Play interactive tour

Edit tour

Windows Analysis Report draft_inv dec21.exe

Overview

General Information

Sample Name:	draft_inv dec21.exe
Analysis ID:	531747
MD5:	89a584acaeb2f9e8baf46714eb7d3550
SHA1:	263ff0b238d57cfc30492f8801530b9986dcae38
SHA256:	59ae017767f6a56eba79abdad1343cba3643744f4668b320c30fda283abdedf2
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Uses 32bit PE files

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Program does not show much activity (idle)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

draft_inv dec21.exe (PID: 6976 cmdline: "C:\Users\user\Desktop\draft_inv dec21.exe" MD5: 89A584ACAEB2F9E8BAF46714EB7D3550)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://statuswar.info/GHDFR/bin_rOlFDOAa61.bin"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1200998777.0000000002CA0000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.1200998777.0000000002CA0000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://statuswar.info/GHDFR/bin_rOlFDOAa61.bin"}

Multi AV Scanner detection for submitted file

Show sources

Source: draft_inv dec21.exe	Metadefender: Detection: 20%			Perma Link
Source: draft_inv dec21.exe	ReversingLabs: Detection: 17%

Source: draft_inv dec21.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://statuswar.info/GHDFR/bin_rOlFDOAa61.bin

Source: draft_inv dec21.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: draft_inv dec21.exe, 00000000.00000000.674652784.0000000000421000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameprajesselv.exe vs draft_inv dec21.exe
Source: draft_inv dec21.exe, 00000000.00000002.1200866367.0000000002980000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameprajesselv.exeFE2XCx Frak vs draft_inv dec21.exe
Source: draft_inv dec21.exe	Binary or memory string: OriginalFilenameprajesselv.exe vs draft_inv dec21.exe

Source: draft_inv dec21.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\draft_inv dec21.exe

Code function: 0_2_02CB02FD

0_2_02CB02FD

Source: C:\Users\user\Desktop\draft_inv dec21.exe

Process Stats: CPU usage > 98%

Source: draft_inv dec21.exe	Metadefender: Detection: 20%
Source: draft_inv dec21.exe	ReversingLabs: Detection: 17%

Source: draft_inv dec21.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\draft_inv dec21.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\draft_inv dec21.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\draft_inv dec21.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\draft_inv dec21.exe

File created: C:\Users\user\AppData\Local\Temp\~DF91089FF9233BF8CB.TMP

Jump to behavior

Source: classification engine

Classification label: mal72.troj.evad.winEXE@1/1@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.1200998777.0000000002CA0000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_0040846A push ds; retf	0_2_00408472
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_00407608 push ebx; iretd	0_2_00407609
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_00405C16 push ss; iretd	0_2_00405BC7
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_004094E5 push esi; iretd	0_2_004094E7
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_00405B7D push ss; iretd	0_2_00405BC7
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_00407F07 push ebp; retf	0_2_00407F0F
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_00408119 push ebx; iretd	0_2_0040811B
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_02CA5A84 push edi; ret	0_2_02CA5A89
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_02CA084B push ss; retf	0_2_02CA0852
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_02CA5A48 push edi; ret	0_2_02CA5A89
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_02CA0BC1 push FFB8EB81h; ret	0_2_02CA0BC6
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_02CA399C push esp; ret	0_2_02CA39EF
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_02CA2B3A push cs; iretd	0_2_02CA2B3F

Source: C:\Users\user\Desktop\draft_inv dec21.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\draft_inv dec21.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\draft_inv dec21.exe

Code function: 0_2_02CB08D3 rdtsc

0_2_02CB08D3

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\draft_inv dec21.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_02CAF610 mov eax, dword ptr fs:[00000030h]		0_2_02CAF610
Source: C:\Users\user\Desktop\draft_inv dec21.exe	Code function: 0_2_02CAC50C mov eax, dword ptr fs:[00000030h]		0_2_02CAC50C

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\draft_inv dec21.exe

Code function: 0_2_02CB08D3 rdtsc

0_2_02CB08D3

Source: draft_inv dec21.exe, 00000000.00000002.1200704632.0000000000D90000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: draft_inv dec21.exe, 00000000.00000002.1200704632.0000000000D90000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: draft_inv dec21.exe, 00000000.00000002.1200704632.0000000000D90000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: draft_inv dec21.exe, 00000000.00000002.1200704632.0000000000D90000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Query Registry1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Security Software Discovery11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Virtualization/Sandbox Evasion11	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Information Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
draft_inv dec21.exe	20%	Metadefender		Browse
draft_inv dec21.exe	18%	ReversingLabs	Win32.Trojan.GuLoader

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://statuswar.info/GHDFR/bin_rOlFDOAa61.bin	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://statuswar.info/GHDFR/bin_rOlFDOAa61.bin	true	Avira URL Cloud: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	531747
Start date:	01.12.2021
Start time:	10:21:21
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	draft_inv dec21.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.troj.evad.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 33.8% (good quality ratio 11.7%) Quality average: 20.8% Quality standard deviation: 32.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115 Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, store-images.s-microsoft.com, s-ring.msedge.net, store-images.s-microsoft.com-c.edgekey.net, img-prod-cms-rt-microsoft-com.akamaized.net, teams-ring.msedge.net, arc.msn.com, t-ring.msedge.net VT rate limit hit for: /opt/package/joesandbox/database/analysis/531747/sample/draft_inv dec21.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\~DF91089FF9233BF8CB.TMP Download File
Process:	C:\Users\user\Desktop\draft_inv dec21.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.6374754921163319
Encrypted:	false
SSDEEP:	12:rl3lKFQCb77z4cl9ZgFLGVwtn4+jbxO/37X6XMRZnAX3CqFZlUoz:r8JloFP1jbxOfLhlAX3CAZlj
MD5:	26F4DF069A76EC44D3497157CFC2A7FF
SHA1:	4FFDEDEB83278CA75D0AAE246C6451342C6A763F
SHA-256:	B83265C7FB0E0239E55E32B503B9D73689FC800BCF26E8670284B2BCF805841B
SHA-512:	161E06993EE630FC83DD0A17D0B2370FF69173EAD77E385A4396E5E921C2037A2547FBEF7CD3B9E605ABE1960C928C158CB9D6C6479A4BD232F5790574AD029A
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.94335884500492
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	draft_inv dec21.exe
File size:	135168
MD5:	89a584acaeb2f9e8baf46714eb7d3550
SHA1:	263ff0b238d57cfc30492f8801530b9986dcae38
SHA256:	59ae017767f6a56eba79abdad1343cba3643744f4668b320c30fda283abdedf2
SHA512:	299b531915221fd0003e2f526c7ac529d948524a065dde767c4d638f4121cd62d3a70e67bca3c013baf79cf98f67d9f84b5097327dfdba2d4ffd4b10dc571241
SSDEEP:	3072:9U8IySFndx820q1KtKiNaoLbi/gRN1bmwADH:9UkSFd22j1KvfEgHJO
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......7b..s...s...s.......r...<!..v...E%..r...Richs...........................PE..L...W.aL.....................0......h.............@

File Icon


Icon Hash:	98989c98b8787c00

Static PE Info

General
Entrypoint:	0x401668
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4C61B357 [Tue Aug 10 20:15:19 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	a7de590cc5b951bdfc15c3f8afbf7326

Entrypoint Preview

Instruction
push 00402250h
call 00007FC874C81625h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
cmp edi, ebx
std
call far fword ptr [edx]
sub byte ptr [edi], dh
dec ecx
xchg eax, esi
loope 00007FC874C815D2h
wait
jmp 00007FC874C8163Dh
mov esp, 00000098h
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+45h], cl
dec esi
push ebx
dec edi
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add bh, bh
int3
xor dword ptr [eax], eax
sub eax, 8ABA351Dh
cmp ch, bh
mov esi, 0468A643h
cwde
or al, C1h
imul eax
xor byte ptr [edi-2064A690h], bl
inc esp
mov cs, cx
nop
movsd
push ss
stosb
dec esp
cmp cl, byte ptr [edi-53h]
xor ebx, dword ptr [ecx-48EE309Ah]
or al, 00h
stosb
add byte ptr [eax-2Dh], ah
xchg eax, ebx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
scasd
or al, byte ptr [eax]
add bl, cl
add eax, dword ptr [eax]
add byte ptr [eax], al
push es
add byte ptr [ecx+ecx*2+4Ch], dl
inc edx
inc ecx
inc edi
add byte ptr [4D000601h], cl
jne 00007FC874C816ACh
jp 00007FC874C8169Eh
xor eax, dword ptr [eax]
sbb dword ptr [ecx], eax
add byte ptr [edx+00h], al
and al, byte ptr [ecx]
and eax, dword ptr [esi+00000003h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1de84	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x21000	0x750	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x238	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1f4	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1d570	0x1e000	False	0.558390299479	data	6.27464824978	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x1f000	0x1a18	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x21000	0x750	0x1000	False	0.18310546875	data	1.93536831113	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x213e8	0x368	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x213d4	0x14	data
RT_VERSION	0x210f0	0x2e4	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaHresultCheck, __vbaStrI4, __vbaFreeVar, __vbaAryMove, __vbaStrVarMove, __vbaLenBstr, __vbaFreeVarList, _adj_fdiv_m64, _adj_fprem1, __vbaStrCat, __vbaSetSystemError, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, __vbaOnError, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaFpR8, __vbaVarTstLt, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, __vbaVarTstEq, __vbaObjVar, DllFunctionCall, __vbaLbound, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, __vbaUI1I2, _CIsqrt, EVENT_SINK_QueryInterface, __vbaUI1I4, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaUbound, __vbaStrVarVal, __vbaVarCat, _CIlog, __vbaErrorOverflow, __vbaNew2, __vbaVar2Vec, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaStrToAnsi, __vbaVarDup, __vbaStrComp, __vbaFpI4, __vbaVarTstGe, __vbaLateMemCallLd, _CIatan, __vbaStrMove, __vbaR8IntI4, _allmul, _CItan, __vbaFPInt, _CIexp, __vbaFreeObj, __vbaFreeStr

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	Cx Frak
InternalName	prajesselv
FileVersion	1.00
CompanyName	Cx Frak
LegalTrademarks	Cx Frak
Comments	Cx Frak
ProductName	Cx Frak
ProductVersion	1.00
FileDescription	Cx Frak
OriginalFilename	prajesselv.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: draft_inv dec21.exe PID: 6976 Parent PID: 1556

General

Start time:	10:22:22
Start date:	01/12/2021
Path:	C:\Users\user\Desktop\draft_inv dec21.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\draft_inv dec21.exe"
Imagebase:	0x400000
File size:	135168 bytes
MD5 hash:	89A584ACAEB2F9E8BAF46714EB7D3550
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.1200998777.0000000002CA0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: draft_inv dec21.exe PID: 6976 Parent PID: 1556 draft_inv dec21.exeCOMMON

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	7.7%
Signature Coverage:	1.4%
Total number of Nodes:	142
Total number of Limit Nodes:	13

Executed Functions

Function 0041B4B0, Relevance: 503.8, APIs: 251, Strings: 36, Instructions: 1528
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaAryConstruct2.MSVBVM60(?,00403268,00000011), ref: 0041B587
__vbaAryConstruct2.MSVBVM60(?,00403284,00000011), ref: 0041B594
#614.MSVBVM60(00000000,4069E000), ref: 0041B59C
__vbaFpR8.MSVBVM60 ref: 0041B5A2
#613.MSVBVM60(?,?), ref: 0041B5DB
__vbaStrVarMove.MSVBVM60(?), ref: 0041B5E8
__vbaStrMove.MSVBVM60 ref: 0041B5F9
__vbaFreeVarList.MSVBVM60(00000002,00000003,?), ref: 0041B60B
#702.MSVBVM60(00000003,000000FF,000000FE,000000FE,000000FE), ref: 0041B637
__vbaStrMove.MSVBVM60 ref: 0041B642
__vbaFreeVar.MSVBVM60 ref: 0041B64A
#716.MSVBVM60(?,Scripting.FileSystemObject,00000000), ref: 0041B665
__vbaObjVar.MSVBVM60(?), ref: 0041B672
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 0041B67D
__vbaFreeVar.MSVBVM60 ref: 0041B689
#692.MSVBVM60(?,Dublers1,BOLIGFORENINGERNES), ref: 0041B6A0
__vbaLateMemCallLd.MSVBVM60(?,?,FileExists,00000001), ref: 0041B6F4
__vbaVarTstLt.MSVBVM60(00008002,00000000), ref: 0041B705
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041B722
#546.MSVBVM60(?), ref: 0041B73B
__vbaVarMove.MSVBVM60 ref: 0041B74D
#611.MSVBVM60 ref: 0041B753
__vbaStrMove.MSVBVM60 ref: 0041B75E
__vbaUI1I2.MSVBVM60 ref: 0041B76B
__vbaUI1I2.MSVBVM60 ref: 0041B777
__vbaUI1I2.MSVBVM60 ref: 0041B784
__vbaUI1I2.MSVBVM60 ref: 0041B791
__vbaUI1I2.MSVBVM60 ref: 0041B79E
__vbaUI1I2.MSVBVM60 ref: 0041B7AB
__vbaUI1I2.MSVBVM60 ref: 0041B7B8
__vbaUI1I2.MSVBVM60 ref: 0041B7C5
__vbaUI1I2.MSVBVM60 ref: 0041B7D2
__vbaUI1I2.MSVBVM60 ref: 0041B7DF
__vbaUI1I2.MSVBVM60 ref: 0041B7EC
__vbaUI1I2.MSVBVM60 ref: 0041B7F9
__vbaUI1I2.MSVBVM60 ref: 0041B806
__vbaUI1I2.MSVBVM60 ref: 0041B813
__vbaUI1I2.MSVBVM60 ref: 0041B820
__vbaUI1I2.MSVBVM60 ref: 0041B82D
__vbaUI1I2.MSVBVM60 ref: 0041B83A
__vbaUI1I2.MSVBVM60 ref: 0041B847
__vbaUI1I2.MSVBVM60 ref: 0041B854
__vbaUI1I2.MSVBVM60 ref: 0041B861
__vbaUI1I2.MSVBVM60 ref: 0041B86E
__vbaUI1I2.MSVBVM60 ref: 0041B87B
__vbaUI1I2.MSVBVM60 ref: 0041B888
__vbaUI1I2.MSVBVM60 ref: 0041B895
__vbaUI1I2.MSVBVM60 ref: 0041B8A2
__vbaUI1I2.MSVBVM60 ref: 0041B8AF
__vbaUI1I2.MSVBVM60 ref: 0041B8BC
__vbaUI1I2.MSVBVM60 ref: 0041B8C9
__vbaUI1I2.MSVBVM60 ref: 0041B8D6
#521.MSVBVM60(CHLORINES), ref: 0041B8E3
#560.MSVBVM60(?), ref: 0041B900
__vbaFreeVar.MSVBVM60 ref: 0041B919
#697.MSVBVM60(00003CBD), ref: 0041B92D
__vbaStrMove.MSVBVM60 ref: 0041B938
__vbaNew2.MSVBVM60(0040304C,0041F49C), ref: 0041B94D
__vbaHresultCheckObj.MSVBVM60(00000000,02B0EA74,0040303C,00000014), ref: 0041B975
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040305C,000000B8), ref: 0041B9A5
__vbaFreeObj.MSVBVM60 ref: 0041B9B1
__vbaStrToAnsi.MSVBVM60(?,Bronkiernes,0015A669,?), ref: 0041B9D9
__vbaSetSystemError.MSVBVM60(00818715,00000000), ref: 0041B9F0
__vbaFreeStr.MSVBVM60 ref: 0041BA12
__vbaUbound.MSVBVM60(00000001,?), ref: 0041BA27
__vbaGenerateBoundsError.MSVBVM60 ref: 0041BA4C
__vbaUI1I4.MSVBVM60 ref: 0041BA67
__vbaVarDup.MSVBVM60 ref: 0041BAA5
#619.MSVBVM60(?,00000008,000000CB), ref: 0041BABE
__vbaStrVarMove.MSVBVM60(?), ref: 0041BACB
__vbaStrMove.MSVBVM60 ref: 0041BAD6
__vbaFreeVarList.MSVBVM60(00000002,00000008,?), ref: 0041BAE8
#628.MSVBVM60(SCOURING,000000C5,00000008), ref: 0041BB16
__vbaStrMove.MSVBVM60 ref: 0041BB24
__vbaVarDup.MSVBVM60 ref: 0041BB46
#518.MSVBVM60(?,?), ref: 0041BB5A
__vbaStrVarVal.MSVBVM60(?,?), ref: 0041BB84
#581.MSVBVM60(00000000), ref: 0041BB87
__vbaFpI4.MSVBVM60 ref: 0041BB8D
__vbaStrMove.MSVBVM60(00000000), ref: 0041BB9C
__vbaStrToAnsi.MSVBVM60(?,00000000), ref: 0041BBAA
__vbaSetSystemError.MSVBVM60(0088DCA8,00480EF5,00000000), ref: 0041BBC6
#685.MSVBVM60 ref: 0041BBCC
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041BBDA
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004030E0,0000001C), ref: 0041BBFE
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,00000000), ref: 0041BC3E
__vbaFreeObj.MSVBVM60 ref: 0041BC4D
__vbaFreeVarList.MSVBVM60(00000003,00000002,?,?), ref: 0041BC70
__vbaStrCopy.MSVBVM60 ref: 0041BC8B
__vbaVarDup.MSVBVM60 ref: 0041BCB1
#522.MSVBVM60(?,00000002), ref: 0041BCC5
#573.MSVBVM60(?,?), ref: 0041BCED
__vbaStrVarVal.MSVBVM60(?,?,00000001,000000FF,00000000), ref: 0041BD07
__vbaStrVarVal.MSVBVM60(?,?,00000000), ref: 0041BD18
#712.MSVBVM60(?,00000000), ref: 0041BD1F
__vbaStrMove.MSVBVM60 ref: 0041BD30
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041BD42
__vbaFreeVarList.MSVBVM60(00000004,00000002,00000002,?,?), ref: 0041BD66
#717.MSVBVM60(00000002,00000008,00000040,00000000), ref: 0041BD90
__vbaStrVarMove.MSVBVM60(00000002), ref: 0041BD9D
__vbaStrMove.MSVBVM60 ref: 0041BDA8
__vbaFreeVar.MSVBVM60 ref: 0041BDB0
#714.MSVBVM60(?,00000008,00000000), ref: 0041BDE0
__vbaI4Var.MSVBVM60(?), ref: 0041BDED
__vbaSetSystemError.MSVBVM60(00000000), ref: 0041BDFF
__vbaFPInt.MSVBVM60 ref: 0041BE17
__vbaFpR8.MSVBVM60 ref: 0041BE1D
__vbaFreeVarList.MSVBVM60(00000002,00000004,?), ref: 0041BE49
#651.MSVBVM60(00000004,?), ref: 0041BE7C
__vbaStrMove.MSVBVM60 ref: 0041BE8A
__vbaStrCat.MSVBVM60(00000000), ref: 0041BE93
__vbaStrMove.MSVBVM60 ref: 0041BE9D
__vbaStrCat.MSVBVM60(Udstykningskontrollerne,00000000), ref: 0041BEA5
__vbaStrMove.MSVBVM60 ref: 0041BEAC
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041BEBE
__vbaFreeVar.MSVBVM60 ref: 0041BECD
__vbaNew2.MSVBVM60(0040304C,0041F49C), ref: 0041BEE6
__vbaHresultCheckObj.MSVBVM60(00000000,02B0EA74,0040303C,00000014), ref: 0041BF0E
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040305C,000000F0), ref: 0041BF3E
__vbaStrMove.MSVBVM60 ref: 0041BF57
__vbaFreeObj.MSVBVM60 ref: 0041BF5F
__vbaR8IntI4.MSVBVM60 ref: 0041BF6B
#696.MSVBVM60(BUGTERS), ref: 0041BFAA
__vbaVarDup.MSVBVM60 ref: 0041BFE8
#528.MSVBVM60(?,00000004), ref: 0041BFFC
__vbaStrVarMove.MSVBVM60(?), ref: 0041C009
__vbaStrMove.MSVBVM60 ref: 0041C017
#696.MSVBVM60(amoebae), ref: 0041C026
__vbaHresultCheckObj.MSVBVM60(00000000,00401218,00402AF0,000006F8), ref: 0041C04D
__vbaFreeStr.MSVBVM60 ref: 0041C059
__vbaFreeVarList.MSVBVM60(00000002,00000004,?), ref: 0041C06F
#587.MSVBVM60(60000000,4160A08A), ref: 0041C082
#564.MSVBVM60(00000004,?), ref: 0041C0BE
__vbaHresultCheck.MSVBVM60(00000000), ref: 0041C0C9
#685.MSVBVM60 ref: 0041C0CF
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041C0DD
__vbaHresultCheckObj.MSVBVM60(00000000,00000000,004030E0,0000001C), ref: 0041C101
__vbaI4Var.MSVBVM60(?,0000635F,?,?,Plaiderne), ref: 0041C13E
__vbaFreeObj.MSVBVM60 ref: 0041C152
__vbaFreeVarList.MSVBVM60(00000002,00000005,?), ref: 0041C168
__vbaHresultCheckObj.MSVBVM60(00000000,00401218,00402AF0,000006FC), ref: 0041C18A
__vbaStrCopy.MSVBVM60 ref: 0041C19B
__vbaHresultCheckObj.MSVBVM60(00000000,00401218,00402AF0,00000700), ref: 0041C1C6
__vbaFreeStr.MSVBVM60 ref: 0041C1D8
__vbaVarDup.MSVBVM60 ref: 0041C203
#607.MSVBVM60(?,0000004C,00000005), ref: 0041C219
#696.MSVBVM60(Necromancy7), ref: 0041C224
__vbaStrVarMove.MSVBVM60(?), ref: 0041C237
__vbaStrMove.MSVBVM60 ref: 0041C245
__vbaHresultCheckObj.MSVBVM60(00000000,00401218,00402AF0,00000704), ref: 0041C27A
__vbaFreeStr.MSVBVM60 ref: 0041C286
__vbaFreeVarList.MSVBVM60(00000002,00000005,?), ref: 0041C298
__vbaStrCopy.MSVBVM60 ref: 0041C2C0
__vbaR8IntI4.MSVBVM60(?,00000D7A,00000445,Foresettled6,000FAB14), ref: 0041C2ED
__vbaFreeStr.MSVBVM60 ref: 0041C301
#648.MSVBVM60(00000005), ref: 0041C31E
__vbaHresultCheckObj.MSVBVM60(00000000,00401218,00402AF0,00000708), ref: 0041C360
__vbaFreeVar.MSVBVM60 ref: 0041C36C
__vbaHresultCheckObj.MSVBVM60(00000000,00401218,00402AF0,0000070C), ref: 0041C392
__vbaFreeStr.MSVBVM60(0041C4B9), ref: 0041C443
__vbaAryDestruct.MSVBVM60(00000000,000FAB14), ref: 0041C45D
__vbaFreeObj.MSVBVM60 ref: 0041C462
__vbaFreeStr.MSVBVM60 ref: 0041C46B

Strings

Inddatafunktionens9, xrefs: 0041BC83
SKROFULOSES, xrefs: 0041BFD4
Unhazarded, xrefs: 0041C951
FileExists, xrefs: 0041B6D3
Tracheotomist3, xrefs: 0041C2A1
Chefsassistenten1, xrefs: 0041C7B3
Ekstrovert2, xrefs: 0041BC9D
Bronkiernes, xrefs: 0041B9C3
COMPENDENCY, xrefs: 0041C32D
Contracter, xrefs: 0041C670
Foresettled6, xrefs: 0041C2D5
nitiden, xrefs: 0041C774
Plaiderne, xrefs: 0041C10F
Dublers1, xrefs: 0041B694
Supralapsarianism, xrefs: 0041BB32
G, xrefs: 0041BB02
amoebae, xrefs: 0041C01B
9-9-9, xrefs: 0041C918
autostyly, xrefs: 0041BA91
6IE, xrefs: 0041B9FE
Scripting.FileSystemObject, xrefs: 0041B659
Uopfyldte, xrefs: 0041CAA6
Alvorlighedens, xrefs: 0041CAE0
SCOURING, xrefs: 0041BAFD
Udstykningskontrollerne, xrefs: 0041BEA0
Xanthophyllite, xrefs: 0041CB3B
I, xrefs: 0041C12A
outrace, xrefs: 0041CB40
CHLORINES, xrefs: 0041B8DB
Afbrydningerne, xrefs: 0041C976
_c, xrefs: 0041BF8F
BOLIGFORENINGERNES, xrefs: 0041B68F
Stuepiges, xrefs: 0041C190
BUGTERS, xrefs: 0041BFA5
antihemophilic, xrefs: 0041CA7F
Necromancy7, xrefs: 0041C21F

Memory Dump Source

Source File: 00000000.00000002.1200595956.000000000041B000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1200578902.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1200582715.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1200602176.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1200608171.0000000000421000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_draft_inv dec21.jbxd

Similarity

API ID: __vba$Free$Move$CheckHresult$List$Error$#696CopySystem$#685AnsiConstruct2New2$#518#521#522#528#546#560#564#573#581#587#607#611#613#614#619#628#648#651#692#697#702#712#714#716#717AddrefBoundsCallDestructGenerateLateUbound
String ID: 6IE$9-9-9$Afbrydningerne$Alvorlighedens$BOLIGFORENINGERNES$BUGTERS$Bronkiernes$CHLORINES$COMPENDENCY$Chefsassistenten1$Contracter$Dublers1$Ekstrovert2$FileExists$Foresettled6$G$Inddatafunktionens9$Necromancy7$Plaiderne$SCOURING$SKROFULOSES$Scripting.FileSystemObject$Stuepiges$Supralapsarianism$Tracheotomist3$Udstykningskontrollerne$Unhazarded$Uopfyldte$Xanthophyllite$_c$amoebae$antihemophilic$autostyly$nitiden$outrace$I
API String ID: 3093002383-3581254469
Opcode ID: 1a49e9c186b717d1112410183b643f0d4131f5e053ccb7ac6f9b77ae23b22e62
Instruction ID: fbc5245dd3baa99f63f311b358571568d74894abc98dca8b60964b0a1439cb1a
Opcode Fuzzy Hash: 1a49e9c186b717d1112410183b643f0d4131f5e053ccb7ac6f9b77ae23b22e62
Instruction Fuzzy Hash: 77D250719002199FDB14DFA4DD84BDEBBB8FF48700F1081AAE60AB7291DB745A85CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0041CE60, Relevance: 71.9, APIs: 33, Strings: 8, Instructions: 191
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#598.MSVBVM60 ref: 0041CEAF
__vbaStrCopy.MSVBVM60 ref: 0041CEBD
#523.MSVBVM60(?), ref: 0041CEC7
__vbaStrMove.MSVBVM60 ref: 0041CED8
__vbaStrCmp.MSVBVM60(informeret,00000000), ref: 0041CEE0
__vbaFreeStr.MSVBVM60 ref: 0041CEF3
#525.MSVBVM60(000000BB), ref: 0041CF07
__vbaStrMove.MSVBVM60 ref: 0041CF12
__vbaStrMove.MSVBVM60(000000B4,?), ref: 0041CF34
#628.MSVBVM60(00000000), ref: 0041CF37
__vbaStrMove.MSVBVM60 ref: 0041CF42
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041CF4E
__vbaFreeVar.MSVBVM60 ref: 0041CF5A
#514.MSVBVM60(WATERISHLY,00000080), ref: 0041CF6A
__vbaStrMove.MSVBVM60 ref: 0041CF75
#712.MSVBVM60(?,Amboinas,knallertbanes,00000001,000000FF,00000000), ref: 0041CF8A
__vbaStrMove.MSVBVM60 ref: 0041CF95
#716.MSVBVM60(?,Scripting.FileSystemObject,00000000), ref: 0041CFA1
__vbaObjVar.MSVBVM60(?), ref: 0041CFAB
__vbaObjSetAddref.MSVBVM60(?,00000000), ref: 0041CFB6
__vbaFreeVar.MSVBVM60 ref: 0041CFBF
#521.MSVBVM60(Glosse5), ref: 0041CFCA
__vbaLateMemCallLd.MSVBVM60(?,?,FolderExists,00000001), ref: 0041D00E
__vbaVarTstLt.MSVBVM60(00008002,00000000), ref: 0041D01C
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041D02F
__vbaNew2.MSVBVM60(0040304C,0041F49C), ref: 0041D04F
__vbaHresultCheckObj.MSVBVM60(00000000,02B0EA74,0040303C,0000004C), ref: 0041D074
__vbaHresultCheckObj.MSVBVM60(00000000,?,004034C8,00000028), ref: 0041D094
__vbaFreeObj.MSVBVM60 ref: 0041D09D
__vbaFreeStr.MSVBVM60(0041D102), ref: 0041D0EC
__vbaFreeObj.MSVBVM60 ref: 0041D0F1
__vbaFreeStr.MSVBVM60 ref: 0041D0FA
__vbaFreeStr.MSVBVM60 ref: 0041D0FF

Strings

Kumulatives4, xrefs: 0041CEB5
Scripting.FileSystemObject, xrefs: 0041CF98
Glosse5, xrefs: 0041CFC5
informeret, xrefs: 0041CEDB
WATERISHLY, xrefs: 0041CF65
Amboinas, xrefs: 0041CF84
knallertbanes, xrefs: 0041CF7F
FolderExists, xrefs: 0041CFF3

Memory Dump Source

Source File: 00000000.00000002.1200595956.000000000041B000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1200578902.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1200582715.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1200602176.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1200608171.0000000000421000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_draft_inv dec21.jbxd

Similarity

API ID: __vba$Free$Move$CheckHresultList$#514#521#523#525#598#628#712#716AddrefCallCopyLateNew2
String ID: Amboinas$FolderExists$Glosse5$Kumulatives4$Scripting.FileSystemObject$WATERISHLY$informeret$knallertbanes
API String ID: 1506482490-314412841
Opcode ID: 156f07288ea05aedafc705d63f8adf25faece7a357f3c43ed58453b45a7a58d9
Instruction ID: 76b354d46ffea17d5b45e4fca0132372d857c35e1c00ea78c16e15ab4c22b2d8
Opcode Fuzzy Hash: 156f07288ea05aedafc705d63f8adf25faece7a357f3c43ed58453b45a7a58d9
Instruction Fuzzy Hash: 03711EB1D00219DBCB14DFA4DD89AEEBFB8FB48705F10812AE506B72A0DB745949CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00401668, Relevance: 1.8, APIs: 1, Instructions: 289
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#100.MSVBVM60(00402250), ref: 0040166D

Memory Dump Source

Source File: 00000000.00000002.1200582715.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1200578902.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1200595956.000000000041B000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1200602176.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1200608171.0000000000421000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_draft_inv dec21.jbxd

Similarity

API ID: #100
String ID:
API String ID: 1341478452-0
Opcode ID: 1438cf99327dbf82d35e965487db4d2664d7c7ce478205cd07bfc82945c57731
Instruction ID: 8bb3f9d3f775942b6a279bc0870e27c90db382770e8ec0ccf3a55d9497d606dc
Opcode Fuzzy Hash: 1438cf99327dbf82d35e965487db4d2664d7c7ce478205cd07bfc82945c57731
Instruction Fuzzy Hash: 3451436154E7C28FC7038B7488695517FB0AE5721971E84EBC4C1DF4B3E22D4D4ACB66

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02CB02FD, Relevance: 5.1, Strings: 4, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

`, xrefs: 02CB050A
Th7S, xrefs: 02CB051C
j+, xrefs: 02CB0447
SY, xrefs: 02CB0385

Memory Dump Source

Source File: 00000000.00000002.1200998777.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ca0000_draft_inv dec21.jbxd

Yara matches

Similarity

API ID:
String ID: SY$Th7S$`$j+
API String ID: 0-3335159331
Opcode ID: c7c62078b61bede459ccefb27ac95c5c450e6bf47d782856ac862f9a3402fbec
Instruction ID: 245d59165ff9e1f76f06cb9ed63441855332438a63fdbeed5440a735930efb6a
Opcode Fuzzy Hash: c7c62078b61bede459ccefb27ac95c5c450e6bf47d782856ac862f9a3402fbec
Instruction Fuzzy Hash: 3E412B352402499BDF399D7949A93EE33E39FD2790FA5C12ACC8E47114D73146CB8B02

Uniqueness

Uniqueness Score: -1.00%

Function 02CAC50C, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200998777.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ca0000_draft_inv dec21.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a211b370e98cb772c5a49a62cbda055a250cbb424e4cb5c35790c5bd25df58d
Instruction ID: 38ba8ba74331b0b652907b5411b75e1e4168eeba32cb12f1a7b8c9924719c525
Opcode Fuzzy Hash: 5a211b370e98cb772c5a49a62cbda055a250cbb424e4cb5c35790c5bd25df58d
Instruction Fuzzy Hash: 5CF0E5367C1A840BEB1AC98DC5E17A5B3D79FC3990FA8C07AE88B8B710C319D84A9511

Uniqueness

Uniqueness Score: -1.00%

Function 02CB08D3, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200998777.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ca0000_draft_inv dec21.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction ID: f1647c15dfe5582e2114d8b48c9dc7a79c4e1b76aa7bcc19d5d00c5bce2ac4c7
Opcode Fuzzy Hash: 9553b201f40634b3f0bfaa8b0557a5c34869809b08848db32634946b51e74d60
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 02CAF610, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1200998777.0000000002CA0000.00000040.00000001.sdmp, Offset: 02CA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2ca0000_draft_inv dec21.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d21eab13cd2da2d02b2e39463d7b3fcd95d25abd7d3303d35b9ec91630853a3
Instruction ID: a0436c612ce283ec56586c1532f7be0902ea2fefc38448e51bd4db534f4431c9
Opcode Fuzzy Hash: 5d21eab13cd2da2d02b2e39463d7b3fcd95d25abd7d3303d35b9ec91630853a3
Instruction Fuzzy Hash: 2FB09239215645CFCA66CA09C0A0F40B3B0F704600FC14480E4028BE21C239E900C900

Uniqueness

Uniqueness Score: -1.00%

Function 0041D120, Relevance: 149.2, APIs: 76, Strings: 9, Instructions: 455
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaAryConstruct2.MSVBVM60(?,00403588,00000011), ref: 0041D1A4
#652.MSVBVM60(?,?), ref: 0041D1C0
__vbaVarTstNe.MSVBVM60(?,?), ref: 0041D1EB
__vbaFreeVarList.MSVBVM60(00000002,00000002,?), ref: 0041D1F9
#523.MSVBVM60(Vibrator), ref: 0041D20C
__vbaStrMove.MSVBVM60 ref: 0041D21D
#717.MSVBVM60(00000002,?,00000040,00000000), ref: 0041D240
__vbaStrVarMove.MSVBVM60(00000002), ref: 0041D24A
__vbaStrMove.MSVBVM60 ref: 0041D255
__vbaFreeVar.MSVBVM60 ref: 0041D25A
__vbaFPInt.MSVBVM60 ref: 0041D274
#660.MSVBVM60(?,00000002,0000000A,00000001,00000001), ref: 0041D297
__vbaVarTstNe.MSVBVM60(?,?), ref: 0041D2BF
__vbaFreeVarList.MSVBVM60(00000003,00000004,0000000A,?), ref: 0041D2D4
__vbaUbound.MSVBVM60(00000001,?), ref: 0041D2EC
__vbaGenerateBoundsError.MSVBVM60 ref: 0041D30F
__vbaUI1I4.MSVBVM60 ref: 0041D32C
#702.MSVBVM60(00000004,000000FF,000000FE,000000FE,000000FE), ref: 0041D360
__vbaStrMove.MSVBVM60 ref: 0041D371
__vbaFreeVar.MSVBVM60 ref: 0041D376
#628.MSVBVM60(Rebaptize,000000A7,00000004), ref: 0041D3A0
__vbaStrMove.MSVBVM60 ref: 0041D3AB
__vbaStrCmp.MSVBVM60(Skilderiernes,00000000), ref: 0041D3B3
__vbaFreeStr.MSVBVM60 ref: 0041D3C5
__vbaFreeVar.MSVBVM60 ref: 0041D3CE
__vbaStrCat.MSVBVM60(nothingness,?), ref: 0041D3E2
__vbaStrMove.MSVBVM60 ref: 0041D3ED
#593.MSVBVM60(00000002), ref: 0041D401
__vbaFreeVar.MSVBVM60 ref: 0041D40C
__vbaAryDestruct.MSVBVM60(00000000,?,0041D489), ref: 0041D465
__vbaFreeStr.MSVBVM60 ref: 0041D470
__vbaFreeStr.MSVBVM60 ref: 0041D475
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041D47C
__vbaFreeStr.MSVBVM60 ref: 0041D481
__vbaFreeStr.MSVBVM60 ref: 0041D486

Strings

forskellige, xrefs: 0041D1D7
UAb, xrefs: 0041D412
nothingness, xrefs: 0041D3DD
Tetum, xrefs: 0041D72C
Rebaptize, xrefs: 0041D38D
Skilderiernes, xrefs: 0041D3AE
|, xrefs: 0041D392
efteraarsdagens, xrefs: 0041D2AB
Vibrator, xrefs: 0041D207

Memory Dump Source

Source File: 00000000.00000002.1200595956.000000000041B000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1200578902.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1200582715.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1200602176.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1200608171.0000000000421000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_draft_inv dec21.jbxd

Similarity

API ID: __vba$Free$Move$DestructList$#523#593#628#652#660#702#717BoundsConstruct2ErrorGenerateUbound
String ID: Rebaptize$Skilderiernes$Tetum$UAb$Vibrator$efteraarsdagens$forskellige$nothingness$|
API String ID: 2449467680-1858127604
Opcode ID: 553de0c6dae1b927fd49fb16e6e17a2d976455ff5639dd5bb85a8676dd8bc52a
Instruction ID: 75c9f5884d4450d9cbc45e44677762e7fe80e7c1f1364c2f314bb7438bb20e1c
Opcode Fuzzy Hash: 553de0c6dae1b927fd49fb16e6e17a2d976455ff5639dd5bb85a8676dd8bc52a
Instruction Fuzzy Hash: A702AEB0D00249DFCB04DFA4DD84ADDFBB9EF48300F10816AE516A72A1DB785A49CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041D7C0, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 203
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(?,00401386), ref: 0041D7DE
#564.MSVBVM60(00000004,?), ref: 0041D873
__vbaHresultCheck.MSVBVM60(00000000), ref: 0041D88F
__vbaVarTstGe.MSVBVM60(00008003,?), ref: 0041D8C6
__vbaFreeVarList.MSVBVM60(00000002,00000004,?), ref: 0041D8DD
__vbaRedim.MSVBVM60(00000080,00000001,00000011,00000011,00000001,0000004E,00000000,?,?,00401386), ref: 0041D90F
__vbaLbound.MSVBVM60(00000001,?), ref: 0041D925
__vbaNew2.MSVBVM60(0040304C,0041F49C), ref: 0041D948
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040303C,00000014), ref: 0041D9AE
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040305C,000000F0), ref: 0041DA11
__vbaStrMove.MSVBVM60 ref: 0041DA42
__vbaFreeObj.MSVBVM60 ref: 0041DA4B
__vbaOnError.MSVBVM60(000000FF,?,?,00401386), ref: 0041DA74
__vbaVarDup.MSVBVM60 ref: 0041DA9B
#717.MSVBVM60(?,?,00000080,00000000), ref: 0041DAB0
__vbaVar2Vec.MSVBVM60(?,?), ref: 0041DABE
__vbaAryMove.MSVBVM60(?,?), ref: 0041DACC
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041DADC
__vbaAryDestruct.MSVBVM60(00000000,?,0041DB5F), ref: 0041DB43
__vbaAryDestruct.MSVBVM60(00000000,?), ref: 0041DB4F
__vbaFreeStr.MSVBVM60 ref: 0041DB58

Strings

Perispheric, xrefs: 0041DA81

Memory Dump Source

Source File: 00000000.00000002.1200595956.000000000041B000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1200578902.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1200582715.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1200602176.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1200608171.0000000000421000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_draft_inv dec21.jbxd

Similarity

API ID: __vba$Free$CheckHresult$DestructListMove$#564#717ChkstkErrorLboundNew2RedimVar2
String ID: Perispheric
API String ID: 1515481650-1911509959
Opcode ID: dfee14f9c2cac8bd4cac5253a19e770d55700ce9858bcd40cc4eff58ff904c86
Instruction ID: a5b5d2a99b2d2e620e879364083d152e0ecfc9f28be2dd0bf9e39a4b37078852
Opcode Fuzzy Hash: dfee14f9c2cac8bd4cac5253a19e770d55700ce9858bcd40cc4eff58ff904c86
Instruction Fuzzy Hash: 33A1F8B1900218EFEB14DF90CD49BDEBBB4BF48704F108199E6497B290D7B45A89CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00405445, Relevance: 37.6, APIs: 25, Instructions: 128
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60(00000000,?,00000001), ref: 0041D4F7
__vbaAryConstruct2.MSVBVM60(?,004035A4,00000011), ref: 0041D508
__vbaUI1I2.MSVBVM60 ref: 0041D52B
__vbaUI1I2.MSVBVM60 ref: 0041D537
__vbaUI1I2.MSVBVM60 ref: 0041D544
__vbaUI1I2.MSVBVM60 ref: 0041D551
__vbaUI1I2.MSVBVM60 ref: 0041D55E
__vbaUI1I2.MSVBVM60 ref: 0041D56B
__vbaUI1I2.MSVBVM60 ref: 0041D578
__vbaUI1I2.MSVBVM60 ref: 0041D585
__vbaUI1I2.MSVBVM60 ref: 0041D592
__vbaUI1I2.MSVBVM60 ref: 0041D59F
__vbaUI1I2.MSVBVM60 ref: 0041D5AC
__vbaUI1I2.MSVBVM60 ref: 0041D5B9
__vbaUI1I2.MSVBVM60 ref: 0041D5C6
__vbaUI1I2.MSVBVM60 ref: 0041D5D3
__vbaUI1I2.MSVBVM60 ref: 0041D5E0
__vbaUI1I2.MSVBVM60 ref: 0041D5ED
__vbaUI1I2.MSVBVM60 ref: 0041D5FA
__vbaUI1I2.MSVBVM60 ref: 0041D607
__vbaUI1I2.MSVBVM60 ref: 0041D614
__vbaUI1I2.MSVBVM60 ref: 0041D621
__vbaUI1I2.MSVBVM60 ref: 0041D62E
__vbaUI1I2.MSVBVM60 ref: 0041D63B
__vbaUI1I2.MSVBVM60 ref: 0041D648
__vbaAryDestruct.MSVBVM60(00000000,?,0041D67E), ref: 0041D66E
__vbaFreeStr.MSVBVM60 ref: 0041D677
__vbaErrorOverflow.MSVBVM60 ref: 0041D693
__vbaStrCopy.MSVBVM60 ref: 0041D6E9
#703.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 0041D710
__vbaStrMove.MSVBVM60 ref: 0041D71B
__vbaFreeVar.MSVBVM60 ref: 0041D72A
#693.MSVBVM60(Tetum), ref: 0041D731
#546.MSVBVM60(00000006), ref: 0041D73F
__vbaVarMove.MSVBVM60 ref: 0041D74B
#594.MSVBVM60(00000006), ref: 0041D763
__vbaFreeVar.MSVBVM60 ref: 0041D76C
__vbaFreeStr.MSVBVM60(0041D799), ref: 0041D788
__vbaFreeVar.MSVBVM60 ref: 0041D78D
__vbaFreeStr.MSVBVM60 ref: 0041D796

Memory Dump Source

Source File: 00000000.00000002.1200582715.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1200578902.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1200595956.000000000041B000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1200602176.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1200608171.0000000000421000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_draft_inv dec21.jbxd

Similarity

API ID: __vba$Free$CopyMove$#546#594#693#703Construct2DestructErrorOverflow
String ID:
API String ID: 1821956300-0
Opcode ID: 276f5d8b087a1817ee8a0c37f1c71dc3b6d8d859fe0a9670f2ef45c3bc641476
Instruction ID: 744bf56689329ecfb7d9c3738c395e2af4faec626c193e459a012e1305416721
Opcode Fuzzy Hash: 276f5d8b087a1817ee8a0c37f1c71dc3b6d8d859fe0a9670f2ef45c3bc641476
Instruction Fuzzy Hash: F3518E74E051898FD708CBA8C4506AEFFB6AF99300F18C1AF895557382C97D9946CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0041DB90, Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#647.MSVBVM60(?,?), ref: 0041DBE7
#669.MSVBVM60 ref: 0041DBED
__vbaVarTstEq.MSVBVM60(?,?), ref: 0041DC05
__vbaFreeVarList.MSVBVM60(00000003,?,?,00008008), ref: 0041DC1B
__vbaLenBstr.MSVBVM60(Prepoison), ref: 0041DC32
__vbaStrI4.MSVBVM60(00000000), ref: 0041DC39
__vbaStrMove.MSVBVM60 ref: 0041DC4A
#648.MSVBVM60(?,?), ref: 0041DC5E
#697.MSVBVM60(00000000), ref: 0041DC68
__vbaStrMove.MSVBVM60 ref: 0041DC73
__vbaStrCat.MSVBVM60(00000000), ref: 0041DC7C
__vbaStrMove.MSVBVM60 ref: 0041DC83
__vbaStrCat.MSVBVM60(Magreste5,00000000), ref: 0041DC8B
__vbaStrMove.MSVBVM60 ref: 0041DC92
__vbaFreeStrList.MSVBVM60(00000002,?,?), ref: 0041DC9E
__vbaFreeVar.MSVBVM60 ref: 0041DCAA
__vbaFreeStr.MSVBVM60(0041DCF4), ref: 0041DCEC
__vbaFreeStr.MSVBVM60 ref: 0041DCF1

Strings

Magreste5, xrefs: 0041DC86
Prepoison, xrefs: 0041DC2D

Memory Dump Source

Source File: 00000000.00000002.1200595956.000000000041B000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1200578902.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1200582715.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1200602176.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1200608171.0000000000421000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_draft_inv dec21.jbxd

Similarity

API ID: __vba$Free$Move$List$#647#648#669#697Bstr
String ID: Magreste5$Prepoison
API String ID: 947445861-2627493581
Opcode ID: 830d6ff1bac82f8f894ffa2886372c4969ca9bda8cbacce08f78a2c83168ea0e
Instruction ID: dabd4e16dc9dad85780c7a1f4318e0d4eb483da765cefd3ccf976883ed15c337
Opcode Fuzzy Hash: 830d6ff1bac82f8f894ffa2886372c4969ca9bda8cbacce08f78a2c83168ea0e
Instruction Fuzzy Hash: C8310BB1C10229DBCB04DFE4DD859EEBBB8FB48701F10412AE502B7660DBB45945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041CD00, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaChkstk.MSVBVM60(?,00401386), ref: 0041CD1E
#563.MSVBVM60(00000003), ref: 0041CD6A
__vbaFreeVar.MSVBVM60 ref: 0041CD83
__vbaVarDup.MSVBVM60 ref: 0041CDAC
#666.MSVBVM60(?,00000003), ref: 0041CDBA
__vbaStrVarVal.MSVBVM60(?,?,000000F0), ref: 0041CDCD
#514.MSVBVM60(00000000), ref: 0041CDD4
__vbaStrMove.MSVBVM60 ref: 0041CDDF
__vbaFreeStr.MSVBVM60 ref: 0041CDE8
__vbaFreeVarList.MSVBVM60(00000002,00000003,?), ref: 0041CDF8
__vbaOnError.MSVBVM60(000000FF,?,?,00401386), ref: 0041CE0A
__vbaFreeStr.MSVBVM60(0041CE3E), ref: 0041CE37

Strings

windir, xrefs: 0041CD98

Memory Dump Source

Source File: 00000000.00000002.1200595956.000000000041B000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1200578902.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1200582715.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1200602176.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1200608171.0000000000421000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_draft_inv dec21.jbxd

Similarity

API ID: __vba$Free$#514#563#666ChkstkErrorListMove
String ID: windir
API String ID: 33530242-2916395732
Opcode ID: 91d8efd7c70174f85feff9719a20ffbfc6033871ccea7cfd83422a6a9558f87d
Instruction ID: e6aa579f0c8a9049a8ca56547832f1436beca04575eff99866e7828044be11d6
Opcode Fuzzy Hash: 91d8efd7c70174f85feff9719a20ffbfc6033871ccea7cfd83422a6a9558f87d
Instruction Fuzzy Hash: B931EE75800248EBDB04DFD4DA89BDEBBB8FF48705F108129F502BB6A4DB745689CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00405452, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaStrCopy.MSVBVM60 ref: 0041D6E9
#703.MSVBVM60(?,000000FF,000000FE,000000FE,000000FE), ref: 0041D710
__vbaStrMove.MSVBVM60 ref: 0041D71B
__vbaFreeVar.MSVBVM60 ref: 0041D72A
#693.MSVBVM60(Tetum), ref: 0041D731
#546.MSVBVM60(00000006), ref: 0041D73F
__vbaVarMove.MSVBVM60 ref: 0041D74B
#594.MSVBVM60(00000006), ref: 0041D763
__vbaFreeVar.MSVBVM60 ref: 0041D76C
__vbaFreeStr.MSVBVM60(0041D799), ref: 0041D788
__vbaFreeVar.MSVBVM60 ref: 0041D78D
__vbaFreeStr.MSVBVM60 ref: 0041D796

Strings

Tetum, xrefs: 0041D72C

Memory Dump Source

Source File: 00000000.00000002.1200582715.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1200578902.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1200595956.000000000041B000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1200602176.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1200608171.0000000000421000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_draft_inv dec21.jbxd

Similarity

API ID: __vba$Free$Move$#546#594#693#703Copy
String ID: Tetum
API String ID: 3424027556-905628157
Opcode ID: 1c594da98886357eb65e8d38022c995777a8108b6059d57a3536aa68669309b3
Instruction ID: debbb4de43000b17f5aa814ab7f2311e5f9ab03fc2c902e23266e0f0673469f8
Opcode Fuzzy Hash: 1c594da98886357eb65e8d38022c995777a8108b6059d57a3536aa68669309b3
Instruction Fuzzy Hash: 0B31EBB5C00219EBCB04DF94EA88ADDBB75EF48714F10822AF426B32A0DB745945CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC20, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#611.MSVBVM60 ref: 0041CC60
__vbaStrMove.MSVBVM60 ref: 0041CC6B
#693.MSVBVM60(Tsadis6), ref: 0041CC76
#546.MSVBVM60(?), ref: 0041CC84
__vbaVarMove.MSVBVM60 ref: 0041CC90
#594.MSVBVM60(?), ref: 0041CCA8
__vbaFreeVar.MSVBVM60 ref: 0041CCB1
__vbaFreeVar.MSVBVM60(0041CCDB), ref: 0041CCCB
__vbaFreeStr.MSVBVM60 ref: 0041CCD4

Strings

Tsadis6, xrefs: 0041CC71

Memory Dump Source

Source File: 00000000.00000002.1200595956.000000000041B000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1200578902.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1200582715.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1200602176.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1200608171.0000000000421000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_draft_inv dec21.jbxd

Similarity

API ID: __vba$Free$Move$#546#594#611#693
String ID: Tsadis6
API String ID: 1219437212-1542986783
Opcode ID: e71565b220ca46919251fe527851be883c96b943f21f06ab68ebff1459f4ce61
Instruction ID: c94e181d5cbc1ccd1ca6a22f06e6dd056c9ae47efbf32daaefd713240a2a09f9
Opcode Fuzzy Hash: e71565b220ca46919251fe527851be883c96b943f21f06ab68ebff1459f4ce61
Instruction Fuzzy Hash: FA112E71840249EFCB04DF94DA89ADDBFB8FB08705F10402AF505B6660DB745A86CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD10, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__vbaFreeVarList.MSVBVM60(00000003), ref: 0041DD99
__vbaNew2.MSVBVM60(0040304C,0041F49C), ref: 0041DDB5
__vbaHresultCheckObj.MSVBVM60(00000000,02B0EA74,0040303C,00000014), ref: 0041DDDA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040305C,0000013C), ref: 0041DE28
__vbaFreeObj.MSVBVM60 ref: 0041DE31

Strings

srlove, xrefs: 0041DE05

Memory Dump Source

Source File: 00000000.00000002.1200595956.000000000041B000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1200578902.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1200582715.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.1200602176.000000000041F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1200608171.0000000000421000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_draft_inv dec21.jbxd

Similarity

API ID: __vba$CheckFreeHresult$ListNew2
String ID: srlove
API String ID: 701738313-3382764130
Opcode ID: c1964454de72d40e1c5f6dd5405c93e0a22430dd1d8a3514be6bcd10a52c6aa0
Instruction ID: cac346f4a2d1903f84c4b3ca624b1a769fd7b818d32e5bf81f080fdd43c713b3
Opcode Fuzzy Hash: c1964454de72d40e1c5f6dd5405c93e0a22430dd1d8a3514be6bcd10a52c6aa0
Instruction Fuzzy Hash: 4A3191B1D01308AFDB14DFA4D985ADEBBB8EF58700F10802AE505F7255D2385909CB98

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report draft_inv dec21.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: draft_inv dec21.exe PID: 6976 Parent PID: 1556

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: draft_inv dec21.exe PID: 6976 Parent PID: 1556 draft_inv dec21.exeCOMMON

Execution Graph

Function 0041B4B0, Relevance: 503.8, APIs: 251, Strings: 36, Instructions: 1528
COMMON

Function 0041CE60, Relevance: 71.9, APIs: 33, Strings: 8, Instructions: 191
COMMON

Function 00401668, Relevance: 1.8, APIs: 1, Instructions: 289
COMMON

Function 02CB02FD, Relevance: 5.1, Strings: 4, Instructions: 139
COMMON

Function 0041D120, Relevance: 149.2, APIs: 76, Strings: 9, Instructions: 455
COMMON

Function 0041D7C0, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 203
COMMON

Function 00405445, Relevance: 37.6, APIs: 25, Instructions: 128
COMMON

Function 0041DB90, Relevance: 35.1, APIs: 18, Strings: 2, Instructions: 99
COMMON

Function 0041CD00, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 77
COMMON

Function 00405452, Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 71
COMMON

Function 0041CC20, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 50
COMMON

Function 0041DD10, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100
COMMON