Play interactive tour

Edit tour

Windows Analysis Report PKO_TRANS_DETAILS_20211216_0809521.exe

Overview

General Information

Sample Name:	PKO_TRANS_DETAILS_20211216_0809521.exe
Analysis ID:	540990
MD5:	1823b507e96d8138bada7c65d424abcc
SHA1:	e5d7884da7d17ba0ae592ff787e84ae665e21c3a
SHA256:	99b81b452d173986229ed512383e05214f35c819aa9da4c2a972bb05c880d536
Tags:	exe
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	72
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected GuLoader

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Uses 32bit PE files

Sample file is different than original file name gathered from version info

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Contains functionality to call native functions

Program does not show much activity (idle)

Contains functionality for execution timing, often used to detect debuggers

Abnormal high CPU Usage

Classification

Process Tree

System is w10x64

PKO_TRANS_DETAILS_20211216_0809521.exe (PID: 6972 cmdline: "C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe" MD5: 1823B507E96D8138BADA7C65D424ABCC)

cleanup

Malware Configuration

Threatname: GuLoader

{"Payload URL": "https://drive.google.com/uc?export=download&id=1byST7nT"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp	JoeSecurity_GuLoader_2	Yara detected GuLoader	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp

Malware Configuration Extractor: GuLoader {"Payload URL": "https://drive.google.com/uc?export=download&id=1byST7nT"}

Multi AV Scanner detection for submitted file

Show sources

Source: PKO_TRANS_DETAILS_20211216_0809521.exe

Virustotal: Detection: 20%

Perma Link

Source: PKO_TRANS_DETAILS_20211216_0809521.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://drive.google.com/uc?export=download&id=1byST7nT

Source: PKO_TRANS_DETAILS_20211216_0809521.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDagins.exe vs PKO_TRANS_DETAILS_20211216_0809521.exe
Source: PKO_TRANS_DETAILS_20211216_0809521.exe	Binary or memory string: OriginalFilenameDagins.exe vs PKO_TRANS_DETAILS_20211216_0809521.exe

Source: PKO_TRANS_DETAILS_20211216_0809521.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_00401E86	0_2_00401E86
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C884B3	0_2_04C884B3
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8D3CE	0_2_04C8D3CE
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C880CC	0_2_04C880CC
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88CCE	0_2_04C88CCE
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C860C1	0_2_04C860C1
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C804D3	0_2_04C804D3
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C868E8	0_2_04C868E8
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86CE3	0_2_04C86CE3
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C804E6	0_2_04C804E6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C890E6	0_2_04C890E6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C884F4	0_2_04C884F4
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C894A0	0_2_04C894A0
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C884B6	0_2_04C884B6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86C56	0_2_04C86C56
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86069	0_2_04C86069
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86878	0_2_04C86878
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8587D	0_2_04C8587D
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8647E	0_2_04C8647E
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88C06	0_2_04C88C06
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86014	0_2_04C86014
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C865D8	0_2_04C865D8
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C805DA	0_2_04C805DA
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C865DE	0_2_04C865DE
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C869D6	0_2_04C869D6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C865E9	0_2_04C865E9
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86580	0_2_04C86580
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C80584	0_2_04C80584
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86985	0_2_04C86985
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86D95	0_2_04C86D95
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C869A0	0_2_04C869A0
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C861BE	0_2_04C861BE
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C89154	0_2_04C89154
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86501	0_2_04C86501
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8051E	0_2_04C8051E
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88D15	0_2_04C88D15
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86928	0_2_04C86928
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8613F	0_2_04C8613F
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C862E2	0_2_04C862E2
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C866F5	0_2_04C866F5
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88AF5	0_2_04C88AF5
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88A8F	0_2_04C88A8F
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8C285	0_2_04C8C285
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88297	0_2_04C88297
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C85EB9	0_2_04C85EB9
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86249	0_2_04C86249
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C85A55	0_2_04C85A55
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86661	0_2_04C86661
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86A65	0_2_04C86A65
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86E28	0_2_04C86E28
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C85E2C	0_2_04C85E2C
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C85A31	0_2_04C85A31
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C863F6	0_2_04C863F6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86B84	0_2_04C86B84
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C85FA4	0_2_04C85FA4
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88BBA	0_2_04C88BBA
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86BB1	0_2_04C86BB1
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8674D	0_2_04C8674D
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C85F46	0_2_04C85F46
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8637E	0_2_04C8637E
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C86B09	0_2_04C86B09

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C884B3 NtAllocateVirtualMemory,	0_2_04C884B3
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C880CC NtAllocateVirtualMemory,	0_2_04C880CC
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C884F4 NtAllocateVirtualMemory,	0_2_04C884F4
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C884B6 NtAllocateVirtualMemory,	0_2_04C884B6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C885B2 NtAllocateVirtualMemory,	0_2_04C885B2
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8855C NtAllocateVirtualMemory,	0_2_04C8855C
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C886AA NtAllocateVirtualMemory,	0_2_04C886AA
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C88631 NtAllocateVirtualMemory,	0_2_04C88631

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Process Stats: CPU usage > 98%

Source: PKO_TRANS_DETAILS_20211216_0809521.exe

Virustotal: Detection: 20%

Source: PKO_TRANS_DETAILS_20211216_0809521.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

File created: C:\Users\user\AppData\Local\Temp\~DF4AE55F204BB0FB8A.TMP

Jump to behavior

Source: classification engine

Classification label: mal72.troj.evad.winEXE@1/1@0/0

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_00406A78 push ebp; ret	0_2_00406A79
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_004081F5 push eax; ret	0_2_004081F6
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C89595 push es; ret	0_2_04C89597
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8B11A push FFFFFFB9h; retf	0_2_04C8B126
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8293C push ebp; iretd	0_2_04C8293D
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C83EA4 push ebx; ret	0_2_04C83EA7

Source: initial sample

Static PE information: section name: .text entropy: 6.98717798783

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Code function: 0_2_04C87CFD rdtsc

0_2_04C87CFD

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8A906 mov eax, dword ptr fs:[00000030h]	0_2_04C8A906
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C87AD4 mov eax, dword ptr fs:[00000030h]	0_2_04C87AD4
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8C285 mov eax, dword ptr fs:[00000030h]	0_2_04C8C285
Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe	Code function: 0_2_04C8B397 mov eax, dword ptr fs:[00000030h]	0_2_04C8B397

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Code function: 0_2_04C87CFD rdtsc

0_2_04C87CFD

Source: C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe

Code function: 0_2_04C8D3CE RtlAddVectoredExceptionHandler,

0_2_04C8D3CE

Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803824263.0000000000C50000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803824263.0000000000C50000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803824263.0000000000C50000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: PKO_TRANS_DETAILS_20211216_0809521.exe, 00000000.00000002.803824263.0000000000C50000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Virtualization/Sandbox Evasion11	OS Credential Dumping	Security Software Discovery11	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Software Packing1	LSASS Memory	Virtualization/Sandbox Evasion11	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	System Information Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
PKO_TRANS_DETAILS_20211216_0809521.exe	21%	Virustotal		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	540990
Start date:	16.12.2021
Start time:	13:10:15
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	PKO_TRANS_DETAILS_20211216_0809521.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal72.troj.evad.winEXE@1/1@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 26.3% (good quality ratio 16%) Quality average: 36.8% Quality standard deviation: 37%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\~DF4AE55F204BB0FB8A.TMP Download File
Process:	C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	2.45010052865662
Encrypted:	false
SSDEEP:	96:jaGu8uY05xb30uxH+iMa9eHC2K4veMC47+crGNa:jtjReMC49rAa
MD5:	9635DCB06D1E14BE1BB3D7D4B4CEA9F0
SHA1:	CCE17243F4FDB2A218D4185E75715E67AE7E219C
SHA-256:	D40FDC94A7E2F1C30434803A370E8881BF493D506000C27178A79CF02ECAB2D6
SHA-512:	D75D3149FFE0F772CE6E99E239E72EADCCB1F2CE55F05ABBF1C687A3991C0DAD6905DA85D0F1CDD8C5FCC91F533E1C0799F04BB2EAC9CD91CB61C480EAA947F3
Malicious:	false
Reputation:	low
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.690014470947888
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	PKO_TRANS_DETAILS_20211216_0809521.exe
File size:	147456
MD5:	1823b507e96d8138bada7c65d424abcc
SHA1:	e5d7884da7d17ba0ae592ff787e84ae665e21c3a
SHA256:	99b81b452d173986229ed512383e05214f35c819aa9da4c2a972bb05c880d536
SHA512:	66c962308ad08bf950dfd738de5585e79aa91a28379fe59ccfd78a578a7e629ff123b63d8509d3f0366089f3cca65e932bee3dee5d8a1744e1f3d8eca340d852
SSDEEP:	3072:U4PvIBPPFoSfth9WGq8Av35lbUTv9/alVVPx:U4PAsGU5+BaxPx
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W.x.....................\.......%.......Rich............................PE..L......U.....................`......$.............@

File Icon


Icon Hash:	bc546d7f6f130982

Static PE Info

General
Entrypoint:	0x401524
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x55BBDCC8 [Fri Jul 31 20:38:32 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7d340e80350d9e6231e6392a24967d10

Entrypoint Preview

Instruction
push 00402DA4h
call 00007F2359376703h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
cmp byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov dword ptr [edi+24160C99h], eax
inc edx
inc edx
mov esp, ACC85C27h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x204f4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25000	0x1956	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x238	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1b0	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x1faf0	0x20000	False	0.557975769043	data	6.98717798783	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x21000	0x36b4	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x25000	0x1956	0x2000	False	0.317504882812	data	4.27344211058	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x258ae	0x10a8	data
RT_ICON	0x25446	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x25424	0x22	data
RT_VERSION	0x25120	0x304	data	English	United States

Imports

DLL

Import

MSVBVM60.DLL

__vbaR8FixI4, _CIcos, _adj_fptan, __vbaVarMove, __vbaStrI4, __vbaHresultCheck, __vbaFreeVar, __vbaAryMove, __vbaLenBstr, __vbaStrVarMove, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaStrCat, __vbaLenBstrB, __vbaHresultCheckObj, __vbaLenVar, _adj_fdiv_m32, __vbaAryDestruct, __vbaOnError, __vbaObjSet, _adj_fdiv_m16i, _adj_fdivr_m16i, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaStrCmp, __vbaVarTstEq, __vbaLbound, _adj_fpatan, __vbaRedim, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, __vbaStrVarVal, __vbaDateVar, _CIlog, __vbaErrorOverflow, __vbaInStr, __vbaNew2, __vbaVar2Vec, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaVarDup, __vbaFpI4, _CIatan, __vbaStrMove, __vbaR8IntI4, _allmul, _CItan, __vbaFPInt, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0409 0x04b0
LegalCopyright	Concurrency
InternalName	Dagins
FileVersion	2.00
CompanyName	Concurrency
LegalTrademarks	Concurrency
Comments	Concurrency
ProductName	Concurrency
ProductVersion	2.00
FileDescription	Concurrency
OriginalFilename	Dagins.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: PKO_TRANS_DETAILS_20211216_0809521.exe PID: 6972 Parent PID: 2464

General

Start time:	13:11:06
Start date:	16/12/2021
Path:	C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\PKO_TRANS_DETAILS_20211216_0809521.exe"
Imagebase:	0x400000
File size:	147456 bytes
MD5 hash:	1823B507E96D8138BADA7C65D424ABCC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Yara matches:	Rule: JoeSecurity_GuLoader_2, Description: Yara detected GuLoader, Source: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: PKO_TRANS_DETAILS_20211216_0809521.exe PID: 6972 Parent PID: 2464 PKO_TRANS_DETAILS_20211216_0809521.exeCOMMON

Executed Functions

Function 04C880CC, Relevance: 1.7, APIs: 1, Instructions: 183memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-BD74E7EE,?,-08097EE8), ref: 04C88736

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 0ac8f6069ddc0ed46253067e2e917783076cdfb232c19ac72b289f4086e0caab
Instruction ID: a454de3d2dcdb7b25fa1ba6e39429125dd90a4a09a955370f03e919132da70d4
Opcode Fuzzy Hash: 0ac8f6069ddc0ed46253067e2e917783076cdfb232c19ac72b289f4086e0caab
Instruction Fuzzy Hash: 7D615630A08789CFDB20AF39C8807EA7BB2EF59308F85416EDD894B611D3356945DB62

Uniqueness

Uniqueness Score: -1.00%

Function 04C8D3CE, Relevance: 1.7, APIs: 1, Instructions: 169COMMON

Download Yara Rule

APIs

RtlAddVectoredExceptionHandler.NTDLL ref: 04C8D977

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 8df0e3cab39c524697214352c113e74dff671418ce5e7663f51119bfa6296cc3
Instruction ID: 2c248ad591ee56cffce06e121b70b256fde3de93304cc649527d4a158a6155fb
Opcode Fuzzy Hash: 8df0e3cab39c524697214352c113e74dff671418ce5e7663f51119bfa6296cc3
Instruction Fuzzy Hash: FF61E571604284CFDB78EE28C9A07EE37A3BB84358F55452EDD0BDB784D734AA408B51

Uniqueness

Uniqueness Score: -1.00%

Function 04C884B6, Relevance: 1.6, APIs: 1, Instructions: 145memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-BD74E7EE,?,-08097EE8), ref: 04C88736

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 1f55106a97f185a4a073531e199fb23257fead6bd359787c562b08404177d95f
Instruction ID: 2149c0af1546fd903f2fbbb6f5fd3ae371e2eb950f3ef2bbb4074ecc8d0a6b38
Opcode Fuzzy Hash: 1f55106a97f185a4a073531e199fb23257fead6bd359787c562b08404177d95f
Instruction Fuzzy Hash: B3512830605389CFCB70AE35C8C07EA7BB2EF59308F85426EDD899B211D3356949DB62

Uniqueness

Uniqueness Score: -1.00%

Function 04C884F4, Relevance: 1.6, APIs: 1, Instructions: 141memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-BD74E7EE,?,-08097EE8), ref: 04C88736

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: ace395fa6f1c9906d18c7371375d82ad53ade972e455a523b05a0cc4a996c658
Instruction ID: f701de37ddf22cf6f15ec072ba8818a2b5dcad4dd7c8866ed17f878e65cca69a
Opcode Fuzzy Hash: ace395fa6f1c9906d18c7371375d82ad53ade972e455a523b05a0cc4a996c658
Instruction Fuzzy Hash: B1514930604389CBCB70AE35C8C47EA77B2EF59318F85426EDD899B211D3356A49DB52

Uniqueness

Uniqueness Score: -1.00%

Function 04C884B3, Relevance: 1.6, APIs: 1, Instructions: 136memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-BD74E7EE,?,-08097EE8), ref: 04C88736

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 4a86f56a698c597691131607b8ebb284cfeb8d312177d5659e82bd777592950c
Instruction ID: da0df9b6b4d2dc0e82e8206ed64315f8bf6a8e85f93ecb30ec3790094a2674e7
Opcode Fuzzy Hash: 4a86f56a698c597691131607b8ebb284cfeb8d312177d5659e82bd777592950c
Instruction Fuzzy Hash: 9D510670609389CFDB70BF25C8807EA7BB2EF59308F85402EDD895B611D3356684DB62

Uniqueness

Uniqueness Score: -1.00%

Function 04C8855C, Relevance: 1.6, APIs: 1, Instructions: 130memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-BD74E7EE,?,-08097EE8), ref: 04C88736

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 61ad57da7e48eba70764b64a7ae0b9da1ec3e0f2c81ce2514dcf79fb333f2e90
Instruction ID: d46f6a439a5d708cbd656594097fffffd7ec23f9a1c16728d4984aba9469e001
Opcode Fuzzy Hash: 61ad57da7e48eba70764b64a7ae0b9da1ec3e0f2c81ce2514dcf79fb333f2e90
Instruction Fuzzy Hash: 82410930644389CBCB30AF25C8C4BEA7BB2EF55318F85426EDC8D9B211D3356949DB62

Uniqueness

Uniqueness Score: -1.00%

Function 04C885B2, Relevance: 1.6, APIs: 1, Instructions: 123memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-BD74E7EE,?,-08097EE8), ref: 04C88736

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 751fff1838bc910656324bf3284e7be8b5787795636c1d43685f7906e8203b7d
Instruction ID: f8c08fccb65f37af09bfa0eb3f71fdb2706aaefb6989c8937567eed074c44fb2
Opcode Fuzzy Hash: 751fff1838bc910656324bf3284e7be8b5787795636c1d43685f7906e8203b7d
Instruction Fuzzy Hash: DD410B30644389CBCB34AE35C8C47EA7BB2EF55318F95426EDC8D9B211C3356A4ADB52

Uniqueness

Uniqueness Score: -1.00%

Function 04C88631, Relevance: 1.6, APIs: 1, Instructions: 113memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-BD74E7EE,?,-08097EE8), ref: 04C88736

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: fdcb886c453aca1df72f3cb95c011757ec2fce5f386d1ad6544bc8a812c49531
Instruction ID: e2c94a18d3c93f664651025e4e2133452229b25eb6e850928ba2f02c2b3078d9
Opcode Fuzzy Hash: fdcb886c453aca1df72f3cb95c011757ec2fce5f386d1ad6544bc8a812c49531
Instruction Fuzzy Hash: BE41C4306053898BDB359F29C8C4BEA7BB2EF46318F5442AEDC4C5B251C335664ADB12

Uniqueness

Uniqueness Score: -1.00%

Function 04C886AA, Relevance: 1.6, APIs: 1, Instructions: 89memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(-BD74E7EE,?,-08097EE8), ref: 04C88736

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: 0c216f0901f534331a35763cab94ba32831deb39088a73f5f3b0bc3647497bb2
Instruction ID: e5ef1ad10c472fdd5e365517e6a41d1741cb7144b998e97fdb7cf34dab0c9ccb
Opcode Fuzzy Hash: 0c216f0901f534331a35763cab94ba32831deb39088a73f5f3b0bc3647497bb2
Instruction Fuzzy Hash: 3D31E730604389CBDB209F39C8C4BE97BB2EF46318F8442ADDC489B251C335654ADB11

Uniqueness

Uniqueness Score: -1.00%

Function 0041E9B4, Relevance: 100.1, APIs: 45, Strings: 12, Instructions: 361
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0041E9B4(void* __ebx, void* __edi, void* __esi, long long __fp0, signed int _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v48;
				short _v52;
				char _v56;
				char _v60;
				char _v64;
				signed int _v68;
				intOrPtr _v76;
				char _v84;
				intOrPtr _v92;
				char _v100;
				intOrPtr _v108;
				char _v116;
				char* _v140;
				char _v148;
				intOrPtr _v156;
				char _v164;
				char _v168;
				void* _v172;
				void* _v176;
				short _v180;
				char _v184;
				char _v188;
				long long _v196;
				signed int _v200;
				signed int _v216;
				signed int _v220;
				short _t194;
				signed int _t204;
				void* _t211;
				char* _t215;
				char* _t231;
				char* _t238;
				char* _t239;
				short _t250;
				void* _t267;
				char* _t268;
				short _t272;
				signed int _t282;
				void* _t283;
				signed int _t285;
				short _t301;
				char* _t303;
				void* _t321;
				void* _t322;
				void* _t323;
				void* _t325;
				intOrPtr _t326;
				void* _t327;
				long long _t335;
				long long _t337;

				_t335 = __fp0;
				_t322 = __esi;
				_t321 = __edi;
				_t326 = _t325 - 0x10;
				 *[fs:0x0] = _t326;
				L004012A0();
				_v20 = _t326;
				_v16 = 0x4011b8;
				_v12 = _a4 & 0x00000001;
				_a4 = _a4 & 0xfffffffe;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4012a6, _t323);
				_v76 = 0x80020004;
				_v84 = 0xa;
				_t194 =  &_v84;
				L00401504();
				_v172 = _t194;
				L004014FE();
				_v168 = _t194;
				 *((intOrPtr*)( *_a4 + 0x6fc))(_a4, _v172,  &_v168, L"intravens", _t194);
				L004014F8();
				_push( &_v84);
				L004014F2();
				_v140 = L"2 / 2 / 2";
				_v148 = 8;
				L004014E0();
				_push(1);
				_push(1);
				_push( &_v100);
				_push( &_v84);
				_push(0x4048b8);
				_push( &_v116);
				L004014E6();
				_v156 = 0x4680;
				_v164 = 0x8002;
				_push( &_v116);
				_t204 =  &_v164;
				_push(_t204);
				L004014EC();
				_v200 = _t204;
				_push( &_v116);
				_push( &_v100);
				_push( &_v84);
				_push(3);
				L004014DA();
				_t327 = _t326 + 0x10;
				if(_v200 != 0) {
					_push(0);
					L004014D4();
					_push(0x8e);
					L004014C2();
					L004014C8();
					L004014CE();
					L004014BC();
				}
				_v140 = L"adfrdsforsknings";
				_v148 = 8;
				L004014E0();
				L004014B6();
				_v108 = 0x80020004;
				_v116 = 0xa;
				_t211 =  &_v116;
				L00401504();
				_v180 = _t211;
				L004014B0();
				_v196 = _t335;
				L004014AA();
				_v184 = _t211;
				_v172 = 0xb0f;
				_v168 = 0x411d;
				L0040149E();
				L004014C8();
				_t215 =  &_v172;
				L004014A4();
				 *((intOrPtr*)( *_a4 + 0x700))(_a4, 0x1e72,  &_v56, _v180,  &_v168, _t215, _t215,  &_v184,  &_v176,  &_v100, L"TRESAARIGT", L"GMELINA", _t211,  &_v100,  &_v84, 0x72);
				 *((short*)(_a4 + 0x38)) = _v176;
				L004014BC();
				L004014DA();
				_v168 = 0x5ed4;
				 *((intOrPtr*)( *_a4 + 0x704))(_a4, 0x2e3e,  &_v168, 0x5e06cb,  &_v184, 3,  &_v84,  &_v116,  &_v100);
				 *((intOrPtr*)(_a4 + 0x3c)) = _v184;
				L00401498();
				L004014C8();
				_v76 = 0xfffffff4;
				_v84 = 2;
				_t231 =  &_v84;
				L0040148C();
				_v92 = _t231;
				_v100 = 8;
				L00401492();
				L004014CE();
				_v168 = 0x1df9;
				_v216 = _v68;
				_v68 = _v68 & 0x00000000;
				_t238 =  &_v60;
				L00401486();
				_t239 =  &_v168;
				L004014C8();
				 *((intOrPtr*)( *_a4 + 0x708))(_a4, L"FRIMRKEHANDLERNE", _t239, _t239, 0x6cb1f3, _t238, _t238,  &_v116,  &_v64,  &_v184,  &_v116,  &_v100, _t231, 0);
				 *((intOrPtr*)(_a4 + 0x40)) = _v184;
				L00401480();
				_t250 =  &_v84;
				L004014DA();
				L004014FE();
				_v168 = _t250;
				_v184 = 0x42b635;
				L004014CE();
				 *((intOrPtr*)( *_a4 + 0x70c))(_a4,  &_v56, 0x430c, _v168,  &_v184, 0x4135,  &_v188, L"Dampeners", 3, _t250,  &_v100,  &_v116, 4,  &_v56,  &_v60,  &_v64,  &_v68);
				 *((intOrPtr*)(_a4 + 0x44)) = _v188;
				L004014BC();
				 *((intOrPtr*)( *_a4 + 0x710))(_a4, 0x6aa, 0x10d6ae,  &_v168);
				_t301 = _v168;
				 *((short*)(_a4 + 0x48)) = _t301;
				 *((intOrPtr*)( *_a4 + 0x714))(_a4,  &_v168);
				_t267 = _v168;
				_v52 = _t267;
				L004014FE();
				_v168 = _t267;
				_t337 =  *0x4011b0;
				 *((long long*)(_t327 + 0x34)) = _t337;
				L0040147A();
				_v196 = _t337;
				_v188 = 0x86ce64;
				L0040146E();
				_v184 = _t267;
				_t268 =  &_v188;
				L00401474();
				_t272 =  *((intOrPtr*)( *_a4 + 0x718))(_a4, _v168,  &_v184, 0x51a8e, _t268, L"prellende", _t268, L"Testae", _t301, _t301, L"Unverbose");
				L00401468();
				L004014C8();
				L004014FE();
				_v172 = _t272;
				_v168 = _v172;
				 *((intOrPtr*)( *_a4 + 0x71c))(_a4,  &_v168, 0x4cfad1,  &_v184, _t272, 0x4680);
				_v32 = _v184;
				_t303 =  &_v56;
				L004014BC();
				_t282 =  *((intOrPtr*)( *_a4 + 0x2b4))(_a4);
				asm("fclex");
				_v200 = _t282;
				if(_v200 >= 0) {
					_v220 = _v220 & 0x00000000;
				} else {
					_push(0x2b4);
					_push(0x404670);
					_push(_a4);
					_push(_v200);
					L00401462();
					_v220 = _t282;
				}
				_v36 = 0x413b0f;
				_t283 = _v36(_t321, _t322, 4, 0);
				asm("daa");
				_t285 = _t283 + _t303 & 0x8589fffe;
				if (_t285 < 0) goto L6;
				goto L6;
				asm("invalid");
				_v148 = 3;
				L0040145C();
				_v12 = 0;
				asm("wait");
				_push(0x41ef9a);
				L004014F8();
				return _t285;
				L6:
				asm("invalid");
			}

0x0041e9b4
0x0041e9b4
0x0041e9b4
0x0041e9b7
0x0041e9c6
0x0041e9d2
0x0041e9da
0x0041e9dd
0x0041e9ea
0x0041e9f3
0x0041e9f6
0x0041ea05
0x0041ea08
0x0041ea0f
0x0041ea16
0x0041ea1a
0x0041ea1f
0x0041ea2b
0x0041ea30
0x0041ea4c
0x0041ea55
0x0041ea5d
0x0041ea5e
0x0041ea63
0x0041ea6d
0x0041ea80
0x0041ea85
0x0041ea87
0x0041ea8c
0x0041ea90
0x0041ea91
0x0041ea99
0x0041ea9a
0x0041ea9f
0x0041eaa9
0x0041eab6
0x0041eab7
0x0041eabd
0x0041eabe
0x0041eac3
0x0041eacd
0x0041ead1
0x0041ead5
0x0041ead6
0x0041ead8
0x0041eadd
0x0041eae9
0x0041eaeb
0x0041eaed
0x0041eaf2
0x0041eaf7
0x0041eb01
0x0041eb0e
0x0041eb16
0x0041eb16
0x0041eb1b
0x0041eb25
0x0041eb38
0x0041eb47
0x0041eb4c
0x0041eb53
0x0041eb5a
0x0041eb5e
0x0041eb63
0x0041eb6f
0x0041eb74
0x0041eb7f
0x0041eb84
0x0041eb8a
0x0041eb93
0x0041eba0
0x0041ebaa
0x0041ebbd
0x0041ebca
0x0041ebee
0x0041ebfe
0x0041ec05
0x0041ec18
0x0041ec20
0x0041ec49
0x0041ec58
0x0041ec5b
0x0041ec65
0x0041ec6a
0x0041ec71
0x0041ec7a
0x0041ec7e
0x0041ec83
0x0041ec86
0x0041ec95
0x0041eca2
0x0041eca7
0x0041ecb3
0x0041ecb9
0x0041eccc
0x0041ecd0
0x0041ecdb
0x0041eceb
0x0041ecfe
0x0041ed0d
0x0041ed22
0x0041ed32
0x0041ed38
0x0041ed45
0x0041ed4a
0x0041ed51
0x0041ed63
0x0041ed92
0x0041eda1
0x0041eda7
0x0041edc5
0x0041edce
0x0041edd5
0x0041ede8
0x0041edee
0x0041edf5
0x0041edfe
0x0041ee03
0x0041ee0a
0x0041ee12
0x0041ee15
0x0041ee1a
0x0041ee20
0x0041ee30
0x0041ee35
0x0041ee40
0x0041ee4c
0x0041ee6c
0x0041ee77
0x0041ee81
0x0041ee87
0x0041ee8c
0x0041ee9a
0x0041eebc
0x0041eec8
0x0041eecb
0x0041eece
0x0041eedb
0x0041eee1
0x0041eee3
0x0041eef0
0x0041ef12
0x0041eef2
0x0041eef2
0x0041eef7
0x0041eefc
0x0041eeff
0x0041ef05
0x0041ef0a
0x0041ef0a
0x0041ef19
0x0041ef26
0x0041ef2b
0x0041ef2c
0x0041ef31
0x0041ef31
0x0041ef33
0x0041ef35
0x0041ef48
0x0041ef4d
0x0041ef54
0x0041ef55
0x0041ef94
0x0041ef99
0x0041ef32
0x0041ef32

APIs

__vbaChkstk.MSVBVM60(?,004012A6), ref: 0041E9D2
#648.MSVBVM60(0000000A), ref: 0041EA1A
#696.MSVBVM60(intravens,0000000A), ref: 0041EA2B
__vbaFreeVar.MSVBVM60 ref: 0041EA55
#610.MSVBVM60(0000000A), ref: 0041EA5E
__vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0000000A), ref: 0041EA80
#662.MSVBVM60(?,004048B8,0000000A,?,00000001,00000001), ref: 0041EA9A
__vbaVarTstEq.MSVBVM60(00008002,?,?,004048B8,0000000A,?,00000001,00000001), ref: 0041EABE
__vbaFreeVarList.MSVBVM60(00000003,0000000A,?,?,00008002,?,?,004048B8,0000000A,?,00000001,00000001), ref: 0041EAD8
__vbaOnError.MSVBVM60(00000000,?,?,?,004012A6), ref: 0041EAED
#525.MSVBVM60(0000008E,00000000,?,?,?,004012A6), ref: 0041EAF7
__vbaStrMove.MSVBVM60(0000008E,00000000,?,?,?,004012A6), ref: 0041EB01
__vbaStrCopy.MSVBVM60(0000008E,00000000,?,?,?,004012A6), ref: 0041EB0E
__vbaFreeStr.MSVBVM60(0000008E,00000000,?,?,?,004012A6), ref: 0041EB16
__vbaVarDup.MSVBVM60 ref: 0041EB38
#619.MSVBVM60(?,?,00000072), ref: 0041EB47
#648.MSVBVM60(0000000A,?,?,00000072), ref: 0041EB5E
#581.MSVBVM60(GMELINA,0000000A,?,?,00000072), ref: 0041EB6F
__vbaLenBstr.MSVBVM60(TRESAARIGT,GMELINA,0000000A,?,?,00000072), ref: 0041EB7F
__vbaStrVarMove.MSVBVM60(?,TRESAARIGT,GMELINA,0000000A,?,?,00000072), ref: 0041EBA0
__vbaStrMove.MSVBVM60(?,TRESAARIGT,GMELINA,0000000A,?,?,00000072), ref: 0041EBAA
__vbaFpI4.MSVBVM60(00000B0F,?,?,?,TRESAARIGT,GMELINA,0000000A,?,?,00000072), ref: 0041EBCA
__vbaFreeStr.MSVBVM60 ref: 0041EC05
__vbaFreeVarList.MSVBVM60(00000003,?,0000000A,?), ref: 0041EC18
#669.MSVBVM60 ref: 0041EC5B
__vbaStrMove.MSVBVM60 ref: 0041EC65
#705.MSVBVM60(00000002,00000000), ref: 0041EC7E
#522.MSVBVM60(?,00000008,00000002,00000000), ref: 0041EC95
__vbaStrCopy.MSVBVM60(?,00000008,00000002,00000000), ref: 0041ECA2
__vbaStrVarVal.MSVBVM60(?,?,?,?,?,00000008,00000002,00000000), ref: 0041ECD0
__vbaStrMove.MSVBVM60(00001DF9,006CB1F3,00000000,?,?,?,?,?,00000008,00000002,00000000), ref: 0041ECEB
__vbaFreeStrList.MSVBVM60(00000004,?,?,?,00000000), ref: 0041ED22
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 0041ED38
#696.MSVBVM60(Dampeners), ref: 0041ED45
__vbaStrCopy.MSVBVM60 ref: 0041ED63
__vbaFreeStr.MSVBVM60 ref: 0041EDA7
#696.MSVBVM60(Unverbose), ref: 0041EDFE
#587.MSVBVM60(?,?,Unverbose), ref: 0041EE15
__vbaR8FixI4.MSVBVM60(?,?,Unverbose), ref: 0041EE30
__vbaLenBstrB.MSVBVM60(prellende,0086CE64,Testae,?,?,Unverbose), ref: 0041EE4C
#697.MSVBVM60(00004680,?,?,Unverbose), ref: 0041EE77
__vbaStrMove.MSVBVM60(00004680,?,?,Unverbose), ref: 0041EE81
#696.MSVBVM60(00000000,00004680,?,?,Unverbose), ref: 0041EE87
__vbaFreeStr.MSVBVM60(?,?,Unverbose), ref: 0041EECE
__vbaHresultCheckObj.MSVBVM60(?,?,00404670,000002B4,?,?,Unverbose), ref: 0041EF05

Strings

FRIMRKEHANDLERNE, xrefs: 0041ECF1
prellende, xrefs: 0041EE47
Dampeners, xrefs: 0041ED40
TRESAARIGT, xrefs: 0041EB7A
2 / 2 / 2, xrefs: 0041EA63
Unverbose, xrefs: 0041EDF9
karikerendes, xrefs: 0041EC9A
adfrdsforsknings, xrefs: 0041EB1B
Testae, xrefs: 0041EE3B
paternalize, xrefs: 0041ED5B
intravens, xrefs: 0041EA26
GMELINA, xrefs: 0041EB6A

Memory Dump Source

Source File: 00000000.00000002.803389432.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.803377846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.803472174.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803484408.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$#696List$Copy$#648Bstr$#522#525#581#587#610#619#662#669#697#705CheckChkstkErrorHresult
String ID: 2 / 2 / 2$Dampeners$FRIMRKEHANDLERNE$GMELINA$TRESAARIGT$Testae$Unverbose$adfrdsforsknings$intravens$karikerendes$paternalize$prellende
API String ID: 2377663758-1801764363
Opcode ID: f1e40b0c78629d26e23cab60b7cb0d2b242af49ad487c012717f3259cffc17e5
Instruction ID: 09234f7e635ed223bb15ff3a63e3d6d8f293b1e24dd550bc5f88497e6019142e
Opcode Fuzzy Hash: f1e40b0c78629d26e23cab60b7cb0d2b242af49ad487c012717f3259cffc17e5
Instruction Fuzzy Hash: 2BF1D775900218AFDB10EF94CC85FEE77B9BF04304F0041AAF648AB2A1DB789A85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00401524, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 20%

			_entry_() {
				signed char _t15;
				signed int _t16;
				signed char _t17;
				signed char _t19;
				signed int* _t20;
				signed char _t139;
				void* _t140;
				signed int _t142;
				intOrPtr* _t143;
				signed int _t144;
				signed int* _t146;
				signed char _t152;

				_push("VB5!6&*"); // executed
				L0040151C(); // executed
				 *_t15 =  *_t15 + _t15;
				 *_t15 =  *_t15 + _t15;
				 *_t15 =  *_t15 + _t15;
				 *_t15 =  *_t15 ^ _t15;
				 *_t15 =  *_t15 + _t15;
				 *_t15 =  *_t15 + _t15;
				 *_t15 =  *_t15 + _t15;
				 *_t15 =  *_t15 + _t15;
				 *(_t144 + 0x24160c99) = _t15;
				_t142 = _t140 + 2;
				asm("invalid");
				_t16 =  *_t15;
				 *_t16 =  *_t16 + _t16;
				 *_t16 =  *_t16 + _t16;
				 *_t139 =  *_t139 + _t16;
				 *_t16 =  *_t16 + _t16;
				 *_t142 =  *_t142 + _t16;
				_push(es);
				_push(_t16);
				 *_t139 =  *_t139 + 0x6d;
				asm("outsd");
				asm("outsb");
				asm("a16 jb 0x3");
				 *_t20 =  *_t20 | _t16;
				 *_t16 =  *_t16 + _t16;
				 *_t16 =  *_t16 + _t16;
				 *_t16 =  *_t16 ^ _t16;
				 *(_t20 - 0x72) = (_t142 << 0x00000020 |  *(_t20 - 0x72)) >> _t139;
				asm("fsubr dword [ecx]");
				asm("adc byte [esp+ecx*2-0x42], 0x53");
				asm("popfd");
				asm("aaa");
				 *(_t20 - 0x58d7b148) = _t144;
				_t17 = gs;
				asm("sbb eax, 0x95dc9733");
				_pop(_t146);
				_pop(_t143);
				asm("cdq");
				asm("iretw");
				asm("adc [edi+0xaa000c], esi");
				asm("pushad");
				asm("rcl dword [ebx], cl");
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				 *_t17 =  *_t17 + _t17;
				asm("aam 0x17");
				 *_t17 =  *_t17 + _t17;
				asm("adc dword [0x6000000], 0x6e614700");
				asm("a16 insb");
				_t19 = _t17 ^  *_t17 | 0x70000601;
				_t152 = _t19;
				if(_t152 < 0) {
					L4:
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					 *_t139 =  *_t139 + _t19;
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
					asm("invalid");
				}
				asm("popa");
				if (_t152 <= 0) goto L3;
				asm("sbb [ecx], eax");
				 *_t143 =  *_t143 + _t19;
				_t144 = _t144 &  *_t146;
				asm("adc eax, 0x746c0000");
				 *_t19 =  *_t19 + _t19;
				asm("adc eax, 0x0");
				 *_t19 =  *_t19 + _t19;
				_t19 = _t19 +  *_t19;
				 *_t19 =  *_t19 & _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 & _t19;
				 *_t19 =  *_t19 + _t19;
				 *[es:eax] =  *[es:eax] + _t19;
				 *_t19 =  *_t19 + _t143;
				asm("adc [eax], al");
				 *_t139 =  *_t139 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *((intOrPtr*)(_t19 + 4)) =  *((intOrPtr*)(_t19 + 4)) + _t139;
				 *_t19 =  *_t19 + _t19;
				asm("into");
				asm("adc [eax], al");
				 *_t19 =  *_t19 + _t139;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 & _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				 *_t19 =  *_t19 + _t19;
				asm("invalid");
				goto L4;
			}

0x00401524
0x00401529
0x0040152e
0x00401530
0x00401532
0x00401534
0x00401536
0x0040153a
0x0040153c
0x0040153e
0x00401540
0x00401547
0x0040154d
0x0040154f
0x00401551
0x00401553
0x00401555
0x00401557
0x00401559
0x0040155c
0x0040155d
0x0040155e
0x00401561
0x00401562
0x00401563
0x00401566
0x00401568
0x0040156a
0x0040156e
0x00401570
0x00401574
0x00401576
0x0040157b
0x0040157c
0x0040157d
0x00401583
0x0040158a
0x0040158f
0x00401590
0x00401595
0x00401596
0x00401598
0x0040159e
0x0040159f
0x004015a5
0x004015a7
0x004015a9
0x004015ab
0x004015ad
0x004015af
0x004015b1
0x004015b3
0x004015b5
0x004015b7
0x004015b9
0x004015bb
0x004015bd
0x004015bf
0x004015c1
0x004015c3
0x004015c5
0x004015c7
0x004015c9
0x004015d3
0x004015d7
0x004015d7
0x004015dc
0x00401643
0x00401643
0x00401647
0x0040164b
0x0040164f
0x00401653
0x00401657
0x0040165b
0x0040165f
0x00401663
0x00401667
0x0040166b
0x0040166f
0x00401673
0x00401677
0x0040167b
0x0040167f
0x00401683
0x00401687
0x0040168b
0x0040168f
0x00401693
0x00401697
0x0040169b
0x0040169f
0x004016a3
0x004016a7
0x004016ab
0x004016af
0x004016b3
0x004016b7
0x004016bb
0x004016bf
0x004016c3
0x004016c7
0x004016cb
0x004016cf
0x004016d3
0x004016d7
0x004016db
0x004016df
0x004016e3
0x004016e7
0x004016eb
0x004016ef
0x004016f3
0x004016f7
0x004016fb
0x004016ff
0x00401703
0x00401707
0x0040170b
0x0040170f
0x00401713
0x00401717
0x00401719
0x0040171b
0x0040171f
0x00401723
0x00401727
0x0040172b
0x0040172f
0x00401733
0x00401737
0x0040173b
0x0040173f
0x00401743
0x00401747
0x0040174b
0x0040174f
0x00401753
0x00401757
0x0040175b
0x0040175f
0x00401763
0x00401767
0x0040176b
0x0040176f
0x00401773
0x00401777
0x0040177b
0x0040177f
0x00401783
0x00401787
0x0040178b
0x0040178f
0x00401793
0x00401797
0x0040179b
0x0040179f
0x004017a3
0x004017a7
0x004017ab
0x004017af
0x004017b3
0x004017b7
0x004017bb
0x004017bf
0x004017c3
0x004017c7
0x004017cb
0x004017cf
0x004017d3
0x004017d7
0x004017db
0x004017df
0x004017e3
0x004017e7
0x004017eb
0x004017ef
0x004017f3
0x004017f7
0x004017fb
0x004017ff
0x00401803
0x00401807
0x0040180b
0x0040180f
0x00401813
0x00401817
0x00401819
0x004015de
0x004015e0
0x004015e2
0x004015e4
0x004015e7
0x004015e9
0x004015ee
0x004015f0
0x004015f6
0x004015f8
0x004015fa
0x004015fc
0x004015fe
0x00401600
0x00401604
0x00401606
0x00401609
0x0040160b
0x0040160d
0x0040160f
0x00401611
0x00401614
0x00401616
0x00401617
0x00401619
0x0040161b
0x0040161d
0x0040161f
0x00401621
0x00401624
0x00401626
0x00401628
0x0040162a
0x0040162c
0x0040162e
0x00401630
0x00401632
0x00401634
0x00401636
0x00401638
0x0040163a
0x0040163c
0x0040163e
0x00401640
0x00401642
0x00000000

APIs

#100.MSVBVM60(VB5!6&*), ref: 00401529

Strings

VB5!6&*, xrefs: 00401524

Memory Dump Source

Source File: 00000000.00000002.803389432.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.803377846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.803472174.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803484408.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!6&*
API String ID: 1341478452-3593831657
Opcode ID: 0701037ce540f06060a36e31acc1cce7199ce60b4004ece5e8803c37ee244071
Instruction ID: 1db90744a86aebbd4c9936e58793fa7ec7d7b121b519b05d2cff0f0fcd851113
Opcode Fuzzy Hash: 0701037ce540f06060a36e31acc1cce7199ce60b4004ece5e8803c37ee244071
Instruction Fuzzy Hash: E3E04EA18AE3C02ED3036B3488224013FB58E8320830B40E784C2CF0F3E0A80C2DCB67

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04C8587D, Relevance: 4.6, Strings: 3, Instructions: 806COMMON

Download Yara Rule

Strings

_;b8, xrefs: 04C858C7
*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW$_;b8
API String ID: 0-3521355498
Opcode ID: 27fbff1d51ea2053191801e67d4c50dc123ce6977b081314f2581534e7c05e05
Instruction ID: b8cbf367c5d2c0b16136ae684a62d2d31f41920da9d9b6097725c090f9ff7e8e
Opcode Fuzzy Hash: 27fbff1d51ea2053191801e67d4c50dc123ce6977b081314f2581534e7c05e05
Instruction Fuzzy Hash: 457200B1604289DFDB749F29CD447EA7BB2FF95314F55812EDC898B254E330AA41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04C85E2C, Relevance: 3.3, Strings: 2, Instructions: 773COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 030d692f781338361390e302f69f768891a600adca7b39681495cf59e67fb552
Instruction ID: e424ed3eb63c1532a5d729f5cdd90d626cb66d6d1a6b1acf5ad6566548d53953
Opcode Fuzzy Hash: 030d692f781338361390e302f69f768891a600adca7b39681495cf59e67fb552
Instruction Fuzzy Hash: 2162FFB2A04249DFDB749F25CD447EA7BB2FF95344F59812DDC899B214E330AA81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04C894A0, Relevance: 3.2, Strings: 2, Instructions: 730COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID: !^L$$*oW
API String ID: 2167126740-1718493406
Opcode ID: 202699a45504a73b76ab1f736292ecad9f8e2219ddc05a94f83c681658526f8c
Instruction ID: f0e0978324060cf3ec2bef8be8c492d98e6019ca5442c05d11e48b771261fdcd
Opcode Fuzzy Hash: 202699a45504a73b76ab1f736292ecad9f8e2219ddc05a94f83c681658526f8c
Instruction Fuzzy Hash: 546200B2A04249DFDB749F29CD447EA77B2FF94314F55812EDC899B214E370AA81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04C85EB9, Relevance: 3.2, Strings: 2, Instructions: 701COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: ce1f37e967848ae6aa7c02697468e3d1d117aeaaba2f2f259d5f73f69b854683
Instruction ID: 9436598a4adf92b6e0fdb8414c6846a73ef7954bb898c8482e7d788ef20dc1b5
Opcode Fuzzy Hash: ce1f37e967848ae6aa7c02697468e3d1d117aeaaba2f2f259d5f73f69b854683
Instruction Fuzzy Hash: C95201B2A04249DFDB749F29CD447EA77B2FF94314F55822EDC899B214E370AA41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04C85FA4, Relevance: 3.2, Strings: 2, Instructions: 696COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 10b1ce0a628ae0f0e54e60331d3c9d33b9df79ed82025111d8230901c57d726a
Instruction ID: b77b92dc01f3946d9c12f1fc998531836230c2e472dc5ac583b1aeee4c21f979
Opcode Fuzzy Hash: 10b1ce0a628ae0f0e54e60331d3c9d33b9df79ed82025111d8230901c57d726a
Instruction Fuzzy Hash: B0520FB2A04249DFDB349F29CD447DA77B2FF94314F59812EDC899B214E370AA81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04C85F46, Relevance: 3.2, Strings: 2, Instructions: 681COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 1149330526144dd118ecfcc3b20d0778504d4df323a071dd91cb14a1cb37d92d
Instruction ID: 9a49b5342ba5c870200abba88a32a8c18948ade20e3cd50a7772dbbcfcadab16
Opcode Fuzzy Hash: 1149330526144dd118ecfcc3b20d0778504d4df323a071dd91cb14a1cb37d92d
Instruction Fuzzy Hash: 2E5200B2A04249DFDB749F29CD447EA77B2FF94314F55822EDC899B214E370AA41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 04C86069, Relevance: 3.2, Strings: 2, Instructions: 671COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 93c4d71d3223df21d11f36f906f494f7dfb2a2c33c295aff4d29a76b83ae9aba
Instruction ID: ad9de2c41b668d364c86bd99c94f009c840e11b1d6d6bde8b9dd8084daabd1d5
Opcode Fuzzy Hash: 93c4d71d3223df21d11f36f906f494f7dfb2a2c33c295aff4d29a76b83ae9aba
Instruction Fuzzy Hash: CD52FFB2A04249DFDB749F25CD447EA77B2FF94314F59812EDC898B214E370AA81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 04C86014, Relevance: 3.2, Strings: 2, Instructions: 655COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: e87b550739360b3f564c0909b56c62b15b61a12642c624df2d4733188c901fed
Instruction ID: 5a1ef655d718e1016f7d2eff974bc1a7e65fa1ca7535e6060207589550d0043f
Opcode Fuzzy Hash: e87b550739360b3f564c0909b56c62b15b61a12642c624df2d4733188c901fed
Instruction Fuzzy Hash: 9B52FEB2A04249DFDB749F25CD447EA77B2FF94314F59822EDC498B214E370AA81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 04C860C1, Relevance: 3.1, Strings: 2, Instructions: 636COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 01446d9e3f28e7d8451edc837a9e871566efdff7d3d441b3a8f8a89f7ee65881
Instruction ID: fab9daf21967ec6a6aad525ab146de70e6002a0e0f557e9e74cbf397e58842d6
Opcode Fuzzy Hash: 01446d9e3f28e7d8451edc837a9e871566efdff7d3d441b3a8f8a89f7ee65881
Instruction Fuzzy Hash: 8F42EEB2A04249DFDB749F25CD447EA77B2FF95314F55822EDC898B214E370AA81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 04C8613F, Relevance: 3.1, Strings: 2, Instructions: 620COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 5c664130497e4fe0ba876c687205612da8d99519fa9efcdc5a1cd2e7bdbf036d
Instruction ID: d9e176738c79a2f6077b3de3e2078f63189338648069e69db74c6d96734a002e
Opcode Fuzzy Hash: 5c664130497e4fe0ba876c687205612da8d99519fa9efcdc5a1cd2e7bdbf036d
Instruction Fuzzy Hash: A342FEB2A04249DFDB749F25CD447EA77B2FF94314F55822EDC498B214E370AA81CB52

Uniqueness

Uniqueness Score: -1.00%

Function 04C861BE, Relevance: 3.1, Strings: 2, Instructions: 605COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 60ebf3dc56d2898c398c780c6d6ffb95d61813a730cd3bebe0ba540e9b01557e
Instruction ID: 76123990955e708f8a558d52cbf1e637be085a2bd4906ddf11be1efe5c37b0c8
Opcode Fuzzy Hash: 60ebf3dc56d2898c398c780c6d6ffb95d61813a730cd3bebe0ba540e9b01557e
Instruction Fuzzy Hash: F0420EB2A04249DFDB349F25CD447EA77B2FF95314F59822EDC498B214E370AA81CB52

Uniqueness

Uniqueness Score: -1.00%

Function 04C86249, Relevance: 3.1, Strings: 2, Instructions: 586COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: c26085178430d81e4f860dc1703e258e605d3ede083fbd26aa276d75d9e513e6
Instruction ID: f884233a5c8310382b69bec23b0576aa2c308b571f8c2a6ca2772dd3a617b38d
Opcode Fuzzy Hash: c26085178430d81e4f860dc1703e258e605d3ede083fbd26aa276d75d9e513e6
Instruction Fuzzy Hash: 57320FB2A04249DFDB309F25CD447DA77B2FF95314F59822EDC499B214E370AA81CB92

Uniqueness

Uniqueness Score: -1.00%

Function 04C862E2, Relevance: 3.1, Strings: 2, Instructions: 563COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: fab38dcc7503401d948b3348d449d5554ed27affaabda038564fea6f21d8b5e1
Instruction ID: 4064150a5bb3ee63abc8cf036e919971dbf05a369ecc2fbae19d56e369053919
Opcode Fuzzy Hash: fab38dcc7503401d948b3348d449d5554ed27affaabda038564fea6f21d8b5e1
Instruction Fuzzy Hash: 473210B2A04249DFDB709F29CD447DA77B2FF95314F59822EDC499B214E370AA81CB42

Uniqueness

Uniqueness Score: -1.00%

Function 04C8637E, Relevance: 3.0, Strings: 2, Instructions: 531COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 3c1abaecccba7bb2a24af50928203c61ae20ada81facb1a2d115c04b62aa0de1
Instruction ID: afaa1cf62f8e4e30c8c35a0fe396b3b8135fce91c3f7adee45b0acad13a37e74
Opcode Fuzzy Hash: 3c1abaecccba7bb2a24af50928203c61ae20ada81facb1a2d115c04b62aa0de1
Instruction Fuzzy Hash: 222211B2A04249DFDB749F25CD447EA77B2FF55314F59822EDC498B214E370AA81CB82

Uniqueness

Uniqueness Score: -1.00%

Function 04C863F6, Relevance: 3.0, Strings: 2, Instructions: 521COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: bb6884686cf2e8a354ca3a357d7996691c9a4ed2161ab034fb85929625ab6d55
Instruction ID: 1e59e3490bc7efa68bb75de854a8c2bd4027d5d1e5be26b08d9f0604cf9c7429
Opcode Fuzzy Hash: bb6884686cf2e8a354ca3a357d7996691c9a4ed2161ab034fb85929625ab6d55
Instruction Fuzzy Hash: E92210B2A04249DFDB749F25CD447EA77B2FF55314F59822EDC498B214E370AA81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 04C8647E, Relevance: 3.0, Strings: 2, Instructions: 500COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 074ba6bd7f1faf54177f73b794ecd46a035d9b9bf53d8b7675beb2c9c71a9274
Instruction ID: 3e5d617007a6bc5240adad6b1e41c8efefd27eea6da91d7d568a1f5a45693934
Opcode Fuzzy Hash: 074ba6bd7f1faf54177f73b794ecd46a035d9b9bf53d8b7675beb2c9c71a9274
Instruction Fuzzy Hash: 192210B2A04248DFDB709F25CD447EA77B2FF55314F59822EDC898B214E371AA81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 04C86501, Relevance: 3.0, Strings: 2, Instructions: 493COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 3688089ffc3e6e2ef2a77a8b611056e2a0d392c8d1b6abd50bfe90728f39ab30
Instruction ID: 3cb26890e52281632b035ce08f906b8d4b66d75090ffee8d81359514bde4da8e
Opcode Fuzzy Hash: 3688089ffc3e6e2ef2a77a8b611056e2a0d392c8d1b6abd50bfe90728f39ab30
Instruction Fuzzy Hash: 342200B2A04288DFDB709F25CD847EA77B3FF55344F59412EDC899B214E371AA818B42

Uniqueness

Uniqueness Score: -1.00%

Function 04C86580, Relevance: 3.0, Strings: 2, Instructions: 472COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 0c195a311d1ccdc4e69c8f63ce338b9c8e1345c0db65e379d0f46a40d68ebba0
Instruction ID: ebaa8679c49d7c46eb884f48664d9f060a43218ab42b21ce80eb86030a8dea83
Opcode Fuzzy Hash: 0c195a311d1ccdc4e69c8f63ce338b9c8e1345c0db65e379d0f46a40d68ebba0
Instruction Fuzzy Hash: 5B1221B2A04288DFDB709F29CD847EA37B3FF95354F59412EDC899B214E371AA418B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C865D8, Relevance: 3.0, Strings: 2, Instructions: 454COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 7200f48049be67e86de28611be5f79da67b4657d5f6d9af302928e6f410890b6
Instruction ID: e8d336a7add6278d85bd59a42c30b1d02a81eab2cdbe44e2458cf186ee8f7b21
Opcode Fuzzy Hash: 7200f48049be67e86de28611be5f79da67b4657d5f6d9af302928e6f410890b6
Instruction Fuzzy Hash: E81202B2A04248DFDF719F25CD847EA77B3BF99344F5A412EDC499B214E370AA818B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C865DE, Relevance: 3.0, Strings: 2, Instructions: 450COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 31b3ac67dd54743334fcf4c04aa177faf8d2a01b06e1ee054268f36c52ae0635
Instruction ID: c722377293e3d0e84200caf869bb3883dc4cf59ee70911561557cd3d0d999a98
Opcode Fuzzy Hash: 31b3ac67dd54743334fcf4c04aa177faf8d2a01b06e1ee054268f36c52ae0635
Instruction Fuzzy Hash: 6D12F1B2A04248DFDF719F25CD847EA77B3BF99344F5A412EDC499B214E370AA818B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C865E9, Relevance: 2.9, Strings: 2, Instructions: 446COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 08cdabc9225338fce252c4e1f03c172d6e1b4342c1d3926ce8579b013ce4291a
Instruction ID: a288f88fb7e368974d551fb4771a6d660dc9f5054ac28c0a901c3027e2d5f88c
Opcode Fuzzy Hash: 08cdabc9225338fce252c4e1f03c172d6e1b4342c1d3926ce8579b013ce4291a
Instruction Fuzzy Hash: 780202B2A04248DFDF719E25CD847EA37B3BF59344F59412DDC499B214E370AA818B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C86661, Relevance: 2.9, Strings: 2, Instructions: 435COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: f8e8d65325841630e2eefa834d93f4aeeaff08eb0cf9228153783d385cb43d68
Instruction ID: b3d60eb0c7139daea6a4911ea63dc074dc6510dcd41ca33bb78c2e93379fc3f3
Opcode Fuzzy Hash: f8e8d65325841630e2eefa834d93f4aeeaff08eb0cf9228153783d385cb43d68
Instruction Fuzzy Hash: 360212B2A04248DFDF719E25CD847EA37B3FF55354F59812EDC888B214E371AA818B42

Uniqueness

Uniqueness Score: -1.00%

Function 04C8674D, Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 101d48ce23f0df4cf31fb452c87c0c8a6af453a375d3a712d9ae6d8d748a5f3a
Instruction ID: c2e83d467099c41b222d3b9e55bb1845f2914c92bb9ebdbd2c985c7c35617530
Opcode Fuzzy Hash: 101d48ce23f0df4cf31fb452c87c0c8a6af453a375d3a712d9ae6d8d748a5f3a
Instruction Fuzzy Hash: F9F123B2A04248DFDB719E29CD847EA77B3FF45354F59412EEC899B210E371AA81CB41

Uniqueness

Uniqueness Score: -1.00%

Function 04C866F5, Relevance: 2.9, Strings: 2, Instructions: 408COMMON

Download Yara Rule

Strings

*oW, xrefs: 04C86862
!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$$*oW
API String ID: 0-1718493406
Opcode ID: 112c50299ca4f738f793ca00e793b01bfe0f6d55316e16d4600561d100c20524
Instruction ID: 5c34231da6a2b1ddcd11a8256087e9c2ec8836620ad4dd9468752223cca3031d
Opcode Fuzzy Hash: 112c50299ca4f738f793ca00e793b01bfe0f6d55316e16d4600561d100c20524
Instruction Fuzzy Hash: DE0202B2A04248DFDF71AE25CD847EA77B3BF45354F59412EDC899B214E370AA818B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C86878, Relevance: 1.6, Strings: 1, Instructions: 361COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: 14694ba1cff07185c354d580017777880095292a4064d1ca075985e515fab846
Instruction ID: 168c70e2821bae7789c34881bb32134d589ba30eea6f7255b9e8d7474cac9908
Opcode Fuzzy Hash: 14694ba1cff07185c354d580017777880095292a4064d1ca075985e515fab846
Instruction Fuzzy Hash: 42E123B1A04248DFDB71AE29CD847EA77B3FF54354F59412EDC898B214E371AA81CB42

Uniqueness

Uniqueness Score: -1.00%

Function 04C868E8, Relevance: 1.6, Strings: 1, Instructions: 349COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: d01f0c44c8ececd5b88ca2842ba86197024043137cec6a8dfae1bc5fb3eeaceb
Instruction ID: 521ab341141c4e6a843995bd2953544cd5a9c3707e0bb739cd7a89f449447405
Opcode Fuzzy Hash: d01f0c44c8ececd5b88ca2842ba86197024043137cec6a8dfae1bc5fb3eeaceb
Instruction Fuzzy Hash: B3E134B1A04248DFDB31AE29CD847EA77B3FF45354F59412EDC898B214E371AA81CB42

Uniqueness

Uniqueness Score: -1.00%

Function 04C86928, Relevance: 1.6, Strings: 1, Instructions: 345COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: 1bc7f7425adb7a626c3bbc999e225dafb2d0a613e6d1136b00383b274c9e91a3
Instruction ID: 2fe70374bb784a85f5699302ec436d2da879398b4c84237494168d0c72c0fb82
Opcode Fuzzy Hash: 1bc7f7425adb7a626c3bbc999e225dafb2d0a613e6d1136b00383b274c9e91a3
Instruction Fuzzy Hash: 01E124B1A04248DFDB359E29CD847EA77B3FF54354F59412EDC898B214E370AA81CB42

Uniqueness

Uniqueness Score: -1.00%

Function 04C869A0, Relevance: 1.6, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: ad1c1e60f164ec27c5f9ec290076630d586f415c479698b6236a9e8cf2234103
Instruction ID: 98b47ef496a9a0bf1085b0afe225fa7642b3ec4844f0cc6cb01d192bdefe768c
Opcode Fuzzy Hash: ad1c1e60f164ec27c5f9ec290076630d586f415c479698b6236a9e8cf2234103
Instruction Fuzzy Hash: 86D103B1A04249DFDF719E29CD847EA77B3FF45354F59412EEC898B224E370AA818B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C869D6, Relevance: 1.6, Strings: 1, Instructions: 332COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: fe0fa7d1ec356133ca868370ff81b7390239c4e9fb478c9db7f30837f227b736
Instruction ID: e8828a1e43e5c1cd84c1b6eec6ed493a9d105d36c4be358db78c4ddbe6cb548f
Opcode Fuzzy Hash: fe0fa7d1ec356133ca868370ff81b7390239c4e9fb478c9db7f30837f227b736
Instruction Fuzzy Hash: C7D102B2A04248DFDB759E29CD847EA37B3FF45354F59412EEC498B224E370AA818B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C86985, Relevance: 1.6, Strings: 1, Instructions: 329COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: f4657ed7cda0341b5a39c96106754a67f45f062442a7091e2799d9ac6057ff46
Instruction ID: 20a733db57fcc1f3621ff6de21cd30425f1db68a8371cb2203a29ec9e69ab37d
Opcode Fuzzy Hash: f4657ed7cda0341b5a39c96106754a67f45f062442a7091e2799d9ac6057ff46
Instruction Fuzzy Hash: 8DD103B2A04248DFDF75AE25CD847EA77B3FF44354F59412EDC898B214E370AA818B42

Uniqueness

Uniqueness Score: -1.00%

Function 04C86A65, Relevance: 1.6, Strings: 1, Instructions: 315COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: e73a26ebed0aa8b8be3e950fc9cd83fb00b0e721ab61af844629797d487ee45b
Instruction ID: 5bf1acf7f1d9d35b6608db0ce4724abdb5ae658c4719728f042c8e17f91873a0
Opcode Fuzzy Hash: e73a26ebed0aa8b8be3e950fc9cd83fb00b0e721ab61af844629797d487ee45b
Instruction Fuzzy Hash: 8FD102B2A00289DFDF319E29CD847EA77B3FF55354F59412EEC488B214E371AA858B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C86B09, Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: fbb7231de364d9a43028b48be8d6f6a9d8f358cce606e8111d43fb9bd4e679d7
Instruction ID: afbe345ac4d0764210c24af6c5e88f0203dea925b8f21c5694291f1eec3b87cc
Opcode Fuzzy Hash: fbb7231de364d9a43028b48be8d6f6a9d8f358cce606e8111d43fb9bd4e679d7
Instruction Fuzzy Hash: A8C1C0B1A04289DFDF71DE29CD847EA7BB3BF44348F59412EEC498B214D371AA818B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C86B84, Relevance: 1.5, Strings: 1, Instructions: 264COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: 4e642c070bec557b41182d8bb8ea61947939ff93d291da81862e31788868506e
Instruction ID: 1439f476805f56ef9428f6aeec219d6a5b7c6d7156fbfcbf85445e26cc19b817
Opcode Fuzzy Hash: 4e642c070bec557b41182d8bb8ea61947939ff93d291da81862e31788868506e
Instruction Fuzzy Hash: 0EB1DFB2A05289DBDF75AE69CD847EA37B3BF58344F59412ADC488B210D371AA818B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C86BB1, Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: 4a02e444df4a14685a1781feac27d12babe7fe143d014cfbaaf6e81614b4cd1c
Instruction ID: f67a34777be62b2301ec618be01bdeb708230687a863834f888af868f51345a2
Opcode Fuzzy Hash: 4a02e444df4a14685a1781feac27d12babe7fe143d014cfbaaf6e81614b4cd1c
Instruction Fuzzy Hash: 9CB1E0B2A04289DBDF759E29CD847EA37B3BF58344F59412EDC48CB214D371AA858B42

Uniqueness

Uniqueness Score: -1.00%

Function 04C86C56, Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: ec095f8c561602fe2ead145537f809dc6915ca6927b977895336f38391303119
Instruction ID: 1c215ff9e26f34a9e92ca491d6d70d67f29b0e79076e9203feda3c7a918831a3
Opcode Fuzzy Hash: ec095f8c561602fe2ead145537f809dc6915ca6927b977895336f38391303119
Instruction Fuzzy Hash: D6A1CEB2A01289DFDF759E69CD847EA37B3BF58304F55422EDC48CB220D371AA858B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C86CE3, Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: 74929e55f53ff8923f5429bbfd2180090166624797e80300387153fd1d2b7c41
Instruction ID: 1672cdaf7713208ec41c28ee2fe358693739d085b55488fb30c6fcfb52c995e8
Opcode Fuzzy Hash: 74929e55f53ff8923f5429bbfd2180090166624797e80300387153fd1d2b7c41
Instruction Fuzzy Hash: 1D91EFB2A00288DBDF759E28CD847DA37B3FF58304F55422EED488B220D371AA858B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C86D95, Relevance: 1.4, Strings: 1, Instructions: 187COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: 65de9141704e5e0ce8f2003703dabf978db09a13d31566d5514231eb47fe0e71
Instruction ID: 8386a3f09bb482a5b9fe9a7a8052a01ad09f22024c1cb3be4c4d73ffef4ac11a
Opcode Fuzzy Hash: 65de9141704e5e0ce8f2003703dabf978db09a13d31566d5514231eb47fe0e71
Instruction Fuzzy Hash: 097102B2A00288DBDF75AE68CD847EE77B3FF58314F59421EED498B120D3716A858B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C86E28, Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

!^L$, xrefs: 04C87131

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: !^L$
API String ID: 0-1059581989
Opcode ID: 8fab306cb7d4f0a616503d32b9cb9c8dfda06f46ed578f90e07162d7d4f64b08
Instruction ID: bddbd81ac4b9c12a200c0e6aed33d629a58c3e5808497963aec9837929bcbb58
Opcode Fuzzy Hash: 8fab306cb7d4f0a616503d32b9cb9c8dfda06f46ed578f90e07162d7d4f64b08
Instruction Fuzzy Hash: A261F1B2A01248DBCF74AE68CD847ED77B3FF48304F65422EDD498B120D3716A869B41

Uniqueness

Uniqueness Score: -1.00%

Function 04C8051E, Relevance: 1.4, Strings: 1, Instructions: 102COMMON

Download Yara Rule

Strings

5P$:, xrefs: 04C80562

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 5P$:
API String ID: 0-3186213163
Opcode ID: 8bbaaf92886852c17c2ff7c6f4d606867896d8583c835de18e1672c16089b73d
Instruction ID: 72d429610659017f31998718a59800c9a0fbefd6cd60122109865dc6ba9fde1e
Opcode Fuzzy Hash: 8bbaaf92886852c17c2ff7c6f4d606867896d8583c835de18e1672c16089b73d
Instruction Fuzzy Hash: 6B315932808345DBC3095F36C988687BBA2EFA1714F364B9DD9949B461D339658FDB02

Uniqueness

Uniqueness Score: -1.00%

Function 04C804E6, Relevance: 1.4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

Strings

5P$:, xrefs: 04C80562

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 5P$:
API String ID: 0-3186213163
Opcode ID: 194395ad2eab9bb60ea3029f3734bc13636faaa2f7ed48488d3d08a2830f8f88
Instruction ID: 6bd5aeee513149137cd0d5bb8d7734445010fba9670796f23631e3e8d9cab190
Opcode Fuzzy Hash: 194395ad2eab9bb60ea3029f3734bc13636faaa2f7ed48488d3d08a2830f8f88
Instruction Fuzzy Hash: CC319732808345DFD7095F36CC48A8BBBA2EFA1714F364A5EC9849B461D335688FDB02

Uniqueness

Uniqueness Score: -1.00%

Function 04C804D3, Relevance: 1.3, Strings: 1, Instructions: 93COMMON

Download Yara Rule

Strings

5P$:, xrefs: 04C80562

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: 5P$:
API String ID: 0-3186213163
Opcode ID: cfda4dac92077a4eb6da2d017a7d4b08526b75f150522eb94956329a2581f07e
Instruction ID: d6685a81b59fe1c232f7e4d032486c3628a257ab33b75b43ebf4ff2b7106d947
Opcode Fuzzy Hash: cfda4dac92077a4eb6da2d017a7d4b08526b75f150522eb94956329a2581f07e
Instruction Fuzzy Hash: 8F31B872808345DFDB549F32CC4468BBBE2AF92304F37490ED6846B461E37468CAC742

Uniqueness

Uniqueness Score: -1.00%

Function 04C8B397, Relevance: 1.3, Strings: 1, Instructions: 38COMMON

Download Yara Rule

Strings

N: ?, xrefs: 04C8B427, 04C8B437

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID: N: ?
API String ID: 0-1351719371
Opcode ID: 998f9a3ab3b5a9ed8ca8832df26506bb42061cf7970319018eb3b83e5b944fd5
Instruction ID: 1f319c3439d6ee74f5d47b3217d2a6e90944363be07a696cda52267c5906a8fe
Opcode Fuzzy Hash: 998f9a3ab3b5a9ed8ca8832df26506bb42061cf7970319018eb3b83e5b944fd5
Instruction Fuzzy Hash: D811D734200285DFCB34EF55D985BDA73A6FF99318F15416EEA098B265E730BA00DB15

Uniqueness

Uniqueness Score: -1.00%

Function 04C8C285, Relevance: .5, Instructions: 538COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a10201bda2d70287350d2e071738fb149494006d8f2989ca9d62ffe4b36c40f
Instruction ID: 1269b2f9aa784943cfe53d5d7841bd8edf03adc19aaf2777c15e6a8fe5483f75
Opcode Fuzzy Hash: 4a10201bda2d70287350d2e071738fb149494006d8f2989ca9d62ffe4b36c40f
Instruction Fuzzy Hash: 1F32F8715083C58FDB35DF39C8887DA7BE2AF56324F4981AEC8998F296D3349641C722

Uniqueness

Uniqueness Score: -1.00%

Function 04C88A8F, Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f737054542f3840b501feb952a6babb1d34ef2ee068c933389252294078e3d28
Instruction ID: bf7f1c719b64780d6432076f5d70d4dc11c3bb960870ee01ae5e00efcb5c591c
Opcode Fuzzy Hash: f737054542f3840b501feb952a6babb1d34ef2ee068c933389252294078e3d28
Instruction Fuzzy Hash: 06A1BF7164428ACFDB74AF65CD01BEE3BB2BF54344F46441EDC8AAB620E3706A41DB52

Uniqueness

Uniqueness Score: -1.00%

Function 04C88AF5, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cbc77c6b54b9f8c444adc78d62df8f2f5c5a6f6414d3a9287a2c36b36fd64b1
Instruction ID: cf500e517fbb10118e1525bac7338338f58f7f7fd499712c85d7cc3ae163d4eb
Opcode Fuzzy Hash: 3cbc77c6b54b9f8c444adc78d62df8f2f5c5a6f6414d3a9287a2c36b36fd64b1
Instruction Fuzzy Hash: C781EE7254438A8FCB74AF35CD01BEE7BA2AF54344F46452EDC8A9B620E3306A45DB52

Uniqueness

Uniqueness Score: -1.00%

Function 04C89154, Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7f96caff4f44961904d21640b326a7caa8c391522602e37605a651f9d5c3019
Instruction ID: fd1e1dfd2024b719a894cc8215d63cdfbd6ad966f116e47b0f76e8fe84f99b00
Opcode Fuzzy Hash: e7f96caff4f44961904d21640b326a7caa8c391522602e37605a651f9d5c3019
Instruction Fuzzy Hash: 5581DF7254838ACFCB746F35CD01BEA7BB2AF55304F46442EDC8A9A520E330AA45DB56

Uniqueness

Uniqueness Score: -1.00%

Function 04C890E6, Relevance: .2, Instructions: 186COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c702a1b1452fe55e73d361d698c65ec659cb4c4f82dc46260f594ad7cbece943
Instruction ID: d43dd8fa19a3005a3663641a169896c27ad6af2082a2353524481f42acd50f0e
Opcode Fuzzy Hash: c702a1b1452fe55e73d361d698c65ec659cb4c4f82dc46260f594ad7cbece943
Instruction Fuzzy Hash: B381DE7264438ACFCB746E35CD01BEA77B2EF14304F46452EDC8A9A620E3306A45DF16

Uniqueness

Uniqueness Score: -1.00%

Function 04C88BBA, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c53dbec16da980c13befb9e7b2a319dbccfca0014079eb28dc3a3cac49d55da5
Instruction ID: 7f06c2504aa3883e138b5d6ebad61ec0e6560fc3acc0e20e39d0d3bdf09d9916
Opcode Fuzzy Hash: c53dbec16da980c13befb9e7b2a319dbccfca0014079eb28dc3a3cac49d55da5
Instruction Fuzzy Hash: 3061CB3158428A8FCB74AE35CD417EA77A2EF14304F45452EDC8A9B620E370AA46DB56

Uniqueness

Uniqueness Score: -1.00%

Function 04C88C06, Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 648042e10bbb3147d11b4fd785b771bc9933fca28115c9ac06ea118622f39f65
Instruction ID: 2f420282daa81c2e1d85e08e3d8406ac81b261a11b9c476ab885318d138518a0
Opcode Fuzzy Hash: 648042e10bbb3147d11b4fd785b771bc9933fca28115c9ac06ea118622f39f65
Instruction Fuzzy Hash: 4F61DD3158838A8FCB75AE34CD417EA3BB2AF15304F45452EDC8ADB160E330AA46DB52

Uniqueness

Uniqueness Score: -1.00%

Function 04C85A55, Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6811300c4dcc6524c62d53f7f86d5f1b295c625a56cf76dfb3bceaf908ec269
Instruction ID: b95d1214a3a788b4d1fb1e896b0cf97c922fc5d189617eb031c67a9ba43672c4
Opcode Fuzzy Hash: f6811300c4dcc6524c62d53f7f86d5f1b295c625a56cf76dfb3bceaf908ec269
Instruction Fuzzy Hash: 84511432505749EFDB31CF298A946E677E3EF95304F54462FC8898B645C371BA4ACB02

Uniqueness

Uniqueness Score: -1.00%

Function 04C85A31, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 932ac912cac207ce6c8dac6664217d41695d30922692f510c73c0cc834440683
Instruction ID: 1e50b094957a2bb06eac519cd83b677fe687ad8488d84fa955e6ce6c9b3b2c08
Opcode Fuzzy Hash: 932ac912cac207ce6c8dac6664217d41695d30922692f510c73c0cc834440683
Instruction Fuzzy Hash: 2251C072A05749EFDB70DE26CAD47E637E3AF98304F54412E984A9B604D371BA418B06

Uniqueness

Uniqueness Score: -1.00%

Function 04C88CCE, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9516efb94b1f5b1850998a352933b17a91804c1c35eb3342d217b0ee22ac952c
Instruction ID: eac670f47fb9d1bfdd1487fb4108d8786860b61a9cdf4c2c93a92f7e87a988ba
Opcode Fuzzy Hash: 9516efb94b1f5b1850998a352933b17a91804c1c35eb3342d217b0ee22ac952c
Instruction Fuzzy Hash: A951DF3158438ACFCB74AE35CD41BEA37B2AF14304F45452E9C8A9B520E331AA46EF52

Uniqueness

Uniqueness Score: -1.00%

Function 04C88D15, Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fb57bccb47884f42fa161713fc391d87a1b7596068ae14c041fc5e24b71144f
Instruction ID: a0bae6d8f66ef3d1eb630037f65819766472113b3f3e388f8d7e88136e7dc489
Opcode Fuzzy Hash: 2fb57bccb47884f42fa161713fc391d87a1b7596068ae14c041fc5e24b71144f
Instruction Fuzzy Hash: FA51C13158428ACFCB74AE35CD41BFA77A2EF14304F45452E9C8ADB520D331AA46EF52

Uniqueness

Uniqueness Score: -1.00%

Function 04C80584, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11bc479090287b10c2642c15192f662dcae8bc1ff662ffd34f5c722402be3b51
Instruction ID: 4459dfa17dda5863e5ea71a1a5f947471d7c47e870fb3849e663ebced75667b6
Opcode Fuzzy Hash: 11bc479090287b10c2642c15192f662dcae8bc1ff662ffd34f5c722402be3b51
Instruction Fuzzy Hash: FD31CA32808644DBC3094F3ACD48A97FBA2EFA2714F36479DC990AB461D336648FDB01

Uniqueness

Uniqueness Score: -1.00%

Function 04C805DA, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b68171d5fdb667fd9e5a287d092f894336c8bd63bc447dc493861b42225b4b4
Instruction ID: 0231e4d0ca4b3e7a15d9a7d062a34f6919fb2747968ecd735e1bc98457392d07
Opcode Fuzzy Hash: 2b68171d5fdb667fd9e5a287d092f894336c8bd63bc447dc493861b42225b4b4
Instruction Fuzzy Hash: 2A218B338042459BD3198F3ACD48A86F7A2AFA2714F36479DC950AB491D33A658FD701

Uniqueness

Uniqueness Score: -1.00%

Function 04C88297, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5506d9982921cb45e70f0bf1bac2c3ff3fa872f1ef660afd8c0f4953ff98407f
Instruction ID: 1530306adb9f4c05d354dca0a6cd7188a7b59bf39b7e00994aa621333558ddf0
Opcode Fuzzy Hash: 5506d9982921cb45e70f0bf1bac2c3ff3fa872f1ef660afd8c0f4953ff98407f
Instruction Fuzzy Hash: C6210A72548288DBD7A4DE26CC497DB73E2BFD4704F85411EAC899B610E3349641CB17

Uniqueness

Uniqueness Score: -1.00%

Function 00401E86, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.803389432.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.803377846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.803472174.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803484408.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf1ea41f6cf40f1bfa25f042d97a798f6d8526d0b6c5b1b9709a180f32504ac2
Instruction ID: 193219c69f73ca9467cef45ba6d276ac33edb2287ae752fed00b0b65091828dd
Opcode Fuzzy Hash: cf1ea41f6cf40f1bfa25f042d97a798f6d8526d0b6c5b1b9709a180f32504ac2
Instruction Fuzzy Hash: 8E115633265AA59FCF619EA8C4C079E7B73AB8B3113C615D1D0406F418CB727893EA96

Uniqueness

Uniqueness Score: -1.00%

Function 04C87CFD, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b00ce978390d96005758edc851a5795c8e5e88f3c7b0091009ad064b09e2ebb
Instruction ID: fe62aff64010bc73b52b768c910787fe35167cddecedb31e61b17bf56a705c14
Opcode Fuzzy Hash: 2b00ce978390d96005758edc851a5795c8e5e88f3c7b0091009ad064b09e2ebb
Instruction Fuzzy Hash: E3C08043D57156593FF13BB46F081760407174182C374C7572405C5609FD41DF446055

Uniqueness

Uniqueness Score: -1.00%

Function 04C87AD4, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85bf63101bc4ede40701e428cf226b97f5d05e643cbe10a180365ee58b9f7a7c
Instruction ID: b3a6f19ea8a30c2515f570200d4892c4cbcfec0911553c30f3334d1fb5bced6a
Opcode Fuzzy Hash: 85bf63101bc4ede40701e428cf226b97f5d05e643cbe10a180365ee58b9f7a7c
Instruction Fuzzy Hash: 48C092BB701581CFFB42DB08C491B8073B0FB14A88BC80490E802DB712C328ED40CA00

Uniqueness

Uniqueness Score: -1.00%

Function 04C8A906, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.805543754.0000000004C80000.00000040.00000001.sdmp, Offset: 04C80000, based on PE: false

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction ID: bebcbd0f18a999ce64e2d619b59837d29f74db5f3d96bd371bc818b82041d4c7
Opcode Fuzzy Hash: ab2d7faec90206d04624137dcf391b9a6c0b9a6dad95826754e4c5e29fff86cb
Instruction Fuzzy Hash: F9B00179662A80CFCE96CF09C290E40B3B4FB48B50F4258D0E8118BB22C268E900CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00420103, Relevance: 80.7, APIs: 43, Strings: 3, Instructions: 243
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E00420103(void* __ebx, void* __ecx, signed int* __edi, void* __esi, void* __fp0, signed int _a4, void* _a82) {
				void* _v2;
				void* _v3;
				void* _v5;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				signed int _v28;
				void* _v32;
				void* _v36;
				char _v40;
				char _v44;
				intOrPtr _v52;
				char _v60;
				intOrPtr _v68;
				char _v76;
				char _v92;
				char _v108;
				char _v112;
				char* _v120;
				intOrPtr _v128;
				char _v148;
				char _v152;
				void* _v156;
				signed int _v160;
				intOrPtr* _v164;
				signed int _v168;
				short _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				signed int _v188;
				signed int _v192;
				signed int _t285;
				signed int _t286;
				char* _t291;
				char* _t292;
				signed int _t296;
				char* _t297;
				signed int _t301;
				signed int _t307;
				intOrPtr* _t309;
				signed char _t316;
				intOrPtr* _t320;
				intOrPtr* _t323;
				intOrPtr* _t325;
				intOrPtr* _t326;
				intOrPtr* _t327;
				intOrPtr* _t330;
				intOrPtr* _t333;
				signed char _t334;
				char* _t377;
				void* _t384;
				void* _t385;
				char* _t422;
				char* _t423;
				signed char _t425;
				signed char* _t426;
				signed int* _t438;
				void* _t477;
				void* _t478;
				intOrPtr _t498;

				_t477 = __esi;
				_t438 = __edi;
				_t384 = __ebx;
				_push(0x4012a6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t498;
				L004012A0();
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = _t498;
				_v8 = 0x401290;
				_v180 = 0x9b84;
				_v176 = 1;
				_v28 = _v28 & 0x00000000;
				while(1) {
					_t285 = _v28;
					if(_t285 > _v180) {
						break;
					}
					L004014CE();
					_push(0x68);
					_t286 = _a4;
					_push( *((intOrPtr*)(_t286 + 0x88)));
					L0040136C();
					L004014C8();
					_push(_t286);
					_push(L"Statemonger4");
					L004013EA();
					asm("sbb eax, eax");
					_v156 =  ~( ~( ~_t286));
					L004014BC();
					if(_v156 != 0) {
						_push(0x37);
						_push( &_v60);
						L00401366();
						_push( &_v60);
						L0040149E();
						L004014C8();
						L004014CE();
						L004014BC();
						L004014F8();
						_push( &_v60);
						L00401360();
						_push( &_v60);
						L0040149E();
						L004014C8();
						L004014F8();
					}
					_v52 = 0x39b5ff;
					_v60 = 3;
					_t291 =  &_v60;
					L0040135A();
					L004014C8();
					_t422 = _t291;
					L004014CE();
					L004014BC();
					L004014F8();
					L0040134E();
					_t292 =  &_v40;
					L00401354();
					_v156 = _t292;
					_t296 =  *((intOrPtr*)( *_v156 + 0x1c))(_v156,  &_v148, _t292, _t291, _t291, 0xffffffff, 0xfffffffe, 0xfffffffe, 0xfffffffe);
					asm("fclex");
					_v160 = _t296;
					if(_v160 >= 0) {
						_t47 =  &_v188;
						 *_t47 = _v188 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x404ce0);
						_push(_v156);
						_push(_v160);
						L00401462();
						_v188 = _t296;
					}
					L0040134E();
					_t297 =  &_v44;
					L00401354();
					_v164 = _t297;
					_t301 =  *((intOrPtr*)( *_v164 + 0x1c))(_v164,  &_v152, _t297, _t296);
					asm("fclex");
					_v168 = _t301;
					if(_v168 >= 0) {
						_t60 =  &_v192;
						 *_t60 = _v192 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x404ce0);
						_push(_v164);
						_push(_v168);
						L00401462();
						_v192 = _t301;
					}
					_v172 =  ~(0 | _v148 - _v152 >= 0x00000000);
					_push( &_v44);
					_push( &_v40);
					_push(2);
					L00401348();
					_t498 = _t498 + 0xc;
					if(_v172 != 0) {
						_v68 = 0xaf;
						_v76 = 2;
						_v120 = L"ADVERTENTLY";
						_v128 = 8;
						L004014E0();
						_push( &_v76);
						_push(0x9f);
						_push( &_v60);
						_push( &_v92);
						L00401372();
						_push(0);
						_push(0x80);
						_push( &_v92);
						_push( &_v108);
						L00401336();
						_push( &_v108);
						_push( &_v112);
						L0040133C();
						_push( &_v112);
						_push(_a4 + 0x94);
						L00401342();
						_push( &_v108);
						_push( &_v92);
						_push( &_v76);
						_push( &_v60);
						_push(4);
						L004014DA();
						_v120 = 0x404d10;
						_v128 = 8;
						L004014E0();
						_push( &_v60);
						_push(0xbe);
						_push( &_v76);
						L004013A8();
						_t377 =  &_v76;
						_push(_t377);
						L0040149E();
						L004014C8();
						_t422 = _t377;
						L004014CE();
						L004014BC();
						_push( &_v76);
						_push( &_v60);
						_push(2);
						L004014DA();
						_t498 = _t498 + 0x20;
					}
					_t307 = _v28 + _v176;
					if(_t307 < 0) {
						L00401408();
						asm("int3");
						asm("int3");
						asm("int3");
						asm("sahf");
						asm("sahf");
						asm("sahf");
						asm("sahf");
						asm("sbb al, 0x5");
						asm("invalid");
						asm("invalid");
						asm("invalid");
						asm("invalid");
						asm("int3");
						_t309 = _t307 +  *_t307 +  *((intOrPtr*)(_t307 +  *_t307));
						 *_t309 =  *_t309 + _t422;
						 *_t309 =  *_t309 + _t309;
						 *_t309 =  *_t309 + _t309;
						 *_t309 =  *_t309 + _t309;
						 *_t309 =  *_t309 + _t309;
						 *_t309 =  *_t309 + _t309;
						 *_t309 =  *_t309 + _t309;
						 *_t309 =  *_t309 + _t309;
						 *_t309 =  *_t309 + _t309;
						 *_t309 =  *_t309 + _t309;
						 *_t309 =  *_t309 + _t309;
						 *_t309 =  *_t309 + _t309;
						asm("fiadd dword [esi]");
						_t478 = _t477 + 1;
						_t423 = _t422 - 6;
						asm("hlt");
						asm("adc al, [edi]");
						_t316 = _t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)) +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)))) +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)) +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)))))) +  *_t438 +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)) +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)))) +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)) +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)))))) +  *_t438)) +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)) +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)))) +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)) +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)))))) +  *_t438 +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)) +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)))) +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)) +  *((intOrPtr*)(_t309 +  *_t309 +  *((intOrPtr*)(_t309 +  *_t309)))))) +  *_t438))));
						 *_t438 =  *_t438 & _t316;
						_t385 = _t384 - 1;
						_t320 = (_t316 +  *_t316 ^ 0x00000007) +  *(_t316 +  *_t316 ^ 0x00000007) +  *((intOrPtr*)((_t316 +  *_t316 ^ 0x00000007) +  *(_t316 +  *_t316 ^ 0x00000007)));
						 *((char*)(_t438 + _t320 + 2)) =  *((char*)(_t438 + _t320 + 2));
						es = _t498;
						es = es;
						_t323 = _t320 +  *_t320 +  *((intOrPtr*)(_t320 +  *_t320)) +  *((intOrPtr*)(_t320 +  *_t320 +  *((intOrPtr*)(_t320 +  *_t320))));
						es = es;
						_t325 = _t323 +  *_t323 +  *((intOrPtr*)(_t323 +  *_t323));
						 *_t423 =  *_t423 + _t325;
						 *((intOrPtr*)(_t325 - 0x7ffffdfe)) =  *((intOrPtr*)(_t325 - 0x7ffffdfe)) + _t325;
						0x207();
						 *_t438 =  *_t438 + _t325;
						_t326 = _t325 +  *_t325;
						 *(_t423 + _t326) =  *(_t423 + _t326) ^ 0x00000080;
						_t327 = _t326 +  *_t326;
						 *_t423 =  *_t423 - 2;
						 *((intOrPtr*)(_t327 - 0x7ffffd6a)) =  *((intOrPtr*)(_t327 - 0x7ffffd6a)) + _t327;
						asm("retf 0x207");
						_pop(es);
						_t425 = _t423 + _t385 ^ 0x00000007;
						_t330 = _t327 +  *_t327 +  *[cs:eax] +  *((intOrPtr*)(_t327 +  *_t327 +  *[cs:eax]));
						 *_t330 =  *_t330 + 0x8a800002;
						asm("adc [eax], cl");
						asm("popfd");
						_t333 = _t330 +  *_t330 +  *((intOrPtr*)(_t330 +  *_t330)) +  *((intOrPtr*)(_t330 +  *_t330 +  *((intOrPtr*)(_t330 +  *_t330))));
						 *(_t333 + 0x8a800002) =  *(_t333 + 0x8a800002) & 0x00000002;
						 *(_t333 + 0x8a800002) =  *(_t333 + 0x8a800002) + _t425;
						_t334 = _t333 +  *_t333;
						_t426 = _t425 + 1;
						 *_t426 =  *_t426 | _t334;
						 *((intOrPtr*)(_t478 + 0x54800002)) =  *((intOrPtr*)(_t478 + 0x54800002)) + _t385;
						 *_t426 =  *_t426 | _t334;
						 *((intOrPtr*)(_t478 + 2)) =  *((intOrPtr*)(_t478 + 2)) + _t426;
						 *((intOrPtr*)(_t334 - 0x7ffffd40)) =  *((intOrPtr*)(_t334 - 0x7ffffd40)) + _t334;
						asm("rol dword [edx], 0x0");
						 *_t426 =  *_t426 | 0x00000002;
						_t124 = _t334 + 0x20866;
						 *_t124 =  *(_t334 + 0x20866) + _t334;
						if( *_t124 >= 0) {
							_t334 = _t334 +  *_t334 | 0x00000002;
							_t126 = _t334 - 0x7ffffdf3;
							 *_t126 =  *(_t334 - 0x7ffffdf3) + _t334;
						}
						_t128 = _t334 + 0x2087c;
						 *_t128 =  *(_t334 + 0x2087c) + _t334;
					} else {
						_v28 = _t307;
						continue;
					}
				}
				L00401330();
				_v24 = _t285;
				asm("wait");
				_push(0x4204cd);
				L004014BC();
				return _t285;
			}

0x00420103
0x00420103
0x00420103
0x00420108
0x00420113
0x00420114
0x00420120
0x00420125
0x00420126
0x00420127
0x00420128
0x0042012b
0x00420132
0x0042013c
0x00420146
0x0042015e
0x0042015e
0x00420167
0x00000000
0x00000000
0x0042017b
0x00420180
0x00420182
0x00420185
0x0042018b
0x00420195
0x0042019a
0x0042019b
0x004201a0
0x004201a7
0x004201ad
0x004201b7
0x004201c5
0x004201c7
0x004201cc
0x004201cd
0x004201d5
0x004201d6
0x004201e0
0x004201f0
0x004201f8
0x00420200
0x00420208
0x00420209
0x00420211
0x00420212
0x0042021c
0x00420224
0x00420224
0x00420229
0x00420230
0x0042023f
0x00420243
0x0042024d
0x00420252
0x0042025d
0x00420265
0x0042026d
0x00420272
0x00420278
0x0042027c
0x00420281
0x0042029c
0x0042029f
0x004202a1
0x004202ae
0x004202d0
0x004202d0
0x004202b0
0x004202b0
0x004202b2
0x004202b7
0x004202bd
0x004202c3
0x004202c8
0x004202c8
0x004202d7
0x004202dd
0x004202e1
0x004202e6
0x00420301
0x00420304
0x00420306
0x00420313
0x00420335
0x00420335
0x00420315
0x00420315
0x00420317
0x0042031c
0x00420322
0x00420328
0x0042032d
0x0042032d
0x0042034f
0x00420359
0x0042035d
0x0042035e
0x00420360
0x00420365
0x00420371
0x00420377
0x0042037e
0x00420385
0x0042038c
0x00420399
0x004203a1
0x004203a2
0x004203aa
0x004203ae
0x004203af
0x004203b4
0x004203b6
0x004203be
0x004203c2
0x004203c3
0x004203cb
0x004203cf
0x004203d0
0x004203d8
0x004203e1
0x004203e2
0x004203ea
0x004203ee
0x004203f2
0x004203f6
0x004203f7
0x004203f9
0x00420401
0x00420408
0x00420415
0x0042041d
0x0042041e
0x00420426
0x00420427
0x0042042c
0x0042042f
0x00420430
0x0042043a
0x0042043f
0x0042044a
0x00420452
0x0042045a
0x0042045e
0x0042045f
0x00420461
0x00420466
0x00420466
0x0042014f
0x00420155
0x004204e8
0x004204ed
0x004204ee
0x004204ef
0x004204f0
0x004204f1
0x004204f2
0x004204f3
0x004204f4
0x004204f8
0x004204fa
0x004204fc
0x004204fe
0x00420500
0x00420502
0x00420504
0x00420506
0x00420508
0x0042050a
0x0042050c
0x0042050e
0x00420510
0x00420512
0x00420514
0x00420516
0x00420518
0x0042051a
0x0042051c
0x00420520
0x00420523
0x00420528
0x00420530
0x00420532
0x00420534
0x0042053c
0x0042053d
0x0042053f
0x00420545
0x00420548
0x0042054d
0x0042055d
0x0042055e
0x00420560
0x00420562
0x00420568
0x0042056f
0x00420571
0x00420573
0x0042057d
0x0042057f
0x00420582
0x00420588
0x0042058d
0x00420593
0x00420596
0x00420598
0x0042059c
0x004205a0
0x004205a1
0x004205a3
0x004205a7
0x004205aa
0x004205ac
0x004205ad
0x004205af
0x004205b5
0x004205b7
0x004205ba
0x004205c0
0x004205c3
0x004205c6
0x004205c6
0x004205cc
0x004205d0
0x004205d2
0x004205d2
0x004205d2
0x004205d6
0x004205d6
0x0042015b
0x0042015b
0x00000000
0x0042015b
0x00420155
0x00420474
0x00420479
0x0042047c
0x0042047d
0x004204c7
0x004204cc

APIs

__vbaChkstk.MSVBVM60(?,004012A6), ref: 00420120
__vbaStrCopy.MSVBVM60 ref: 0042017B
#514.MSVBVM60(?,00000068), ref: 0042018B
__vbaStrMove.MSVBVM60(?,00000068), ref: 00420195
__vbaStrCmp.MSVBVM60(Statemonger4,00000000,?,00000068), ref: 004201A0
__vbaFreeStr.MSVBVM60(Statemonger4,00000000,?,00000068), ref: 004201B7
#526.MSVBVM60(?,00000037,Statemonger4,00000000,?,00000068), ref: 004201CD
__vbaStrVarMove.MSVBVM60(?,?,00000037,Statemonger4,00000000,?,00000068), ref: 004201D6
__vbaStrMove.MSVBVM60(?,?,00000037,Statemonger4,00000000,?,00000068), ref: 004201E0
__vbaStrCopy.MSVBVM60(?,?,00000037,Statemonger4,00000000,?,00000068), ref: 004201F0
__vbaFreeStr.MSVBVM60(?,?,00000037,Statemonger4,00000000,?,00000068), ref: 004201F8
__vbaFreeVar.MSVBVM60(?,?,00000037,Statemonger4,00000000,?,00000068), ref: 00420200
#670.MSVBVM60(?,?,?,00000037,Statemonger4,00000000,?,00000068), ref: 00420209
__vbaStrVarMove.MSVBVM60(?,?,?,?,00000037,Statemonger4,00000000,?,00000068), ref: 00420212
__vbaStrMove.MSVBVM60(?,?,?,?,00000037,Statemonger4,00000000,?,00000068), ref: 0042021C
__vbaFreeVar.MSVBVM60(?,?,?,?,00000037,Statemonger4,00000000,?,00000068), ref: 00420224
#702.MSVBVM60(00000003,000000FF,000000FE,000000FE,000000FE,Statemonger4,00000000,?,00000068), ref: 00420243
__vbaStrMove.MSVBVM60(00000003,000000FF,000000FE,000000FE,000000FE,Statemonger4,00000000,?,00000068), ref: 0042024D
__vbaStrCopy.MSVBVM60(00000003,000000FF,000000FE,000000FE,000000FE,Statemonger4,00000000,?,00000068), ref: 0042025D
__vbaFreeStr.MSVBVM60(00000003,000000FF,000000FE,000000FE,000000FE,Statemonger4,00000000,?,00000068), ref: 00420265
__vbaFreeVar.MSVBVM60(00000003,000000FF,000000FE,000000FE,000000FE,Statemonger4,00000000,?,00000068), ref: 0042026D
#685.MSVBVM60(00000003,000000FF,000000FE,000000FE,000000FE,Statemonger4,00000000,?,00000068), ref: 00420272
__vbaObjSet.MSVBVM60(?,00000000,00000003,000000FF,000000FE,000000FE,000000FE,Statemonger4,00000000,?,00000068), ref: 0042027C
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404CE0,0000001C), ref: 004202C3
#685.MSVBVM60(00000000,?,00404CE0,0000001C), ref: 004202D7
__vbaObjSet.MSVBVM60(?,00000000), ref: 004202E1
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404CE0,0000001C), ref: 00420328
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00420360
__vbaVarDup.MSVBVM60 ref: 00420399
#629.MSVBVM60(?,?,0000009F,00000002), ref: 004203AF
#717.MSVBVM60(?,?,00000080,00000000,?,?,0000009F,00000002), ref: 004203C3
__vbaVar2Vec.MSVBVM60(?,?,?,?,00000080,00000000,?,?,0000009F,00000002), ref: 004203D0
__vbaAryMove.MSVBVM60(?,?,?,?,?,?,00000080,00000000,?,?,0000009F,00000002), ref: 004203E2
__vbaFreeVarList.MSVBVM60(00000004,?,00000002,?,?,?,?,?,?,?,?,00000080,00000000,?,?,0000009F), ref: 004203F9
__vbaVarDup.MSVBVM60 ref: 00420415
#607.MSVBVM60(?,000000BE,?), ref: 00420427
__vbaStrVarMove.MSVBVM60(?,?,000000BE,?), ref: 00420430
__vbaStrMove.MSVBVM60(?,?,000000BE,?), ref: 0042043A
__vbaStrCopy.MSVBVM60(?,?,000000BE,?), ref: 0042044A
__vbaFreeStr.MSVBVM60(?,?,000000BE,?), ref: 00420452
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,000000BE,?), ref: 00420461
__vbaR8IntI4.MSVBVM60 ref: 00420474
__vbaFreeStr.MSVBVM60(004204CD), ref: 004204C7

Strings

Statemonger4, xrefs: 0042019B
BECRY, xrefs: 0042016D
ADVERTENTLY, xrefs: 00420385

Memory Dump Source

Source File: 00000000.00000002.803389432.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.803377846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.803472174.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803484408.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$Copy$List$#685CheckHresult$#514#526#607#629#670#702#717ChkstkVar2
String ID: ADVERTENTLY$BECRY$Statemonger4
API String ID: 407260883-2726011186
Opcode ID: 4c069a4986b28515122ce4f796d0dbfa188b9c90a015c07d3bc2fabc17322ace
Instruction ID: 0df0f7ef93cc2af2300959acc305587d336437537ee24f4d6ad938e138ec9a38
Opcode Fuzzy Hash: 4c069a4986b28515122ce4f796d0dbfa188b9c90a015c07d3bc2fabc17322ace
Instruction Fuzzy Hash: 40A1FF71900218ABDB10EBA1DC85FDEB7B9AF04304F50417AF509B71E2DB789A89CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0041EFB9, Relevance: 66.7, APIs: 33, Strings: 5, Instructions: 201
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E0041EFB9(void* __ebx, void* __edi, void* __esi, long long __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				signed int _v52;
				intOrPtr _v60;
				char _v68;
				char _v84;
				intOrPtr _v92;
				intOrPtr _v96;
				char _v100;
				short _v108;
				long long _v116;
				char* _v124;
				char _v132;
				char* _v140;
				char _v148;
				short _v152;
				char* _v156;
				char _v164;
				intOrPtr _v168;
				char* _t79;
				short _t81;
				short _t96;
				char* _t98;
				signed int _t99;
				char* _t103;
				char* _t110;
				intOrPtr _t124;
				void* _t136;
				void* _t138;
				intOrPtr _t139;
				intOrPtr _t140;

				_t148 = __fp0;
				_t136 = _t138;
				_t139 = _t138 - 0x10;
				_push(0x4012a6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t139;
				L004012A0();
				_v20 = _t139;
				_v16 = 0x4011c8;
				_v12 = 0;
				_v8 = 0;
				_push(L"Depotindehavere6");
				L00401474();
				_v60 = 0x8c;
				_v68 = 3;
				_push( &_v68);
				_t79 =  &_v84;
				_push(_t79);
				L0040144A();
				_push(0x861e3e);
				L00401444();
				_v92 = _t79;
				_v100 = 0x8008;
				_push( &_v84);
				_t81 =  &_v100;
				_push(_t81);
				L00401450();
				_v152 = _t81;
				_push( &_v100);
				_push( &_v84);
				_push( &_v68);
				_push(3);
				L004014DA();
				_t140 = _t139 + 0x10;
				if(_v152 != 0) {
					_push(0);
					_push(0x6e);
					_push(1);
					_push(0x11);
					_t103 =  &_v40;
					_push(_t103);
					_push(1);
					_push(0x80);
					L0040143E();
					_t140 = _t140 + 0x1c;
					_push(_v40);
					_push(1);
					L00401438();
					_v32 = _t103;
					_push(0x35);
					_push(0xf0);
					_push(0x4c);
					L00401432();
					_t124 =  *((intOrPtr*)(_a4 + 0x4c)) + _t103;
					if(_t124 < 0) {
						L00401408();
						_push(_t136);
						_push(_t124);
						_push(_t124);
						_push(0x4012a6);
						_push( *[fs:0x0]);
						 *[fs:0x0] = _t140;
						_push(0x40);
						L004012A0();
						_v96 = _t140;
						_v92 = 0x4011d8;
						_v156 = L"5/5/5";
						_v164 = 8;
						L004014E0();
						_push( &_v132);
						_push( &_v148);
						L00401426();
						_push( &_v148);
						L0040142C();
						_v116 = __fp0;
						_push( &_v148);
						_t110 =  &_v132;
						_push(_t110);
						_push(2);
						L004014DA();
						_v108 = 0x5717;
						asm("wait");
						_push(0x41f2b8);
						return _t110;
					}
					 *((intOrPtr*)(_a4 + 0x4c)) = _t124;
				}
				_v124 = L"8/8/8";
				_v132 = 8;
				L004014E0();
				_push( &_v68);
				_push( &_v84);
				L00401426();
				_push( &_v84);
				L0040142C();
				 *((long long*)(_a4 + 0x50)) = _t148;
				_push( &_v84);
				_push( &_v68);
				_push(2);
				L004014DA();
				L004014CE();
				_v124 =  &_v36;
				_v132 = 0x4008;
				_push( &_v132);
				_push( &_v68);
				L00401420();
				_v140 = L"Forbedringshusenes3";
				_v148 = 0x8008;
				_push( &_v68);
				_t96 =  &_v148;
				_push(_t96);
				L00401450();
				_v152 = _t96;
				L004014F8();
				if(_v152 != 0) {
					_push(0);
					L004014D4();
					L0040141A();
					L004014C8();
					_t99 = _v52;
					_v168 = _t99;
					_v52 = _v52 & 0x00000000;
					_push(0x85);
					L004014C8();
					_push(_t99);
					L00401414();
					L004014C8();
					L004014CE();
					_push( &_v52);
					_push( &_v48);
					_push( &_v44);
					_push(3);
					L00401480();
				}
				asm("wait");
				_push(0x41f20d);
				L004014BC();
				_t98 =  &_v40;
				_push(_t98);
				_push(0);
				L0040140E();
				return _t98;
			}

0x0041efb9
0x0041efba
0x0041efbc
0x0041efbf
0x0041efca
0x0041efcb
0x0041efd7
0x0041efdf
0x0041efe2
0x0041efe9
0x0041eff0
0x0041eff7
0x0041effc
0x0041f001
0x0041f004
0x0041f00e
0x0041f00f
0x0041f012
0x0041f013
0x0041f018
0x0041f01d
0x0041f022
0x0041f025
0x0041f02f
0x0041f030
0x0041f033
0x0041f034
0x0041f039
0x0041f043
0x0041f047
0x0041f04b
0x0041f04c
0x0041f04e
0x0041f053
0x0041f05f
0x0041f061
0x0041f063
0x0041f065
0x0041f067
0x0041f069
0x0041f06c
0x0041f06d
0x0041f06f
0x0041f074
0x0041f079
0x0041f07c
0x0041f07f
0x0041f081
0x0041f086
0x0041f089
0x0041f08b
0x0041f090
0x0041f092
0x0041f09d
0x0041f09f
0x0041f220
0x0041f225
0x0041f228
0x0041f229
0x0041f22a
0x0041f235
0x0041f236
0x0041f23d
0x0041f240
0x0041f248
0x0041f24b
0x0041f252
0x0041f259
0x0041f266
0x0041f26e
0x0041f272
0x0041f273
0x0041f27b
0x0041f27c
0x0041f281
0x0041f287
0x0041f288
0x0041f28b
0x0041f28c
0x0041f28e
0x0041f296
0x0041f29c
0x0041f29d
0x00000000
0x0041f29d
0x0041f0a8
0x0041f0a8
0x0041f0ab
0x0041f0b2
0x0041f0bf
0x0041f0c7
0x0041f0cb
0x0041f0cc
0x0041f0d4
0x0041f0d5
0x0041f0dd
0x0041f0e3
0x0041f0e7
0x0041f0e8
0x0041f0ea
0x0041f0fa
0x0041f102
0x0041f105
0x0041f10f
0x0041f113
0x0041f114
0x0041f119
0x0041f123
0x0041f130
0x0041f131
0x0041f137
0x0041f138
0x0041f13d
0x0041f147
0x0041f155
0x0041f157
0x0041f159
0x0041f15e
0x0041f168
0x0041f16d
0x0041f170
0x0041f176
0x0041f17a
0x0041f188
0x0041f18d
0x0041f18e
0x0041f198
0x0041f1a5
0x0041f1ad
0x0041f1b1
0x0041f1b5
0x0041f1b6
0x0041f1b8
0x0041f1bd
0x0041f1c0
0x0041f1c1
0x0041f1fc
0x0041f201
0x0041f204
0x0041f205
0x0041f207
0x0041f20c

APIs

__vbaChkstk.MSVBVM60(?,004012A6), ref: 0041EFD7
__vbaLenBstrB.MSVBVM60(Depotindehavere6,?,?,?,?,004012A6), ref: 0041EFFC
#575.MSVBVM60(?,00000003), ref: 0041F013
__vbaStrI4.MSVBVM60(00861E3E,?,00000003), ref: 0041F01D
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?,?,00861E3E,?,00000003), ref: 0041F034
__vbaFreeVarList.MSVBVM60(00000003,00000003,?,00008008,00008008,?,?,?,?,?,?,00861E3E,?,00000003), ref: 0041F04E
__vbaRedim.MSVBVM60(00000080,00000001,00000000,00000011,00000001,0000006E,00000000,?,?,?,004012A6), ref: 0041F074
__vbaLbound.MSVBVM60(00000001,?,?,?,?,?,?,?,?,?,?,?,004012A6), ref: 0041F081
#588.MSVBVM60(0000004C,000000F0,00000035,00000001,?,?,?,?,?,?,?,?,?,?,?,004012A6), ref: 0041F092
__vbaVarDup.MSVBVM60 ref: 0041F0BF
#687.MSVBVM60(?,?), ref: 0041F0CC
__vbaDateVar.MSVBVM60(?,?,?), ref: 0041F0D5
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?), ref: 0041F0EA
__vbaStrCopy.MSVBVM60(?,?,?,?,?,?,004012A6), ref: 0041F0FA
#524.MSVBVM60(?,00004008), ref: 0041F114
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,00004008), ref: 0041F138
__vbaFreeVar.MSVBVM60(00008008,?,?,?,?,00004008), ref: 0041F147
__vbaOnError.MSVBVM60(00000000,00008008,?,?,?,?,00004008), ref: 0041F159
#611.MSVBVM60(00000000,00008008,?,?,?,?,00004008), ref: 0041F15E
__vbaStrMove.MSVBVM60(00000000,00008008,?,?,?,?,00004008), ref: 0041F168
__vbaStrMove.MSVBVM60(00000085,00000000,00008008,?,?,?,?,00004008), ref: 0041F188
#512.MSVBVM60(00000000,00000085,00000000,00008008,?,?,?,?,00004008), ref: 0041F18E
__vbaStrMove.MSVBVM60(00000000,00000085,00000000,00008008,?,?,?,?,00004008), ref: 0041F198
__vbaStrCopy.MSVBVM60(00000000,00000085,00000000,00008008,?,?,?,?,00004008), ref: 0041F1A5
__vbaFreeStrList.MSVBVM60(00000003,?,?,00000000,00000000,00000085,00000000,00008008,?,?,?,?,00004008), ref: 0041F1B8
__vbaFreeStr.MSVBVM60(0041F20D,00008008,?,?,?,?,00004008), ref: 0041F1FC
__vbaAryDestruct.MSVBVM60(00000000,?,0041F20D,00008008,?,?,?,?,00004008), ref: 0041F207
__vbaErrorOverflow.MSVBVM60(0000004C,000000F0,00000035,00000001,?,?,?,?,?,?,?,?,?,?,?,004012A6), ref: 0041F220
__vbaChkstk.MSVBVM60(00000000,004012A6,?,?,?,0000004C,000000F0,00000035,00000001,?), ref: 0041F240
__vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004012A6), ref: 0041F266
#687.MSVBVM60(?,?), ref: 0041F273
__vbaDateVar.MSVBVM60(?,?,?), ref: 0041F27C
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?), ref: 0041F28E

Strings

5/5/5, xrefs: 0041F252
Forbedringshusenes3, xrefs: 0041F119
8/8/8, xrefs: 0041F0AB
laun, xrefs: 0041F0F2
Depotindehavere6, xrefs: 0041EFF7

Memory Dump Source

Source File: 00000000.00000002.803389432.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.803377846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.803472174.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803484408.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$List$Move$#687ChkstkCopyDateError$#512#524#575#588#611BstrDestructLboundOverflowRedim
String ID: 5/5/5$8/8/8$Depotindehavere6$Forbedringshusenes3$laun
API String ID: 609771696-1857968058
Opcode ID: 5d2ea896f3a866deb57b35a16ab7531ac5ce4e9ce3d1ee6de6585cbae56cfb08
Instruction ID: 0b11e98b96facae1345067cc9ecbe62258f25fc668125346d00e96617c98f18b
Opcode Fuzzy Hash: 5d2ea896f3a866deb57b35a16ab7531ac5ce4e9ce3d1ee6de6585cbae56cfb08
Instruction Fuzzy Hash: 21711F71D10219AADB00EBE1CC42FEEB7BCBF04704F50456BF505B71A1EB789A498B69

Uniqueness

Uniqueness Score: -1.00%

Function 0041FEDE, Relevance: 64.9, APIs: 31, Strings: 6, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0041FEDE(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4, void* _a28) {
				intOrPtr _v8;
				long long* _v12;
				void* _v24;
				void* _v28;
				char _v32;
				intOrPtr _v40;
				char _v48;
				intOrPtr _v56;
				char _v64;
				char _v80;
				char _v96;
				char* _v104;
				intOrPtr _v112;
				short _v132;
				char* _t53;
				char* _t54;
				char* _t60;
				char* _t70;
				long long* _t104;
				void* _t108;

				_push(0x4012a6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t104;
				_push(0x74);
				L004012A0();
				_v12 = _t104;
				_v8 = 0x401278;
				L004014CE();
				_v104 = L"valgfriheders";
				_v112 = 8;
				L004014E0();
				_t53 =  &_v48;
				_push(_t53);
				L004013A2();
				_v132 =  ~(0 | _t53 != 0x0000ffff);
				_t70 =  &_v48;
				L004014F8();
				_t54 = _v132;
				if(_t54 != 0) {
					_v104 = 0x404c24;
					_v112 = 8;
					L004014E0();
					_t54 =  &_v48;
					_push(_t54);
					_push(0x74);
					L0040139C();
					L004014C8();
					L004014CE();
					L004014BC();
					L004014F8();
					_push(L"Flashene");
					_push(L"commendator");
					L00401396();
					L004014C8();
					_t108 = _a4 + 0x80;
					L004014CE();
					_t70 =  &_v32;
					L004014BC();
				}
				_push(_t70);
				_push(_t70);
				 *_t104 =  *0x401270;
				L00401384();
				L0040138A();
				L00401390();
				asm("fcomp qword [0x401268]");
				asm("fnstsw ax");
				asm("sahf");
				if(_t108 != 0) {
					_v40 = 0x5a;
					_v48 = 2;
					_push( &_v48);
					_push(0x91);
					_push(L"Lyrikanmeldelser7");
					L0040137E();
					L004014C8();
					L004014CE();
					L004014BC();
					L004014F8();
					_v56 = 0xfc;
					_v64 = 2;
					_v104 = L"subchela";
					_v112 = 8;
					L004014E0();
					_push( &_v64);
					_push(0x52);
					_push( &_v48);
					_push( &_v80);
					L00401372();
					_push( &_v80);
					_t60 =  &_v96;
					_push(_t60);
					L00401378();
					_push(_t60);
					L0040149E();
					L004014C8();
					_push( &_v80);
					_push( &_v64);
					_t54 =  &_v48;
					_push(_t54);
					_push(3);
					L004014DA();
				}
				asm("wait");
				_push(0x4200f0);
				L004014BC();
				L004014BC();
				return _t54;
			}

0x0041fee3
0x0041feee
0x0041feef
0x0041fef6
0x0041fef9
0x0041ff01
0x0041ff04
0x0041ff11
0x0041ff16
0x0041ff1d
0x0041ff2a
0x0041ff2f
0x0041ff32
0x0041ff33
0x0041ff43
0x0041ff47
0x0041ff4a
0x0041ff4f
0x0041ff55
0x0041ff57
0x0041ff5e
0x0041ff6b
0x0041ff70
0x0041ff73
0x0041ff74
0x0041ff76
0x0041ff80
0x0041ff8d
0x0041ff95
0x0041ff9d
0x0041ffa2
0x0041ffa7
0x0041ffac
0x0041ffb6
0x0041ffc0
0x0041ffc6
0x0041ffcb
0x0041ffce
0x0041ffce
0x0041ffd9
0x0041ffda
0x0041ffdb
0x0041ffde
0x0041ffe3
0x0041ffe8
0x0041ffed
0x0041fff3
0x0041fff5
0x0041fff6
0x0041fffc
0x00420003
0x0042000d
0x0042000e
0x00420013
0x00420018
0x00420022
0x00420032
0x0042003a
0x00420042
0x00420047
0x0042004e
0x00420055
0x0042005c
0x00420069
0x00420071
0x00420072
0x00420077
0x0042007b
0x0042007c
0x00420084
0x00420085
0x00420088
0x00420089
0x0042008e
0x0042008f
0x00420099
0x004200a1
0x004200a5
0x004200a6
0x004200a9
0x004200aa
0x004200ac
0x004200b1
0x004200b4
0x004200b5
0x004200e2
0x004200ea
0x004200ef

APIs

__vbaChkstk.MSVBVM60(?,004012A6), ref: 0041FEF9
__vbaStrCopy.MSVBVM60(?,?,?,?,004012A6), ref: 0041FF11
__vbaVarDup.MSVBVM60 ref: 0041FF2A
#558.MSVBVM60(?), ref: 0041FF33
__vbaFreeVar.MSVBVM60(?), ref: 0041FF4A
__vbaVarDup.MSVBVM60(?), ref: 0041FF6B
#606.MSVBVM60(00000074,?,?), ref: 0041FF76
__vbaStrMove.MSVBVM60(00000074,?,?), ref: 0041FF80
__vbaStrCopy.MSVBVM60(00000074,?,?), ref: 0041FF8D
__vbaFreeStr.MSVBVM60(00000074,?,?), ref: 0041FF95
__vbaFreeVar.MSVBVM60(00000074,?,?), ref: 0041FF9D
__vbaStrCat.MSVBVM60(commendator,Flashene,00000074,?,?), ref: 0041FFAC
__vbaStrMove.MSVBVM60(commendator,Flashene,00000074,?,?), ref: 0041FFB6
__vbaStrCopy.MSVBVM60(commendator,Flashene,00000074,?,?), ref: 0041FFC6
__vbaFreeStr.MSVBVM60(commendator,Flashene,00000074,?,?), ref: 0041FFCE
#582.MSVBVM60(?,?,?), ref: 0041FFDE
__vbaFPInt.MSVBVM60(?,?,?), ref: 0041FFE3
__vbaFpR8.MSVBVM60(?,?,?), ref: 0041FFE8
#628.MSVBVM60(Lyrikanmeldelser7,00000091,00000002,?,?,?), ref: 00420018
__vbaStrMove.MSVBVM60(Lyrikanmeldelser7,00000091,00000002,?,?,?), ref: 00420022
__vbaStrCopy.MSVBVM60(Lyrikanmeldelser7,00000091,00000002,?,?,?), ref: 00420032
__vbaFreeStr.MSVBVM60(Lyrikanmeldelser7,00000091,00000002,?,?,?), ref: 0042003A
__vbaFreeVar.MSVBVM60(Lyrikanmeldelser7,00000091,00000002,?,?,?), ref: 00420042
__vbaVarDup.MSVBVM60(Lyrikanmeldelser7,00000091,00000002,?,?,?), ref: 00420069
#629.MSVBVM60(?,00000002,00000052,00000002,Lyrikanmeldelser7,00000091,00000002,?,?,?), ref: 0042007C
__vbaLenVar.MSVBVM60(?,?,?,00000002,00000052,00000002,Lyrikanmeldelser7,00000091,00000002,?,?,?), ref: 00420089
__vbaStrVarMove.MSVBVM60(00000000,?,?,?,00000002,00000052,00000002,Lyrikanmeldelser7,00000091,00000002,?,?,?), ref: 0042008F
__vbaStrMove.MSVBVM60(00000000,?,?,?,00000002,00000052,00000002,Lyrikanmeldelser7,00000091,00000002,?,?,?), ref: 00420099
__vbaFreeVarList.MSVBVM60(00000003,00000002,00000002,?,00000000,?,?,?,00000002,00000052,00000002,Lyrikanmeldelser7,00000091,00000002), ref: 004200AC
__vbaFreeStr.MSVBVM60(004200F0,?,?,?), ref: 004200E2
__vbaFreeStr.MSVBVM60(004200F0,?,?,?), ref: 004200EA

Strings

subchela, xrefs: 00420055
Lyrikanmeldelser7, xrefs: 00420013
Z, xrefs: 0041FFFC
commendator, xrefs: 0041FFA7
Flashene, xrefs: 0041FFA2
valgfriheders, xrefs: 0041FF16

Memory Dump Source

Source File: 00000000.00000002.803389432.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.803377846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.803472174.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803484408.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Move$Copy$#558#582#606#628#629ChkstkList
String ID: Flashene$Lyrikanmeldelser7$Z$commendator$subchela$valgfriheders
API String ID: 3695853280-319128775
Opcode ID: 01901f29b561204eee59850829a42c5f0f2ba20a35a748ea4bf2eaa691dc6ace
Instruction ID: 4a891ea69ebf96a633766c47e134599202518b63de22958c13f779a54f5aac62
Opcode Fuzzy Hash: 01901f29b561204eee59850829a42c5f0f2ba20a35a748ea4bf2eaa691dc6ace
Instruction Fuzzy Hash: 2051F871D002099ADB04EBE5D896AEEB7B8AF04308F50853EF115B61E1EB7C5909CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041F5C0, Relevance: 59.7, APIs: 30, Strings: 4, Instructions: 158
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E0041F5C0(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4, void* _a8, void* _a12, void* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v44;
				void* _v48;
				char _v64;
				char _v80;
				char* _v104;
				intOrPtr _v112;
				intOrPtr _v120;
				char _v128;
				short _v132;
				signed int _v136;
				intOrPtr* _v140;
				signed int _v144;
				intOrPtr* _v152;
				signed int _v156;
				signed int _v160;
				short _t75;
				signed int _t78;
				short _t82;
				signed int _t88;
				intOrPtr _t128;

				_push(0x4012a6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t128;
				L004012A0();
				_v12 = _t128;
				_v8 = 0x401200;
				L004014CE();
				L004014CE();
				L004014CE();
				_v104 = L"15:15:15";
				_v112 = 8;
				L004014E0();
				_push( &_v64);
				_push( &_v80);
				L004013D8();
				_v120 = 0xf;
				_v128 = 0x8002;
				_push( &_v80);
				_t75 =  &_v128;
				_push(_t75);
				L004014EC();
				_v132 = _t75;
				_push( &_v80);
				_push( &_v64);
				_push(2);
				L004014DA();
				_t78 = _v132;
				if(_t78 != 0) {
					if( *0x421544 != 0) {
						_v152 = 0x421544;
					} else {
						_push(0x421544);
						_push(0x404ab8);
						L004013F6();
						_v152 = 0x421544;
					}
					_v132 =  *_v152;
					_t88 =  *((intOrPtr*)( *_v132 + 0x14))(_v132,  &_v48);
					asm("fclex");
					_v136 = _t88;
					if(_v136 >= 0) {
						_v156 = _v156 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x4048fc);
						_push(_v132);
						_push(_v136);
						L00401462();
						_v156 = _t88;
					}
					_v140 = _v48;
					_t78 =  *((intOrPtr*)( *_v140 + 0x60))(_v140,  &_v44);
					asm("fclex");
					_v144 = _t78;
					if(_v144 >= 0) {
						_v160 = _v160 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x404ac8);
						_push(_v140);
						_push(_v144);
						L00401462();
						_v160 = _t78;
					}
					L004014CE();
					L004014BC();
					L004013F0();
					_push(L"Opbevarer3");
					L004013D2();
					L004014C8();
				}
				L004013CC();
				 *(_a4 + 0x68) = _t78;
				_push(L"RESISTLESSNESS");
				L004013C6();
				L004014C8();
				_push(_t78);
				_push(L"NONPERSISTENCE");
				L004013EA();
				asm("sbb eax, eax");
				_v132 =  ~( ~( ~_t78));
				L004014BC();
				_t82 = _v132;
				if(_t82 != 0) {
					L00401498();
					L004014C8();
					L004014CE();
					L004014BC();
					L004013C0();
				}
				_v32 = 0x75b6c5;
				_push(0x41f83d);
				L004014BC();
				L004014BC();
				L004014BC();
				L004014BC();
				return _t82;
			}

0x0041f5c5
0x0041f5d0
0x0041f5d1
0x0041f5dd
0x0041f5e5
0x0041f5e8
0x0041f5f5
0x0041f600
0x0041f60b
0x0041f610
0x0041f617
0x0041f624
0x0041f62c
0x0041f630
0x0041f631
0x0041f636
0x0041f63d
0x0041f647
0x0041f648
0x0041f64b
0x0041f64c
0x0041f651
0x0041f658
0x0041f65c
0x0041f65d
0x0041f65f
0x0041f667
0x0041f66d
0x0041f67a
0x0041f697
0x0041f67c
0x0041f67c
0x0041f681
0x0041f686
0x0041f68b
0x0041f68b
0x0041f6a9
0x0041f6b8
0x0041f6bb
0x0041f6bd
0x0041f6ca
0x0041f6e9
0x0041f6cc
0x0041f6cc
0x0041f6ce
0x0041f6d3
0x0041f6d6
0x0041f6dc
0x0041f6e1
0x0041f6e1
0x0041f6f3
0x0041f70b
0x0041f70e
0x0041f710
0x0041f71d
0x0041f73f
0x0041f71f
0x0041f71f
0x0041f721
0x0041f726
0x0041f72c
0x0041f732
0x0041f737
0x0041f737
0x0041f74f
0x0041f757
0x0041f75f
0x0041f764
0x0041f769
0x0041f773
0x0041f773
0x0041f778
0x0041f780
0x0041f783
0x0041f788
0x0041f792
0x0041f797
0x0041f798
0x0041f79d
0x0041f7a4
0x0041f7aa
0x0041f7b1
0x0041f7b6
0x0041f7bc
0x0041f7be
0x0041f7c8
0x0041f7d5
0x0041f7dd
0x0041f7e2
0x0041f7e2
0x0041f7e7
0x0041f7ee
0x0041f81f
0x0041f827
0x0041f82f
0x0041f837
0x0041f83c

APIs

__vbaChkstk.MSVBVM60(?,004012A6), ref: 0041F5DD
__vbaStrCopy.MSVBVM60(?,?,?,?,004012A6), ref: 0041F5F5
__vbaStrCopy.MSVBVM60(?,?,?,?,004012A6), ref: 0041F600
__vbaStrCopy.MSVBVM60(?,?,?,?,004012A6), ref: 0041F60B
__vbaVarDup.MSVBVM60 ref: 0041F624
#544.MSVBVM60(?,?), ref: 0041F631
__vbaVarTstEq.MSVBVM60(00008002,?,?,?,?,?), ref: 0041F64C
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?), ref: 0041F65F
__vbaNew2.MSVBVM60(00404AB8,00421544), ref: 0041F686
__vbaHresultCheckObj.MSVBVM60(00000000,?,004048FC,00000014), ref: 0041F6DC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404AC8,00000060), ref: 0041F732
__vbaStrCopy.MSVBVM60(00000000,?,00404AC8,00000060), ref: 0041F74F
__vbaFreeStr.MSVBVM60(00000000,?,00404AC8,00000060), ref: 0041F757
__vbaFreeObj.MSVBVM60(00000000,?,00404AC8,00000060), ref: 0041F75F
#519.MSVBVM60(Opbevarer3), ref: 0041F769
__vbaStrMove.MSVBVM60(Opbevarer3), ref: 0041F773
#615.MSVBVM60(Opbevarer3), ref: 0041F778
#527.MSVBVM60(RESISTLESSNESS), ref: 0041F788
__vbaStrMove.MSVBVM60(RESISTLESSNESS), ref: 0041F792
__vbaStrCmp.MSVBVM60(NONPERSISTENCE,00000000,RESISTLESSNESS), ref: 0041F79D
__vbaFreeStr.MSVBVM60(NONPERSISTENCE,00000000,RESISTLESSNESS), ref: 0041F7B1
#669.MSVBVM60(NONPERSISTENCE,00000000,RESISTLESSNESS), ref: 0041F7BE
__vbaStrMove.MSVBVM60(NONPERSISTENCE,00000000,RESISTLESSNESS), ref: 0041F7C8
__vbaStrCopy.MSVBVM60(NONPERSISTENCE,00000000,RESISTLESSNESS), ref: 0041F7D5
__vbaFreeStr.MSVBVM60(NONPERSISTENCE,00000000,RESISTLESSNESS), ref: 0041F7DD
#554.MSVBVM60(NONPERSISTENCE,00000000,RESISTLESSNESS), ref: 0041F7E2
__vbaFreeStr.MSVBVM60(0041F83D), ref: 0041F81F
__vbaFreeStr.MSVBVM60(0041F83D), ref: 0041F827
__vbaFreeStr.MSVBVM60(0041F83D), ref: 0041F82F
__vbaFreeStr.MSVBVM60(0041F83D), ref: 0041F837

Strings

RESISTLESSNESS, xrefs: 0041F783
Opbevarer3, xrefs: 0041F764
15:15:15, xrefs: 0041F610
NONPERSISTENCE, xrefs: 0041F798

Memory Dump Source

Source File: 00000000.00000002.803389432.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.803377846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.803472174.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803484408.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Copy$Move$CheckHresult$#519#527#544#554#615#669ChkstkListNew2
String ID: 15:15:15$NONPERSISTENCE$Opbevarer3$RESISTLESSNESS
API String ID: 1494020804-607155047
Opcode ID: b0b272cf30cb89bbf18289e06ccbc1ed86fde94f3814f5bf1a8d8a96178663e1
Instruction ID: 415ff1ab1f3326d98950aacceed4232b7fafba5a3a88e7e406531b48760cceab
Opcode Fuzzy Hash: b0b272cf30cb89bbf18289e06ccbc1ed86fde94f3814f5bf1a8d8a96178663e1
Instruction Fuzzy Hash: 00610A719002199BDB14EFA5C882BEDBBB4BF44308F10817EE505B71B1DB785989CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA46, Relevance: 58.0, APIs: 31, Strings: 2, Instructions: 242
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E0041FA46(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				short _v28;
				void* _v32;
				char _v36;
				char _v40;
				intOrPtr _v48;
				char _v56;
				intOrPtr _v64;
				char _v72;
				char _v88;
				intOrPtr _v96;
				char _v104;
				char* _v128;
				intOrPtr _v136;
				intOrPtr _v144;
				char _v152;
				void* _v156;
				void* _v160;
				signed int _v164;
				intOrPtr* _v168;
				signed int _v172;
				intOrPtr* _v180;
				signed int _v184;
				signed int _v188;
				intOrPtr* _v192;
				signed int _v196;
				signed int _v200;
				char* _t117;
				char* _t119;
				short _t121;
				short _t130;
				signed int _t133;
				signed int _t139;
				signed int _t149;
				signed int _t154;
				intOrPtr _t189;
				void* _t190;

				_push(0x4012a6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t189;
				L004012A0();
				_v12 = _t189;
				_v8 = 0x401228;
				_v48 = 0x21b425;
				_v56 = 3;
				_push(0xfffffffe);
				_push(0xfffffffe);
				_push(0xfffffffe);
				_push(0xffffffff);
				_t117 =  &_v56;
				_push(_t117);
				L004013AE();
				_v64 = _t117;
				_v72 = 8;
				_push( &_v72);
				_t119 =  &_v88;
				_push(_t119);
				L004013B4();
				_push(0xcc);
				L004013DE();
				_v96 = _t119;
				_v104 = 0x8008;
				_push( &_v88);
				_t121 =  &_v104;
				_push(_t121);
				L004014EC();
				_v160 = _t121;
				_push( &_v104);
				_push( &_v88);
				_push( &_v72);
				_push( &_v56);
				_push(4);
				L004014DA();
				_t190 = _t189 + 0x14;
				if(_v160 != 0) {
					if( *0x421544 != 0) {
						_v180 = 0x421544;
					} else {
						_push(0x421544);
						_push(0x404ab8);
						L004013F6();
						_v180 = 0x421544;
					}
					_v160 =  *_v180;
					_t149 =  *((intOrPtr*)( *_v160 + 0x14))(_v160,  &_v40);
					asm("fclex");
					_v164 = _t149;
					if(_v164 >= 0) {
						_v184 = _v184 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x4048fc);
						_push(_v160);
						_push(_v164);
						L00401462();
						_v184 = _t149;
					}
					_v168 = _v40;
					_t154 =  *((intOrPtr*)( *_v168 + 0x140))(_v168,  &_v156);
					asm("fclex");
					_v172 = _t154;
					if(_v172 >= 0) {
						_v188 = _v188 & 0x00000000;
					} else {
						_push(0x140);
						_push(0x404ac8);
						_push(_v168);
						_push(_v172);
						L00401462();
						_v188 = _t154;
					}
					_v24 = _v156;
					L004013F0();
					_v128 = 0x404bbc;
					_v136 = 8;
					L004014E0();
					_push( &_v56);
					_push(0xee);
					_push( &_v72);
					L004013A8();
					_push(0x98);
					_push( &_v72);
					_push( &_v88);
					L004014B6();
					_push( &_v88);
					L0040149E();
					L004014C8();
					L004014CE();
					L004014BC();
					_push( &_v88);
					_push( &_v72);
					_push( &_v56);
					_push(3);
					L004014DA();
					_t190 = _t190 + 0x10;
				}
				_v128 = L"10:10:10";
				_v136 = 8;
				L004014E0();
				_push( &_v56);
				_push( &_v72);
				L004013D8();
				_v144 = 0xa;
				_v152 = 0x8002;
				_push( &_v72);
				_t130 =  &_v152;
				_push(_t130);
				L004014EC();
				_v160 = _t130;
				_push( &_v72);
				_push( &_v56);
				_push(2);
				L004014DA();
				_t133 = _v160;
				if(_t133 != 0) {
					if( *0x421544 != 0) {
						_v192 = 0x421544;
					} else {
						_push(0x421544);
						_push(0x404ab8);
						L004013F6();
						_v192 = 0x421544;
					}
					_v160 =  *_v192;
					_t139 =  *((intOrPtr*)( *_v160 + 0x14))(_v160,  &_v40);
					asm("fclex");
					_v164 = _t139;
					if(_v164 >= 0) {
						_v196 = _v196 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x4048fc);
						_push(_v160);
						_push(_v164);
						L00401462();
						_v196 = _t139;
					}
					_v168 = _v40;
					_t133 =  *((intOrPtr*)( *_v168 + 0x60))(_v168,  &_v36);
					asm("fclex");
					_v172 = _t133;
					if(_v172 >= 0) {
						_v200 = _v200 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x404ac8);
						_push(_v168);
						_push(_v172);
						L00401462();
						_v200 = _t133;
					}
					L004014CE();
					L004014BC();
					L004013F0();
					_push(L"Terminsydelserne");
					L004013D2();
					L004014C8();
				}
				_v28 = 0x67f9;
				_push(0x41fe46);
				L004014BC();
				return _t133;
			}

0x0041fa4b
0x0041fa56
0x0041fa57
0x0041fa63
0x0041fa6b
0x0041fa6e
0x0041fa75
0x0041fa7c
0x0041fa83
0x0041fa85
0x0041fa87
0x0041fa89
0x0041fa8b
0x0041fa8e
0x0041fa8f
0x0041fa94
0x0041fa97
0x0041faa1
0x0041faa2
0x0041faa5
0x0041faa6
0x0041faab
0x0041fab0
0x0041fab5
0x0041fab8
0x0041fac2
0x0041fac3
0x0041fac6
0x0041fac7
0x0041facc
0x0041fad6
0x0041fada
0x0041fade
0x0041fae2
0x0041fae3
0x0041fae5
0x0041faea
0x0041faf6
0x0041fb03
0x0041fb20
0x0041fb05
0x0041fb05
0x0041fb0a
0x0041fb0f
0x0041fb14
0x0041fb14
0x0041fb32
0x0041fb4a
0x0041fb4d
0x0041fb4f
0x0041fb5c
0x0041fb7e
0x0041fb5e
0x0041fb5e
0x0041fb60
0x0041fb65
0x0041fb6b
0x0041fb71
0x0041fb76
0x0041fb76
0x0041fb88
0x0041fba3
0x0041fba9
0x0041fbab
0x0041fbb8
0x0041fbdd
0x0041fbba
0x0041fbba
0x0041fbbf
0x0041fbc4
0x0041fbca
0x0041fbd0
0x0041fbd5
0x0041fbd5
0x0041fbeb
0x0041fbf2
0x0041fbf7
0x0041fbfe
0x0041fc11
0x0041fc19
0x0041fc1a
0x0041fc22
0x0041fc23
0x0041fc28
0x0041fc30
0x0041fc34
0x0041fc35
0x0041fc3d
0x0041fc3e
0x0041fc48
0x0041fc55
0x0041fc5d
0x0041fc65
0x0041fc69
0x0041fc6d
0x0041fc6e
0x0041fc70
0x0041fc75
0x0041fc75
0x0041fc78
0x0041fc7f
0x0041fc92
0x0041fc9a
0x0041fc9e
0x0041fc9f
0x0041fca4
0x0041fcae
0x0041fcbb
0x0041fcbc
0x0041fcc2
0x0041fcc3
0x0041fcc8
0x0041fcd2
0x0041fcd6
0x0041fcd7
0x0041fcd9
0x0041fce1
0x0041fcea
0x0041fcf7
0x0041fd14
0x0041fcf9
0x0041fcf9
0x0041fcfe
0x0041fd03
0x0041fd08
0x0041fd08
0x0041fd26
0x0041fd3e
0x0041fd41
0x0041fd43
0x0041fd50
0x0041fd72
0x0041fd52
0x0041fd52
0x0041fd54
0x0041fd59
0x0041fd5f
0x0041fd65
0x0041fd6a
0x0041fd6a
0x0041fd7c
0x0041fd94
0x0041fd97
0x0041fd99
0x0041fda6
0x0041fdc8
0x0041fda8
0x0041fda8
0x0041fdaa
0x0041fdaf
0x0041fdb5
0x0041fdbb
0x0041fdc0
0x0041fdc0
0x0041fdd8
0x0041fde0
0x0041fde8
0x0041fded
0x0041fdf2
0x0041fdfc
0x0041fdfc
0x0041fe01
0x0041fe07
0x0041fe40
0x0041fe45

APIs

__vbaChkstk.MSVBVM60(?,004012A6), ref: 0041FA63
#704.MSVBVM60(00000003,000000FF,000000FE,000000FE,000000FE,?,?,?,?,?,?,?,?,?,?,004012A6), ref: 0041FA8F
#528.MSVBVM60(?,00000008,00000003,000000FF,000000FE,000000FE,000000FE), ref: 0041FAA6
#537.MSVBVM60(000000CC,?,00000008,00000003,000000FF,000000FE,000000FE,000000FE), ref: 0041FAB0
__vbaVarTstEq.MSVBVM60(00008008,?,?,?,?,?,000000CC,?,00000008,00000003,000000FF,000000FE,000000FE,000000FE), ref: 0041FAC7
__vbaFreeVarList.MSVBVM60(00000004,00000003,00000008,?,00008008,00008008,?,?,?,?,?,000000CC,?,00000008,00000003,000000FF), ref: 0041FAE5
__vbaNew2.MSVBVM60(00404AB8,00421544), ref: 0041FB0F
__vbaHresultCheckObj.MSVBVM60(00000000,?,004048FC,00000014), ref: 0041FB71
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404AC8,00000140), ref: 0041FBD0
__vbaFreeObj.MSVBVM60(00000000,?,00404AC8,00000140), ref: 0041FBF2
__vbaVarDup.MSVBVM60(00000000,?,00404AC8,00000140), ref: 0041FC11
#607.MSVBVM60(?,000000EE,?), ref: 0041FC23
#619.MSVBVM60(?,?,00000098,?,000000EE,?), ref: 0041FC35
__vbaStrVarMove.MSVBVM60(?,?,?,00000098,?,000000EE,?), ref: 0041FC3E
__vbaStrMove.MSVBVM60(?,?,?,00000098,?,000000EE,?), ref: 0041FC48
__vbaStrCopy.MSVBVM60(?,?,?,00000098,?,000000EE,?), ref: 0041FC55
__vbaFreeStr.MSVBVM60(?,?,?,00000098,?,000000EE,?), ref: 0041FC5D
__vbaFreeVarList.MSVBVM60(00000003,?,?,?,?,?,?,00000098,?,000000EE,?), ref: 0041FC70
__vbaVarDup.MSVBVM60 ref: 0041FC92
#544.MSVBVM60(?,?), ref: 0041FC9F
__vbaVarTstEq.MSVBVM60(00008002,?,?,?,?,?), ref: 0041FCC3
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?), ref: 0041FCD9
__vbaNew2.MSVBVM60(00404AB8,00421544), ref: 0041FD03
__vbaHresultCheckObj.MSVBVM60(00000000,?,004048FC,00000014), ref: 0041FD65
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404AC8,00000060), ref: 0041FDBB
__vbaStrCopy.MSVBVM60(00000000,?,00404AC8,00000060), ref: 0041FDD8
__vbaFreeStr.MSVBVM60(00000000,?,00404AC8,00000060), ref: 0041FDE0
__vbaFreeObj.MSVBVM60(00000000,?,00404AC8,00000060), ref: 0041FDE8
#519.MSVBVM60(Terminsydelserne), ref: 0041FDF2
__vbaStrMove.MSVBVM60(Terminsydelserne), ref: 0041FDFC
__vbaFreeStr.MSVBVM60(0041FE46), ref: 0041FE40

Strings

10:10:10, xrefs: 0041FC78
Terminsydelserne, xrefs: 0041FDED

Memory Dump Source

Source File: 00000000.00000002.803389432.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.803377846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.803472174.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803484408.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$ListMove$CopyNew2$#519#528#537#544#607#619#704Chkstk
String ID: 10:10:10$Terminsydelserne
API String ID: 3785144090-1211720303
Opcode ID: 79e49951502da45ff02b847c0ec1021321008d9438cdb52e60be372a40857513
Instruction ID: f354dc2284e0bc9b14e24e2ee9f09a5f4cc83f34c974d9529c37b4986d497a93
Opcode Fuzzy Hash: 79e49951502da45ff02b847c0ec1021321008d9438cdb52e60be372a40857513
Instruction Fuzzy Hash: CFB1D871E00228AEDB10DFA5CD45FDEB7B9BF44304F1041AAE109B71A1DB785A89CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0041F2D5, Relevance: 52.7, APIs: 27, Strings: 3, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E0041F2D5(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				intOrPtr _v52;
				char _v60;
				char _v76;
				char* _v100;
				intOrPtr _v108;
				intOrPtr _v116;
				char _v124;
				void* _v128;
				signed int _v132;
				signed int _v136;
				intOrPtr* _v140;
				signed int _v144;
				signed int _v152;
				intOrPtr* _v156;
				signed int _v160;
				signed int _v164;
				signed int _t82;
				signed int _t84;
				signed int _t91;
				signed int _t100;
				signed int _t106;
				signed int _t111;
				short _t113;
				intOrPtr _t135;

				_push(0x4012a6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t135;
				L004012A0();
				_v12 = _t135;
				_v8 = 0x4011f0;
				_v116 = 0x65ef31;
				_v124 = 0x8003;
				_v52 =  *0x4011e8;
				_v60 = 4;
				_push( &_v76);
				_t82 =  &_v60;
				_push(_t82);
				L00401402();
				_v132 = _t82;
				if(_v132 >= 0) {
					_v152 = _v152 & 0x00000000;
				} else {
					_push(_v132);
					L004013FC();
					_v152 = _t82;
				}
				_push( &_v124);
				_t84 =  &_v76;
				_push(_t84);
				L00401450();
				_v136 = _t84;
				_push( &_v76);
				_push( &_v60);
				_push(2);
				L004014DA();
				if(_v136 != 0) {
					if( *0x421544 != 0) {
						_v156 = 0x421544;
					} else {
						_push(0x421544);
						_push(0x404ab8);
						L004013F6();
						_v156 = 0x421544;
					}
					_v132 =  *_v156;
					_t106 =  *((intOrPtr*)( *_v132 + 0x14))(_v132,  &_v44);
					asm("fclex");
					_v136 = _t106;
					if(_v136 >= 0) {
						_v160 = _v160 & 0x00000000;
					} else {
						_push(0x14);
						_push(0x4048fc);
						_push(_v132);
						_push(_v136);
						L00401462();
						_v160 = _t106;
					}
					_v140 = _v44;
					_t111 =  *((intOrPtr*)( *_v140 + 0x108))(_v140,  &_v128);
					asm("fclex");
					_v144 = _t111;
					if(_v144 >= 0) {
						_v164 = _v164 & 0x00000000;
					} else {
						_push(0x108);
						_push(0x404ac8);
						_push(_v140);
						_push(_v144);
						L00401462();
						_v164 = _t111;
					}
					_v24 = _v128;
					L004013F0();
					_v52 = 0x80020004;
					_v60 = 0xa;
					_t113 =  &_v60;
					_push(_t113);
					L00401504();
					 *((short*)(_a4 + 0x5c)) = _t113;
					L004014F8();
				}
				_v100 = L"Outblossom";
				_v108 = 8;
				L004014E0();
				_push( &_v60);
				_push( &_v76);
				L00401492();
				_push(0x8d);
				_push( &_v76);
				_t91 =  &_v32;
				_push(_t91);
				L00401486();
				_push(_t91);
				L00401414();
				L004014C8();
				_push(_t91);
				L00401498();
				L004014C8();
				_push(_t91);
				L004013EA();
				asm("sbb eax, eax");
				_v132 =  ~( ~_t91 + 1);
				_push( &_v40);
				_push( &_v36);
				_push( &_v32);
				_push(3);
				L00401480();
				_push( &_v76);
				_push( &_v60);
				_push(2);
				L004014DA();
				_t100 = _v132;
				if(_t100 != 0) {
					L004013E4();
					_push(0x9a);
					L004013DE();
					L004014C8();
					L004014CE();
					L004014BC();
				}
				_push(L"sideben");
				L00401474();
				_v28 = _t100;
				asm("wait");
				_push(0x41f5a5);
				return _t100;
			}

0x0041f2da
0x0041f2e5
0x0041f2e6
0x0041f2f2
0x0041f2fa
0x0041f2fd
0x0041f304
0x0041f30b
0x0041f318
0x0041f31b
0x0041f325
0x0041f326
0x0041f329
0x0041f32a
0x0041f32f
0x0041f336
0x0041f348
0x0041f338
0x0041f338
0x0041f33b
0x0041f340
0x0041f340
0x0041f352
0x0041f353
0x0041f356
0x0041f357
0x0041f35c
0x0041f366
0x0041f36a
0x0041f36b
0x0041f36d
0x0041f37e
0x0041f38b
0x0041f3a8
0x0041f38d
0x0041f38d
0x0041f392
0x0041f397
0x0041f39c
0x0041f39c
0x0041f3ba
0x0041f3c9
0x0041f3cc
0x0041f3ce
0x0041f3db
0x0041f3fa
0x0041f3dd
0x0041f3dd
0x0041f3df
0x0041f3e4
0x0041f3e7
0x0041f3ed
0x0041f3f2
0x0041f3f2
0x0041f404
0x0041f41c
0x0041f422
0x0041f424
0x0041f431
0x0041f456
0x0041f433
0x0041f433
0x0041f438
0x0041f43d
0x0041f443
0x0041f449
0x0041f44e
0x0041f44e
0x0041f461
0x0041f468
0x0041f46d
0x0041f474
0x0041f47b
0x0041f47e
0x0041f47f
0x0041f487
0x0041f48e
0x0041f48e
0x0041f493
0x0041f49a
0x0041f4a7
0x0041f4af
0x0041f4b3
0x0041f4b4
0x0041f4b9
0x0041f4c1
0x0041f4c2
0x0041f4c5
0x0041f4c6
0x0041f4cb
0x0041f4cc
0x0041f4d6
0x0041f4db
0x0041f4dc
0x0041f4e6
0x0041f4eb
0x0041f4ec
0x0041f4f3
0x0041f4f8
0x0041f4ff
0x0041f503
0x0041f507
0x0041f508
0x0041f50a
0x0041f515
0x0041f519
0x0041f51a
0x0041f51c
0x0041f524
0x0041f52a
0x0041f52c
0x0041f531
0x0041f536
0x0041f540
0x0041f54d
0x0041f555
0x0041f555
0x0041f55a
0x0041f55f
0x0041f564
0x0041f567
0x0041f568
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012A6), ref: 0041F2F2
#564.MSVBVM60(00000004,?), ref: 0041F32A
__vbaHresultCheck.MSVBVM60(00000000,00000004,?), ref: 0041F33B
__vbaVarTstNe.MSVBVM60(?,00008003,?,?,?,?,?,00000004,?), ref: 0041F357
__vbaFreeVarList.MSVBVM60(00000002,00000004,?,?,00008003,?,?,?,?,?,00000004,?), ref: 0041F36D
__vbaNew2.MSVBVM60(00404AB8,00421544), ref: 0041F397
__vbaHresultCheckObj.MSVBVM60(00000000,?,004048FC,00000014), ref: 0041F3ED
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404AC8,00000108), ref: 0041F449
__vbaFreeObj.MSVBVM60(00000000,?,00404AC8,00000108), ref: 0041F468
#648.MSVBVM60(0000000A), ref: 0041F47F
__vbaFreeVar.MSVBVM60(0000000A), ref: 0041F48E
__vbaVarDup.MSVBVM60(0000000A), ref: 0041F4A7
#522.MSVBVM60(?,?), ref: 0041F4B4
__vbaStrVarVal.MSVBVM60(?,?,0000008D,?,?), ref: 0041F4C6
#512.MSVBVM60(00000000,?,?,0000008D,?,?), ref: 0041F4CC
__vbaStrMove.MSVBVM60(00000000,?,?,0000008D,?,?), ref: 0041F4D6
#669.MSVBVM60(00000000,00000000,?,?,0000008D,?,?), ref: 0041F4DC
__vbaStrMove.MSVBVM60(00000000,00000000,?,?,0000008D,?,?), ref: 0041F4E6
__vbaStrCmp.MSVBVM60(00000000,00000000,00000000,?,?,0000008D,?,?), ref: 0041F4EC
__vbaFreeStrList.MSVBVM60(00000003,?,?,?,00000000,00000000,00000000,?,?,0000008D,?,?), ref: 0041F50A
__vbaFreeVarList.MSVBVM60(00000002,?,?), ref: 0041F51C
#598.MSVBVM60 ref: 0041F52C
#537.MSVBVM60(0000009A), ref: 0041F536
__vbaStrMove.MSVBVM60(0000009A), ref: 0041F540
__vbaStrCopy.MSVBVM60(0000009A), ref: 0041F54D
__vbaFreeStr.MSVBVM60(0000009A), ref: 0041F555
__vbaLenBstrB.MSVBVM60(sideben), ref: 0041F55F

Strings

Outblossom, xrefs: 0041F493
1e, xrefs: 0041F304
sideben, xrefs: 0041F55A

Memory Dump Source

Source File: 00000000.00000002.803389432.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.803377846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.803472174.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803484408.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultListMove$#512#522#537#564#598#648#669BstrChkstkCopyNew2
String ID: 1e$Outblossom$sideben
API String ID: 3723212987-4218911862
Opcode ID: 7ce366f1c676b15888296be471599cc08a8e46b85b412296ca1d6a416931e87b
Instruction ID: 21fae418e24b0917f146ce9f84e7b706d78bab9846233f5978a1c5ba67e88955
Opcode Fuzzy Hash: 7ce366f1c676b15888296be471599cc08a8e46b85b412296ca1d6a416931e87b
Instruction Fuzzy Hash: 4F710B71D00218ABDB10EFA5C885BDEBBB8BF14308F10417AF505B71A1DB785989CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0041F858, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0041F858(void* __ebx, char* __ecx, intOrPtr __edi, char* __esi, intOrPtr _a4) {
				void* _v0;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				short _v28;
				short _v32;
				intOrPtr _v36;
				char _v40;
				char _v44;
				intOrPtr _v48;
				char _v60;
				intOrPtr _v68;
				char _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr* _v88;
				signed int _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				char _v124;
				char* _v132;
				char _v140;
				intOrPtr _v148;
				char _v156;
				void* _v160;
				void* _v164;
				signed int _v168;
				void* _v172;
				signed int _v176;
				intOrPtr* _v184;
				signed int _v188;
				signed int _v192;
				void* _v196;
				signed int _v200;
				signed int _v204;
				signed int _t179;
				signed int _t181;
				char* _t182;
				char* _t184;
				intOrPtr _t187;
				signed int* _t190;
				char* _t192;
				short _t194;
				short _t203;
				signed int _t206;
				signed int _t212;
				signed int _t222;
				signed int _t227;
				signed int _t242;
				signed int _t247;
				void* _t248;
				char* _t249;
				intOrPtr _t269;
				char* _t270;
				intOrPtr _t272;
				intOrPtr _t274;
				void* _t276;

				_t270 = __esi;
				_t269 = __edi;
				_t249 = __ecx;
				_t248 = __ebx;
				_t272 = _t274;
				_push(__ecx);
				_push(__ecx);
				_push(0x4012a6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t274;
				_push(0x64);
				L004012A0();
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_v12 = _t274;
				_v8 = 0x401218;
				_v100 = 0x57a8;
				_v96 = 1;
				 *(_a4 + 0x70) =  *(_a4 + 0x70) & 0x00000000;
				while(1) {
					_t179 =  *(_a4 + 0x70);
					if(_t179 > _v100) {
						break;
					}
					_push(L"frdende");
					L004014AA();
					if(_t179 > 0x4a385f) {
						L004013E4();
						if( *0x421544 != 0) {
							_v108 = 0x421544;
						} else {
							_push(0x421544);
							_push(0x404ab8);
							L004013F6();
							_v108 = 0x421544;
						}
						_v80 =  *_v108;
						_t242 =  *((intOrPtr*)( *_v80 + 0x14))(_v80,  &_v28);
						asm("fclex");
						_v84 = _t242;
						if(_v84 >= 0) {
							_v112 = _v112 & 0x00000000;
						} else {
							_push(0x14);
							_push(0x4048fc);
							_push(_v80);
							_push(_v84);
							L00401462();
							_v112 = _t242;
						}
						_v88 = _v28;
						_v68 = 0x80020004;
						_v76 = 0xa;
						L004012A0();
						_t270 =  &_v76;
						_t269 = _t274;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t247 =  *((intOrPtr*)( *_v88 + 0x13c))(_v88, L"barneansigtet", 0x10);
						asm("fclex");
						_v92 = _t247;
						if(_v92 >= 0) {
							_v116 = _v116 & 0x00000000;
						} else {
							_push(0x13c);
							_push(0x404ac8);
							_push(_v88);
							_push(_v92);
							L00401462();
							_v116 = _t247;
						}
						_t249 =  &_v28;
						L004013F0();
					}
					_t187 =  *(_a4 + 0x70) + _v96;
					if(_t187 >= 0) {
						_t249 = _a4;
						 *((intOrPtr*)(_t249 + 0x70)) = _t187;
						continue;
					}
					L00401408();
					_push(_t272);
					_push(_t249);
					_push(_t249);
					_push(0x4012a6);
					_push( *[fs:0x0]);
					 *[fs:0x0] = _t274;
					L004012A0();
					_push(_t248);
					_push(_t270);
					_push(_t269);
					_v48 = _t274;
					_v44 = 0x401228;
					_v84 = 0x21b425;
					_v92 = 3;
					_push(0xfffffffe);
					_push(0xfffffffe);
					_push(0xfffffffe);
					_push(0xffffffff);
					_t190 =  &_v92;
					_push(_t190);
					L004013AE();
					_v100 = _t190;
					_v108 = 8;
					_push( &_v108);
					_t192 =  &_v124;
					_push(_t192);
					L004013B4();
					_push(0xcc);
					L004013DE();
					_v132 = _t192;
					_v140 = 0x8008;
					_push( &_v124);
					_t194 =  &_v140;
					_push(_t194);
					L004014EC();
					_v196 = _t194;
					_push( &_v140);
					_push( &_v124);
					_push( &_v108);
					_push( &_v92);
					_push(4);
					L004014DA();
					_t276 = _t274 + 0x14;
					if(_v196 != 0) {
						if( *0x421544 != 0) {
							_v184 = 0x421544;
						} else {
							_push(0x421544);
							_push(0x404ab8);
							L004013F6();
							_v184 = 0x421544;
						}
						_v164 =  *_v184;
						_t222 =  *((intOrPtr*)( *_v164 + 0x14))(_v164,  &_v44);
						asm("fclex");
						_v168 = _t222;
						if(_v168 >= 0) {
							_v188 = _v188 & 0x00000000;
						} else {
							_push(0x14);
							_push(0x4048fc);
							_push(_v164);
							_push(_v168);
							L00401462();
							_v188 = _t222;
						}
						_v172 = _v44;
						_t227 =  *((intOrPtr*)( *_v172 + 0x140))(_v172,  &_v160);
						asm("fclex");
						_v176 = _t227;
						if(_v176 >= 0) {
							_v192 = _v192 & 0x00000000;
						} else {
							_push(0x140);
							_push(0x404ac8);
							_push(_v172);
							_push(_v176);
							L00401462();
							_v192 = _t227;
						}
						_v28 = _v160;
						L004013F0();
						_v132 = 0x404bbc;
						_v140 = 8;
						L004014E0();
						_push( &_v60);
						_push(0xee);
						_push( &_v76);
						L004013A8();
						_push(0x98);
						_push( &_v76);
						_push( &_v92);
						L004014B6();
						_push( &_v92);
						L0040149E();
						L004014C8();
						L004014CE();
						L004014BC();
						_push( &_v92);
						_push( &_v76);
						_push( &_v60);
						_push(3);
						L004014DA();
						_t276 = _t276 + 0x10;
					}
					_v132 = L"10:10:10";
					_v140 = 8;
					L004014E0();
					_push( &_v60);
					_push( &_v76);
					L004013D8();
					_v148 = 0xa;
					_v156 = 0x8002;
					_push( &_v76);
					_t203 =  &_v156;
					_push(_t203);
					L004014EC();
					_v164 = _t203;
					_push( &_v76);
					_push( &_v60);
					_push(2);
					L004014DA();
					_t206 = _v164;
					if(_t206 != 0) {
						if( *0x421544 != 0) {
							_v196 = 0x421544;
						} else {
							_push(0x421544);
							_push(0x404ab8);
							L004013F6();
							_v196 = 0x421544;
						}
						_v164 =  *_v196;
						_t212 =  *((intOrPtr*)( *_v164 + 0x14))(_v164,  &_v44);
						asm("fclex");
						_v168 = _t212;
						if(_v168 >= 0) {
							_v200 = _v200 & 0x00000000;
						} else {
							_push(0x14);
							_push(0x4048fc);
							_push(_v164);
							_push(_v168);
							L00401462();
							_v200 = _t212;
						}
						_v172 = _v44;
						_t206 =  *((intOrPtr*)( *_v172 + 0x60))(_v172,  &_v40);
						asm("fclex");
						_v176 = _t206;
						if(_v176 >= 0) {
							_v204 = _v204 & 0x00000000;
						} else {
							_push(0x60);
							_push(0x404ac8);
							_push(_v172);
							_push(_v176);
							L00401462();
							_v204 = _t206;
						}
						L004014CE();
						L004014BC();
						L004013F0();
						_push(L"Terminsydelserne");
						L004013D2();
						L004014C8();
					}
					_v32 = 0x67f9;
					_push(0x41fe46);
					L004014BC();
					return _t206;
				}
				_v36 =  *0x401210;
				_v44 = 4;
				_push( &_v60);
				_t181 =  &_v44;
				_push(_t181);
				L00401402();
				_v80 = _t181;
				if(_v80 >= 0) {
					_v120 = _v120 & 0x00000000;
				} else {
					_push(_v80);
					L004013FC();
					_v120 = _t181;
				}
				_t182 =  &_v60;
				_push(_t182);
				L004013BA();
				_v24 = _t182;
				_push( &_v60);
				_t184 =  &_v44;
				_push(_t184);
				_push(2);
				L004014DA();
				asm("wait");
				_push(0x41fa26);
				return _t184;
			}

0x0041f858
0x0041f858
0x0041f858
0x0041f858
0x0041f859
0x0041f85b
0x0041f85c
0x0041f85d
0x0041f868
0x0041f869
0x0041f870
0x0041f873
0x0041f878
0x0041f879
0x0041f87a
0x0041f87b
0x0041f87e
0x0041f885
0x0041f88c
0x0041f896
0x0041f8b1
0x0041f8b4
0x0041f8ba
0x00000000
0x00000000
0x0041f8c0
0x0041f8c5
0x0041f8cf
0x0041f8d5
0x0041f8e1
0x0041f8fb
0x0041f8e3
0x0041f8e3
0x0041f8e8
0x0041f8ed
0x0041f8f2
0x0041f8f2
0x0041f907
0x0041f916
0x0041f919
0x0041f91b
0x0041f922
0x0041f93b
0x0041f924
0x0041f924
0x0041f926
0x0041f92b
0x0041f92e
0x0041f931
0x0041f936
0x0041f936
0x0041f942
0x0041f945
0x0041f94c
0x0041f956
0x0041f95b
0x0041f95e
0x0041f960
0x0041f961
0x0041f962
0x0041f963
0x0041f971
0x0041f977
0x0041f979
0x0041f980
0x0041f99c
0x0041f982
0x0041f982
0x0041f987
0x0041f98c
0x0041f98f
0x0041f992
0x0041f997
0x0041f997
0x0041f9a0
0x0041f9a3
0x0041f9a3
0x0041f8a2
0x0041f8a5
0x0041f8ab
0x0041f8ae
0x00000000
0x0041f8ae
0x0041fa41
0x0041fa46
0x0041fa49
0x0041fa4a
0x0041fa4b
0x0041fa56
0x0041fa57
0x0041fa63
0x0041fa68
0x0041fa69
0x0041fa6a
0x0041fa6b
0x0041fa6e
0x0041fa75
0x0041fa7c
0x0041fa83
0x0041fa85
0x0041fa87
0x0041fa89
0x0041fa8b
0x0041fa8e
0x0041fa8f
0x0041fa94
0x0041fa97
0x0041faa1
0x0041faa2
0x0041faa5
0x0041faa6
0x0041faab
0x0041fab0
0x0041fab5
0x0041fab8
0x0041fac2
0x0041fac3
0x0041fac6
0x0041fac7
0x0041facc
0x0041fad6
0x0041fada
0x0041fade
0x0041fae2
0x0041fae3
0x0041fae5
0x0041faea
0x0041faf6
0x0041fb03
0x0041fb20
0x0041fb05
0x0041fb05
0x0041fb0a
0x0041fb0f
0x0041fb14
0x0041fb14
0x0041fb32
0x0041fb4a
0x0041fb4d
0x0041fb4f
0x0041fb5c
0x0041fb7e
0x0041fb5e
0x0041fb5e
0x0041fb60
0x0041fb65
0x0041fb6b
0x0041fb71
0x0041fb76
0x0041fb76
0x0041fb88
0x0041fba3
0x0041fba9
0x0041fbab
0x0041fbb8
0x0041fbdd
0x0041fbba
0x0041fbba
0x0041fbbf
0x0041fbc4
0x0041fbca
0x0041fbd0
0x0041fbd5
0x0041fbd5
0x0041fbeb
0x0041fbf2
0x0041fbf7
0x0041fbfe
0x0041fc11
0x0041fc19
0x0041fc1a
0x0041fc22
0x0041fc23
0x0041fc28
0x0041fc30
0x0041fc34
0x0041fc35
0x0041fc3d
0x0041fc3e
0x0041fc48
0x0041fc55
0x0041fc5d
0x0041fc65
0x0041fc69
0x0041fc6d
0x0041fc6e
0x0041fc70
0x0041fc75
0x0041fc75
0x0041fc78
0x0041fc7f
0x0041fc92
0x0041fc9a
0x0041fc9e
0x0041fc9f
0x0041fca4
0x0041fcae
0x0041fcbb
0x0041fcbc
0x0041fcc2
0x0041fcc3
0x0041fcc8
0x0041fcd2
0x0041fcd6
0x0041fcd7
0x0041fcd9
0x0041fce1
0x0041fcea
0x0041fcf7
0x0041fd14
0x0041fcf9
0x0041fcf9
0x0041fcfe
0x0041fd03
0x0041fd08
0x0041fd08
0x0041fd26
0x0041fd3e
0x0041fd41
0x0041fd43
0x0041fd50
0x0041fd72
0x0041fd52
0x0041fd52
0x0041fd54
0x0041fd59
0x0041fd5f
0x0041fd65
0x0041fd6a
0x0041fd6a
0x0041fd7c
0x0041fd94
0x0041fd97
0x0041fd99
0x0041fda6
0x0041fdc8
0x0041fda8
0x0041fda8
0x0041fdaa
0x0041fdaf
0x0041fdb5
0x0041fdbb
0x0041fdc0
0x0041fdc0
0x0041fdd8
0x0041fde0
0x0041fde8
0x0041fded
0x0041fdf2
0x0041fdfc
0x0041fdfc
0x0041fe01
0x0041fe07
0x0041fe40
0x0041fe45
0x0041fe45
0x0041f9b3
0x0041f9b6
0x0041f9c0
0x0041f9c1
0x0041f9c4
0x0041f9c5
0x0041f9ca
0x0041f9d1
0x0041f9e0
0x0041f9d3
0x0041f9d3
0x0041f9d6
0x0041f9db
0x0041f9db
0x0041f9e4
0x0041f9e7
0x0041f9e8
0x0041f9ed
0x0041f9f3
0x0041f9f4
0x0041f9f7
0x0041f9f8
0x0041f9fa
0x0041fa02
0x0041fa03
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004012A6), ref: 0041F873
__vbaLenBstr.MSVBVM60(frdende), ref: 0041F8C5
#598.MSVBVM60(frdende), ref: 0041F8D5
__vbaNew2.MSVBVM60(00404AB8,00421544,frdende), ref: 0041F8ED
__vbaHresultCheckObj.MSVBVM60(00000000,?,004048FC,00000014), ref: 0041F931
__vbaChkstk.MSVBVM60(00000000,?,004048FC,00000014), ref: 0041F956
__vbaHresultCheckObj.MSVBVM60(00000000,?,00404AC8,0000013C), ref: 0041F992
__vbaFreeObj.MSVBVM60(00000000,?,00404AC8,0000013C), ref: 0041F9A3
#564.MSVBVM60(00000004,?), ref: 0041F9C5
__vbaHresultCheck.MSVBVM60(00000000,00000004,?), ref: 0041F9D6
__vbaI4Var.MSVBVM60(?,00000004,?), ref: 0041F9E8
__vbaFreeVarList.MSVBVM60(00000002,00000004,?,?,00000004,?), ref: 0041F9FA

Strings

barneansigtet, xrefs: 0041F964
frdende, xrefs: 0041F8C0

Memory Dump Source

Source File: 00000000.00000002.803389432.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.803377846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.803472174.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803484408.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$ChkstkFree$#564#598BstrListNew2
String ID: barneansigtet$frdende
API String ID: 3715095588-2602298864
Opcode ID: a8617708fa323a216ac28e51396ac7278213668781010422f12e0e3b0415de6f
Instruction ID: 53152cf1e45f25ab452a0635acfd5c8c6571bf765594cdf59804846293d20696
Opcode Fuzzy Hash: a8617708fa323a216ac28e51396ac7278213668781010422f12e0e3b0415de6f
Instruction Fuzzy Hash: DE41E3B1D50218EFDB00EFD5C846BDDBBB4BB44714F60402AE505BB2A2C7B8598ACF59

Uniqueness

Uniqueness Score: -1.00%

Function 004043F6, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E004043F6(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				long long _v32;
				char _v48;
				char _v64;
				char* _v72;
				intOrPtr _v80;
				char* _t22;
				intOrPtr _t31;

				_a4 = _a4 - 0xffff;
				_push(0x4012a6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t31;
				_push(0x40);
				L004012A0();
				_v12 = _t31;
				_v8 = 0x4011d8;
				_v72 = L"5/5/5";
				_v80 = 8;
				L004014E0();
				_push( &_v48);
				_push( &_v64);
				L00401426();
				_push( &_v64);
				L0040142C();
				_v32 = __fp0;
				_push( &_v64);
				_t22 =  &_v48;
				_push(_t22);
				_push(2);
				L004014DA();
				_v24 = 0x5717;
				asm("wait");
				_push(0x41f2b8);
				return _t22;
			}

0x004043f6
0x0041f22a
0x0041f235
0x0041f236
0x0041f23d
0x0041f240
0x0041f248
0x0041f24b
0x0041f252
0x0041f259
0x0041f266
0x0041f26e
0x0041f272
0x0041f273
0x0041f27b
0x0041f27c
0x0041f281
0x0041f287
0x0041f288
0x0041f28b
0x0041f28c
0x0041f28e
0x0041f296
0x0041f29c
0x0041f29d
0x00000000

APIs

__vbaChkstk.MSVBVM60(00000000,004012A6,?,?,?,0000004C,000000F0,00000035,00000001,?), ref: 0041F240
__vbaVarDup.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004012A6), ref: 0041F266
#687.MSVBVM60(?,?), ref: 0041F273
__vbaDateVar.MSVBVM60(?,?,?), ref: 0041F27C
__vbaFreeVarList.MSVBVM60(00000002,?,?,?,?,?), ref: 0041F28E

Strings

5/5/5, xrefs: 0041F252

Memory Dump Source

Source File: 00000000.00000002.803389432.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.803377846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.803472174.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803484408.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#687ChkstkDateFreeList
String ID: 5/5/5
API String ID: 913103056-834512054
Opcode ID: 61b9d1b339524d4fd4dfa49436b8586506de71e2f5710318a8a6ddee2925f2bc
Instruction ID: ea3a6e12cf430230ab54bfd306de10a83ec3040e4c548682316e98490281850e
Opcode Fuzzy Hash: 61b9d1b339524d4fd4dfa49436b8586506de71e2f5710318a8a6ddee2925f2bc
Instruction Fuzzy Hash: 74014CB1C00209BACB04EBD1C846EEEB7BCEF04704F50857BF510B61A0EB7C65498B69

Uniqueness

Uniqueness Score: -1.00%

Function 0041FE63, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0041FE63(short* _a8) {
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v36;
				short _v40;
				intOrPtr _t24;

				_push(0x4012a6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t24;
				_push(0x18);
				L004012A0();
				_v28 = _t24;
				_v24 = 0x401238;
				_v20 = 0;
				_v16 = 0;
				_v8 = 1;
				_v8 = 2;
				_push(0xffffffff);
				L004014D4();
				_v8 = 3;
				_v40 = 0x6028;
				 *_a8 = _v40;
				 *[fs:0x0] = _v36;
				return 0;
			}

0x0041fe69
0x0041fe74
0x0041fe75
0x0041fe7c
0x0041fe7f
0x0041fe87
0x0041fe8a
0x0041fe91
0x0041fe98
0x0041fe9f
0x0041fea6
0x0041fead
0x0041feaf
0x0041feb4
0x0041febb
0x0041fec8
0x0041fed0
0x0041fedb

APIs

__vbaChkstk.MSVBVM60(?,004012A6), ref: 0041FE7F
__vbaOnError.MSVBVM60(000000FF,?,?,?,?,004012A6), ref: 0041FEAF

Strings

(`, xrefs: 0041FEBB

Memory Dump Source

Source File: 00000000.00000002.803389432.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.803377846.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.803472174.0000000000421000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803484408.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.803502480.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$ChkstkError
String ID: (`
API String ID: 3554142864-1362550029
Opcode ID: d823ffaf231def704c4b740c4da996badede493c30f92a6b0f6d38603cb51612
Instruction ID: df29edafd6d985b2850fb91d4f2a6074930ec5bf23d24e700a020f98b40b96e7
Opcode Fuzzy Hash: d823ffaf231def704c4b740c4da996badede493c30f92a6b0f6d38603cb51612
Instruction Fuzzy Hash: CAF01971900248EBDB00DF99C906B8EBBB4EB05714F50856AE410BB291D3B95A088BA5

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report PKO_TRANS_DETAILS_20211216_0809521.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: GuLoader

Yara Overview

Memory Dumps

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: PKO_TRANS_DETAILS_20211216_0809521.exe PID: 6972 Parent PID: 2464

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: PKO_TRANS_DETAILS_20211216_0809521.exe PID: 6972 Parent PID: 2464 PKO_TRANS_DETAILS_20211216_0809521.exeCOMMON

Executed Functions

Function 04C880CC, Relevance: 1.7, APIs: 1, Instructions: 183memorynativeCOMMON

Function 04C8D3CE, Relevance: 1.7, APIs: 1, Instructions: 169COMMON

Function 04C884B6, Relevance: 1.6, APIs: 1, Instructions: 145memorynativeCOMMON

Function 0041E9B4, Relevance: 100.1, APIs: 45, Strings: 12, Instructions: 361
COMMON

Function 00401524, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Function 00420103, Relevance: 80.7, APIs: 43, Strings: 3, Instructions: 243
COMMON