368B4E8B82

Uniqueness

Uniqueness Score: -1.00%

Function 0075DB76, Relevance: 1.6, APIs: 1, Instructions: 66memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 2e3b812ddf9406c7c0723ca2343c025a63dfc7dff33209a5f0f31067d5f020e6
Instruction ID: 77ee87d55839dac28941a56fa46511611010a80f3042b328916c2ef262f5aa9a
Opcode Fuzzy Hash: 2e3b812ddf9406c7c0723ca2343c025a63dfc7dff33209a5f0f31067d5f020e6
Instruction Fuzzy Hash: 8C21BE35605259DFDB389F28D8406ED77B1FF48359F24002EEC4A9B321C7BA8A49DB41

Uniqueness

Uniqueness Score: -1.00%

Function 0075DBC7, Relevance: 1.6, APIs: 1, Instructions: 57memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 891146e4c0e8482791d8e918f02595ccaa5efbfb1f0e6cc5a737f10cf578eeac
Instruction ID: 42d07f23dabc3baed3bdbce6b9f043059b52313d77436fa59edd62a89fbbe56c
Opcode Fuzzy Hash: 891146e4c0e8482791d8e918f02595ccaa5efbfb1f0e6cc5a737f10cf578eeac
Instruction Fuzzy Hash: 4911E135605288DFDB388F14C8406ED33B1FF89315F24402ADC4A5B311C7B98E459B41

Uniqueness

Uniqueness Score: -1.00%

Function 0075DC13, Relevance: 1.5, APIs: 1, Instructions: 46memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0075DC5D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: feac8dd8dfd363342a80afd25e29686aefa0784b9bc44548b61a2f1e292552e9
Instruction ID: 8de3d43bc101fdef6d8bd2abd8d41e85a2c6050125749595e48a99a26ec17a3c
Opcode Fuzzy Hash: feac8dd8dfd363342a80afd25e29686aefa0784b9bc44548b61a2f1e292552e9
Instruction Fuzzy Hash: 05018036605244DFDB349E58D8406EC77B2FF4835AF24441AEC4E9B221C7BA8F49DB41

Uniqueness

Uniqueness Score: -1.00%

Function 0075F872, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(-51634B6F,?,?,?,?,0075EB88,-00000001745A4444,00750B19), ref: 0075F943

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 9205adc4aa34d03e8035456a4b1746b52a315d6a0975517faba85d621faad4bb
Instruction ID: f76ea21f14e9d9a510ad55939c79f5c557c9f7b4933a434d10e0f64eccc1ceff
Opcode Fuzzy Hash: 9205adc4aa34d03e8035456a4b1746b52a315d6a0975517faba85d621faad4bb
Instruction Fuzzy Hash: DE0169B29090949FDF34CE18DD44AEE77BAABD9710F16402AEC5DAB308C670AE048790

Uniqueness

Uniqueness Score: -1.00%

Function 00757824, Relevance: 1.5, APIs: 1, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e705b5a826a7c599a45673f02f3791e5a87539f3e2c60cc0d7a816c39df0b8f3
Instruction ID: cd3077933d433486936b1489526c7cefde8a3306f39299e871e7a1030c568dcf
Opcode Fuzzy Hash: e705b5a826a7c599a45673f02f3791e5a87539f3e2c60cc0d7a816c39df0b8f3
Instruction Fuzzy Hash: 21919A36508399DFD7258F389C541D9BFB2EF15314F2844AED9859B212C73A4A4BCB81

Uniqueness

Uniqueness Score: -1.00%

Function 0075F8A8, Relevance: 1.5, APIs: 1, Instructions: 35nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(-51634B6F,?,?,?,?,0075EB88,-00000001745A4444,00750B19), ref: 0075F943

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a2e326c7d0575ed9e2767dd168dcc32976eb300423ea602d2d6254e5b2b88354
Instruction ID: f0c7219282b758d248a5c1ccffa38ae92bdc3b21b23cb0b6e77052de247829f5
Opcode Fuzzy Hash: a2e326c7d0575ed9e2767dd168dcc32976eb300423ea602d2d6254e5b2b88354
Instruction Fuzzy Hash: 88F0A937C040659BD7244F2D99002C9B77AEFD5764F6A406EDC58BB305C6366F4A87C0

Uniqueness

Uniqueness Score: -1.00%

Function 0075F8E2, Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(-51634B6F,?,?,?,?,0075EB88,-00000001745A4444,00750B19), ref: 0075F943

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 0c3fd80801a8c824ac4e402572dd909579758190e4abd8ca1b0ca849945c688c
Instruction ID: 7e7858d60fc0931c9045ba9329492bad61bb1c4af905cbabcb33614882c352e6
Opcode Fuzzy Hash: 0c3fd80801a8c824ac4e402572dd909579758190e4abd8ca1b0ca849945c688c
Instruction Fuzzy Hash: B6F062378052659BD7218F3C58101857771AF56664B1A40EEDC58AB312CA365F0E87D1

Uniqueness

Uniqueness Score: -1.00%

Function 0075AD16, Relevance: 1.5, APIs: 1, Instructions: 7libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0075AD2A

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fd03d0e7f2ae6f725cb18b2dc10da16e2ae96c14be02aaa6ecedb9400e1e5e6e
Instruction ID: 6457bce3a2e4be4b65a42f9aae4fa5b4ea0d20799a384ac369cd85cc1de6947f
Opcode Fuzzy Hash: fd03d0e7f2ae6f725cb18b2dc10da16e2ae96c14be02aaa6ecedb9400e1e5e6e
Instruction Fuzzy Hash: 93C02B301003040FC301AF28808184737709F92300B10C056E040430C9C7200B1DFBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0075855D, Relevance: 1.4, APIs: 1, Instructions: 163sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000000DE), ref: 00758EDC

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: ba533888c5a638bf720999cde6562d3873bd03d312e847229d10065b51f6a6b0
Instruction ID: ef1a18f2d6e21c8a82a74134845bbfe57fc2c5d719ea9d17268e9e25120a6f77
Opcode Fuzzy Hash: ba533888c5a638bf720999cde6562d3873bd03d312e847229d10065b51f6a6b0
Instruction Fuzzy Hash: 43510332408398DFCBA5CF34C8596D97BB2EF14310F28495ADD899F611CB754A4ACB82

Uniqueness

Uniqueness Score: -1.00%

Function 007511B1, Relevance: .2, Instructions: 249COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 363c3ba0faea653dbae465448d5fe0e6cad256926e3cd69cfb2443cf644bc9a7
Instruction ID: 8599655f7826a247e5c3a5fa8c51831d76df64cde26d38ec47acbde54eb12a10
Opcode Fuzzy Hash: 363c3ba0faea653dbae465448d5fe0e6cad256926e3cd69cfb2443cf644bc9a7
Instruction Fuzzy Hash: 8091EB32A08389CFDB24CF34CC956E97FA0FF06312F55496EDD888B652C279894AC781

Uniqueness

Uniqueness Score: -1.00%

Function 007511F3, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f68622f52d6a2dcced989df790421cf3e8d73451cf12b06dc5dce7c269d1c8b2
Instruction ID: bf569a80eb63880f1d60c40956bbbed8b56c8f11f87c394fd7279d3452b0e5b8
Opcode Fuzzy Hash: f68622f52d6a2dcced989df790421cf3e8d73451cf12b06dc5dce7c269d1c8b2
Instruction Fuzzy Hash: 5081BB32A08389CFD7248F38C8952D97BA1FF05312F55486EDD999B652C2798A4BCBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00751272, Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ef9485689b45494013de88999661ba89ff2e5433bc1aaf3221e1ed4a328f432
Instruction ID: e6898beb75274b487172e20d25c89be7354f6bdf6b3daa35c409f87050c7f832
Opcode Fuzzy Hash: 1ef9485689b45494013de88999661ba89ff2e5433bc1aaf3221e1ed4a328f432
Instruction Fuzzy Hash: B171A932A04399CFD728CF38CC812D97BA1FF05316F55456EED598B652C37A8A4ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 00418020, Relevance: 210.8, APIs: 110, Strings: 10, Instructions: 806COMMON

Download Yara Rule

APIs

#526.MSVBVM60(?,00000001), ref: 004180C7
__vbaVarTstNe.MSVBVM60(00008008,?), ref: 004180EF
__vbaFreeVar.MSVBVM60 ref: 004180FE
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 0041811F
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,00000014), ref: 00418144
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038D8,00000058), ref: 00418168
__vbaStrMove.MSVBVM60 ref: 00418181
__vbaFreeObj.MSVBVM60 ref: 0041818C
__vbaStrCat.MSVBVM60(18:18,18:), ref: 00418198
__vbaStrMove.MSVBVM60 ref: 004181A3
#541.MSVBVM60(?,00000000), ref: 004181AD
__vbaStrVarMove.MSVBVM60(?), ref: 004181BA
__vbaStrMove.MSVBVM60 ref: 004181C5
__vbaFreeStr.MSVBVM60 ref: 004181CA
__vbaFreeVar.MSVBVM60 ref: 004181D6
__vbaFpI4.MSVBVM60 ref: 004181E4
__vbaHresultCheckObj.MSVBVM60(00000000,?,004035F4,00000064), ref: 004181FE
__vbaR8Str.MSVBVM60(00403908), ref: 00418211
__vbaFPFix.MSVBVM60 ref: 00418217
__vbaFpR8.MSVBVM60 ref: 0041821D
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 00418247
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,00000014), ref: 00418272
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038D8,000000E8), ref: 004182A0
__vbaStrMove.MSVBVM60 ref: 004182AF
__vbaFreeObj.MSVBVM60 ref: 004182B8
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 004182CD
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,00000014), ref: 004182F2
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038D8,00000130), ref: 00418318
__vbaStrMove.MSVBVM60 ref: 00418327
__vbaFreeObj.MSVBVM60 ref: 00418330
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 00418345
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,0000004C), ref: 0041836A
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040390C,0000002C), ref: 004183B5
__vbaFreeObj.MSVBVM60 ref: 004183C4
#678.MSVBVM60(00000000,3FF00000,00000000,40000000,00000000,40080000,?,?), ref: 0041840B
__vbaFpR8.MSVBVM60 ref: 00418411
__vbaFpR8.MSVBVM60 ref: 0041842D
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 00418459
#690.MSVBVM60(Loxodograph4,fusentasten,dioxinholdigt,Centrummerne6), ref: 00418481
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 0041849A
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,00000014), ref: 004184BF
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038D8,00000058), ref: 004184E3
__vbaStrMove.MSVBVM60 ref: 004184FC
__vbaFreeObj.MSVBVM60 ref: 00418501
__vbaHresultCheckObj.MSVBVM60(00000000,?,004035F4,00000254), ref: 00418523
__vbaSetSystemError.MSVBVM60(001EB2E8,004400F3,00693EBE), ref: 00418543
#539.MSVBVM60(?,00000001,00000001,00000001), ref: 00418566
__vbaStrVarMove.MSVBVM60(?), ref: 00418573
__vbaStrMove.MSVBVM60 ref: 0041857E
__vbaFreeVar.MSVBVM60 ref: 00418586
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 0041859F
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,00000014), ref: 004185C4
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038D8,000000D8), ref: 004185EE
__vbaStrMove.MSVBVM60 ref: 00418601
__vbaFreeObj.MSVBVM60 ref: 0041860A
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 0041861F
__vbaLateMemCallLd.MSVBVM60(?,?,UMBcSr9gYByBtJt9cHne224,00000000), ref: 0041863F
__vbaObjVar.MSVBVM60(00000000), ref: 00418649
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 00418654
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,0000000C), ref: 0041866E
__vbaFreeObj.MSVBVM60 ref: 0041867D
__vbaFreeVar.MSVBVM60 ref: 00418685
__vbaStrToAnsi.MSVBVM60(00000000,Steroidprparaters), ref: 00418694
__vbaSetSystemError.MSVBVM60(?,00304D17,00000000), ref: 004186AF
__vbaFreeStr.MSVBVM60 ref: 004186CC
#593.MSVBVM60(0000000A), ref: 004186F3
__vbaFreeVar.MSVBVM60 ref: 00418701
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 0041871A
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,00000014), ref: 00418745
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038D8,00000078), ref: 00418770
__vbaFreeObj.MSVBVM60 ref: 00418775
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 0041878A
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,0000004C), ref: 004187AF
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040390C,0000001C,?,?,?,?), ref: 00418801
__vbaObjSet.MSVBVM60(?,?,?,?,?,?), ref: 00418816
__vbaFreeObj.MSVBVM60(?,?,?,?), ref: 00418825
__vbaSetSystemError.MSVBVM60(006AF9B7,007D5504), ref: 0041883F
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 00418868
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,00000014), ref: 0041888D
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038D8,000000F8), ref: 004188B7
__vbaStrMove.MSVBVM60 ref: 004188CA
__vbaFreeObj.MSVBVM60 ref: 004188D3
__vbaOnError.MSVBVM60(00000000), ref: 004188D7
_adj_fdiv_m64.MSVBVM60(429C0000), ref: 00418907
__vbaFpI4.MSVBVM60(432D0000,?,429C0000), ref: 00418931
__vbaHresultCheckObj.MSVBVM60(00000000,?,004035F4,000002C0,?,429C0000), ref: 00418965
__vbaStrToAnsi.MSVBVM60(00000000,Unphlegmatic,0076D9A1), ref: 00418985
__vbaSetSystemError.MSVBVM60(0069DD4A,0061A6F3,00062CAA,00696241,00000000), ref: 004189A7
__vbaFreeStr.MSVBVM60(?,429C0000), ref: 004189C0
#704.MSVBVM60(00000002,000000FF,000000FE,000000FE,000000FE), ref: 004189EB
__vbaStrMove.MSVBVM60(?,429C0000), ref: 004189F6
__vbaFreeVar.MSVBVM60(?,429C0000), ref: 00418A02
#546.MSVBVM60(00000002), ref: 00418A0F
__vbaVarMove.MSVBVM60(?,429C0000), ref: 00418A1E
__vbaStrCopy.MSVBVM60 ref: 00418A31
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403624,000006F8), ref: 00418A76
__vbaFreeStr.MSVBVM60 ref: 00418A7F
__vbaR8IntI4.MSVBVM60 ref: 00418A8B
__vbaFreeVar.MSVBVM60(00418B3D), ref: 00418AF3
__vbaFreeObj.MSVBVM60 ref: 00418B02
__vbaFreeObj.MSVBVM60 ref: 00418B07
__vbaFreeStr.MSVBVM60 ref: 00418B12
__vbaFreeStr.MSVBVM60 ref: 00418B17
__vbaFreeStr.MSVBVM60 ref: 00418B1C
__vbaFreeStr.MSVBVM60 ref: 00418B21
__vbaFreeStr.MSVBVM60 ref: 00418B26
__vbaFreeStr.MSVBVM60 ref: 00418B2B
__vbaFreeStr.MSVBVM60 ref: 00418B30
__vbaFreeStr.MSVBVM60 ref: 00418B35
__vbaFreeStr.MSVBVM60 ref: 00418B3A

Strings

fusentasten, xrefs: 00418477
UMBcSr9gYByBtJt9cHne224, xrefs: 0041862F
Steroidprparaters, xrefs: 0041868B
18:, xrefs: 0041818E
Unphlegmatic, xrefs: 0041897C
Ofr9, xrefs: 00418A29
dioxinholdigt, xrefs: 00418472
Centrummerne6, xrefs: 0041846D
18:18, xrefs: 00418193
Loxodograph4, xrefs: 0041847C

Memory Dump Source

Source File: 00000001.00000002.520139389.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.520132043.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.520182521.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.520188869.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$Move$New2$Error$System$Ansi$#526#539#541#546#593#678#690#704AddrefCallCopyLateList_adj_fdiv_m64
String ID: 18:$18:18$Centrummerne6$Loxodograph4$Ofr9$Steroidprparaters$UMBcSr9gYByBtJt9cHne224$Unphlegmatic$dioxinholdigt$fusentasten
API String ID: 3104790891-1915240266
Opcode ID: 69e126b7dc18ee9da74113e34a8a146c7376bc4952790935d31927cc47dfa6f9
Instruction ID: 2ffe00ac9a1650e7f18d3e89ce830b486e51c8477a08a726feef1b764e46b37e
Opcode Fuzzy Hash: 69e126b7dc18ee9da74113e34a8a146c7376bc4952790935d31927cc47dfa6f9
Instruction Fuzzy Hash: 11627D71900218ABDB10DFA1DE88FDABBB8FF44701F20816AF545B72A1DB745A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00418B70, Relevance: 103.7, APIs: 53, Strings: 6, Instructions: 432COMMON

Download Yara Rule

APIs

__vbaStrCat.MSVBVM60(004038A4,00403A24), ref: 00418C08
__vbaStrMove.MSVBVM60 ref: 00418C0F
#524.MSVBVM60(?,?), ref: 00418C33
__vbaVarTstNe.MSVBVM60(?,?), ref: 00418C58
__vbaFreeVar.MSVBVM60 ref: 00418C6E
__vbaStrCat.MSVBVM60(:5:,00403908), ref: 00418C87
__vbaStrMove.MSVBVM60 ref: 00418C8E
__vbaStrCat.MSVBVM60(00403908,00000000), ref: 00418C9A
__vbaStrMove.MSVBVM60 ref: 00418CA7
#541.MSVBVM60(?,00000000), ref: 00418CAE
__vbaStrVarMove.MSVBVM60(?), ref: 00418CB8
__vbaStrMove.MSVBVM60 ref: 00418CC3
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 00418CCF
__vbaFreeVar.MSVBVM60 ref: 00418CDB
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 00418CEF
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,00000014), ref: 00418D14
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038D8,000000E8), ref: 00418D3E
__vbaStrMove.MSVBVM60 ref: 00418D4D
__vbaFreeObj.MSVBVM60 ref: 00418D52
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 00418D6A
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,00000044), ref: 00418E75
__vbaLateIdSt.MSVBVM60(?,00000000), ref: 00418EA7
__vbaFreeVar.MSVBVM60 ref: 00418EB6
#560.MSVBVM60(?), ref: 00418EC9
__vbaFreeVar.MSVBVM60 ref: 00418EE4
#610.MSVBVM60(00000001), ref: 00418EF7
#552.MSVBVM60(?,00000001,00000001), ref: 00418F07
__vbaVarMove.MSVBVM60 ref: 00418F13
__vbaFreeVar.MSVBVM60 ref: 00418F1C
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 00418F30
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,0000004C), ref: 00418F55
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040390C,00000028), ref: 00418F75
__vbaFreeObj.MSVBVM60 ref: 00418F7E
__vbaStrCat.MSVBVM60(00403A70,12-12-1), ref: 00418F93
#545.MSVBVM60(?,00000001), ref: 00418FA7
__vbaVarTstNe.MSVBVM60(00004008,?), ref: 00418FCC
__vbaFreeVarList.MSVBVM60(00000002,00000008,?), ref: 00418FDF
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 00419003
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,00000014), ref: 0041902E
__vbaHresultCheckObj.MSVBVM60(00000000,?,004038D8,00000108), ref: 0041905F
__vbaFreeObj.MSVBVM60 ref: 00419064
#546.MSVBVM60(00000008), ref: 0041906E
__vbaVarMove.MSVBVM60 ref: 0041907A
__vbaNew2.MSVBVM60(004038C8,0041AC74), ref: 00419092
__vbaHresultCheckObj.MSVBVM60(00000000,005DED9C,004038B8,0000001C), ref: 004190B7
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403A88,00000060), ref: 00419114
__vbaFreeObj.MSVBVM60 ref: 0041911D
__vbaFreeVar.MSVBVM60(00419197), ref: 00419171
__vbaFreeStr.MSVBVM60 ref: 0041917C
__vbaFreeStr.MSVBVM60 ref: 00419181
__vbaFreeVar.MSVBVM60 ref: 00419186
__vbaFreeObj.MSVBVM60 ref: 0041918B
__vbaFreeStr.MSVBVM60 ref: 00419194

Strings

12-12-1, xrefs: 00418F89
Forryk, xrefs: 004190ED
8:@, xrefs: 00418E4E
:5:, xrefs: 00418C82
$:@, xrefs: 00418E12
ULTRAREFINEMENT, xrefs: 00418E44

Memory Dump Source

Source File: 00000001.00000002.520139389.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.520132043.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.520182521.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.520188869.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$Move$New2$List$#524#541#545#546#552#560#610Late
String ID: $:@$12-12-1$8:@$:5:$Forryk$ULTRAREFINEMENT
API String ID: 2486721585-2908976325
Opcode ID: 7fe8cd7198c5b2b810a7a074384e1eaa0262fed477fd6d3623eaf4b8d6915aec
Instruction ID: b49bbfe35173fe46a9341ac6d48e8629b44392d0164de190eb88aeff21ccd46f
Opcode Fuzzy Hash: 7fe8cd7198c5b2b810a7a074384e1eaa0262fed477fd6d3623eaf4b8d6915aec
Instruction Fuzzy Hash: 9F0239719002189FDB10DFA8CD84ADDBBF8FF58304F1081AAE549BB2A1EB745985CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00760205, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 128processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: cc351c3f811ecd044b6033a891ae41fd645c4807626b9dde404a49eec33241ca
Instruction ID: 76b4785c7ed02e0bf546ed15034df9a5559d18efa0fe96eb793a81e908cdc517
Opcode Fuzzy Hash: cc351c3f811ecd044b6033a891ae41fd645c4807626b9dde404a49eec33241ca
Instruction Fuzzy Hash: 01510332544255CFDB35DE18D9A8BEB7762BF98360F21405ADC0BAB304C7395E458BD2

Uniqueness

Uniqueness Score: -1.00%

Function 0076026F, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 119processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: 52af2fa4e7cbbbe8f916a08f363597cfdc4f342a51d74b138b738671a9dbd055
Instruction ID: 1fcf592d3e93d6e4029d1b8c3985793572ae59c692bfcec681ab491cc99e04ec
Opcode Fuzzy Hash: 52af2fa4e7cbbbe8f916a08f363597cfdc4f342a51d74b138b738671a9dbd055
Instruction Fuzzy Hash: 6A41D232544255CFCB35DE18C9A8BEB7762BF98350F21405EDC0BAB205C7395A518BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00760298, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Strings

uOIe, xrefs: 0076030D

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID: uOIe
API String ID: 2186235152-436217044
Opcode ID: 099628c3fdae70a9ac9419a2cc775a8fc7269533ac3d582d84205bf4e4c02117
Instruction ID: 608fa8bdf1ff26ca2ff4cf9a430fb14cb3644e66521f57ee228e39079b110d3f
Opcode Fuzzy Hash: 099628c3fdae70a9ac9419a2cc775a8fc7269533ac3d582d84205bf4e4c02117
Instruction Fuzzy Hash: 3A41D132544299CFCB35DF18C9A8BEB7762BF98360F21405ADC0BAB705C7395A518BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00401320, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401325

Strings

VB5!6&*, xrefs: 00401320

Memory Dump Source

Source File: 00000001.00000002.520139389.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.520132043.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.520182521.000000000041A000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.520188869.000000000041C000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: d4fd8919a890ba2f68dc935dd428b2f3bebdebb50f90dc1b1f2e5bd8a559b0e2
Instruction ID: 2d402a1a674bc0ae6fc2808c2d0b453a897fa1f96a457fabeb167ce211608343
Opcode Fuzzy Hash: d4fd8919a890ba2f68dc935dd428b2f3bebdebb50f90dc1b1f2e5bd8a559b0e2
Instruction Fuzzy Hash: 17E09B4188E7D00EE34392B64A265456FB45C6366432A45EB94D2DA5E3C4AD188AC377

Uniqueness

Uniqueness Score: -1.00%

Function 0075CB17, Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d68d60bc0b9ffe1cf69c65c4f4a8e3d6ea2765a21ef0a197457e3c6ffcf44132
Instruction ID: ac8c77fb341c4d1b2ca3d28d1c9346f46fddf7f0d5cad61a9f4f27939e39e22a
Opcode Fuzzy Hash: d68d60bc0b9ffe1cf69c65c4f4a8e3d6ea2765a21ef0a197457e3c6ffcf44132
Instruction Fuzzy Hash: 4B41F371208385DFCF769E648965BF93BA0DF95753F20001FEC4BD7180DAF808499A52

Uniqueness

Uniqueness Score: -1.00%

Function 00750E43, Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 00750E48

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: ee30713f2b14b5be47f0813b5db4c4e3a352e9e56591e346c536f0228e8db2de
Instruction ID: 5c57f1b4d2c2b85c12455323806b5729c3236aa47c4fb1de0738dde8559bd71d
Opcode Fuzzy Hash: ee30713f2b14b5be47f0813b5db4c4e3a352e9e56591e346c536f0228e8db2de
Instruction Fuzzy Hash: DE41693251D388CFD725DF38885B6D97FA0BF42312F64499ED88ADB212D6B48549CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075C7F0, Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab08650f2fb33f972a8cdad0314a1632dc24d4a7b2f4d2cb4a2846d873c0a2f
Instruction ID: 492e47655938d200a86fc890b60a2a812b1515a15eb79480265e3cc3b38ae7d1
Opcode Fuzzy Hash: aab08650f2fb33f972a8cdad0314a1632dc24d4a7b2f4d2cb4a2846d873c0a2f
Instruction Fuzzy Hash: AF4129716083C89FCB369E3448257F63FE19F55342F68801BEC8BDB241D6B85A49E752

Uniqueness

Uniqueness Score: -1.00%

Function 007603C7, Relevance: 1.6, APIs: 1, Instructions: 99processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 075428d559906e6799f5ba1158df275198da18a613563f0f3d4b229a7047c972
Instruction ID: fb0a808379636d2d6dc009a8385d4acf18daf356d19e4e82cb230cbbf61eb529
Opcode Fuzzy Hash: 075428d559906e6799f5ba1158df275198da18a613563f0f3d4b229a7047c972
Instruction Fuzzy Hash: DD411636904296CFCB348F28C8647DA7762FF55360F2640AECC466F246CB355A458BC1

Uniqueness

Uniqueness Score: -1.00%

Function 007569D9, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b639ec83303a495c881fc7b17af3a643e1b729ff431f324c28e843768e688d5
Instruction ID: 84c0c58b9ee1129e521add00e16a5b3589a594c1474cf4b4242f0ae2cb538c0f
Opcode Fuzzy Hash: 6b639ec83303a495c881fc7b17af3a643e1b729ff431f324c28e843768e688d5
Instruction Fuzzy Hash: 3E313D36504395DFDF359F7848047E937A0AF54362F65412FEC0ADB240D6B94A4A8B82

Uniqueness

Uniqueness Score: -1.00%

Function 0076038E, Relevance: 1.6, APIs: 1, Instructions: 95processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: e3424c03fae119c6f8357f07613f51557c78d83fa95bccf63711569b9db0bafb
Instruction ID: b39fc72d02bebcaccd2a8145c252077ac4946d03f12e5cbc3f00f8da839c1f22
Opcode Fuzzy Hash: e3424c03fae119c6f8357f07613f51557c78d83fa95bccf63711569b9db0bafb
Instruction Fuzzy Hash: A631D2329442A6CFDB34CF18C9A4BEA7762BF95360F26406ADC0AAF245C7355E45CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00760367, Relevance: 1.6, APIs: 1, Instructions: 92processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: f717c048f94a71c27f0d8d08761e8c3f73081c28225f04b26be039510d9092ae
Instruction ID: 2df8762697abb8fb52ffce93620f231b8ae64ea457ab608d97a176bb3631ef66
Opcode Fuzzy Hash: f717c048f94a71c27f0d8d08761e8c3f73081c28225f04b26be039510d9092ae
Instruction Fuzzy Hash: 0C31D232944295CFCB38CF18C9A4BEA7762BF95360F26406ACC0BAB345C7355D558BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00750227, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a936d591f23585f82153d4835bcde3a127fa16b00f291234f9bc9176651ffe
Instruction ID: 5ec42cbc5fd964c477dec341d99b751696e9661ef600930535e2c5548eee8699
Opcode Fuzzy Hash: 10a936d591f23585f82153d4835bcde3a127fa16b00f291234f9bc9176651ffe
Instruction Fuzzy Hash: 78212935904395DFCF35EF7888187E93BB0FF45352F64402AEC4AD7200D7B9494A9A92

Uniqueness

Uniqueness Score: -1.00%

Function 00760440, Relevance: 1.6, APIs: 1, Instructions: 74processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 9fd6cd899631494eb88117a8d94f452e24e55b4e1bde38862fcd58e230605ba7
Instruction ID: 073e616b0b984295a8efb08eedf7c331add00d0f2f5596bf2b95422d41f6bd3f
Opcode Fuzzy Hash: 9fd6cd899631494eb88117a8d94f452e24e55b4e1bde38862fcd58e230605ba7
Instruction Fuzzy Hash: 68212633844265CFDB34DE18C5647EA3362FF54360F26406ADC0AAF244C7364E458BD1

Uniqueness

Uniqueness Score: -1.00%

Function 0075C363, Relevance: 1.6, APIs: 1, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000,00750219), ref: 0075C4E2

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 21556af78eb04758b62f995a289066576a6b3cbce799d0e283ecb9e532dd7ce0
Instruction ID: 40e2bb725ca05931521a2bff93229fffa23936194a907167faea3e7684c25bba
Opcode Fuzzy Hash: 21556af78eb04758b62f995a289066576a6b3cbce799d0e283ecb9e532dd7ce0
Instruction Fuzzy Hash: 3821073B9483A59FD731AE2858147D43BA1DF043AA768049FEC09DF301C57B4B4B8B82

Uniqueness

Uniqueness Score: -1.00%

Function 0076049C, Relevance: 1.6, APIs: 1, Instructions: 62processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 4d1bb62e3958b80a9d1746af5a1afd2b10d065db39804e718fa3250fafba487a
Instruction ID: c2b1f7eccb8145616117c75029ef1134edb4344a80dd6398eac44a99b73ae5ce
Opcode Fuzzy Hash: 4d1bb62e3958b80a9d1746af5a1afd2b10d065db39804e718fa3250fafba487a
Instruction Fuzzy Hash: E2212737C442658FDB349E18D5547DA7352BF543A1F26405BDC06AF304C7364F4A8AD1

Uniqueness

Uniqueness Score: -1.00%

Function 0075B62E, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0075B800

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 832f128cef5689d88ec1c1e9305fd7314f59fbe4c144dffdceaa2f4d4966aa38
Instruction ID: 4cb6f2a3fcd039154c6df7a2ea239b6e16557c3820712c389ebabd431913cbe2
Opcode Fuzzy Hash: 832f128cef5689d88ec1c1e9305fd7314f59fbe4c144dffdceaa2f4d4966aa38
Instruction Fuzzy Hash: A121353B808212DBD7745E3CC9002EAB7A0FF14311F56486EAC89EB301C7758B4A8F86

Uniqueness

Uniqueness Score: -1.00%

Function 0075B60F, Relevance: 1.6, APIs: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0075B800

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c54a77c5132b13d0af100857a1845ba35394bfd9dbb670ed0a8d3d3f47dac308
Instruction ID: 7f379356049b350354c1fbd802781d297e41a1e0d86d95b250a5ca83cdd3a954
Opcode Fuzzy Hash: c54a77c5132b13d0af100857a1845ba35394bfd9dbb670ed0a8d3d3f47dac308
Instruction Fuzzy Hash: 27112776518286DFDB745E38CA417FA77E4EF54312F56086FAC85EB200C3B44A448B96

Uniqueness

Uniqueness Score: -1.00%

Function 0075B672, Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0075B800

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d1ae1f1bf3713fb5a5aac4be47bef96c624bfe67116b5730e594863591af7b1b
Instruction ID: 127d5470bd434ee82d66c370e91b28116c7d0e77f7732616636cabb6d9d074f0
Opcode Fuzzy Hash: d1ae1f1bf3713fb5a5aac4be47bef96c624bfe67116b5730e594863591af7b1b
Instruction Fuzzy Hash: 9E11223A804252DBD7749F38C9003EA77A4FF18315F55482EAC89EB301C7798A458B96

Uniqueness

Uniqueness Score: -1.00%

Function 00752987, Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(-405AC28B), ref: 00759880

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 04aacee2af571dab3bbcbf8904127c271ef0afd5a67946d474d3cbe6654eff21
Instruction ID: bace93aa604d8aba566eb39d9fe94d9c9bc82612ccdfdf18f4a31b3147da69c2
Opcode Fuzzy Hash: 04aacee2af571dab3bbcbf8904127c271ef0afd5a67946d474d3cbe6654eff21
Instruction Fuzzy Hash: B6016B7BC051A5DBD7158F2498052C5BB71EF12258B2A44CED8996FA02C3374B0FCB81

Uniqueness

Uniqueness Score: -1.00%

Function 0075C3E6, Relevance: 1.5, APIs: 1, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000,00750219), ref: 0075C4E2

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6f44f46f5e53fb71a2c3c417a548dc7183bda9ca97f83bce5f2f1122a1aa8659
Instruction ID: 68dcc1c85749825cdcf66409b47e366ab19959d5280c77cce5019ad4120ae335
Opcode Fuzzy Hash: 6f44f46f5e53fb71a2c3c417a548dc7183bda9ca97f83bce5f2f1122a1aa8659
Instruction Fuzzy Hash: 3F012B36504355DFC7326FA844147E47770EF407A6779805BEC45DB201CB7D4A4A8B42

Uniqueness

Uniqueness Score: -1.00%

Function 0075C462, Relevance: 1.5, APIs: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000,00750219), ref: 0075C4E2

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c6f43fcaddd35a06195d36812a51469f40b7130609029e4da50ca982446f39d
Instruction ID: 20596d908dc0744415aa77e166862ef46bb9579520c2178bb8e8d41618ad4ab3
Opcode Fuzzy Hash: 8c6f43fcaddd35a06195d36812a51469f40b7130609029e4da50ca982446f39d
Instruction Fuzzy Hash: 04014F3B9042269FC3255B6894102D87721FE40AAA379809DEC55AF301DB3B9A8B8BC1

Uniqueness

Uniqueness Score: -1.00%

Function 0075B6F6, Relevance: 1.5, APIs: 1, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0075B800

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 09b364c2362d314dda42dbf15dfe6123fad6a7406fea2d369bda88193c842c3e
Instruction ID: c00f40c73a3bb4d8f29bddb7e1d47508408bd933543a2e1376d5b0843b3be4fc
Opcode Fuzzy Hash: 09b364c2362d314dda42dbf15dfe6123fad6a7406fea2d369bda88193c842c3e
Instruction Fuzzy Hash: 3001D83B844251DBD7645F38C9002E9B7A0FF14315F66887EAC85AB311C7794A868F86

Uniqueness

Uniqueness Score: -1.00%

Function 0076052F, Relevance: 1.5, APIs: 1, Instructions: 37processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 9c5b828e3d528bec5a8c579440e63c38a7340b6950a629c7ac7818b551030145
Instruction ID: 0658295dcfa7171815aedba5ffe5ee22aa7d99444744ac87f3c4870a24c154d0
Opcode Fuzzy Hash: 9c5b828e3d528bec5a8c579440e63c38a7340b6950a629c7ac7818b551030145
Instruction Fuzzy Hash: 86F028378401758BCB349E58D5507DA7362FF183AAF26405BDC166F304CB3A5E458BD2

Uniqueness

Uniqueness Score: -1.00%

Function 007597CE, Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(-405AC28B), ref: 00759880

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: d2004c45f920f9a937cb95d3b336103f1404b87a5a04196d87615f5debdc36ef
Instruction ID: f4d68d06b086fbfdf46c9ab92624f5781641ded6ee1262fe555d0d3187a1ce08
Opcode Fuzzy Hash: d2004c45f920f9a937cb95d3b336103f1404b87a5a04196d87615f5debdc36ef
Instruction Fuzzy Hash: 98F046769015D9CFD7198F30880A3C2BB75AB12144F1B9485C8992B922C7725909CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0075C352, Relevance: 1.5, APIs: 1, Instructions: 32libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000,00750219), ref: 0075C4E2

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: acbeb64bdac221aa4f3f99041bfe71a725b456d9ff274fdf02b91ef22a0415ed
Instruction ID: 4338dee8d7c4bebbb7b654aaa68494192509964bfb6941c4f600604f472d21f5
Opcode Fuzzy Hash: acbeb64bdac221aa4f3f99041bfe71a725b456d9ff274fdf02b91ef22a0415ed
Instruction Fuzzy Hash: AFF06DB15182D9DFCF75DF688C08BEA3BF4AF48312F10401AAC0DEB240D6B49A048B66

Uniqueness

Uniqueness Score: -1.00%

Function 0075B738, Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0075B800

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c1e23aa4754f65e6de63787a5a7fa4b1321781744893c63f8715e656c9449b03
Instruction ID: ef005db082f006c78eecdad7f52fb05714ee8f6240af450889bf7df0a5974fe4
Opcode Fuzzy Hash: c1e23aa4754f65e6de63787a5a7fa4b1321781744893c63f8715e656c9449b03
Instruction Fuzzy Hash: 4DF02D3B808211EBC7645F38DC006DDB790FF24315F164C6ED8C5A7211C7760A4A8F85

Uniqueness

Uniqueness Score: -1.00%

Function 0075980F, Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(-405AC28B), ref: 00759880

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 6f1ab33797fa371b39761bc46ff7a348621d3f3b2d81d09b3616ed457608f4dc
Instruction ID: 38f2dd8ea4d010391d05bbea9d54ba3a86305956563f736ba00b4baea35f9a76
Opcode Fuzzy Hash: 6f1ab33797fa371b39761bc46ff7a348621d3f3b2d81d09b3616ed457608f4dc
Instruction Fuzzy Hash: 1EF0903B90406AEBE3244A2894002C4B721EF152A976994DAD4696B212C62B9B4F8BC0

Uniqueness

Uniqueness Score: -1.00%

Function 00760570, Relevance: 1.5, APIs: 1, Instructions: 31processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE ref: 007605B3

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 55ac65637b7353c952ebcf481cd9924a3158bb7f5b206e6e55460a979f1f1ee0
Instruction ID: 4ae6e89efcb91f970b3d09168261a0fc8c08a46923e83ca3f414181154e6576a
Opcode Fuzzy Hash: 55ac65637b7353c952ebcf481cd9924a3158bb7f5b206e6e55460a979f1f1ee0
Instruction Fuzzy Hash: A4F0F03B8001269BCB349E28A4407C87352FF043AAB26408EDC1A6F300CB3B8F4A4BC0

Uniqueness

Uniqueness Score: -1.00%

Function 0075B794, Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0075B800

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eb24e38e93c64a5ad60cbff6b1495176c1a8b21c984c596865409466c8c179d5
Instruction ID: 1f1adfee4575ac2696cd66e6aa61e21b35abb72dfb38e2ef562642ab09329bba
Opcode Fuzzy Hash: eb24e38e93c64a5ad60cbff6b1495176c1a8b21c984c596865409466c8c179d5
Instruction Fuzzy Hash: FCF0A03A840165CBD7344F2888043C8B720FF54755F6944BE9C54AF302C7361A8A8BC4

Uniqueness

Uniqueness Score: -1.00%

Function 00759853, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(-405AC28B), ref: 00759880

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: 9680e0457f10ae7ec2270a495579ad36ff27af090875655b1ef4fceee40c2a91
Instruction ID: 51bd981dcc6e4f3b1cf0755c687b9fddf66b3a4385357d5cfc6c02d004080448
Opcode Fuzzy Hash: 9680e0457f10ae7ec2270a495579ad36ff27af090875655b1ef4fceee40c2a91
Instruction Fuzzy Hash: FCE08C3B908066A7E3216A3864102C4FB62EA153DE72D85CED40D6F322C52B4B4F8BC0

Uniqueness

Uniqueness Score: -1.00%

Function 0075C4BF, Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000,00750219), ref: 0075C4E2

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f9065e999b54bac2c6b77644d76bfd0a41bfa75e190c1cf0b67986c4e7303a8a
Instruction ID: 9928a812810b6de092f856298e4f8b65d6370c9721175ba82f5462352957a794
Opcode Fuzzy Hash: f9065e999b54bac2c6b77644d76bfd0a41bfa75e190c1cf0b67986c4e7303a8a
Instruction Fuzzy Hash: 31E04835900215DFC7151F6D54043C87721EF41A65774C05DEC519B201DB3A95979BC1

Uniqueness

Uniqueness Score: -1.00%

Function 00758BFC, Relevance: 1.4, APIs: 1, Instructions: 138sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000000DE), ref: 00758EDC

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 06ed5fb917b467db9429ad8cdb88e06fc26e498fa620e885ee1db2f53b84e5b2
Instruction ID: 8cbd0560d977a6f566e08fc489b8e85b2844559f2ef63a506f304d96b47387d9
Opcode Fuzzy Hash: 06ed5fb917b467db9429ad8cdb88e06fc26e498fa620e885ee1db2f53b84e5b2
Instruction Fuzzy Hash: D0416B37018398DFC7168F38D8255D57FB2EF15315F25889EDC859F612C77A4A4A8780

Uniqueness

Uniqueness Score: -1.00%

Function 00758D37, Relevance: 1.4, APIs: 1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dbe17969f99f7bfa547619701bcda230e4a4b1c7f900779d21ba4c9df9e7f9a
Instruction ID: 05dfca5464c343f0f128c8cc2c26ee925d0cb41e8d9b784d676246275ce0908a
Opcode Fuzzy Hash: 5dbe17969f99f7bfa547619701bcda230e4a4b1c7f900779d21ba4c9df9e7f9a
Instruction Fuzzy Hash: 58415A374092989BC7164F38A8101D47F72EF19355B6848DEEC899F212C73B0A4B8781

Uniqueness

Uniqueness Score: -1.00%

Function 00758D34, Relevance: 1.4, APIs: 1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f34974cc3560333e1f2561199c93aa881e1fdee3380c2c5df697ae4ba23b3ae
Instruction ID: 9bcc2d8bcf0bf43e973a41b1ea64cb3c4d4c3c6c9d6bc02b002994b3623d2a63
Opcode Fuzzy Hash: 9f34974cc3560333e1f2561199c93aa881e1fdee3380c2c5df697ae4ba23b3ae
Instruction Fuzzy Hash: 0D4168374093D89BC7164F3898242D47FB3EF29714B6848AEED85AF612C73A494B9781

Uniqueness

Uniqueness Score: -1.00%

Function 00758D9B, Relevance: 1.4, APIs: 1, Instructions: 107sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000000DE), ref: 00758EDC

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8c6eaab5f61f3fc0ec94484ded68d277881f0a87b6163e0246cdf0be8def9e32
Instruction ID: 8ccbd906e41460049158938f0c02325820df32d0a286b668caa89fee6f10d606
Opcode Fuzzy Hash: 8c6eaab5f61f3fc0ec94484ded68d277881f0a87b6163e0246cdf0be8def9e32
Instruction Fuzzy Hash: A8315A374093999BC3164F3898242D57F72EF15314B6888EEDC859F712C73A4E4B9781

Uniqueness

Uniqueness Score: -1.00%

Function 00758E13, Relevance: 1.3, APIs: 1, Instructions: 81sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000000DE), ref: 00758EDC

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6943066163513d5197aa132929484663eb54c98db0c6177afd115865f442ca20
Instruction ID: b21ff07847ca2877f8cac8021c338667770ae8d81ea813ee3bc67d855206cd6a
Opcode Fuzzy Hash: 6943066163513d5197aa132929484663eb54c98db0c6177afd115865f442ca20
Instruction Fuzzy Hash: 0621083B4092999BD3268F38A8242C57F72DF1535976888DFD8999F712C63B0B4B8781

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0075EA2B, Relevance: 3.0, Strings: 2, Instructions: 505COMMON

Download Yara Rule

Strings

L', xrefs: 0075F81D
BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID: BDm3$L'
API String ID: 2706961497-3885944387
Opcode ID: b2a778044d2498ea8d2de63614efce0eb5e3de98f7c5ec98b189551c9549b64a
Instruction ID: 3c894afeef3a19773d6d9b40c302171b4dd6cf0b0abeaf94d00edacf048784b9
Opcode Fuzzy Hash: b2a778044d2498ea8d2de63614efce0eb5e3de98f7c5ec98b189551c9549b64a
Instruction Fuzzy Hash: AD2229715083C5CFCB25CF38C8987DABBE1AF16311F5981AACC994F296D3B84649C712

Uniqueness

Uniqueness Score: -1.00%

Function 0075EF13, Relevance: 2.6, Strings: 2, Instructions: 147COMMON

Download Yara Rule

Strings

f=A., xrefs: 0075EF30
BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3$f=A.
API String ID: 0-3762196301
Opcode ID: f55c2acad3aca5bdd39768a4c97b2dd938f42d1cd481e1cb565de1b9122cc6da
Instruction ID: e20dfffeca05d61b82d89fafcb47ebb958f0e1e09c5f2741001e4bfba459313b
Opcode Fuzzy Hash: f55c2acad3aca5bdd39768a4c97b2dd938f42d1cd481e1cb565de1b9122cc6da
Instruction Fuzzy Hash: 9F512D729483C4CBDF358F3888943EABBE1AF15311F5980AECC998F24AD3794646C752

Uniqueness

Uniqueness Score: -1.00%

Function 00756F34, Relevance: 2.6, Strings: 2, Instructions: 129COMMON

Download Yara Rule

Strings

Fqj, xrefs: 0075734E
yL[e, xrefs: 0075721F

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: yL[e$Fqj
API String ID: 0-1280952089
Opcode ID: b28131b2a355966c4ea95bc3453dc04b9e4e052aa0d704c0b4102a37f1384ad0
Instruction ID: 07f6431e9f3084deefb682108a054665d9fc24901cb74aa69a97f10f1ab0fbd8
Opcode Fuzzy Hash: b28131b2a355966c4ea95bc3453dc04b9e4e052aa0d704c0b4102a37f1384ad0
Instruction Fuzzy Hash: 5E519271608788CBDB38CE55E9D57EA72F36F88301F64412A9D4E5B604C3B8AA45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00756FF3, Relevance: 2.6, Strings: 2, Instructions: 127COMMON

Download Yara Rule

Strings

yL[e, xrefs: 0075721F
R?z, xrefs: 00757054

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: R?z$yL[e
API String ID: 0-2623649773
Opcode ID: 80df13b3e3a3c5e719fba241061d2e3d6976efb56ec4d3091a6036aad81442a6
Instruction ID: b65ceb81e7e3b1622a69c92dcce5ed8d65140eb800945c551b876127fb6c20f6
Opcode Fuzzy Hash: 80df13b3e3a3c5e719fba241061d2e3d6976efb56ec4d3091a6036aad81442a6
Instruction Fuzzy Hash: 0D41F236908398DBD734CE68A8916CA77F2BF88306F64446EDD4D5F206C3795A4ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 007541C0, Relevance: 2.6, Strings: 2, Instructions: 113COMMON

Download Yara Rule

Strings

Z, xrefs: 007542C9
`, xrefs: 007543C6

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Z$`
API String ID: 0-1354253173
Opcode ID: 9b63bd232a7ea9192f13f773451613736c66b237b98776c72b27a0df337a7b9c
Instruction ID: fd492b603b6bcd09ce7fbaa61af83ac8ea3e2d54ca84ad3d3bd4ae8fbf65f887
Opcode Fuzzy Hash: 9b63bd232a7ea9192f13f773451613736c66b237b98776c72b27a0df337a7b9c
Instruction Fuzzy Hash: 1D31C332D04354CBDF388F7889593FB32A2AB61346F62411FDC4F97544D9B80ACD9681

Uniqueness

Uniqueness Score: -1.00%

Function 007541F7, Relevance: 2.6, Strings: 2, Instructions: 98COMMON

Download Yara Rule

Strings

Z, xrefs: 007542C9
`, xrefs: 007543C6

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: Z$`
API String ID: 0-1354253173
Opcode ID: 6760469c35ed039695f576eac066f619fdfc993752009154b13122272606b553
Instruction ID: ce29b10cd7ce100e407689fb68a4d66b82f5d4544301af4f3d2ca8e6128b3ca5
Opcode Fuzzy Hash: 6760469c35ed039695f576eac066f619fdfc993752009154b13122272606b553
Instruction Fuzzy Hash: 9B313D33D04294CBDB348F3888593E936A2BF55356FA6415FDC0E9B604C6760BCD8B81

Uniqueness

Uniqueness Score: -1.00%

Function 0075EA42, Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID: BDm3
API String ID: 2706961497-139009610
Opcode ID: ad8daccb4e2a63058a14e09064fd9fc1c45187e9e67a3a3f500301b2dde72438
Instruction ID: 2a0530c108b709683d4d9497311fa8291516ee09cf097a532ecf46b2ea7212f6
Opcode Fuzzy Hash: ad8daccb4e2a63058a14e09064fd9fc1c45187e9e67a3a3f500301b2dde72438
Instruction Fuzzy Hash: BAD126315083C58EDB258F38C8987DABBE1AF16310F59C1EACC994F293D379864AC752

Uniqueness

Uniqueness Score: -1.00%

Function 0075EABB, Relevance: 1.5, Strings: 1, Instructions: 291COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID: BDm3
API String ID: 2706961497-139009610
Opcode ID: 763bf88d9dc746a6c89ea3a190bd2b2a526f9e83e78c3e28bc16a4a03016ec25
Instruction ID: 8fa6e3aa165220fe0d23eb07b6e6ad18b2c091536e41a80d40919da2e5d6581a
Opcode Fuzzy Hash: 763bf88d9dc746a6c89ea3a190bd2b2a526f9e83e78c3e28bc16a4a03016ec25
Instruction Fuzzy Hash: C1C105315083C58EDB258F38C8987DABFE1AF12310F59C2AACC994F297D3798646C752

Uniqueness

Uniqueness Score: -1.00%

Function 0075EB03, Relevance: 1.5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID: BDm3
API String ID: 2706961497-139009610
Opcode ID: 504e330c1f9794dd98f2c075d042b23239863fdf325f3fb7ad0583357923a57b
Instruction ID: 003de26ff9cbfa9064b6e4e7b2095b452b9fafccb4129c0c096360340e1ef16e
Opcode Fuzzy Hash: 504e330c1f9794dd98f2c075d042b23239863fdf325f3fb7ad0583357923a57b
Instruction Fuzzy Hash: 9CC1F4315083C58EDB258F3888987DABFE19F12311F59C2AACCD94F297D379464AC752

Uniqueness

Uniqueness Score: -1.00%

Function 0075EBB3, Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: 806c01adb5c9c7b10a4c1ff6c6fa7e7601e5b6096ed9992c34a8488f3247477c
Instruction ID: adb1b5d8c4a6447c8e2f3cf94690d258fa8fe1bf2c6c760496fd1e10fbd7bcae
Opcode Fuzzy Hash: 806c01adb5c9c7b10a4c1ff6c6fa7e7601e5b6096ed9992c34a8488f3247477c
Instruction Fuzzy Hash: D3B1D2215083C58ADB258F3888987DABFE15F12321F59C2EACCD94F2D7D3B9464AC752

Uniqueness

Uniqueness Score: -1.00%

Function 0075EBE3, Relevance: 1.5, Strings: 1, Instructions: 256COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: daa91b59a394ecc65be949dbad538f21bc33c65412d69ddda3e553d84c32e0e9
Instruction ID: fd9500270f5d584dff0d31602ed4bee3497a82301d840f45781aaeb2fc9b0347
Opcode Fuzzy Hash: daa91b59a394ecc65be949dbad538f21bc33c65412d69ddda3e553d84c32e0e9
Instruction Fuzzy Hash: EFB1C2215083C58ADB258F3888987DABFE15F12321F59C2DACCD94F2D7D3B9464AC752

Uniqueness

Uniqueness Score: -1.00%

Function 0075DF39, Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: c3d1cc66427865178f4bacfdcc340e88f3a5c07276218a2394313a9bec2375d2
Instruction ID: c98242f6b5f7df0befae786a612e832fbc048197b3618c4c73b48a4dfb90992f
Opcode Fuzzy Hash: c3d1cc66427865178f4bacfdcc340e88f3a5c07276218a2394313a9bec2375d2
Instruction Fuzzy Hash: 80A10575A04389CFDB388F24CC947EA77A2EF54341F65402ADC4A8B245D7B95F89CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075EC0F, Relevance: 1.5, Strings: 1, Instructions: 251COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: 703e839873c52669f0f164b5330c066fbcd3b0c924e79355cf9385208a9401fe
Instruction ID: 6cc208208c7e538d7123797a142d8172162755b9c726cd3e2da696adcf7c2b9d
Opcode Fuzzy Hash: 703e839873c52669f0f164b5330c066fbcd3b0c924e79355cf9385208a9401fe
Instruction Fuzzy Hash: B0B1C1215483C58ADB258F3888987DABFE15F12321F59C29ACCD94F1D7D3B8464AC752

Uniqueness

Uniqueness Score: -1.00%

Function 0075EC42, Relevance: 1.5, Strings: 1, Instructions: 247COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: c0a2270ac42fc384bbac13b0c58b60158bc8958e7e22a1d7e0df48c942ebc22a
Instruction ID: eaedca526027abec45109f6a17ba96eef3c4faa8ce047476e0f8a7736747d8e5
Opcode Fuzzy Hash: c0a2270ac42fc384bbac13b0c58b60158bc8958e7e22a1d7e0df48c942ebc22a
Instruction Fuzzy Hash: 55B1F4215483C58ADB258F3888587DABFE15F12321F59C2EACCD94F2D7D3B8464AC752

Uniqueness

Uniqueness Score: -1.00%

Function 0075EC93, Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: fa2f8e1c82b35740b2f81d305aa9b3e52900849a05be80752d65c00e77404703
Instruction ID: e6c2cea4b4fef3183a9d11b30b2910fec37c2d0720303781ef8096bbf5eed0fb
Opcode Fuzzy Hash: fa2f8e1c82b35740b2f81d305aa9b3e52900849a05be80752d65c00e77404703
Instruction Fuzzy Hash: 9FA115315083C58ADB358F3888987DABFE1AF12311F59C1EACC994F297D3B9464AC752

Uniqueness

Uniqueness Score: -1.00%

Function 0075ECD3, Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: 272b6487c0b4f93144efed11cfd1e1912030467fef4c36cae7778f95da8b813d
Instruction ID: d4e1b778cd14c698e2d6719999d6b7febc30b7412f0f9df800552f911c815b39
Opcode Fuzzy Hash: 272b6487c0b4f93144efed11cfd1e1912030467fef4c36cae7778f95da8b813d
Instruction Fuzzy Hash: D1A1F5315483C48EDB258F3888987DABFE1AF12311F59C1AACC994F297D3B9464AC752

Uniqueness

Uniqueness Score: -1.00%

Function 0075EDB8, Relevance: 1.5, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: bb9175e200db85ccb93f9d64c05307ef97a52bf61d0bfba940e073f2f6315d05
Instruction ID: bb8732b5247df6b897be288b3b11b033b173f87c469b6acaf3047c02e6e28c30
Opcode Fuzzy Hash: bb9175e200db85ccb93f9d64c05307ef97a52bf61d0bfba940e073f2f6315d05
Instruction Fuzzy Hash: 27817D329483C98FDF348F388C947DA7BE1AF15351F5881AACC998F286D3794646C762

Uniqueness

Uniqueness Score: -1.00%

Function 007547EF, Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

hY\\, xrefs: 0075490C

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: hY\\
API String ID: 0-3362265672
Opcode ID: 2ddff66beb51c5ff04f16755519297c65cda138619548935e872f2a94dab174b
Instruction ID: 86920f73a259b1edec9537d0a830c301c041a82382ae9265d714004ccaf72352
Opcode Fuzzy Hash: 2ddff66beb51c5ff04f16755519297c65cda138619548935e872f2a94dab174b
Instruction Fuzzy Hash: 9C8105726083489FCB788F28CC957EE77B1BF58310F55442EDC8E9B244D7745A848B56

Uniqueness

Uniqueness Score: -1.00%

Function 0075481B, Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

hY\\, xrefs: 0075490C

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: hY\\
API String ID: 0-3362265672
Opcode ID: 11094bf207057eb88d0a2908ec87cb7ebe4677a1a37cdc31779b800a79ffa9ee
Instruction ID: 8c5c6f704ca0e7eebd963af93dff4b216de8b48df8c477cb08e10c8d0556e655
Opcode Fuzzy Hash: 11094bf207057eb88d0a2908ec87cb7ebe4677a1a37cdc31779b800a79ffa9ee
Instruction Fuzzy Hash: 858103766083889FCB748F28CC957EE77B1BF48314F55842EDC8E8B245C7785A858B46

Uniqueness

Uniqueness Score: -1.00%

Function 0075ED8A, Relevance: 1.5, Strings: 1, Instructions: 202COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: 984e35122c53479518fbbd222c2a20f8712780b795dff6eb760776461ea6681e
Instruction ID: 1912d01f388eba921086d1aa2fc31bee8d05b805897a2e845c8e7ebbda26b228
Opcode Fuzzy Hash: 984e35122c53479518fbbd222c2a20f8712780b795dff6eb760776461ea6681e
Instruction Fuzzy Hash: 7D814B325483C58FDF358F3888987EA7BE1AF11311F59C1AACC998F286D3794646C752

Uniqueness

Uniqueness Score: -1.00%

Function 0075ED73, Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: 0d8a0ecd51917065118eaf12ac2657ce9049e5c73bd6a44b8c75176ed466cc0a
Instruction ID: 4d995096ecf51e0581de4c7d80c49391741493ed9b979530debde616b986dfb5
Opcode Fuzzy Hash: 0d8a0ecd51917065118eaf12ac2657ce9049e5c73bd6a44b8c75176ed466cc0a
Instruction Fuzzy Hash: 2E81F8715483C48ADB358F3888987EA7FE1AF12311F59C1AACCD94F29BD3B84646C752

Uniqueness

Uniqueness Score: -1.00%

Function 00754967, Relevance: 1.4, Strings: 1, Instructions: 192COMMON

Download Yara Rule

Strings

hY\\, xrefs: 0075490C

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: hY\\
API String ID: 0-3362265672
Opcode ID: aa1456bbdb8b04afd973a41048f26c544dd031f078269ead88d44347887963d9
Instruction ID: c3f32e8fc049a788bcc96099ff4f3f71fa9b3e9116959bd75f78d8b808d739f9
Opcode Fuzzy Hash: aa1456bbdb8b04afd973a41048f26c544dd031f078269ead88d44347887963d9
Instruction Fuzzy Hash: 287112766083489FCB748F28CC957EE77B5BF88314F54842EDC8D9B205C7789A858B51

Uniqueness

Uniqueness Score: -1.00%

Function 007548C3, Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

hY\\, xrefs: 0075490C

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: hY\\
API String ID: 0-3362265672
Opcode ID: b1d6f9b41789170428cd2a2e165bdfb48dae3f09253de36b83d3fa95f6b15cbc
Instruction ID: e05ecc7349cd2f8e325703212d3939aad91bddd18312c2dc33e71f1f8c96ec2c
Opcode Fuzzy Hash: b1d6f9b41789170428cd2a2e165bdfb48dae3f09253de36b83d3fa95f6b15cbc
Instruction Fuzzy Hash: C671F1766083489FCB788F28CC957EE77B5BF88314F54842EDC8D9B205C7785A848B52

Uniqueness

Uniqueness Score: -1.00%

Function 0075EE44, Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: 85461b865a3132ca43f4116070a95747dcd389e3e48521a3f14c69a779c0bdb6
Instruction ID: 219862fd01b5a0337616e4c5b41f89b74f9c38cf48f47db583d33d4ab4064fa4
Opcode Fuzzy Hash: 85461b865a3132ca43f4116070a95747dcd389e3e48521a3f14c69a779c0bdb6
Instruction Fuzzy Hash: ED715F729483C8CBDF358F388C947EA7BE1AF15311F5881AACC998F246C3794646C752

Uniqueness

Uniqueness Score: -1.00%

Function 0075495D, Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

hY\\, xrefs: 0075490C

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: hY\\
API String ID: 0-3362265672
Opcode ID: a37339d3be435974e0311b5f0106dff9960efca93e71b1c4a763f0382db464d4
Instruction ID: 40460363fb4efedc6e4047a589f0f6bdc082d9517175dd8d84bb7428627af8b2
Opcode Fuzzy Hash: a37339d3be435974e0311b5f0106dff9960efca93e71b1c4a763f0382db464d4
Instruction Fuzzy Hash: 9B61D2766083489FCB749F28CC957EE77B5BF88310F54842EED4D8B244C7785A848B56

Uniqueness

Uniqueness Score: -1.00%

Function 0075EEAF, Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: 9f2fa4344205e55194b0636b68b32e728d12af5ac5a134c05a01b0b7da6254fb
Instruction ID: 8f90b8d7f90f4319cf20b2349af822df5c224456fe35f6879e5e682cc17d2f74
Opcode Fuzzy Hash: 9f2fa4344205e55194b0636b68b32e728d12af5ac5a134c05a01b0b7da6254fb
Instruction Fuzzy Hash: F6616E729483C48BDF348E3888947EA7BE1AF15311F59C1AACC998F28AD37946468752

Uniqueness

Uniqueness Score: -1.00%

Function 0075DFD0, Relevance: 1.4, Strings: 1, Instructions: 154COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: 4998cea3d62e1389fde83b19100d2a1fa17dcc1ad9ed73f926d7fdebd9083762
Instruction ID: 0e031cd247945f45a030ab7c02c7bce638ce04d6a35f11fa02c967e29e42aeb5
Opcode Fuzzy Hash: 4998cea3d62e1389fde83b19100d2a1fa17dcc1ad9ed73f926d7fdebd9083762
Instruction Fuzzy Hash: EE51E176904369DBDB388E2499907EA7762BF44351F29402ADC4E9B340C37A5F49CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 0075DF44, Relevance: 1.4, Strings: 1, Instructions: 153COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: bf3ab8abc5e618d41c6236de5b3cb49d7b1e0dfa993ed6a20c502604183fa3e9
Instruction ID: 2c1056907fb8d1172646b6e3e2670ae616ca7e7450e438bbf9931d0efb32a0b3
Opcode Fuzzy Hash: bf3ab8abc5e618d41c6236de5b3cb49d7b1e0dfa993ed6a20c502604183fa3e9
Instruction Fuzzy Hash: 2D51E072904399DBDB38CF24D9907EA7772BF44341F65802ADC4A9B244D3B96B49CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075DF76, Relevance: 1.4, Strings: 1, Instructions: 150COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: afd15775dd94355a3c3819a4c9ab1c72cfc4c81a244fdd16d86bd883d5a45a05
Instruction ID: 32b7d25b9010b2ff8573b817b7edd641bae1dbeab0d573aa936ae109885faba4
Opcode Fuzzy Hash: afd15775dd94355a3c3819a4c9ab1c72cfc4c81a244fdd16d86bd883d5a45a05
Instruction Fuzzy Hash: 6751FF72904399DBDB38CE24DD907EA3762BF44351F25802ADC4E9B244C3B96B49CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075D76D, Relevance: 1.4, Strings: 1, Instructions: 148COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe, xrefs: 00760DE9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\Hong Tak Engineering SB Payment Receipt 241121_PDF.exe
API String ID: 0-4188496072
Opcode ID: 5fc3ad24ebedda3d4f55e0dbee2f5ca2477aec434bdf975341d557ac892d9e72
Instruction ID: 4f209b80d76d0a4d943d2b3ca6da3db6b13811b436fe7cf0fce456d8f508c418
Opcode Fuzzy Hash: 5fc3ad24ebedda3d4f55e0dbee2f5ca2477aec434bdf975341d557ac892d9e72
Instruction Fuzzy Hash: 1551026254D3C55FC727DB70886A496BF64BA1332070D8ACFC88A4F8A3D7599405D792

Uniqueness

Uniqueness Score: -1.00%

Function 0075DFA4, Relevance: 1.4, Strings: 1, Instructions: 147COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: c292e86b8b9ffb0639e6c302f6ee0ac565c83b7988e1fa7e80a90e8e628b8574
Instruction ID: dd025d7d4c6960ca9d854df271c04ee81ee3bc69e1feff6d9b75c47902cddc11
Opcode Fuzzy Hash: c292e86b8b9ffb0639e6c302f6ee0ac565c83b7988e1fa7e80a90e8e628b8574
Instruction Fuzzy Hash: 5D510172904399DBDB38CF24DD917EA3772BF44301F25802ADC4A9B244C3B96B49CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075EF53, Relevance: 1.4, Strings: 1, Instructions: 141COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: 8c7b22ca54a9ca9198e9d18cebe267075942d898951849cafdda450951216280
Instruction ID: 829139545b7666441a3181643a5696272975159b6f5161c06607b46db2aadc2a
Opcode Fuzzy Hash: 8c7b22ca54a9ca9198e9d18cebe267075942d898951849cafdda450951216280
Instruction Fuzzy Hash: C2512D729483C88FDF358F3488943EABBE1AF15311F1980AECC998F246D7794546C752

Uniqueness

Uniqueness Score: -1.00%

Function 0075E287, Relevance: 1.4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: fb7577fb7373d7699c0b66be21fc1ad486c017f4b828ed35a80ed31787766160
Instruction ID: ba4daa6129c40798090907c6f7cc3b633dee2f170b1fdc326459cb7e83cd4442
Opcode Fuzzy Hash: fb7577fb7373d7699c0b66be21fc1ad486c017f4b828ed35a80ed31787766160
Instruction Fuzzy Hash: B451CEB6908398DFDB38CF24DD917EA37A6BF54311F15802ADC4A9B244C3795B49CB82

Uniqueness

Uniqueness Score: -1.00%

Function 007567AF, Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

/, xrefs: 00756853

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: f77c49191f7f4530ff50a0678cb84f7375806d997830f6f24c53bf6d607ca067
Instruction ID: 30970f2a2be88fc742c26ec53f512fe141be03cf797aadfef8ade319b71c89ac
Opcode Fuzzy Hash: f77c49191f7f4530ff50a0678cb84f7375806d997830f6f24c53bf6d607ca067
Instruction Fuzzy Hash: 04414536559745CFC31A9F34CC426E5BBA0EF52301F69485DC9858B612C3B5918F8B83

Uniqueness

Uniqueness Score: -1.00%

Function 0075E088, Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: f54b57ebf003520f748674af36ce312a88c24cc0f15ceec54ec0763b5e4d6994
Instruction ID: cfa96b3be2de95cc617e4278c1af11872841d983fb1342e51e75ebe81ebba5e3
Opcode Fuzzy Hash: f54b57ebf003520f748674af36ce312a88c24cc0f15ceec54ec0763b5e4d6994
Instruction Fuzzy Hash: 0451F0B2908398DBCB38CE24DD917EE37A6BF44311F15812ADC5A8B285D3795B44CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075EF93, Relevance: 1.4, Strings: 1, Instructions: 134COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: b9b8a4738cc19d1ff91a85f3b99bdb70da8e75b82ea4f9611803e75d3a4c1b7c
Instruction ID: 84adb6549d1bf2203b45b3c6d2600ee0e0ae110c12a406cb3a09ba59d31073b9
Opcode Fuzzy Hash: b9b8a4738cc19d1ff91a85f3b99bdb70da8e75b82ea4f9611803e75d3a4c1b7c
Instruction Fuzzy Hash: 0E515E769483C48FDF358E348C943EABBE1AF15311F1980AECC998F246D379454AC792

Uniqueness

Uniqueness Score: -1.00%

Function 0075E053, Relevance: 1.4, Strings: 1, Instructions: 131COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: 35c7e29c5305c6bf43d0c702ee419d41a7ff5e6a3672b7a528f3cae443832838
Instruction ID: 8bd0c95e743606a9ad4fc72f69cfcc9a6e43377e069f72c81fde17188a637c08
Opcode Fuzzy Hash: 35c7e29c5305c6bf43d0c702ee419d41a7ff5e6a3672b7a528f3cae443832838
Instruction Fuzzy Hash: AF51EE76904298DBDB38CF24DD817EE7776BF44311F15802ADC4A9B245C3796B88CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075E369, Relevance: 1.4, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: b75f3e57b00e49063c75cd49baf20b522e08d1f1fb71eeaa073df5a8dc20801a
Instruction ID: 31ef092d191a4e28ebde7b96f33fbae35e235242a215c7201b073a3c12384e92
Opcode Fuzzy Hash: b75f3e57b00e49063c75cd49baf20b522e08d1f1fb71eeaa073df5a8dc20801a
Instruction Fuzzy Hash: 7151CF76904298DBDB38CF24DD807EE7766BF54351F15402ADC4E9B244C3796B49CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075E10E, Relevance: 1.4, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: af2ef2aabef8095cfb5fed24872d6a426825db2043e4f807bea7da4dea98b0af
Instruction ID: a35b578b943923430218cbf320688f65c9bc088b45168da77986842863cbf04f
Opcode Fuzzy Hash: af2ef2aabef8095cfb5fed24872d6a426825db2043e4f807bea7da4dea98b0af
Instruction Fuzzy Hash: 9851BE76904298DBDB38CE24DD907EA7766BF44351F15402ADC4A9B244C3796B49CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075E22E, Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: 3319e0850bbdbc7903360c65eb9b27b781ae17e8f80c43a7daff9f01fac98c6e
Instruction ID: ac7489dc3ab124558d75914943bf810d5acd8a12adf4dced6b4919fa375b8390
Opcode Fuzzy Hash: 3319e0850bbdbc7903360c65eb9b27b781ae17e8f80c43a7daff9f01fac98c6e
Instruction Fuzzy Hash: 4651BB76A08298DBDB38CF24DD817EE7776BF44311F15802ADC4A9B245C3796B49CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075E3D2, Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: c5fddee583b102919cf61220fcc96bc1f9fc82e7d8984bec09ece522d02218c8
Instruction ID: 266ab8c31aad4a292e0ba4cdacf6f61c5013ce0c317e15c1de19e4704e468643
Opcode Fuzzy Hash: c5fddee583b102919cf61220fcc96bc1f9fc82e7d8984bec09ece522d02218c8
Instruction Fuzzy Hash: 6351BB76A04398DBDB38CE24D9817EA7762BF44311F15802ADC4A9B244C3796B49CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075E428, Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: 79c390a944db913980d7a2b77bbebbecfc7f25766f05e47f1de128c5f758612d
Instruction ID: acc9ec988c4837cafc9972d407f8e6fe035d30dbcff43dd93e551932344b4512
Opcode Fuzzy Hash: 79c390a944db913980d7a2b77bbebbecfc7f25766f05e47f1de128c5f758612d
Instruction Fuzzy Hash: 0151AD76908298DBDB38CF24DD917EA7766BF44311F15802ADC4E9B244C3796B48CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075E170, Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: 5a24ae6dec7b8e0e9b4a92d48fdaf50dc03cb5b9bdf69f9cedf392de9e61827b
Instruction ID: 28ea79ae586d4dc487b535e6305a2127b149562f76fae63d0927d4a832dc24ff
Opcode Fuzzy Hash: 5a24ae6dec7b8e0e9b4a92d48fdaf50dc03cb5b9bdf69f9cedf392de9e61827b
Instruction Fuzzy Hash: B251AD76908298DBDB38CF24DD917EA7766BF44311F15802ADC4E9B244D3796B48CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075E333, Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: 8dd16de68358b16c7c0bac112ba67662248256d0449d8f27b4dee2dd94ac7743
Instruction ID: c9da97ebafe71e047e31b43d4e7a1dae93569c5d86afb06c67a9f67465959cd3
Opcode Fuzzy Hash: 8dd16de68358b16c7c0bac112ba67662248256d0449d8f27b4dee2dd94ac7743
Instruction Fuzzy Hash: 7F51CB76A04298DBDB38CF24DC957EE77B6BF44311F15802ADC4A9B245C3796B48CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00756F0E, Relevance: 1.4, Strings: 1, Instructions: 124COMMON

Download Yara Rule

Strings

yL[e, xrefs: 0075721F

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: yL[e
API String ID: 0-711218662
Opcode ID: 2791273fadacae8fc30e278f62eb4a5409acb0c8a137d880aea4b2738d48fd28
Instruction ID: 69ffde5a33a632b2a951e62aef52d5d3adbb7fc47a956481c04d33a46603d474
Opcode Fuzzy Hash: 2791273fadacae8fc30e278f62eb4a5409acb0c8a137d880aea4b2738d48fd28
Instruction Fuzzy Hash: 71519831608688DFD738CE59D9917DA73F2BF88701F644129DD4D9F204D378AA46CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0075E1FF, Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: 859d3e278b72ba9acc070974b85574b3d39a6c74e7c51fa6977e95bef9b1ec0f
Instruction ID: 828e197e1cd3c2ed995eea45b322b114150f989fec5fd3cf12c7a6d5d33e9387
Opcode Fuzzy Hash: 859d3e278b72ba9acc070974b85574b3d39a6c74e7c51fa6977e95bef9b1ec0f
Instruction Fuzzy Hash: 5251CC72A04298DBDB38CF24DD817EE7776BF44311F15802ADC4A9B245C3796B48CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075E2BE, Relevance: 1.4, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: 495dadcb38187945bdb1eb05d3ec8403874f26b8d41b2f8535004235cf1e7698
Instruction ID: 23afa9b5f186e0483fc8d49fa48b1c71c8a45df80a3f77974a31a2ab93380df2
Opcode Fuzzy Hash: 495dadcb38187945bdb1eb05d3ec8403874f26b8d41b2f8535004235cf1e7698
Instruction Fuzzy Hash: 7B51BC76A04398DBDB38CF24DD917EE7766BF44311F15802ADC4A9B245C3796B48CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075E1BB, Relevance: 1.4, Strings: 1, Instructions: 116COMMON

Download Yara Rule

Strings

%U9, xrefs: 0075E0E9

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: %U9
API String ID: 0-603333855
Opcode ID: 9038da1342c43bd46244dfad87fc0138ddf79599a5b5244886865ffcb0ac9f1d
Instruction ID: eef2f6e557d6ec937da29f8b841ca09b2ef5ba32ecbdb725eb569cee351dd9f0
Opcode Fuzzy Hash: 9038da1342c43bd46244dfad87fc0138ddf79599a5b5244886865ffcb0ac9f1d
Instruction Fuzzy Hash: AD51ADB2A08398DBDB38CE24DD957EA37A6BB44301F15402ADC4A9B245D3796B44CB82

Uniqueness

Uniqueness Score: -1.00%

Function 007567C6, Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

/, xrefs: 00756853

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: b60eaf9c129a28155bd785a67a01a930af40f5f11718d1d13bd6eac44b74f374
Instruction ID: 6a13c06c3955877052cb2016f48819546e79e222c98d88c841acc4ab9be48170
Opcode Fuzzy Hash: b60eaf9c129a28155bd785a67a01a930af40f5f11718d1d13bd6eac44b74f374
Instruction Fuzzy Hash: 4441683A919258CFC3699F38CD425E9B7A0FF55301F69485DD8868B611C3B9928FCB83

Uniqueness

Uniqueness Score: -1.00%

Function 0075F032, Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: 661dc77d92c456d54726b5ade77924749ebc169909021726d2e711e7003c4fef
Instruction ID: f614a203ee80b0cb0023783606e4394e15613c2c47ab3778addeaab63e64669d
Opcode Fuzzy Hash: 661dc77d92c456d54726b5ade77924749ebc169909021726d2e711e7003c4fef
Instruction Fuzzy Hash: 1E412D769483848BDF348E348C947EABBA1EF15311F59C06ECC899F246D379464A87A2

Uniqueness

Uniqueness Score: -1.00%

Function 0075F063, Relevance: 1.4, Strings: 1, Instructions: 106COMMON

Download Yara Rule

Strings

BDm3, xrefs: 0075F2C0

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: BDm3
API String ID: 0-139009610
Opcode ID: ecce8d79cbd93d1bba254185053f870054ccd6cee790d8ea34207e50b6474ead
Instruction ID: d1ce1e4e5112b14cdf1af10dd03679271d173e25879a88de599f94f8c7a0bae8
Opcode Fuzzy Hash: ecce8d79cbd93d1bba254185053f870054ccd6cee790d8ea34207e50b6474ead
Instruction Fuzzy Hash: 5B412E769483848FDF248E388C943EABBE1EF55311F59C06ECC899F206D379454687A2

Uniqueness

Uniqueness Score: -1.00%

Function 00756820, Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

/, xrefs: 00756853

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 9f8343c80d3615cc67a61f972ae060d278ccc4ca34e8cb802e2af7faf7f253b9
Instruction ID: d97856e477e9b709acddf22d949af1cef5ba112703c5d556ba484bd427237cc5
Opcode Fuzzy Hash: 9f8343c80d3615cc67a61f972ae060d278ccc4ca34e8cb802e2af7faf7f253b9
Instruction Fuzzy Hash: CC31343B818615CFD3299F348D425DABBA0FF56341F2A485DD8868B611C379528F8B83

Uniqueness

Uniqueness Score: -1.00%

Function 00757093, Relevance: 1.3, Strings: 1, Instructions: 66COMMON

Download Yara Rule

Strings

yL[e, xrefs: 0075721F

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: yL[e
API String ID: 0-711218662
Opcode ID: 8f1b9a7405a1f6329f29cce1675161771d2d54c226d20bdd07f748799d6a46c1
Instruction ID: c7dcc0c71ac7e3fdd0ccaf31ab09b81c9897627792f50dec651891221e8ebe7c
Opcode Fuzzy Hash: 8f1b9a7405a1f6329f29cce1675161771d2d54c226d20bdd07f748799d6a46c1
Instruction Fuzzy Hash: 2A21D77150879CCBEB38DE5AEDC16DB72F37FD8702F64812A8D0D4B505C2B86985D681

Uniqueness

Uniqueness Score: -1.00%

Function 007570DE, Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

yL[e, xrefs: 0075721F

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID: yL[e
API String ID: 0-711218662
Opcode ID: 4dbb133779e8f41b4a1bc53b986169524d7c904522920501a79735cfcc6990bf
Instruction ID: 1fe1ffeb79522d7b25efc1a240276497a50211cb962bd360304f07dc6c15c503
Opcode Fuzzy Hash: 4dbb133779e8f41b4a1bc53b986169524d7c904522920501a79735cfcc6990bf
Instruction Fuzzy Hash: 38212B3690875CCBE7388E69A9C02C672F2BF8C756F64412E9D0D5B605C3795A8ACA81

Uniqueness

Uniqueness Score: -1.00%

Function 0075498F, Relevance: .2, Instructions: 182COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4596a9ca12a74e3cf6aae98cf5d1e9f7d0cd60c4da6134d1be99a80017b4cc5c
Instruction ID: 0b976fe2053ed86d0e4052889c69d03f5a121b479a28253c830294d7451e2c50
Opcode Fuzzy Hash: 4596a9ca12a74e3cf6aae98cf5d1e9f7d0cd60c4da6134d1be99a80017b4cc5c
Instruction Fuzzy Hash: 2F71CE766083589FCB388F28C8957EE77B1BF48314F55442EDC8D8B301C7799A898B91

Uniqueness

Uniqueness Score: -1.00%

Function 00754933, Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc0445fd27503d68f41be0fffa24e0e594c81a49714f547990b6256c60956b38
Instruction ID: 2a60178aef75fdff84d91c407f417124a03127cea5087b1fda4ff4f7b91b7520
Opcode Fuzzy Hash: bc0445fd27503d68f41be0fffa24e0e594c81a49714f547990b6256c60956b38
Instruction Fuzzy Hash: C561D0766083489FCB788F28CC957EE77B1BF88304F55442EDD8D8B205C7785A848B56

Uniqueness

Uniqueness Score: -1.00%

Function 0075F342, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f3665b6d4eab33f25fa4c3be17277e0924cd51b831f0a06f6108560467efd6f
Instruction ID: 5c4f0928a07d0f344986d170c2a3913fa5967253e4d24aa86d6b0602b2fed659
Opcode Fuzzy Hash: 0f3665b6d4eab33f25fa4c3be17277e0924cd51b831f0a06f6108560467efd6f
Instruction Fuzzy Hash: FD4127328083D9C7CB308E3888943EA7B73AF12355F99417ACC995F295D3B54A4EC752

Uniqueness

Uniqueness Score: -1.00%

Function 007508F9, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a528c7c34da6bdca975b64efb2ae631c8d942edcd7a18aba0f9a1a9eed9d51ce
Instruction ID: f12340ae1a63a88065a9679962d206e3e20859cc12663b5414ea5d35e6e3ae46
Opcode Fuzzy Hash: a528c7c34da6bdca975b64efb2ae631c8d942edcd7a18aba0f9a1a9eed9d51ce
Instruction Fuzzy Hash: 70318A36408345DFD7248F34C8865DEBBB1FF09315F61441DED599B201C3759A8ACB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075B48A, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID: AllocateCreateFileMemoryVirtual
String ID:
API String ID: 2773895085-0
Opcode ID: dfbf8ca9f56ba51eff270bce68f299a0cc827e41d15ac305f66e739a6c3fa5da
Instruction ID: 829a4102b66c13b656f3e8478503b884a9de6a13d90a101d85ceed3adf8abae9
Opcode Fuzzy Hash: dfbf8ca9f56ba51eff270bce68f299a0cc827e41d15ac305f66e739a6c3fa5da
Instruction Fuzzy Hash: 08310271518289CFD738DF3888567ED7BE1FF40312F50446EED8A8A252D7B889898B42

Uniqueness

Uniqueness Score: -1.00%

Function 00751E67, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 400e0b84ad3b66241e7379f7a2e25f3154328441e4425fa4d5894dfb5b9a2fe3
Instruction ID: 13ca0ae5a1ea3049381cab9aa3d0432120b9ead5485934cf588f89b7fd5c6f86
Opcode Fuzzy Hash: 400e0b84ad3b66241e7379f7a2e25f3154328441e4425fa4d5894dfb5b9a2fe3
Instruction Fuzzy Hash: 91318B3A9093A29FC3168F3888111D17BE2EE5732976948DEC4958F613C76B064BDB81

Uniqueness

Uniqueness Score: -1.00%

Function 00751E5C, Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49a411460f91d117ba20ce6d3400a5b5c2d8abeb101cb48bbe99f895c8573391
Instruction ID: 16fda1959d3c2fa3436e6b164b62fc7b052fa161396d13f428e921edbeed72e0
Opcode Fuzzy Hash: 49a411460f91d117ba20ce6d3400a5b5c2d8abeb101cb48bbe99f895c8573391
Instruction Fuzzy Hash: A831AA3561A3928FC3068F3888151E17BE2EF5731576948EEC5818F613C76A004BDB81

Uniqueness

Uniqueness Score: -1.00%

Function 0075F3A9, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e23590f8827b124912c93aa023ff2c4e6777431d94928da7a61db297b1d7f4cf
Instruction ID: c29fd4cbbc23589019977999fe12a78d1d34796c15285b4118cfeda98009de5a
Opcode Fuzzy Hash: e23590f8827b124912c93aa023ff2c4e6777431d94928da7a61db297b1d7f4cf
Instruction Fuzzy Hash: CF314C328083D9C6CB309E3888903DAB773AF11355F69457ECC995F251D3BA468EC752

Uniqueness

Uniqueness Score: -1.00%

Function 00750943, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79b9cfd9cfa07ea36b019b7447b17c4d306902664fbad6db885d7b6159b64af5
Instruction ID: 968ed34b39bd5fc7e448473e7e5e74bf0a2b8e7add56bcbf527a2cb53bb7998f
Opcode Fuzzy Hash: 79b9cfd9cfa07ea36b019b7447b17c4d306902664fbad6db885d7b6159b64af5
Instruction Fuzzy Hash: 3E317876404349DFD7189F34C886ADEBBB1FF45311F62841DDD95AB201C7B49A89CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0075F3EF, Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0dc0eb55a5edbe8d9f29e5bfa4af842a18f0e83ba98c7378fdb7f36f0a3267
Instruction ID: fc303c6823944e4193ef2f35ec154b7394680832296e4cd819ab9043d4d433e9
Opcode Fuzzy Hash: 1d0dc0eb55a5edbe8d9f29e5bfa4af842a18f0e83ba98c7378fdb7f36f0a3267
Instruction Fuzzy Hash: 7F314C329083C9CBCB348E3888952DA7B72AF15355F69457ECC898B252D3B9468FC752

Uniqueness

Uniqueness Score: -1.00%

Function 0075D108, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1bc235bcad3b6db4b4debd24c8dd3dbf015c7fa06296f4ee862d2dc96e20379
Instruction ID: 21f8b636da9c15bc3693df9afdf65c6227b2f2423d8e7b6239cf9d59c5c289f6
Opcode Fuzzy Hash: c1bc235bcad3b6db4b4debd24c8dd3dbf015c7fa06296f4ee862d2dc96e20379
Instruction Fuzzy Hash: C9113975604648DFCB35CE18C888AD573A1BB58312F42446AEC09CB314C7B8DD48DF16

Uniqueness

Uniqueness Score: -1.00%

Function 00754123, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cd1815b67e8ad6aff0d181f9cc17e3e48c4a205de6d29c20c98936938232cbb
Instruction ID: e6667afba70d38752f44afb73845db4856c49d07d528a7da18dca3d9957e288b
Opcode Fuzzy Hash: 5cd1815b67e8ad6aff0d181f9cc17e3e48c4a205de6d29c20c98936938232cbb
Instruction Fuzzy Hash: D4D0224391886C9E7B562A323E800EA0C220AE42AA324C1107C0F8A902D8CCCCCC10C2

Uniqueness

Uniqueness Score: -1.00%

Function 00759889, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b7bf1c53fc9c850077d0c17c95fd8ce38e149e3800af3c3de4bd2f7cb8c6449f
Instruction ID: 3ce9cb0245d3d2540d75f4eae99fe46ded5213cab1afb01eeca3dc46a763df73
Opcode Fuzzy Hash: b7bf1c53fc9c850077d0c17c95fd8ce38e149e3800af3c3de4bd2f7cb8c6449f
Instruction Fuzzy Hash: 70C08CFA2051C19FEF22CF18D891BC5BBA4AB0DA48F1C04C5D801CBB02C250E910CB04

Uniqueness

Uniqueness Score: -1.00%

Function 0075C345, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.520378272.0000000000750000.00000040.00000001.sdmp, Offset: 00750000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ieinstal.exe PID: 672 Parent PID: 6132 ieinstal.exeCOMMON

Executed Functions

Function 0056FDCF, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 005705B3

Strings

uOIe, xrefs: 0057030D

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID: uOIe
API String ID: 3310709589-436217044
Opcode ID: 4953383a7e29936e03b7e4777f89b767a2d2ed94d4d80edfd1f3836f351e1bae
Instruction ID: d52c017f2eb1f78de679948d0df6da49806afc7521ea0f4e58d98c1679f4fb35
Opcode Fuzzy Hash: 4953383a7e29936e03b7e4777f89b767a2d2ed94d4d80edfd1f3836f351e1bae
Instruction Fuzzy Hash: 84912431504249CFCF759E28E9A8BEA3FE1BF99310F61952ACC4E8B295C7304941EB52

Uniqueness

Uniqueness Score: -1.00%

Function 0056B5A0, Relevance: 1.9, APIs: 1, Instructions: 432fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0056B800

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 13dc80e0b6dd5e8d181377851f3f9be0fd93fa176959595985ab51a1b3eeec19
Instruction ID: 11b63110d71d44ebc82a87bf31fabb923ad960d55c8012e782f6b21fb19858be
Opcode Fuzzy Hash: 13dc80e0b6dd5e8d181377851f3f9be0fd93fa176959595985ab51a1b3eeec19
Instruction Fuzzy Hash: FCF18A37908356CFD7249F38C8456E9BFA0FF15310F29486ED9899B751C7318A86CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0056D82A, Relevance: 1.6, APIs: 1, Instructions: 125memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-1376DCF7,?,C9C702C2), ref: 0056DC5D

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 99ae7cb452927182fd587f97af938bc41bc9f5d1197bf181e2d184a8de71c35b
Instruction ID: 2f2ae1f6186caac6ab379f2c5d1e550f8a7d70f80dd4250d3c1033b864939f8d
Opcode Fuzzy Hash: 99ae7cb452927182fd587f97af938bc41bc9f5d1197bf181e2d184a8de71c35b
Instruction Fuzzy Hash: C441CE72B08388DFDF745E6489547FA7BB1BF58344F220D1ADC8A97265D3704A80DB22

Uniqueness

Uniqueness Score: -1.00%

Function 0056B5AB, Relevance: 1.6, APIs: 1, Instructions: 71fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0056B800

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 15bcd2bf03b9aa6ae786f7025426ea7619de5362febe1ca5b3c4503fcf7e58f4
Instruction ID: c400a20d4f36711184c46b1f297b08fcbf868200c9c6513630790e580e23d27f
Opcode Fuzzy Hash: 15bcd2bf03b9aa6ae786f7025426ea7619de5362febe1ca5b3c4503fcf7e58f4
Instruction Fuzzy Hash: E2212937918256DFE7745F38C9013DABBA4FF54310F564C6EAC85EB211C7314A818B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0056F872, Relevance: 1.5, APIs: 1, Instructions: 37nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(-51634B6F,?,?,?,?,0056EB88,-00000001745A4444,00560B19), ref: 0056F943

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 9205adc4aa34d03e8035456a4b1746b52a315d6a0975517faba85d621faad4bb
Instruction ID: 5662256e7c37da0f02eac8f4fc68c3735688806bab6e722ac6e1508bea49b39e
Opcode Fuzzy Hash: 9205adc4aa34d03e8035456a4b1746b52a315d6a0975517faba85d621faad4bb
Instruction Fuzzy Hash: 8E0169B29090949FDF34CE18DD44AEE77BAABD9710F16402AEC5DAB308C670AE048790

Uniqueness

Uniqueness Score: -1.00%

Function 00560E43, Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

EnumWindows.USER32 ref: 00560E48

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: EnumWindows
String ID:
API String ID: 1129996299-0
Opcode ID: ee30713f2b14b5be47f0813b5db4c4e3a352e9e56591e346c536f0228e8db2de
Instruction ID: 09fbfb0323533cacacc16e49f06d102837dfe8ea1afc55dee8a24ce72d8af0a6
Opcode Fuzzy Hash: ee30713f2b14b5be47f0813b5db4c4e3a352e9e56591e346c536f0228e8db2de
Instruction Fuzzy Hash: A141563251C785CFD725CF38C84A6AA7FA4BB42310F68499ED48ACB252D6308945CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0056C7F0, Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aab08650f2fb33f972a8cdad0314a1632dc24d4a7b2f4d2cb4a2846d873c0a2f
Instruction ID: f1dc5f960720156eaf02ba3f15ee4aa05478f1328d6a442d390917f387b7a1a8
Opcode Fuzzy Hash: aab08650f2fb33f972a8cdad0314a1632dc24d4a7b2f4d2cb4a2846d873c0a2f
Instruction Fuzzy Hash: DF41D3756082C59FCB35DE6488253F62FA2BF66380F58881BECCBCB341CA304A41E756

Uniqueness

Uniqueness Score: -1.00%

Function 005669D9, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b639ec83303a495c881fc7b17af3a643e1b729ff431f324c28e843768e688d5
Instruction ID: d3fd1b325b3b3b023c69b863742ef2c5a46a83859c6f7369b98c033bd034876b
Opcode Fuzzy Hash: 6b639ec83303a495c881fc7b17af3a643e1b729ff431f324c28e843768e688d5
Instruction Fuzzy Hash: 2631E836608255DFDF349F6898047F93FA1FF95361F25492BEC8AD7240CA714A428B52

Uniqueness

Uniqueness Score: -1.00%

Function 00560227, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10a936d591f23585f82153d4835bcde3a127fa16b00f291234f9bc9176651ffe
Instruction ID: dfee0100dc8f7c50247fbbd5b114e4e5075e789e3923f59849faf297b5ec4815
Opcode Fuzzy Hash: 10a936d591f23585f82153d4835bcde3a127fa16b00f291234f9bc9176651ffe
Instruction Fuzzy Hash: A8210539608266DBCF34EF7888183F93FB0FF95351F60441AEC8AD7240DB3149029A52

Uniqueness

Uniqueness Score: -1.00%

Function 0056C363, Relevance: 1.6, APIs: 1, Instructions: 68libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000,00560219), ref: 0056C4E2

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 21556af78eb04758b62f995a289066576a6b3cbce799d0e283ecb9e532dd7ce0
Instruction ID: a87a1749ab8a759c18193a1549b92da7e480d2c1b7e6d0f3fcef4820b986aa2b
Opcode Fuzzy Hash: 21556af78eb04758b62f995a289066576a6b3cbce799d0e283ecb9e532dd7ce0
Instruction Fuzzy Hash: E321F93B9482625BC730EE2858142E43FA1FF143AA768489FE849DF701C9375B478B83

Uniqueness

Uniqueness Score: -1.00%

Function 0056B62E, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0056B800

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 832f128cef5689d88ec1c1e9305fd7314f59fbe4c144dffdceaa2f4d4966aa38
Instruction ID: ecd638133ba8000510dfd7bc8b11bd57e82bba70a8f95f7f0647cbcd3e0da075
Opcode Fuzzy Hash: 832f128cef5689d88ec1c1e9305fd7314f59fbe4c144dffdceaa2f4d4966aa38
Instruction Fuzzy Hash: 4A21083B904256DBE7745E3CC9002DA77A4FF14315F55486EAC85EB701C7314B858F96

Uniqueness

Uniqueness Score: -1.00%

Function 0056B60F, Relevance: 1.6, APIs: 1, Instructions: 55fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0056B800

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c54a77c5132b13d0af100857a1845ba35394bfd9dbb670ed0a8d3d3f47dac308
Instruction ID: f9fa456f3871d6728ed1e570ccb91a3a227a44197bb022c77a00bfca2625c10c
Opcode Fuzzy Hash: c54a77c5132b13d0af100857a1845ba35394bfd9dbb670ed0a8d3d3f47dac308
Instruction Fuzzy Hash: B8113A76518386DFEB745E38CA417EA7BE4FF54310F560C2EAC85EB611C7704A808B9A

Uniqueness

Uniqueness Score: -1.00%

Function 0056B672, Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0056B800

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d1ae1f1bf3713fb5a5aac4be47bef96c624bfe67116b5730e594863591af7b1b
Instruction ID: 2f583d7d026eac2d031e390da7e0b368087bf72aa9c739736c80ab870ed413ca
Opcode Fuzzy Hash: d1ae1f1bf3713fb5a5aac4be47bef96c624bfe67116b5730e594863591af7b1b
Instruction Fuzzy Hash: 3511E23A804256DBE7749F38C9013DA7BA4FF14315F55486EAC89EB301C7358A818B96

Uniqueness

Uniqueness Score: -1.00%

Function 0056C3E6, Relevance: 1.5, APIs: 1, Instructions: 41libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000,00560219), ref: 0056C4E2

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6f44f46f5e53fb71a2c3c417a548dc7183bda9ca97f83bce5f2f1122a1aa8659
Instruction ID: a493155f4b5bf653e85ac04b430985733fcb85b9375f6b4ee3b956957da1feeb
Opcode Fuzzy Hash: 6f44f46f5e53fb71a2c3c417a548dc7183bda9ca97f83bce5f2f1122a1aa8659
Instruction Fuzzy Hash: 8601F2365042569BCA20AB6848143F87FB0FF507A6765859BAC86AB201CF3586428B82

Uniqueness

Uniqueness Score: -1.00%

Function 0056C462, Relevance: 1.5, APIs: 1, Instructions: 39libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000,00560219), ref: 0056C4E2

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8c6f43fcaddd35a06195d36812a51469f40b7130609029e4da50ca982446f39d
Instruction ID: 8af6ed672ebbc08e2eba5fa296476c606f2a37f8f6f891c15f237063d82b3920
Opcode Fuzzy Hash: 8c6f43fcaddd35a06195d36812a51469f40b7130609029e4da50ca982446f39d
Instruction Fuzzy Hash: 2B018B3B9041369BC3255F1C54102987B21FF50BA936584DED856AF301CB379B8B8BC2

Uniqueness

Uniqueness Score: -1.00%

Function 0056B6F6, Relevance: 1.5, APIs: 1, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0056B800

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 09b364c2362d314dda42dbf15dfe6123fad6a7406fea2d369bda88193c842c3e
Instruction ID: 193e542af6a91f58fd6ecfeb1e6811ed7edf535ff1d08a8de0c5c210eb26729e
Opcode Fuzzy Hash: 09b364c2362d314dda42dbf15dfe6123fad6a7406fea2d369bda88193c842c3e
Instruction Fuzzy Hash: F601D83B844251DBD7645F38C900299B7A4FF14315F66887EAC85EB311C7354A868F86

Uniqueness

Uniqueness Score: -1.00%

Function 0056C352, Relevance: 1.5, APIs: 1, Instructions: 32libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000,00560219), ref: 0056C4E2

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: acbeb64bdac221aa4f3f99041bfe71a725b456d9ff274fdf02b91ef22a0415ed
Instruction ID: 901c95f9a073324d60cffc420e21d026f106f4987724a3d3fa071d7013f516f7
Opcode Fuzzy Hash: acbeb64bdac221aa4f3f99041bfe71a725b456d9ff274fdf02b91ef22a0415ed
Instruction Fuzzy Hash: B4F0F9B5618195DFCF74DF688C18BFA3EF5BF59311F50441AAC4DD7240DA709A018B26

Uniqueness

Uniqueness Score: -1.00%

Function 0056B738, Relevance: 1.5, APIs: 1, Instructions: 32fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0056B800

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c1e23aa4754f65e6de63787a5a7fa4b1321781744893c63f8715e656c9449b03
Instruction ID: 906bb653726e3d8788ee3d4b692fb131c8ca39d978dc38be14da72f7bc03b458
Opcode Fuzzy Hash: c1e23aa4754f65e6de63787a5a7fa4b1321781744893c63f8715e656c9449b03
Instruction Fuzzy Hash: 40F0A93B848211EBD7645F38DD016D9B7A4FF14355F16486ED885A7211C7360A868B85

Uniqueness

Uniqueness Score: -1.00%

Function 0056B794, Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,C2989231), ref: 0056B800

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eb24e38e93c64a5ad60cbff6b1495176c1a8b21c984c596865409466c8c179d5
Instruction ID: 21bd5a89307c1f6b12d12d26001713ab9f6be4823a577ce070897497ad8665fe
Opcode Fuzzy Hash: eb24e38e93c64a5ad60cbff6b1495176c1a8b21c984c596865409466c8c179d5
Instruction Fuzzy Hash: B3F0A03A840165CBD7344F2888043C8B720FF50754F6944BE9854AF302C7361A868BC4

Uniqueness

Uniqueness Score: -1.00%

Function 0056C4BF, Relevance: 1.5, APIs: 1, Instructions: 20libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,?,?,00000000,00560219), ref: 0056C4E2

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f9065e999b54bac2c6b77644d76bfd0a41bfa75e190c1cf0b67986c4e7303a8a
Instruction ID: acc659c4197e7e04410e84ef7b2273853abfb797e918b45508d92b87949fdca8
Opcode Fuzzy Hash: f9065e999b54bac2c6b77644d76bfd0a41bfa75e190c1cf0b67986c4e7303a8a
Instruction Fuzzy Hash: 15E0863A500166DBC7241F6D58043D87F21FF51BA47A4C0AEECA2DB201DB36A6879FC2

Uniqueness

Uniqueness Score: -1.00%

Function 0056AD16, Relevance: 1.5, APIs: 1, Instructions: 7libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 0056AD2A

Memory Dump Source

Source File: 00000006.00000002.564225292.0000000000560000.00000040.00000001.sdmp, Offset: 00560000, based on PE: false

Yara matches

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: fd03d0e7f2ae6f725cb18b2dc10da16e2ae96c14be02aaa6ecedb9400e1e5e6e
Instruction ID: 6457bce3a2e4be4b65a42f9aae4fa5b4ea0d20799a384ac369cd85cc1de6947f
Opcode Fuzzy Hash: fd03d0e7f2ae6f725cb18b2dc10da16e2ae96c14be02aaa6ecedb9400e1e5e6e
Instruction Fuzzy Hash: 93C02B301003040FC301AF28808184737709F92300B10C056E040430C9C7200B1DFBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Hong Tak Engineering SB Payment Receipt 241121_PDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: Hong Tak Engineering SB Payment Receipt 241121_PDF.exe PID: 6132 Parent PID: 5256

General