Edit tour

Windows Analysis Report
empudh9lY5

Overview

General Information

Sample Name:	empudh9lY5 (renamed file extension from none to exe)
Analysis ID:	715067
MD5:	8f43b86f351db105a727e67e39459d78
SHA1:	ad9b43ecbae064ddca1908c40999974bc28466ba
SHA256:	9830e0d007c07364bf97b2a3e0496b7a7f5811e7e71fcdd9dada104d29d1982c
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Uses 32bit PE files

Yara signature match

Found large amount of non-executed APIs

PE file contains strange resources

Contains functionality to read the PEB

Uses code obfuscation techniques (call, push, ret)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Found potential string decryption / allocating functions

Classification

Process Tree

System is w10x64

empudh9lY5.exe (PID: 2560 cmdline: C:\Users\user\Desktop\empudh9lY5.exe MD5: 8F43B86F351DB105A727E67E39459D78)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp	CoreImpact_sysdll_exe	Detects a malware sysdll.exe from the Rocket Kitten APT	Florian Roth	0x1e799:$x6: /info.dat 0x1e6bf:$z2: Encountered error sending error message to client 0x1e68b:$z3: Encountered error building error message to client 0x1e4b3:$z4: Attempting to unlock uninitialized lock! 0x1e273:$z5: connect_back_tcp_channel#do_connect:: Error resolving connect back hostname 0x1e343:$z6: select_event_get(): fd not found 0x1e6f3:$z7: Encountered error sending syscall response to client 0x20d8b:$z8: GetProcAddress() error 0x1e498:$z9: Error entering thread lock 0x1e4dc:$z10: Error exiting thread lock 0x1e2bf:$z11: connect_back_tcp_channel_init:: socket() failed 0x1e73e:$z12: event_add() failed for ev. 0x1e728:$z13: Uh, oh, exit() failed 0x1e73e:$z14: event_add() failed for ev. 0x1e759:$z15: event_add() failed. 0x1e77e:$z16: needroot 0x1e78e:$z17: ./plugins/
00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp	WoolenGoldfish_Generic_3	Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ	Florian Roth	0x1e273:$x3: connect_back_tcp_channel#do_connect:: Error resolving connect back hostname 0x48fb:$s0: kernel32.dll GetProcAddressLoadLibraryAws2_32.dll 0x1e4b3:$s2: Attempting to unlock uninitialized lock! 0x20910:$s4: unable to load kernel32.dll 0x1e6f3:$s7: Encountered error sending syscall response to client 0x1e799:$s9: /info.dat 0x1e498:$s10: Error entering thread lock 0x1e4dc:$s11: Error exiting thread lock 0x1e2bf:$s12: connect_back_tcp_channel_init:: socket() failed
Process Memory Space: empudh9lY5.exe PID: 2560	CoreImpact_sysdll_exe	Detects a malware sysdll.exe from the Rocket Kitten APT	Florian Roth	0x8395:$x6: /info.dat 0x87ba:$x6: /info.dat 0x82ce:$z2: Encountered error sending error message to client 0x829b:$z3: Encountered error building error message to client 0x80e7:$z4: Attempting to unlock uninitialized lock! 0x7eb9:$z5: connect_back_tcp_channel#do_connect:: Error resolving connect back hostname 0x7f85:$z6: select_event_get(): fd not found 0x8300:$z7: Encountered error sending syscall response to client 0x8ed9:$z8: GetProcAddress() error 0x80cc:$z9: Error entering thread lock 0x8110:$z10: Error exiting thread lock 0x7f05:$z11: connect_back_tcp_channel_init:: socket() failed 0x834b:$z12: event_add() failed for ev. 0x8335:$z13: Uh, oh, exit() failed 0x834b:$z14: event_add() failed for ev. 0x8366:$z15: event_add() failed. 0x837a:$z16: needroot 0x838a:$z17: ./plugins/
Process Memory Space: empudh9lY5.exe PID: 2560	WoolenGoldfish_Generic_3	Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ	Florian Roth	0x7eb9:$x3: connect_back_tcp_channel#do_connect:: Error resolving connect back hostname 0x7c4c:$s0: kernel32.dll GetProcAddressLoadLibraryAws2_32.dll 0x80e7:$s2: Attempting to unlock uninitialized lock! 0x8a82:$s4: unable to load kernel32.dll 0x8300:$s7: Encountered error sending syscall response to client 0x8395:$s9: /info.dat 0x87ba:$s9: /info.dat 0x80cc:$s10: Error entering thread lock 0x8110:$s11: Error exiting thread lock 0x7f05:$s12: connect_back_tcp_channel_init:: socket() failed

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: empudh9lY5.exe

ReversingLabs: Detection: 21%

Source: empudh9lY5.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: global traffic

TCP traffic: 192.168.2.3:49702 -> 189.30.155.39:8080

Source: unknown

DNS traffic detected: queries for: sherlock.servegame.com

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects a malware sysdll.exe from the Rocket Kitten APT Author: Florian Roth
Source: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ Author: Florian Roth
Source: Process Memory Space: empudh9lY5.exe PID: 2560, type: MEMORYSTR	Matched rule: Detects a malware sysdll.exe from the Rocket Kitten APT Author: Florian Roth
Source: Process Memory Space: empudh9lY5.exe PID: 2560, type: MEMORYSTR	Matched rule: Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ Author: Florian Roth

Source: empudh9lY5.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: CoreImpact_sysdll_exe author = Florian Roth, description = Detects a malware sysdll.exe from the Rocket Kitten APT, score = 27.12.2014, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = f89a4d4ae5cca6d69a5256c96111e707
Source: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: WoolenGoldfish_Generic_3 date = 2015/03/25, hash2 = e8dbcde49c7f760165ebb0cb3452e4f1c24981f5, author = Florian Roth, description = Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ, score = 86222ef166474e53f1eb6d7e6701713834e6fee7, reference = http://goo.gl/NpJpVZ, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE
Source: Process Memory Space: empudh9lY5.exe PID: 2560, type: MEMORYSTR	Matched rule: CoreImpact_sysdll_exe author = Florian Roth, description = Detects a malware sysdll.exe from the Rocket Kitten APT, score = 27.12.2014, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, hash = f89a4d4ae5cca6d69a5256c96111e707
Source: Process Memory Space: empudh9lY5.exe PID: 2560, type: MEMORYSTR	Matched rule: WoolenGoldfish_Generic_3 date = 2015/03/25, hash2 = e8dbcde49c7f760165ebb0cb3452e4f1c24981f5, author = Florian Roth, description = Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ, score = 86222ef166474e53f1eb6d7e6701713834e6fee7, reference = http://goo.gl/NpJpVZ, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE

Source: empudh9lY5.exe

Static PE information: Resource name: RT_GROUP_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057492D	0_2_0057492D
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574047	0_2_00574047
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574847	0_2_00574847
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573871	0_2_00573871
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574071	0_2_00574071
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00570861	0_2_00570861
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057403B	0_2_0057403B
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057402D	0_2_0057402D
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005740C6	0_2_005740C6
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005740FD	0_2_005740FD
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005878ED	0_2_005878ED
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057408E	0_2_0057408E
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057288C	0_2_0057288C
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057488B	0_2_0057488B
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005738BF	0_2_005738BF
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005740A9	0_2_005740A9
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573962	0_2_00573962
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574169	0_2_00574169
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574115	0_2_00574115
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057390B	0_2_0057390B
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005741F0	0_2_005741F0
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005739E0	0_2_005739E0
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005741A6	0_2_005741A6
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574240	0_2_00574240
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573A67	0_2_00573A67
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573A1E	0_2_00573A1E
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574A0D	0_2_00574A0D
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574A36	0_2_00574A36
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573AD7	0_2_00573AD7
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005742CA	0_2_005742CA
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005742E9	0_2_005742E9
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573A95	0_2_00573A95
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005742BD	0_2_005742BD
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573AA1	0_2_00573AA1
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573B56	0_2_00573B56
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573B44	0_2_00573B44
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574344	0_2_00574344
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573B76	0_2_00573B76
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573B7D	0_2_00573B7D
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574361	0_2_00574361
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573B03	0_2_00573B03
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573B25	0_2_00573B25
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574320	0_2_00574320
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005743F1	0_2_005743F1
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573BFB	0_2_00573BFB
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574399	0_2_00574399
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573BBC	0_2_00573BBC
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005743B8	0_2_005743B8
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005743A2	0_2_005743A2
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574440	0_2_00574440
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574400	0_2_00574400
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573CD4	0_2_00573CD4
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573CDF	0_2_00573CDF
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573CFA	0_2_00573CFA
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574486	0_2_00574486
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057355C	0_2_0057355C
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574574	0_2_00574574
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057357D	0_2_0057357D
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573563	0_2_00573563
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573D62	0_2_00573D62
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00587511	0_2_00587511
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573D04	0_2_00573D04
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573536	0_2_00573536
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573D30	0_2_00573D30
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573D25	0_2_00573D25
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057452D	0_2_0057452D
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005735D4	0_2_005735D4
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005745F6	0_2_005745F6
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573DF5	0_2_00573DF5
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573595	0_2_00573595
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057158D	0_2_0057158D
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573DA0	0_2_00573DA0
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057465B	0_2_0057465B
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574666	0_2_00574666
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573609	0_2_00573609
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573E08	0_2_00573E08
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00586E3F	0_2_00586E3F
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573628	0_2_00573628
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005736DC	0_2_005736DC
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573ED9	0_2_00573ED9
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005736CF	0_2_005736CF
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005746FF	0_2_005746FF
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005746E3	0_2_005746E3
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005736EE	0_2_005736EE
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573E93	0_2_00573E93
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573EA3	0_2_00573EA3
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573EAD	0_2_00573EAD
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057374B	0_2_0057374B
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00587F6A	0_2_00587F6A
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057476B	0_2_0057476B
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573719	0_2_00573719
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574709	0_2_00574709
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057373F	0_2_0057373F
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574726	0_2_00574726
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573F2D	0_2_00573F2D
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057372B	0_2_0057372B
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573FFC	0_2_00573FFC
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005737E1	0_2_005737E1
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00574797	0_2_00574797
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00573782	0_2_00573782
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_0057378F	0_2_0057378F

Source: C:\Users\user\Desktop\empudh9lY5.exe

Code function: String function: 0057497C appears 190 times

Source: empudh9lY5.exe

ReversingLabs: Detection: 21%

Source: empudh9lY5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\empudh9lY5.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: classification engine

Classification label: mal56.winEXE@1/0@3/1

Source: C:\Users\user\Desktop\empudh9lY5.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\empudh9lY5.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: empudh9lY5.exe

Static file information: File size 1283072 > 1048576

Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_005719B5 pushfd ; ret		0_2_005719B6
Source: C:\Users\user\Desktop\empudh9lY5.exe	Code function: 0_2_00571219 push 090000B4h; iretd		0_2_0057121E

Source: initial sample

Static PE information: section name: .text entropy: 6.9280540298858515

Source: C:\Users\user\Desktop\empudh9lY5.exe

API coverage: 7.8 %

Source: C:\Users\user\Desktop\empudh9lY5.exe

Code function: 0_2_0057492D mov ebx, dword ptr fs:[00000030h]

0_2_0057492D

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Software Packing	OS Credential Dumping	1 System Information Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Remote System Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	1 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
empudh9lY5.exe	22%	ReversingLabs	Win32.Trojan.Gholee

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sherlock.servegame.com	189.30.155.39	true	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
189.30.155.39	sherlock.servegame.com	Brazil		8167	BrasilTelecomSA-FilialDistritoFederalBR	false

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	715067
Start date and time:	2022-10-03 15:49:52 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	empudh9lY5 (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.winEXE@1/0@3/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 101 Number of non-executed functions: 6

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ocsp.digicert.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: empudh9lY5.exe

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
BrasilTelecomSA-FilialDistritoFederalBR	t16MNxU8jg.elf	Get hash	malicious	Browse	191.220.220.29
	DRL8J3CIbk.elf	Get hash	malicious	Browse	187.52.131.224
	Qp7zXlMjyW.elf	Get hash	malicious	Browse	189.31.202.232
	M9TjaXeG5H.elf	Get hash	malicious	Browse	177.202.107.38
	rpxxl1EGGG.elf	Get hash	malicious	Browse	201.67.116.253
	cdDHJ7f6r5.elf	Get hash	malicious	Browse	187.55.212.239
	4NakbgBoDV.elf	Get hash	malicious	Browse	200.101.106.214
	XfUkJyh9A3.elf	Get hash	malicious	Browse	201.40.140.155
	boat.arm5-20220930-1611.elf	Get hash	malicious	Browse	191.222.20.79
	boat.arm-20220930-1611.elf	Get hash	malicious	Browse	191.219.16.233
	fursro1cJb.elf	Get hash	malicious	Browse	189.73.242.112
	py1AN0kk3c.elf	Get hash	malicious	Browse	177.3.17.29
	MaF4fGY31G.elf	Get hash	malicious	Browse	187.5.181.35
	Ux97JfisA1.elf	Get hash	malicious	Browse	201.41.82.75
	bk.mpsl-20220928-2324.elf	Get hash	malicious	Browse	191.219.111.248
	cYJ0QBMQZq.elf	Get hash	malicious	Browse	177.3.224.63
	FSL55rr4kY.elf	Get hash	malicious	Browse	179.255.188.34
	TeHYz0aAva.elf	Get hash	malicious	Browse	177.203.181.164
	7H1A4kavqO.elf	Get hash	malicious	Browse	187.52.5.200
	U7bd2ikFnw.elf	Get hash	malicious	Browse	187.52.5.210

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.2099397885668255
TrID:	Win32 Executable (generic) a (10002005/4) 98.87% InstallShield setup (43055/19) 0.43% Win32 EXE PECompact compressed (generic) (41571/9) 0.41% Windows Screen Saver (13104/52) 0.13% DOS Executable Borland C++ (13009/5) 0.13%
File name:	empudh9lY5.exe
File size:	1283072
MD5:	8f43b86f351db105a727e67e39459d78
SHA1:	ad9b43ecbae064ddca1908c40999974bc28466ba
SHA256:	9830e0d007c07364bf97b2a3e0496b7a7f5811e7e71fcdd9dada104d29d1982c
SHA512:	e8d59fceaa01d7ef3b5ced15f15d75a0bdd0bd3cc828a741798798e4527f4d58051a2b3c5a028f347c42a49f760d918bd9f1d46f7ab8adccf5837db024982011
SSDEEP:	24576:pmUgVoR4T0gR1U2vfVD8sA15qkJ1K3mbDQca9L32GY:pGoqT0ujvTO6L3
TLSH:	27555AA27694C132C0620674DD6BCAF964357E24DF30A5877BE03F4F3EB5B807926296
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	6117164569166de9

Static PE Info

General

Entrypoint:	0x40138c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x4B3D3B00 [Fri Jan 1 00:00:00 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	cafc89e1b0a9b2c5b10389d6d19936ce

Entrypoint Preview

Instruction
jmp 00007F2114C4EAC2h
bound di, dword ptr [edx]
inc ebx
sub ebp, dword ptr [ebx]
dec eax
dec edi
dec edi
dec ebx
nop
jmp 00007F2115114B4Dh
mov eax, dword ptr [004C608Bh]
shl eax, 02h
mov dword ptr [004C608Fh], eax
push edx
push 00000000h
call 00007F2114D12010h
mov edx, eax
call 00007F2114D0326Fh
pop edx
call 00007F2114D03191h
call 00007F2114D032A4h
push 00000000h
call 00007F2114D044D9h
pop ecx
push 004C6034h
push 00000000h
call 00007F2114D11FEAh
mov dword ptr [004C6093h], eax
push 00000000h
jmp 00007F2114D0D99Ch
jmp 00007F2114D0450Bh
xor eax, eax
mov al, byte ptr [004C607Dh]
ret
mov eax, dword ptr [004C6093h]
ret
pushad
mov ebx, BCB05000h
push ebx
push 00000BADh
ret
mov ecx, 000000E4h
or ecx, ecx
je 00007F2114C4EAFFh
cmp dword ptr [004C608Bh], 00000000h
jnc 00007F2114C4EABCh
mov eax, 000000FEh
call 00007F2114C4EA8Ch
mov ecx, 000000E4h
push ecx
push 00000008h
call 00007F2114D11FA7h
push eax
call 00007F2114D11FF5h
or eax, eax
jne 00007F2114C4EABCh
mov eax, 000000FDh
call 00007F2114C4EA6Bh
push eax
push eax
push dword ptr [004C608Bh]
call 00007F2114D0DB66h
push dword ptr [004C608Bh]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xfc000	0x482	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xf9000	0x24e5	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfd000	0x489e3	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xf8000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc5000	0xc4200	False	0.5265893881453155	data	6.9280540298858515	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xc6000	0x31000	0x29200	False	0.3381637063069909	data	5.3675051401997385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xf7000	0x1000	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xf8000	0x1000	0x200	False	0.05078125	data	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.idata	0xf9000	0x3000	0x2600	False	0.3246299342105263	data	5.165811799711141	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.edata	0xfc000	0x1000	0x600	False	0.3919270833333333	data	4.649758707069864	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xfd000	0x489e3	0x48a00	False	0.07789304539586919	data	3.41590450767586	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x146000	0xc000	0x0	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_BITMAP	0xfe558	0x5c	Device independent bitmap graphic, 9 x 11 x 1, image size 44
RT_BITMAP	0xfe5b4	0x64	Device independent bitmap graphic, 11 x 13 x 1, image size 52
RT_BITMAP	0xfe618	0x6c	Device independent bitmap graphic, 13 x 15 x 1, image size 60
RT_BITMAP	0xfe684	0x74	Device independent bitmap graphic, 15 x 17 x 1, image size 68
RT_BITMAP	0xfe6f8	0x7c	Device independent bitmap graphic, 15 x 19 x 1, image size 76
RT_BITMAP	0xfe774	0x84	Device independent bitmap graphic, 17 x 21 x 1, image size 84
RT_BITMAP	0xfe7f8	0x8c	Device independent bitmap graphic, 19 x 23 x 1, image size 92
RT_BITMAP	0xfe884	0x94	Device independent bitmap graphic, 21 x 25 x 1, image size 100
RT_BITMAP	0xfe918	0x9c	Device independent bitmap graphic, 21 x 27 x 1, image size 108
RT_BITMAP	0xfe9b4	0xb0	Device independent bitmap graphic, 14 x 9 x 4, image size 72
RT_BITMAP	0xfea64	0xec	Device independent bitmap graphic, 18 x 11 x 4, image size 132
RT_BITMAP	0xfeb50	0x104	Device independent bitmap graphic, 22 x 13 x 4, image size 156
RT_BITMAP	0xfec54	0x158	Device independent bitmap graphic, 26 x 15 x 4, image size 240
RT_BITMAP	0xfedac	0x178	Device independent bitmap graphic, 26 x 17 x 4, image size 272
RT_BITMAP	0xfef24	0x198	Device independent bitmap graphic, 30 x 19 x 4, image size 304
RT_BITMAP	0xff0bc	0x20c	Device independent bitmap graphic, 34 x 21 x 4, image size 420
RT_BITMAP	0xff2c8	0x234	Device independent bitmap graphic, 38 x 23 x 4, image size 460
RT_BITMAP	0xff4fc	0x25c	Device independent bitmap graphic, 38 x 25 x 4, image size 500
RT_BITMAP	0xff758	0x5c	Device independent bitmap graphic, 9 x 11 x 1, image size 44
RT_BITMAP	0xff7b4	0x64	Device independent bitmap graphic, 11 x 13 x 1, image size 52
RT_BITMAP	0xff818	0x6c	Device independent bitmap graphic, 13 x 15 x 1, image size 60
RT_BITMAP	0xff884	0x74	Device independent bitmap graphic, 15 x 17 x 1, image size 68
RT_BITMAP	0xff8f8	0x7c	Device independent bitmap graphic, 15 x 19 x 1, image size 76
RT_BITMAP	0xff974	0x84	Device independent bitmap graphic, 17 x 21 x 1, image size 84
RT_BITMAP	0xff9f8	0x8c	Device independent bitmap graphic, 19 x 23 x 1, image size 92
RT_BITMAP	0xffa84	0x94	Device independent bitmap graphic, 21 x 25 x 1, image size 100
RT_BITMAP	0xffb18	0x9c	Device independent bitmap graphic, 21 x 27 x 1, image size 108
RT_BITMAP	0xffbb4	0xb0	Device independent bitmap graphic, 14 x 9 x 4, image size 72
RT_BITMAP	0xffc64	0xec	Device independent bitmap graphic, 18 x 11 x 4, image size 132
RT_BITMAP	0xffd50	0x104	Device independent bitmap graphic, 22 x 13 x 4, image size 156
RT_BITMAP	0xffe54	0x158	Device independent bitmap graphic, 26 x 15 x 4, image size 240
RT_BITMAP	0xfffac	0x178	Device independent bitmap graphic, 26 x 17 x 4, image size 272
RT_BITMAP	0x100124	0x198	Device independent bitmap graphic, 30 x 19 x 4, image size 304
RT_BITMAP	0x1002bc	0x20c	Device independent bitmap graphic, 34 x 21 x 4, image size 420
RT_BITMAP	0x1004c8	0x234	Device independent bitmap graphic, 38 x 23 x 4, image size 460
RT_BITMAP	0x1006fc	0x25c	Device independent bitmap graphic, 38 x 25 x 4, image size 500
RT_ICON	0x100958	0x882	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x1011dc	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 0	English	United States
RT_ICON	0x10a684	0x7258	Device independent bitmap graphic, 84 x 168 x 32, image size 0	English	United States
RT_ICON	0x1118dc	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 0	English	United States
RT_ICON	0x1180c4	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 0	English	United States
RT_ICON	0x11d54c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 0	English	United States
RT_ICON	0x121774	0x3a48	Device independent bitmap graphic, 60 x 120 x 32, image size 0	English	United States
RT_ICON	0x1251bc	0x32e8	Device independent bitmap graphic, 56 x 112 x 32, image size 0	English	United States
RT_ICON	0x1284a4	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States
RT_ICON	0x12aa4c	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 0	English	United States
RT_ICON	0x12c4b4	0x1588	Device independent bitmap graphic, 36 x 72 x 32, image size 0	English	United States
RT_ICON	0x12da3c	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States
RT_ICON	0x12eae4	0xcd8	Device independent bitmap graphic, 28 x 56 x 32, image size 0	English	United States
RT_ICON	0x12f7bc	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	English	United States
RT_ICON	0x130144	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 0	English	United States
RT_ICON	0x1307fc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States
RT_DIALOG	0x130c64	0x76	data
RT_STRING	0x130cdc	0x35c	data
RT_STRING	0x131038	0xdc	data
RT_STRING	0x131114	0x10c	data
RT_STRING	0x131220	0x33c	data
RT_STRING	0x13155c	0x3dc	data
RT_STRING	0x131938	0xf0	data
RT_STRING	0x131a28	0xd8	data
RT_STRING	0x131b00	0x274	data
RT_STRING	0x131d74	0x3d8	data
RT_STRING	0x13214c	0x374	data
RT_STRING	0x1324c0	0x2dc	data
RT_STRING	0x13279c	0x390	data
RT_STRING	0x132b2c	0x454	data
RT_RCDATA	0x132f80	0x10	data
RT_RCDATA	0x132f90	0x734	Delphi compiled form 'TAddCEADataForm'
RT_RCDATA	0x1336c4	0x3ca	Delphi compiled form 'TAddDIDDataForm'
RT_RCDATA	0x133a90	0x15c7	Delphi compiled form 'TAudioFormatForm'
RT_RCDATA	0x135058	0x78f	Delphi compiled form 'TAudioFormatListForm'
RT_RCDATA	0x1357e8	0xb12	Delphi compiled form 'TColorimetryForm'
RT_RCDATA	0x1362fc	0xff	Delphi compiled form 'TCommonForm'
RT_RCDATA	0x1363fc	0x1aa2	Delphi compiled form 'TDetailedResolutionForm'
RT_RCDATA	0x137ea0	0x7e4	Delphi compiled form 'TDIDDetailedResolutionListForm'
RT_RCDATA	0x138684	0x2216	Delphi compiled form 'TDisplayForm'
RT_RCDATA	0x13a89c	0x1c20	Delphi compiled form 'TExtensionBlockForm'
RT_RCDATA	0x13c4bc	0x45f	Delphi compiled form 'TFreeSyncRangeForm'
RT_RCDATA	0x13c91c	0x16d1	Delphi compiled form 'THDMI2SupportForm'
RT_RCDATA	0x13dff0	0x4f3	Delphi compiled form 'THDMIResolutionForm'
RT_RCDATA	0x13e4e4	0x18dd	Delphi compiled form 'THDMISupportForm'
RT_RCDATA	0x13fdc4	0x830	Delphi compiled form 'THDRStaticMetadataForm'
RT_RCDATA	0x1405f4	0xf41	Delphi compiled form 'TPropertiesForm'
RT_RCDATA	0x141538	0xee8	Delphi compiled form 'TSpeakerSetupForm'
RT_RCDATA	0x142420	0x581	Delphi compiled form 'TStandardResolutionForm'
RT_RCDATA	0x1429a4	0x13af	Delphi compiled form 'TTiledDisplayTopologyForm'
RT_RCDATA	0x143d54	0x556	Delphi compiled form 'TTVResolutionForm'
RT_RCDATA	0x1442ac	0x7d2	Delphi compiled form 'TTVResolutionListForm'
RT_RCDATA	0x144a80	0xaba	Delphi compiled form 'TVideoCapabilityForm'
RT_GROUP_ICON	0x14553c	0xe6	GLS_BINARY_LSB_FIRST	English	United States
RT_MANIFEST	0x145624	0x3bf	ASCII text, with CRLF line terminators

Imports

DLL	Import
SETUPAPI.DLL	SetupDiDestroyDeviceInfoList, SetupDiEnumDeviceInfo, SetupDiGetClassDevsA
ADVAPI32.DLL	RegCloseKey, RegCreateKeyExA, RegDeleteKeyA, RegDeleteValueA, RegEnumKeyExA, RegFlushKey, RegOpenKeyExA, RegQueryValueExA, RegSetValueExA
KERNEL32.DLL	CloseHandle, CompareStringA, CreateEventA, CreateFileA, CreateThread, DeleteCriticalSection, DeleteFileA, EnterCriticalSection, EnumCalendarInfoA, ExitProcess, FindClose, FindFirstFileA, FindResourceA, FormatMessageA, FreeLibrary, FreeResource, GetACP, GetCPInfo, GetCommandLineA, GetCurrentProcessId, GetCurrentThreadId, GetDateFormatA, GetDiskFreeSpaceA, GetEnvironmentStrings, GetFileAttributesA, GetFileType, GetFullPathNameA, GetLastError, GetLocalTime, GetLocaleInfoA, GetModuleFileNameA, GetModuleHandleA, GetOEMCP, GetProcAddress, GetProcessHeap, GetStartupInfoA, GetStdHandle, GetStringTypeA, GetStringTypeW, GetSystemDefaultLangID, GetThreadLocale, GetTickCount, GetUserDefaultLCID, GetVersion, GetVersionExA, GlobalAddAtomA, GlobalDeleteAtom, GlobalFindAtomA, HeapAlloc, HeapFree, InitializeCriticalSection, InterlockedDecrement, InterlockedExchange, InterlockedIncrement, IsValidLocale, LCMapStringA, LeaveCriticalSection, LoadLibraryA, LoadLibraryExA, LoadResource, LockResource, MulDiv, MultiByteToWideChar, RaiseException, ReadFile, ResetEvent, RtlUnwind, SetConsoleCtrlHandler, SetEndOfFile, SetErrorMode, SetEvent, SetFilePointer, SetHandleCount, SetLastError, SetThreadLocale, SizeofResource, Sleep, TlsAlloc, TlsFree, TlsGetValue, TlsSetValue, UnhandledExceptionFilter, VirtualAlloc, VirtualFree, VirtualQuery, WaitForSingleObject, WideCharToMultiByte, WriteFile, lstrcpyA, lstrcpynA, lstrlenA
VERSION.DLL	GetFileVersionInfoA, GetFileVersionInfoSizeA, VerQueryValueA
COMCTL32.DLL	ImageList_Add, ImageList_BeginDrag, ImageList_Destroy, ImageList_DragEnter, ImageList_DragLeave, ImageList_DragMove, ImageList_DragShowNolock, ImageList_Draw, ImageList_DrawEx, ImageList_EndDrag, ImageList_GetBkColor, ImageList_GetDragImage, ImageList_GetIconSize, ImageList_GetImageCount, ImageList_Read, ImageList_Remove, ImageList_Replace, ImageList_SetBkColor, ImageList_SetIconSize, ImageList_Write, _TrackMouseEvent, ImageList_Create
COMDLG32.DLL	GetOpenFileNameA, GetSaveFileNameA
GDI32.DLL	BitBlt, CreateBitmap, CreateBrushIndirect, CreateCompatibleBitmap, CreateCompatibleDC, CreateDIBSection, CreateDIBitmap, CreateFontIndirectA, CreateHalftonePalette, CreatePalette, CreatePenIndirect, CreateSolidBrush, DeleteDC, DeleteObject, Ellipse, ExcludeClipRect, ExtTextOutA, GetBitmapBits, GetBrushOrgEx, GetClipBox, GetCurrentPositionEx, GetDCOrgEx, GetDIBColorTable, GetDIBits, GetDeviceCaps, GetObjectA, GetPaletteEntries, GetPixel, GetRgnBox, GetStockObject, GetSystemPaletteEntries, GetTextExtentPoint32A, GetTextMetricsA, GetWindowOrgEx, IntersectClipRect, LineTo, MaskBlt, MoveToEx, PatBlt, RealizePalette, RectVisible, Rectangle, RestoreDC, RoundRect, SaveDC, SelectClipRgn, SelectObject, SelectPalette, SetBkColor, SetBkMode, SetBrushOrgEx, SetDIBColorTable, SetPixel, SetROP2, SetStretchBltMode, SetTextColor, SetViewportOrgEx, SetWindowOrgEx, StretchBlt, UnrealizeObject
USER32.DLL	ActivateKeyboardLayout, AdjustWindowRectEx, BeginPaint, CallNextHookEx, CallWindowProcA, CharLowerA, CharNextA, CharToOemA, CheckDlgButton, CheckMenuItem, ClientToScreen, CreateIcon, CreateMenu, CreatePopupMenu, CreateWindowExA, DefFrameProcA, DefMDIChildProcA, DefWindowProcA, DeleteMenu, DestroyCursor, DestroyIcon, DestroyMenu, DestroyWindow, DispatchMessageA, DispatchMessageW, DrawEdge, DrawFocusRect, DrawFrameControl, DrawIcon, DrawIconEx, DrawMenuBar, DrawTextA, EnableMenuItem, EnableScrollBar, EnableWindow, EndPaint, EnumChildWindows, EnumThreadWindows, EnumWindows, EqualRect, FillRect, FindWindowA, FrameRect, GetActiveWindow, GetCapture, GetClassInfoA, GetClassLongA, GetClientRect, GetCursor, GetCursorPos, GetDC, GetDCEx, GetDesktopWindow, GetFocus, GetForegroundWindow, GetIconInfo, GetKeyNameTextA, GetKeyState, GetKeyboardLayout, GetKeyboardLayoutList, GetKeyboardLayoutNameA, GetKeyboardState, GetKeyboardType, GetLastActivePopup, GetMenu, GetMenuItemCount, GetMenuItemID, GetMenuItemInfoA, GetMenuState, GetMenuStringA, GetMessagePos, GetParent, GetPropA, GetScrollInfo, GetScrollPos, GetScrollRange, GetSubMenu, GetSysColor, GetSysColorBrush, GetSystemMenu, GetTopWindow, GetWindow, GetWindowDC, GetWindowLongA, GetWindowLongW, GetWindowPlacement, GetWindowRect, GetWindowTextA, GetWindowThreadProcessId, InflateRect, InsertMenuA, InsertMenuItemA, IntersectRect, InvalidateRect, IsChild, IsDialogMessageA, IsDialogMessageW, IsDlgButtonChecked, IsIconic, IsRectEmpty, IsWindow, IsWindowEnabled, IsWindowUnicode, IsWindowVisible, IsZoomed, KillTimer, LoadBitmapA, LoadCursorA, LoadIconA, LoadKeyboardLayoutA, LoadStringA, MapVirtualKeyA, MapWindowPoints, MessageBoxA, OemToCharA, OffsetRect, PeekMessageA, PeekMessageW, PostMessageA, PostQuitMessage, PtInRect, RedrawWindow, RegisterClassA, RegisterClipboardFormatA, RegisterWindowMessageA, ReleaseCapture, ReleaseDC, RemoveMenu, RemovePropA, ScreenToClient, ScrollWindow, SendMessageA, SendMessageW, SetActiveWindow, SetCapture, SetClassLongA, SetCursor, SetFocus, SetForegroundWindow, SetMenu, SetMenuItemInfoA, SetParent, SetPropA, SetRect, SetScrollInfo, SetScrollPos, SetScrollRange, SetTimer, SetWindowLongA, SetWindowLongW, SetWindowPlacement, SetWindowPos, SetWindowTextA, SetWindowsHookExA, ShowOwnedPopups, ShowScrollBar, ShowWindow, SystemParametersInfoA, TrackPopupMenu, TranslateMDISysAccel, TranslateMessage, UnhookWindowsHookEx, UnregisterClassA, UpdateWindow, WaitMessage, WindowFromPoint, wsprintfA, GetSystemMetrics
OLEAUT32.DLL	SafeArrayCreate, SafeArrayGetLBound, SafeArrayGetUBound, SafeArrayPtrOfIndex, SysAllocStringLen, SysFreeString, SysReAllocStringLen, VariantChangeType, VariantClear, VariantCopy, VariantInit

Exports

Name	Ordinal	Address
@$xp$28Vistaaltfixunit@TVistaAltFix	3	0x466b0c
@Vistaaltfixunit@Finalization$qqrv	8	0x466cb0
@Vistaaltfixunit@Register$qqrv	4	0x466b38
@Vistaaltfixunit@TVistaAltFix@	2	0x466ac8
@Vistaaltfixunit@TVistaAltFix@$bctr$qqrp18Classes@TComponent	5	0x466ba4
@Vistaaltfixunit@TVistaAltFix@$bdtr$qqrv	6	0x466c1c
@Vistaaltfixunit@TVistaAltFix@VistaWithTheme$qqrv	7	0x466c6c
@Vistaaltfixunit@initialization$qqrv	9	0x466ce0
_AddCEADataForm	11	0x4ef1a0
_AddDIDDataForm	12	0x4ef1a4
_AudioFormatForm	13	0x4ef1a8
_AudioFormatListForm	14	0x4ef1ac
_ColorimetryForm	15	0x4ef1b0
_CommonForm	16	0x4ef1b4
_DIDDetailedResolutionListForm	18	0x4ef20c
_DetailedResolutionForm	17	0x4ef208
_DisplayForm	19	0x4ef214
_ExtensionBlockForm	20	0x4ef254
_FreeSyncRangeForm	21	0x4f2714
_HDMI2SupportForm	24	0x4f2720
_HDMIResolutionForm	22	0x4f2718
_HDMISupportForm	23	0x4f271c
_HDRStaticMetadataForm	25	0x4f2724
_PropertiesForm	26	0x4f2728
_SpeakerSetupForm	27	0x4f272c
_StandardResolutionForm	28	0x4f2730
_TVResolutionForm	30	0x4f2738
_TVResolutionListForm	31	0x4f273c
_TiledDisplayTopologyForm	29	0x4f2734
_VideoCapabilityForm	32	0x4f2740
__GetExceptDLLinfo	1	0x4013e5
___CPPdebugHook	10	0x4c6098

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2022 15:51:33.522084951 CEST	49702	8080	192.168.2.3	189.30.155.39
Oct 3, 2022 15:51:33.783726931 CEST	8080	49702	189.30.155.39	192.168.2.3
Oct 3, 2022 15:51:34.319655895 CEST	49702	8080	192.168.2.3	189.30.155.39
Oct 3, 2022 15:51:34.578561068 CEST	8080	49702	189.30.155.39	192.168.2.3
Oct 3, 2022 15:51:35.210315943 CEST	49702	8080	192.168.2.3	189.30.155.39
Oct 3, 2022 15:51:35.469022989 CEST	8080	49702	189.30.155.39	192.168.2.3
Oct 3, 2022 15:52:05.559123993 CEST	49703	8080	192.168.2.3	189.30.155.39
Oct 3, 2022 15:52:05.794964075 CEST	8080	49703	189.30.155.39	192.168.2.3
Oct 3, 2022 15:52:06.306580067 CEST	49703	8080	192.168.2.3	189.30.155.39
Oct 3, 2022 15:52:06.542495012 CEST	8080	49703	189.30.155.39	192.168.2.3
Oct 3, 2022 15:52:07.056663990 CEST	49703	8080	192.168.2.3	189.30.155.39
Oct 3, 2022 15:52:07.292512894 CEST	8080	49703	189.30.155.39	192.168.2.3
Oct 3, 2022 15:52:37.412137985 CEST	49704	8080	192.168.2.3	189.30.155.39
Oct 3, 2022 15:52:37.656075001 CEST	8080	49704	189.30.155.39	192.168.2.3
Oct 3, 2022 15:52:38.168632984 CEST	49704	8080	192.168.2.3	189.30.155.39
Oct 3, 2022 15:52:38.412554026 CEST	8080	49704	189.30.155.39	192.168.2.3
Oct 3, 2022 15:52:38.918927908 CEST	49704	8080	192.168.2.3	189.30.155.39
Oct 3, 2022 15:52:39.163156033 CEST	8080	49704	189.30.155.39	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 3, 2022 15:51:33.484947920 CEST	57840	53	192.168.2.3	8.8.8.8
Oct 3, 2022 15:51:33.507029057 CEST	53	57840	8.8.8.8	192.168.2.3
Oct 3, 2022 15:52:05.536159992 CEST	57990	53	192.168.2.3	8.8.8.8
Oct 3, 2022 15:52:05.556083918 CEST	53	57990	8.8.8.8	192.168.2.3
Oct 3, 2022 15:52:37.390862942 CEST	52387	53	192.168.2.3	8.8.8.8
Oct 3, 2022 15:52:37.410737038 CEST	53	52387	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 3, 2022 15:51:33.484947920 CEST	192.168.2.3	8.8.8.8	0x7839	Standard query (0)	sherlock.servegame.com	A (IP address)	IN (0x0001)	false
Oct 3, 2022 15:52:05.536159992 CEST	192.168.2.3	8.8.8.8	0x74c3	Standard query (0)	sherlock.servegame.com	A (IP address)	IN (0x0001)	false
Oct 3, 2022 15:52:37.390862942 CEST	192.168.2.3	8.8.8.8	0x5f5e	Standard query (0)	sherlock.servegame.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Oct 3, 2022 15:51:33.507029057 CEST	8.8.8.8	192.168.2.3	0x7839	No error (0)	sherlock.servegame.com	189.30.155.39	A (IP address)	IN (0x0001)	false
Oct 3, 2022 15:52:05.556083918 CEST	8.8.8.8	192.168.2.3	0x74c3	No error (0)	sherlock.servegame.com	189.30.155.39	A (IP address)	IN (0x0001)	false
Oct 3, 2022 15:52:37.410737038 CEST	8.8.8.8	192.168.2.3	0x5f5e	No error (0)	sherlock.servegame.com	189.30.155.39	A (IP address)	IN (0x0001)	false

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: empudh9lY5.exePID: 2560, Parent PID: 3452

General

Target ID:	0
Start time:	15:50:47
Start date:	03/10/2022
Path:	C:\Users\user\Desktop\empudh9lY5.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\empudh9lY5.exe
Imagebase:	0x400000
File size:	1283072 bytes
MD5 hash:	8F43B86F351DB105A727E67E39459D78
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: CoreImpact_sysdll_exe, Description: Detects a malware sysdll.exe from the Rocket Kitten APT, Source: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth Rule: WoolenGoldfish_Generic_3, Description: Detects a operation Woolen-Goldfish sample - http://goo.gl/NpJpVZ, Source: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: empudh9lY5.exePID: 2560, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.9%
Total number of Nodes:	163
Total number of Limit Nodes:	11

Executed Functions

Function 00570861 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 1049
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 32c26da9a362bbdbbe48f6b82013c3dd7413cbd64758970b6ede0b1cc463401a
Instruction ID: 880ca5a26d064b2c2edea243fd02ab97b57a6f968179fbb3f224ed5613b21a5a
Opcode Fuzzy Hash: 32c26da9a362bbdbbe48f6b82013c3dd7413cbd64758970b6ede0b1cc463401a
Instruction Fuzzy Hash: 8452CB77F69A5207F7184978EC842752D42F7D1320F2AD63E8A8FC72C6DA6C8D427681

Uniqueness

Uniqueness Score: -1.00%

Function 00573536 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 1001
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 0069e93763057e1fec54a672c5fd0883bdcdf8d88520c396e88a7f21e5bac877
Instruction ID: 0e759fae46d357376e3dc3ee5f3fa6c43d9de758b04a5f32f0e1300b6979f350
Opcode Fuzzy Hash: 0069e93763057e1fec54a672c5fd0883bdcdf8d88520c396e88a7f21e5bac877
Instruction Fuzzy Hash: 5852A977F19A5207F7184978DC942752E82F7D1320F2AD63E8A8FC72C6DA6C8D427681

Uniqueness

Uniqueness Score: -1.00%

Function 0057357D Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 999
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: e9b6ef9ad24f7c738d02bcec09b8ac0f1414ca73415cb128bbf314b6e73bb26c
Instruction ID: 94482d077595019f87b4080bf02f155ce642cdc679b90ce8118b6fd7342e83a3
Opcode Fuzzy Hash: e9b6ef9ad24f7c738d02bcec09b8ac0f1414ca73415cb128bbf314b6e73bb26c
Instruction Fuzzy Hash: E952B977F19A5207F7184978DC942752E82F7D1320F2AD63E8A8FC72C6DA6C8D427681

Uniqueness

Uniqueness Score: -1.00%

Function 00573563 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 999
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: b3ead114e96b551e20064ed2fac9741a0c3df96b2654141003b6e1c002ce5159
Instruction ID: b6373c0734b57eeb1c262ec51f6d73e2508b01981d4fd6a28cf1d385aed6513e
Opcode Fuzzy Hash: b3ead114e96b551e20064ed2fac9741a0c3df96b2654141003b6e1c002ce5159
Instruction Fuzzy Hash: 4352A977F19A5207F7184978DC942752E82F7D1320F2AD63E8A8FC72C6DA6C8D427681

Uniqueness

Uniqueness Score: -1.00%

Function 00573595 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 998
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: b85e7046a8497e735b6176a60850b6752b30d31739f565c6aef4e74aaeb64653
Instruction ID: 2a7819ce42038d59008825b47a2b281706f03d83453f73a89bbd4634803af2c7
Opcode Fuzzy Hash: b85e7046a8497e735b6176a60850b6752b30d31739f565c6aef4e74aaeb64653
Instruction Fuzzy Hash: 1552BA77F19A5207F7184978DC942752E82F7D1320F2AD63E8A8FC72C6DA6C8D427681

Uniqueness

Uniqueness Score: -1.00%

Function 0057355C Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 992
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: abc1bc2ccf0aa25dde91303819e2b43183b3c2dd2f2cef3e6df58f352db2cae1
Instruction ID: 7df23f1c9159756b991ca8fb6e765846d2d4781e21e26e43928c142a10a79426
Opcode Fuzzy Hash: abc1bc2ccf0aa25dde91303819e2b43183b3c2dd2f2cef3e6df58f352db2cae1
Instruction Fuzzy Hash: 9342A977F19A5207F7184978DC942752E82F7D1320F2AD63E8A8FC72C6DA6C8D427681

Uniqueness

Uniqueness Score: -1.00%

Function 005735D4 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 990
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 31001c690d68829d04ad5092bd740451b11087acc6ad2e085fb0057ce12ad62d
Instruction ID: 6b7fe273459711cf20af35d65928826b5aa465e0d136bd44a4eb96ea7c047785
Opcode Fuzzy Hash: 31001c690d68829d04ad5092bd740451b11087acc6ad2e085fb0057ce12ad62d
Instruction Fuzzy Hash: 7842B977F19A5207F7184978DC942352E42F7D1320F2AD63E8A8EC72C6DA6C8D43B681

Uniqueness

Uniqueness Score: -1.00%

Function 00573609 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 983
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: be673afb20144bc7b2593548a215c4b132886a2d59c8d351fd48f7f503cd16ae
Instruction ID: 3f7d6b32ee2ece2dee3de6a0eaea9e4399011d9de5251cfa15581c7f184f139a
Opcode Fuzzy Hash: be673afb20144bc7b2593548a215c4b132886a2d59c8d351fd48f7f503cd16ae
Instruction Fuzzy Hash: 1842AA77F19A5207F7184978DC941752D82F7D1320F2AD63E8A8EC72C6DA6C8D437681

Uniqueness

Uniqueness Score: -1.00%

Function 00573628 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 973
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 3e210ad404169a6c20d9e0d4da80f23b5f0570510c826872c3add3621c30cb1e
Instruction ID: a6ef169516642506d579eab208625fdee873b16ac7f80c2f3b02039271b93d12
Opcode Fuzzy Hash: 3e210ad404169a6c20d9e0d4da80f23b5f0570510c826872c3add3621c30cb1e
Instruction Fuzzy Hash: 9F42A977F19A5207F7184978DC942752E42F7D1320F2AD63E8A8EC72C6DA6C8D43B681

Uniqueness

Uniqueness Score: -1.00%

Function 005736EE Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 954
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: b8830e8237e3c3034ad6fe3edaf0f82b8a92dfe3c605b294894bb00559b33abf
Instruction ID: 47c3dca787591059d55fa75cda5a34fced9cfad919be592489a1f24d2a46af5b
Opcode Fuzzy Hash: b8830e8237e3c3034ad6fe3edaf0f82b8a92dfe3c605b294894bb00559b33abf
Instruction Fuzzy Hash: 8442BA77F59A5207F7184978DC942356E42F7D1320F2AD63E8A8EC72C6DA6C8C43A681

Uniqueness

Uniqueness Score: -1.00%

Function 005736DC Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 952
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 60196cd5c9b8fbe7bafefd835a923c4e63853b899f73ae627921ad4bcafa58f0
Instruction ID: fe066fa0e9afbd539b897e7bdf51c9e08a0f47ad417ba5a1caea6de0281d4a0f
Opcode Fuzzy Hash: 60196cd5c9b8fbe7bafefd835a923c4e63853b899f73ae627921ad4bcafa58f0
Instruction Fuzzy Hash: 8C42BA77F59A5207F7184978DC941356E42F7D1320F2AD63E8A8EC72C6DA6C8C43B681

Uniqueness

Uniqueness Score: -1.00%

Function 005736CF Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 951
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: bf8b6397c15287046680c72a23c02199e38d424e0060897dda1680f0d483b57d
Instruction ID: 595f9039a3965ccead4b1f98b857bd800bd3a8058375c7b7abb01b6f9ab8ab3e
Opcode Fuzzy Hash: bf8b6397c15287046680c72a23c02199e38d424e0060897dda1680f0d483b57d
Instruction Fuzzy Hash: 9F42BA77F59A5207F7184978DC941356E82F7D1320F2AD63E8A8EC72C6DA6C8C43B681

Uniqueness

Uniqueness Score: -1.00%

Function 0057374B Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 947
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: f3a2001d7d17a79ba975b18c4b49311dc61d9f78e8e2b3c4ee0032fc4db9cd1b
Instruction ID: 028df8037b15867b80f3d96a0ace2ca9512b0e347e4c44c26373e23b555c4609
Opcode Fuzzy Hash: f3a2001d7d17a79ba975b18c4b49311dc61d9f78e8e2b3c4ee0032fc4db9cd1b
Instruction Fuzzy Hash: 4042BB77F19A5207F7184978DC952357E42F7D1320F2AD63E8A8EC72C6DA6C8C43A681

Uniqueness

Uniqueness Score: -1.00%

Function 0057372B Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 947
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: b0527c18b5731d82ee70bafef0dcb59d971b5c6882c9a0864abaf4d03e1d3ab9
Instruction ID: 384565140fdbe921cb0b60df2825b4565e54e1627105de4359c376a38ec74762
Opcode Fuzzy Hash: b0527c18b5731d82ee70bafef0dcb59d971b5c6882c9a0864abaf4d03e1d3ab9
Instruction Fuzzy Hash: CF42BA77F59A5207F7184978DC952357E42F7D1320F2AC63A8A8FC72C6DA6C8C43A681

Uniqueness

Uniqueness Score: -1.00%

Function 00573719 Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 944
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 64350f5ff09c190aff3180dbe3b3b6b91675f89317fd5523a8a75b9e378052ba
Instruction ID: fc9d552a4f1c7973c8bf4467717377882ca5b0a43834e01d891608061f1c0949
Opcode Fuzzy Hash: 64350f5ff09c190aff3180dbe3b3b6b91675f89317fd5523a8a75b9e378052ba
Instruction Fuzzy Hash: 3B42BA77F59A5207F7184978DC952353E42F7D1320F2AC63A8A8EC72C6DA6C8C43A681

Uniqueness

Uniqueness Score: -1.00%

Function 0057373F Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 943COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: ccd2dc3280026b415ac8c740022266879226b2f8e993d38af359288a6682b55c
Instruction ID: 8b94057cd8bf67a7af713fee49aebc3b6a94c7ef376ed01f6eded1bfcda00b24
Opcode Fuzzy Hash: ccd2dc3280026b415ac8c740022266879226b2f8e993d38af359288a6682b55c
Instruction Fuzzy Hash: 2042BB77F59A5207F7184978DC951353E42F7D1320F2AD63E8A8EC72C6DA6C8C43A681

Uniqueness

Uniqueness Score: -1.00%

Function 0057378F Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 932COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 610fbe2dc8f4b64618ee1ccdc1f18a555f8c13da6d88b99a514541cc7821e82d
Instruction ID: 905b309cd915ed837d775af7b852f0e03378175400fcaf30012270768f707880
Opcode Fuzzy Hash: 610fbe2dc8f4b64618ee1ccdc1f18a555f8c13da6d88b99a514541cc7821e82d
Instruction Fuzzy Hash: 3242CB77F59A5207F7184978DC851353E42F7D2320F2AD63A8A8EC72C6DA6C8C43B681

Uniqueness

Uniqueness Score: -1.00%

Function 00573782 Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 931COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 49e69e5a81d5fed27b95e3e9043df61bef7e15fa5e0028f5a9993e02469fae63
Instruction ID: 0c03d33037a04dd00acbed217317087930c8d287e3e3e97d7eb144c1229ff0d1
Opcode Fuzzy Hash: 49e69e5a81d5fed27b95e3e9043df61bef7e15fa5e0028f5a9993e02469fae63
Instruction Fuzzy Hash: 0A42CB77F59A5207F7184978DC951353E42F7D2320F2AC63A8A8EC72C6DA6C8C43B681

Uniqueness

Uniqueness Score: -1.00%

Function 005737E1 Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 905COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 8b4303914e884fb0246b6b34a621113ca49f034eb7adf9cc3f5ed703f3b956ff
Instruction ID: c80b2848e0b1065ef65851c0fda49cdd3161a118210ad3eff2fddaf7f2d2d8d8
Opcode Fuzzy Hash: 8b4303914e884fb0246b6b34a621113ca49f034eb7adf9cc3f5ed703f3b956ff
Instruction Fuzzy Hash: 5E42BC77F59A5247F7184978DC951353E42F7D2310F2AC63A8A8FC72C6DA6C8C43A681

Uniqueness

Uniqueness Score: -1.00%

Function 00573871 Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 886COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: ff714241860521323b00319ef51d46f5f6739c8a55ea74ef8c9fe272da5d0206
Instruction ID: 1db9040e00670020ba35b0a094696cac1f6b3a8f6b7007ce72bb4e787a0ea5b6
Opcode Fuzzy Hash: ff714241860521323b00319ef51d46f5f6739c8a55ea74ef8c9fe272da5d0206
Instruction Fuzzy Hash: F632AB77F19A5247F7184978DC941357E42F7D2310F2AC63E8A8EC76C6DA6C8C43A681

Uniqueness

Uniqueness Score: -1.00%

Function 005738BF Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 866COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: a2a6be4f448ba6db66b3bc4e57760070b1f0f2ca340c6d18ee56db2df8205ac1
Instruction ID: 23e3ce70f875ffdda179227b1f22e99fdc12ca0e55967205256a87c55d952ac6
Opcode Fuzzy Hash: a2a6be4f448ba6db66b3bc4e57760070b1f0f2ca340c6d18ee56db2df8205ac1
Instruction Fuzzy Hash: F432BA77F19A5247F7194978DC841353E42F7D2310F2AC63E8A8EC72C6DA6C8C43A681

Uniqueness

Uniqueness Score: -1.00%

Function 0057390B Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 844COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 80b5fbd8267cd0de6e69ae855f6c9d0f57561eac8196bfe88e6f185203643f66
Instruction ID: 600adbac8c4ef115d50b4bfd3ff8debb49e8dfaba2e9bd62e0dce3091e43c0b8
Opcode Fuzzy Hash: 80b5fbd8267cd0de6e69ae855f6c9d0f57561eac8196bfe88e6f185203643f66
Instruction Fuzzy Hash: 7732BB77F58A5247F7194A78DC851353E42F7D2310F2AC63E8A8EC76C6DA6C8C43A681

Uniqueness

Uniqueness Score: -1.00%

Function 00573962 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 813COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 425ea2b21fa3094206c4a962e8635d2091844987071cfeae567e64dcdf0b3db8
Instruction ID: 7c206d35c48ac35ca5b7c0a7e49c4e3c5d45084f2d54e1b85bd09be524ec3b3d
Opcode Fuzzy Hash: 425ea2b21fa3094206c4a962e8635d2091844987071cfeae567e64dcdf0b3db8
Instruction Fuzzy Hash: 6732BA77F19A524BF7154A34DC842353E42F7D2310F2AC53ACA8EC76C6DA6C8C43A682

Uniqueness

Uniqueness Score: -1.00%

Function 005739E0 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 781COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: b6a238338072d1ff6756e0cfa1d7c460a9f9ab06a199c18853f328ea8790d0c3
Instruction ID: 1e765565752dfaae9000362174eceae31357e20326ac6c169de670f07c9bdddd
Opcode Fuzzy Hash: b6a238338072d1ff6756e0cfa1d7c460a9f9ab06a199c18853f328ea8790d0c3
Instruction Fuzzy Hash: 0022AB77F18A524BF7154A74DC941353E42F7D2310F2AC57A8A8ECB6C6DA6C8C43A782

Uniqueness

Uniqueness Score: -1.00%

Function 00573A1E Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 767COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 4878c6c3d0d3e0ed9cf77ca6bff4e9d344fa7f165a4ba8d3162231cf5d96ee2c
Instruction ID: bedb457052ee12c10e8005003332947ab4c5b496bec2954e7c30ed60126136ea
Opcode Fuzzy Hash: 4878c6c3d0d3e0ed9cf77ca6bff4e9d344fa7f165a4ba8d3162231cf5d96ee2c
Instruction Fuzzy Hash: C522A977F18A524BF7154A74DC941353E42F7D2310F2AC53ACA8E8B6C6DA6C8C43A782

Uniqueness

Uniqueness Score: -1.00%

Function 00573AA1 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 751COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 467a134331c3d1e9b47d8006bbc1420a0f2d383385a434c4cbd59ae73590da4c
Instruction ID: 782d7f1a0abac5eaf94736bd19956d5da17c27efc0ade5afe3b895779fa2527a
Opcode Fuzzy Hash: 467a134331c3d1e9b47d8006bbc1420a0f2d383385a434c4cbd59ae73590da4c
Instruction Fuzzy Hash: 3422CA77F19A524BF7154A74DC841353E52F7C2310F2AC57ACA8E8B6C6DA6C8C43A782

Uniqueness

Uniqueness Score: -1.00%

Function 00573A67 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 746COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 9fae65e8a0b5fe1981e11e41b3fa5b74135d559e3052e1d0553fc3d290eccaad
Instruction ID: d0e252d36e271adc88d1882583c4773974479262c5c38bb8de608733b49638fd
Opcode Fuzzy Hash: 9fae65e8a0b5fe1981e11e41b3fa5b74135d559e3052e1d0553fc3d290eccaad
Instruction Fuzzy Hash: BB22CA77F18A524BF7154A34DC941353E52F7D2310F2AC57ACA8E8B6C6DA6C8C43A782

Uniqueness

Uniqueness Score: -1.00%

Function 00573AD7 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 744COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: cdba78a1d7ac1223e31ed189fe5f8a542d6e228b17124dd402484119486fb07c
Instruction ID: fb5b669fcc09e7c504632a30272c3f0f0ac080b417e5dd8919d61c5135d4cbb2
Opcode Fuzzy Hash: cdba78a1d7ac1223e31ed189fe5f8a542d6e228b17124dd402484119486fb07c
Instruction Fuzzy Hash: 0722CB77F19A524BF7154A34DC941353E52F7C2310F2AC57ACA8E8B6C6DA6C8C43A782

Uniqueness

Uniqueness Score: -1.00%

Function 00573A95 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 738COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: fb2245b095e7276797e794ea01fb05a8e6eddde393760f8309ab9b2dbd0e026f
Instruction ID: 606f29556b819246a10fef4a2d84bae643c8fa53a75f35dc93f0c005fd0c7939
Opcode Fuzzy Hash: fb2245b095e7276797e794ea01fb05a8e6eddde393760f8309ab9b2dbd0e026f
Instruction Fuzzy Hash: C622CB77F19A524BF7154A34DC841353E52F7D2310F2AC57ACA8E8B6C6DA6C8C43A782

Uniqueness

Uniqueness Score: -1.00%

Function 00573B03 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 737COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 8b25ed8073a8dbb598f63968297713fb057b57d280bb1d53e7d625c5d3131db0
Instruction ID: 17eb015973223872cbf30b20a87cc16acee7ed7b528b3126398fb145f49a7847
Opcode Fuzzy Hash: 8b25ed8073a8dbb598f63968297713fb057b57d280bb1d53e7d625c5d3131db0
Instruction Fuzzy Hash: 4222CA77F19A524BF7154A74DC841353E52F7D2310F2AC57ACA8E8B6C2DA6C8C43A782

Uniqueness

Uniqueness Score: -1.00%

Function 00573B56 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 729COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 2a998a12476d5dd8f6d5bade0bf82696b51cae72e9bb045b74c3c5c168535864
Instruction ID: 368667a81c5e93dd03f858be6df03f2007070cec1cfb37dc9a191c5a5dbaba4d
Opcode Fuzzy Hash: 2a998a12476d5dd8f6d5bade0bf82696b51cae72e9bb045b74c3c5c168535864
Instruction Fuzzy Hash: 3222CB77F19A524BF7154A34DC941353E52F7D2310F2AC57ACA8E8B6C2DA6C8C43A782

Uniqueness

Uniqueness Score: -1.00%

Function 00573B25 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 724COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 88fe23a0df381e307865b6083cba76a4fce37383ff9392a0b107b47c0007e02b
Instruction ID: 9f8ef0c9fb47a2da7235ba57dcb3bac9cc757b04b492803c17fb6dcc1134bbe1
Opcode Fuzzy Hash: 88fe23a0df381e307865b6083cba76a4fce37383ff9392a0b107b47c0007e02b
Instruction Fuzzy Hash: 9322DC77F19A524BF7154A34DC841353E52F7C2310F2AC57ACA8E8B6C2DA6C8C43A782

Uniqueness

Uniqueness Score: -1.00%

Function 00573B7D Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 723COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 51e8258ec47da7718d0ab567be0e2aed0425695201c8e46270553661878b2a76
Instruction ID: 6d43c8aeb1952961fc32984a017d8f14741272147b983a7685adc663f19004f1
Opcode Fuzzy Hash: 51e8258ec47da7718d0ab567be0e2aed0425695201c8e46270553661878b2a76
Instruction Fuzzy Hash: 7C22DC77F19A524BF7154A34DC841353E52F7C2310F2AC57ACA8E8B6C6DA6C8C43A782

Uniqueness

Uniqueness Score: -1.00%

Function 00573B44 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 721COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: d12f7ae65dd7b01370a5e048695a14a791664f0a6ffc480e2acdd9e40944436e
Instruction ID: deaa47ae64e0a4bc31318d57028d4569c031dfe824b5412a88613bdf0838490d
Opcode Fuzzy Hash: d12f7ae65dd7b01370a5e048695a14a791664f0a6ffc480e2acdd9e40944436e
Instruction Fuzzy Hash: 9922CB77F19A524BF7154A34DC941353E52F7D2310F2AC57ACA8E8B6C2DA6C8C43A782

Uniqueness

Uniqueness Score: -1.00%

Function 00573B76 Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 718COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 18ffca96f87f8c041d42caeffda937be9a8d1469746009cc9b6666b2ce5974dd
Instruction ID: b040c020a2ab4203ad424a890a62292a9f15067cbc74553ed1522ebf0c706da0
Opcode Fuzzy Hash: 18ffca96f87f8c041d42caeffda937be9a8d1469746009cc9b6666b2ce5974dd
Instruction Fuzzy Hash: 5512DC77F196524BF7154A34DC941353E52F7C2310F2AC57ACA8E8B6C2DA6C8C43A782

Uniqueness

Uniqueness Score: -1.00%

Function 00573BBC Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 714COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 5ea838fc8060be43d74bc89912b631c8903795357858cbeda54dbb670d6a02d6
Instruction ID: ffa2269ce07bc35719dd5b5730badc753a22f39fc89a42f3f7dd45277b22c2bf
Opcode Fuzzy Hash: 5ea838fc8060be43d74bc89912b631c8903795357858cbeda54dbb670d6a02d6
Instruction Fuzzy Hash: 0112CC77F196524BF7154A74DC841353E52F7D2310F2AC57ACA8E8B6C2DA6C8C43A782

Uniqueness

Uniqueness Score: -1.00%

Function 00573BFB Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 699COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 4ca3321ea890fa391c4d67a16f8bbb19aa90fd483b63fdcc1b6d3cdc8497f70e
Instruction ID: 441de0762d53a043799a2be6d97c5589a0b3d8cdfa0dc41a30fd1ef188ac42dd
Opcode Fuzzy Hash: 4ca3321ea890fa391c4d67a16f8bbb19aa90fd483b63fdcc1b6d3cdc8497f70e
Instruction Fuzzy Hash: 0B12CB77F19A524BF7154A74DC841353E52F7D2310F2AC57ACA8E8B582DB6C8C43AB82

Uniqueness

Uniqueness Score: -1.00%

Function 00573CDF Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 641COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: d8f7040bc02d96f4300947ff409ad4b752c9ce001bcd2723c95efb35df03b52b
Instruction ID: 36c7ffb49100069436fd169c8c9fe6abd77ec7d7ce47cdd066e120d5fba88a5f
Opcode Fuzzy Hash: d8f7040bc02d96f4300947ff409ad4b752c9ce001bcd2723c95efb35df03b52b
Instruction Fuzzy Hash: DA02CB76F097524BF7154A74DC841357E52FBD2310F2AC57ACA8E8B582DB6C8C43AB82

Uniqueness

Uniqueness Score: -1.00%

Function 00573CD4 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 636COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: bacfff0798caf0a6709de0d7326be627323b0b2a0a5f5ff60248960d0fb02e0b
Instruction ID: 9217ebc250b55f7c548e9f9526322036d1cdb4ae7c763cfb134c2efa9b8c0711
Opcode Fuzzy Hash: bacfff0798caf0a6709de0d7326be627323b0b2a0a5f5ff60248960d0fb02e0b
Instruction Fuzzy Hash: 1902CA76F086524BF7154A74DC841357E52FBD2310F2AC57ACA8E8B582DB6C8C43AB82

Uniqueness

Uniqueness Score: -1.00%

Function 00573D04 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 635COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: ba3fcdb326015dd176a87427441f1edc96f4f55391e48e91ac121669c3eaf7a1
Instruction ID: 080e2e33fe94fa2589ef4680fc28766e518ce067d3f73711afb39143d921e4ab
Opcode Fuzzy Hash: ba3fcdb326015dd176a87427441f1edc96f4f55391e48e91ac121669c3eaf7a1
Instruction Fuzzy Hash: 2202CB76F097524BF7154A74DC841357E52F7D2310F2AC57ACA8E8B582DB6C8C43AB82

Uniqueness

Uniqueness Score: -1.00%

Function 00573CFA Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 634COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: b8bc6c5aa623f73cee2e8cad452ff2d988c6157ec9c2bb3262c4530bebb88b7c
Instruction ID: e0988ce63a7d48db05539f4a4ec51f7fbe50c1060fe9dc96aadc0a6c3f71d677
Opcode Fuzzy Hash: b8bc6c5aa623f73cee2e8cad452ff2d988c6157ec9c2bb3262c4530bebb88b7c
Instruction Fuzzy Hash: 7902CA76F097524BF7154A74DC841357E52FBD2310F2AC57ACA8E8B582DB6C8C43AB82

Uniqueness

Uniqueness Score: -1.00%

Function 00573D30 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 632COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 0d7388b8f4f31f4c842a1a6345d4f38f35abc908b0cbf9b22e538f1d99b86763
Instruction ID: 5297c73fc88cc2d84085a1da27ccb09b7ee68ddae08fe0fa5e7f34b15be8e3f6
Opcode Fuzzy Hash: 0d7388b8f4f31f4c842a1a6345d4f38f35abc908b0cbf9b22e538f1d99b86763
Instruction Fuzzy Hash: B702BA76B096524BE7154A74DC841367E52F7D2310F2AC57ACA8E8B582DB6C8C43AB82

Uniqueness

Uniqueness Score: -1.00%

Function 00573D25 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 626COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: e5488888a8e9d6c8ffd34895f2aaee8a5dd30dbeba87000cb31e5ff23a4eefe0
Instruction ID: e27a32b77b73d408d815ddda9584351c6cd77a16d4ef0c4857ac97210573d00a
Opcode Fuzzy Hash: e5488888a8e9d6c8ffd34895f2aaee8a5dd30dbeba87000cb31e5ff23a4eefe0
Instruction Fuzzy Hash: DB02CB76F097524BE7154A74DC941367F52F7C2310F2AC57ACA8A8B582DB6C8C43ABC2

Uniqueness

Uniqueness Score: -1.00%

Function 00573D62 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 621COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 8226ae4e3af14941bf1b2ea3686d776a9ea579cbe4d5226775c99778280f21c3
Instruction ID: d50207108e9c186c7bc2f0788218bc4c4244a6ebd5fa1a42821b49b82dc37db0
Opcode Fuzzy Hash: 8226ae4e3af14941bf1b2ea3686d776a9ea579cbe4d5226775c99778280f21c3
Instruction Fuzzy Hash: 5802CB76F096524BE7154A74DC841367F52F7C2310F2AC57ACA8A8B582DB6C8C42ABC2

Uniqueness

Uniqueness Score: -1.00%

Function 00573E08 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 605COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: b4d250d2c2c7c3813f3741138df8a245da5ec0ac4a0641cbe78a98527da94bb9
Instruction ID: b0af797348edb638696e93c4db02a0dd0bf145d03084df700a09d85ca7611749
Opcode Fuzzy Hash: b4d250d2c2c7c3813f3741138df8a245da5ec0ac4a0641cbe78a98527da94bb9
Instruction Fuzzy Hash: B502CC76F097514BE7154A74DC911367F52FBC2310F2AC57ECA8A8B582DB6C8C42ABC2

Uniqueness

Uniqueness Score: -1.00%

Function 00573DA0 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 604COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: b504e525b5ff0847b30db271e260ca5e4c09ca6b21ae514a37e4dd4a0bef7900
Instruction ID: 6a13ada557e8f073944d5bda39d6e164ee172bcec28496712565061dd22e3722
Opcode Fuzzy Hash: b504e525b5ff0847b30db271e260ca5e4c09ca6b21ae514a37e4dd4a0bef7900
Instruction Fuzzy Hash: 3202BB76F097514BE7154A74DC941367F52FBC2310F2AC57ACA8A8B582DB6C8C42ABC2

Uniqueness

Uniqueness Score: -1.00%

Function 0057288C Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 601COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 729541a83b41850805e114f442dec421c96b1972c53631ef1197e2807bff7a7d
Instruction ID: 4fed4bd0af82b4cc7131d85694cff48fbd47eb4ba4072f023a8f983ecdf6302c
Opcode Fuzzy Hash: 729541a83b41850805e114f442dec421c96b1972c53631ef1197e2807bff7a7d
Instruction Fuzzy Hash: F102CB76F097514BE7154A74DC911367F52FBC2310F2AC57ECA8A8B582DB6C8C42ABC2

Uniqueness

Uniqueness Score: -1.00%

Function 00573DF5 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 588COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: a1a847ab924934a23c920763b7a4a2e61e8d38e5a0cc3e0adc546c6057bf875c
Instruction ID: f124adeaa70776c5a2542494f2f506d39b656303f1d4c652bb562ac4f9cdca37
Opcode Fuzzy Hash: a1a847ab924934a23c920763b7a4a2e61e8d38e5a0cc3e0adc546c6057bf875c
Instruction Fuzzy Hash: E102BB76F097514BE7154A74DC901367F52FBC2310F2AC57ECA8A8B582DB688C43ABC2

Uniqueness

Uniqueness Score: -1.00%

Function 00573ED9 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 585COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 922660a6564501509358c18eda071ef195f62e6ec25a65e6ed717dd4a92c9e50
Instruction ID: eb8fab4dec2e66c68a6756e1dd969cac7fd0d1985365eab7abb24ff957470915
Opcode Fuzzy Hash: 922660a6564501509358c18eda071ef195f62e6ec25a65e6ed717dd4a92c9e50
Instruction Fuzzy Hash: 2802CA76F097514BE7154A74D8841367F52FBC2310F2AC57ECA8A8B582DB6C8C43ABC2

Uniqueness

Uniqueness Score: -1.00%

Function 00573F2D Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 585COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 4297e4e8bbaa6ca38b72e7c4ee5bbb96b00d80f8993fa986395e6a98fc9ba3de
Instruction ID: a54994361dda92d8f2416340dca08bd264ed70c5742de9102e851213d091ca31
Opcode Fuzzy Hash: 4297e4e8bbaa6ca38b72e7c4ee5bbb96b00d80f8993fa986395e6a98fc9ba3de
Instruction Fuzzy Hash: 5BF1BA76F097514BE7154A74DC911367F52FBD2310F2AC57ECA8A8B182DB688C43ABC2

Uniqueness

Uniqueness Score: -1.00%

Function 00573EAD Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 576COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: ba5648b64e405bb2b7fbc29451664bd804b73d2d789b1009fafa842417922c5d
Instruction ID: 53d44e65f7a98242a1dca90f11b732192f4ecbc7164ca0ed0b56ec3620610152
Opcode Fuzzy Hash: ba5648b64e405bb2b7fbc29451664bd804b73d2d789b1009fafa842417922c5d
Instruction Fuzzy Hash: FCF1BA76F097514BE7154A74DC941367F52FBC2310F2AC57ACA8A8B582DB688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00573E93 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 568COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 58506ed5e1da5932b0b64d3e7c16861f119bbc0794d41d56d01f6fc465048acd
Instruction ID: 23ef3921eca329439711b9e8d6d23ebe3b6353cd5ae3a1a2eb96343b8c982cde
Opcode Fuzzy Hash: 58506ed5e1da5932b0b64d3e7c16861f119bbc0794d41d56d01f6fc465048acd
Instruction Fuzzy Hash: EBF1CA76B097514BE7154A74DC901367F52FBC2310F2AC57ECA8A8B582DB688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00573EA3 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 564COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 04d12413353b2991f35cf4c12089ee831202567d6c599cab0a5258ae300a6040
Instruction ID: c20086d42b3b595b7affef444a12fae8ac53e80c129f1ef95bd14c40a8033041
Opcode Fuzzy Hash: 04d12413353b2991f35cf4c12089ee831202567d6c599cab0a5258ae300a6040
Instruction Fuzzy Hash: EBF1CB76B097514BE7154A74DC911367F52FBC2310F2AC57ECA8A8B582DB688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00574047 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 546COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 97316a0389823ad215085b062255128d875aeb925f3e1d01abe77ce800c97545
Instruction ID: cf0b1d84e3196605e92759fc2ac7179a34dc5e9d27f78b5817bae4ae627923bc
Opcode Fuzzy Hash: 97316a0389823ad215085b062255128d875aeb925f3e1d01abe77ce800c97545
Instruction Fuzzy Hash: 39F1CD76B097914BE7158A74DC911367F52FBD6300F29C57EC98A8B182DB688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00574071 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 544COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 2d3a8117946ee08617136c153ef01b03ce69550a91e363a94987ba56fa73d18b
Instruction ID: 3718fbeca8c2aa5f1fc5a9428230e12852506e2611e7a4b9d1895aac796f2caf
Opcode Fuzzy Hash: 2d3a8117946ee08617136c153ef01b03ce69550a91e363a94987ba56fa73d18b
Instruction Fuzzy Hash: 5CF1BD76A097914BE7154A74DC911367F52FBD6300F29C57ECA8A8B182DB688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00573FFC Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 542COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 05e4866e544a5a256c92d574ea53ed74fba47916ae329e1c08c6433f76d223ba
Instruction ID: ada7a61e1a798be1432501b57ce17541a10ad23e2396e3de0d0cf3a6cffbb3d8
Opcode Fuzzy Hash: 05e4866e544a5a256c92d574ea53ed74fba47916ae329e1c08c6433f76d223ba
Instruction Fuzzy Hash: F2F1CD76A097914BE7154A74DC951367F52FBC6300F29C57ECA8A8B183D7688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 005740A9 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 536COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: d653da9f1f697bd627b67115e6e62070ee4c469e94bcc50dc217f791a86f0236
Instruction ID: 449291562cfd2b27dff1273f6f73e0aaa62ac87ff4ef70f6369b710827622eb3
Opcode Fuzzy Hash: d653da9f1f697bd627b67115e6e62070ee4c469e94bcc50dc217f791a86f0236
Instruction Fuzzy Hash: C3F1BB76B097914BE7158A74D8911367F52FBD6300F29C57EC98A8B182DB688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 005740C6 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 532COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: a359fe400c8cc1620b3955c690824926aa0a53fc03fe0fadb54f87bc9b5a98a4
Instruction ID: d109251b673f3267d189fba4d50c857c871dfd59e62f280cdd038311b3d02dc6
Opcode Fuzzy Hash: a359fe400c8cc1620b3955c690824926aa0a53fc03fe0fadb54f87bc9b5a98a4
Instruction Fuzzy Hash: C9F1AA76B097914BE7158A74D8911367F52FBD6300F29C57EC98A8B182DB688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 0057402D Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 528COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 548eb6c79bb95dc676a7e61fce8541beb7df24a445208f07e1a5c36081286def
Instruction ID: 70998ed09a02032aa8f6caa0e774a4fb2e75b65f052d64c0589e1d6c898072d5
Opcode Fuzzy Hash: 548eb6c79bb95dc676a7e61fce8541beb7df24a445208f07e1a5c36081286def
Instruction Fuzzy Hash: 24E1CD76A097914BE7158A74DC911367F52FBC6300F29C57EC98A8B183DB688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 0057403B Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 527COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: b57fd3c779d7846724383e00d9022216031d0c68823c2fa4f96447fb4df5026e
Instruction ID: 3e0553004f9aa55c23e9d7e9a09dae99ad75a95b6f25b6a355410ff50b119b71
Opcode Fuzzy Hash: b57fd3c779d7846724383e00d9022216031d0c68823c2fa4f96447fb4df5026e
Instruction Fuzzy Hash: EBE1BD76A097914BE7158A74DC911367F52FBD6300F29C57EC98A8B183DB688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 0057408E Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 526COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: ff20929334a134b8a8b0d9e60c409b4c226977286d7be38180cfb13cadae1bcf
Instruction ID: 0885c9d015de4c250f1baf0ac0c4296ecd4d27e6e0bd424ad7dbd29b8cdc5fe2
Opcode Fuzzy Hash: ff20929334a134b8a8b0d9e60c409b4c226977286d7be38180cfb13cadae1bcf
Instruction Fuzzy Hash: ABE1AB76A097914BE7158A74DC911267F52FBD6300F29C57EC98A8B183DB688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00574115 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 520COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 465d74e60463a4f0d4f4eb170b6ae6c956d8f99bab71083e97aa353c5f59a5f8
Instruction ID: f5ef84f86e7a66a98cb90d692cfd5b21c5f4fb22867c09c5f96f1078eed3f574
Opcode Fuzzy Hash: 465d74e60463a4f0d4f4eb170b6ae6c956d8f99bab71083e97aa353c5f59a5f8
Instruction Fuzzy Hash: 5CE1CB76B097914BE7158A74D8911267F52FBD6300F29C57EC98A8B183DB688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 005740FD Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 516COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 30b388b5f754bacb3e1dcd4d2ca6ca085b1449ffacd776bb95bb3a6c6496209b
Instruction ID: a3ceea83375763e9f46f17729c14f70dbe1def130017f5dbb88a5c989c65a6fb
Opcode Fuzzy Hash: 30b388b5f754bacb3e1dcd4d2ca6ca085b1449ffacd776bb95bb3a6c6496209b
Instruction Fuzzy Hash: 27E1BC76B097914BE7158A74DC911267F52FBD6300F29C57EC98A8B183DB688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00574169 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 499COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: e9a3dc6f28dca5126d54a4670049ba955656c6bf22de15ba37f3772511c1a0be
Instruction ID: 8085863fffcef6e42caded7027a6ccbcd20484d461485d0e6ebf3a21a8d7a5f3
Opcode Fuzzy Hash: e9a3dc6f28dca5126d54a4670049ba955656c6bf22de15ba37f3772511c1a0be
Instruction Fuzzy Hash: 36E1AD76A197914BE7158A74DC911267F62FBC6300F29C57ECD8A8B183D7688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 005741A6 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 481COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 4793f653552c5475bb6f3429679618223c1526ceea4f7e598f0eab4e0da7d784
Instruction ID: bab7fbdb34cd00acdd61c9438cf6e8e34f7ad2aa08e5c7de2b852ef29c1d96cd
Opcode Fuzzy Hash: 4793f653552c5475bb6f3429679618223c1526ceea4f7e598f0eab4e0da7d784
Instruction Fuzzy Hash: 66E1AD76A097914BE7158F74D8911267F62FBD6300F29C57EC98A8B183D7688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 005741F0 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 469COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 343a2f1d2b408f36a4a2e97aa4f8e9e078ec769269e99bd46fbe04a6e311cbf3
Instruction ID: 84ee947595abe0d918577877b97fb85e298f75104504b9453f06f90ede7524d6
Opcode Fuzzy Hash: 343a2f1d2b408f36a4a2e97aa4f8e9e078ec769269e99bd46fbe04a6e311cbf3
Instruction Fuzzy Hash: 7CD1AD76A097914BE7158B74D8911267F62FBC6300F29C57ECD8A8B183D7688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00574240 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 463COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: c7d27008043515c8936be3d6140748ef1513ff6ebe820565a241b113ef0769bb
Instruction ID: 89c9d5de79de928b7efc1caf3558f8b56b28a26569ab1debc0c1a74af1753a4f
Opcode Fuzzy Hash: c7d27008043515c8936be3d6140748ef1513ff6ebe820565a241b113ef0769bb
Instruction Fuzzy Hash: C1D1BF76A097914BE7158F74D8911667F62FBC6300F29C57EC98A8B183D7688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 005742CA Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 427COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 244f2d1bc76325f7a066873046cdcb9f2b90e2546f1b693a8e241d4935381b92
Instruction ID: 3d4de3521c59ed49119b87680f4b65ecb53c41a43898d49a2a911a9a4989e500
Opcode Fuzzy Hash: 244f2d1bc76325f7a066873046cdcb9f2b90e2546f1b693a8e241d4935381b92
Instruction Fuzzy Hash: 39C1BE76A097914BE7168F70D8911267F61FB87300F6985BEC98A8B153D7288C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 005742BD Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 427COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: f74c92b0a99d29521d32cabf9852f60fc452f565aadba4933b545f86a50c9413
Instruction ID: 7951dee8ce95a56176bfffd0afbb60e90a466a17931f1740184378870b4dbf7e
Opcode Fuzzy Hash: f74c92b0a99d29521d32cabf9852f60fc452f565aadba4933b545f86a50c9413
Instruction Fuzzy Hash: 79D1BE76A097914BE7168F70D8911267F61FB87300F69C5BEC98A8B153D7688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 005742E9 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 426COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: ca2423eb8f0149b21bfad8103c36ffa1242dddff79f4d97201f776a09f10eae2
Instruction ID: e5e3cdf5a0dae947359f2b0f538bc4e214d94989071f0a84ea35e4cf2713189c
Opcode Fuzzy Hash: ca2423eb8f0149b21bfad8103c36ffa1242dddff79f4d97201f776a09f10eae2
Instruction Fuzzy Hash: 9AC1C076A097914BE7168F70D8911667F61FB87300F6985BECD8A8B153D7288C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00574361 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 418COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: fc282ea611e34645bef4f346b240c4a64b3052d52d9eede5e4dc380d4f6f6420
Instruction ID: 4323761c18db72237501f45b62347dc158a93fbb880fc3df3bf72f68849de896
Opcode Fuzzy Hash: fc282ea611e34645bef4f346b240c4a64b3052d52d9eede5e4dc380d4f6f6420
Instruction Fuzzy Hash: 99C1DE76A097914BE7168F70D8911667F61FB87300F6985BECD8A8B153D7288C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00574344 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 416COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: d6d11194f26d2d733feefe065cf9687eed3c79355724aaeb42a5610962cfbb77
Instruction ID: 24a2712315bd6377b1aa94d5f365aa444308602c17e7264c051d2e6946115120
Opcode Fuzzy Hash: d6d11194f26d2d733feefe065cf9687eed3c79355724aaeb42a5610962cfbb77
Instruction Fuzzy Hash: 95C1D076A097914BE7168F70D8911267F61FB87300F6985BECD8A8B153D7288C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00574320 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 416COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 3d1f77c3756438d550095b8b3c19bf3ff89ec221c598bd2ed633be8d6737c3f6
Instruction ID: 4e3d0e576198eb78436a70af6678b4c6c22c7f1731c0b08211ae6a29d81fdea8
Opcode Fuzzy Hash: 3d1f77c3756438d550095b8b3c19bf3ff89ec221c598bd2ed633be8d6737c3f6
Instruction Fuzzy Hash: C8C1B0766097914BE7158F70D8911267F61FB87300F6985BECD8A8B193D7288C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 005743A2 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 404COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 950542bcbf66fbaa5c6f6993bb39aadd0bdc92fcaa19281861bd556cef6ec91e
Instruction ID: 1e8a63a7a1bd7fdae98b2bf91478eba3f3568b1a2fc25bd5d062f84dc97ab3cd
Opcode Fuzzy Hash: 950542bcbf66fbaa5c6f6993bb39aadd0bdc92fcaa19281861bd556cef6ec91e
Instruction Fuzzy Hash: C6C1CE76A097914BE7168F70D8911267F61FB87300F6985BECD8A8B153D7688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00574399 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: e13c03c22223434a9cfff33caf8c169901cb9a62dbd468e8a7e69856979a3d54
Instruction ID: d165160d0708fed633188825ff99eca3d360498fc52525f0b526143ae2ea847f
Opcode Fuzzy Hash: e13c03c22223434a9cfff33caf8c169901cb9a62dbd468e8a7e69856979a3d54
Instruction Fuzzy Hash: EEC1BE76A097914BE7168F70D8911267F61FB87300F6985BECD8A8B153D7688C43EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 005743B8 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 399COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: c8f7d6090eac9a0812edc93e0fa78c1cf179aec6c654b7c6fd672b472dd12ba9
Instruction ID: f8af1c029769c63c359a3ee50d718157386bab626adc06f0cfa9faa286411e43
Opcode Fuzzy Hash: c8f7d6090eac9a0812edc93e0fa78c1cf179aec6c654b7c6fd672b472dd12ba9
Instruction Fuzzy Hash: 9FC1BE76A097914BE7168F70D8911267F61FB87300F6985BECD8A8B153D7689C03EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00574400 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 394COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 93b89a28d528a33a1b6ba960e7346797a8c95125c31a274639b50d04b4ed8700
Instruction ID: dc74973fb507db77b3676c61fe846ca22da290f0654f065dcf65aaf45ef0a9cf
Opcode Fuzzy Hash: 93b89a28d528a33a1b6ba960e7346797a8c95125c31a274639b50d04b4ed8700
Instruction Fuzzy Hash: F1C1B072A087914BE7168F74D8911667F61FB87300F6985BECD868B193D7688C03EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 0057158D Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 389COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 3da12d63dfaf1645b202625a241eb93a19279c4e51f669a4b9b3309339f7dd69
Instruction ID: 504edd2f3dc0a31e8e6e705b431541091b4c2adf5c4d566fc2320c4c3759dce8
Opcode Fuzzy Hash: 3da12d63dfaf1645b202625a241eb93a19279c4e51f669a4b9b3309339f7dd69
Instruction Fuzzy Hash: 7AC1BF72A097814BE7168F74D8911667F61FB87300F6985BECD868B193D7288C03EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00574440 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 388COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 62cfe11508721a6c222bb10cc1408781fd0c1c02813f8ad5c6e755eb9a378ecc
Instruction ID: 39d2a41ed796aacdf0efc7350368fe7cd95fae8a84075a70482d81cd85bf4ee7
Opcode Fuzzy Hash: 62cfe11508721a6c222bb10cc1408781fd0c1c02813f8ad5c6e755eb9a378ecc
Instruction Fuzzy Hash: 65C19F726097818BE7168F74D8911267F61FB87300F6985BECD8A8B553D7689C03EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 00574486 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 387COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 816238632618edf9218ed127eb3307b5ad86299cddf93cd70beb6e4de922aac3
Instruction ID: 986c40a5ae587a4784322b3997950df5ae41fb1fe03b896f14a7cf4887314b31
Opcode Fuzzy Hash: 816238632618edf9218ed127eb3307b5ad86299cddf93cd70beb6e4de922aac3
Instruction Fuzzy Hash: 10C1BD72A097914BE7168F74D8911267F61FB83300F6985BECD8A8B593D7688C03DBC2

Uniqueness

Uniqueness Score: -1.00%

Function 005743F1 Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 382COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: da49a6e99b39987b5a130667e0c64f694cf121a4b7eca86dc0418799fa87758c
Instruction ID: 7f2fc751bd3c10459cfd4a6e39f41752ebd655dc96dac270a6c91f605e6ced2d
Opcode Fuzzy Hash: da49a6e99b39987b5a130667e0c64f694cf121a4b7eca86dc0418799fa87758c
Instruction Fuzzy Hash: FAC1AC726097918BE7168F74D8911267F61FB87300F6985BECD868B153D7689C03EBC2

Uniqueness

Uniqueness Score: -1.00%

Function 0057452D Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 338COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 6d665e7f4cd397f64f652fd6d87a8f3c7d37b9644ebd7f3b93c71127a4754836
Instruction ID: 78093b2650d3f91d66037ac8d5508b0eb3e38ccdd7ff74032375153add8d1491
Opcode Fuzzy Hash: 6d665e7f4cd397f64f652fd6d87a8f3c7d37b9644ebd7f3b93c71127a4754836
Instruction Fuzzy Hash: B1B188725097819BE7128F70D892117BF61FB83300F6585BEC9868B553D7689843EFC2

Uniqueness

Uniqueness Score: -1.00%

Function 00574574 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 334COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 1a381df1cfa8828c4e47193e76721580a4f8896f68d8e7998fd3ab53cda72d96
Instruction ID: 9e918524af80785467a5c37ec20c1c8f08297f581fad4b05bd1b6cf5c8560577
Opcode Fuzzy Hash: 1a381df1cfa8828c4e47193e76721580a4f8896f68d8e7998fd3ab53cda72d96
Instruction Fuzzy Hash: 9AA177729087819BEB168F70D892157BF61FB87300B6585BEC9868B453D7689843EFC2

Uniqueness

Uniqueness Score: -1.00%

Function 005745F6 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 334COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 0fcf6f2ddffb3b7c440e015b012cae03cdd843fa776e0fa492a75e675da5c846
Instruction ID: a189030e1fb7774e4e7ad0f718c518f6c1412a45173abe028fb6bafc5e30b574
Opcode Fuzzy Hash: 0fcf6f2ddffb3b7c440e015b012cae03cdd843fa776e0fa492a75e675da5c846
Instruction Fuzzy Hash: A6A18A729487819BDB169F70D892167BF61FB93300B6584BEC98A4B453D3249843EFC3

Uniqueness

Uniqueness Score: -1.00%

Function 00574666 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 314COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: f28024c545930a7642cde5423c575ce4545a7c3d04ff5cd3660c17a891c8f316
Instruction ID: 284aee1038547ebbd6950214e3c7537b0da47ea6fc758b75d7e3c4bd9fd2fb1a
Opcode Fuzzy Hash: f28024c545930a7642cde5423c575ce4545a7c3d04ff5cd3660c17a891c8f316
Instruction Fuzzy Hash: 69A145729097819BDB169F70D892157BF61FB83300F6585BEC9868B493D3249843EBD3

Uniqueness

Uniqueness Score: -1.00%

Function 0057465B Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 308COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: fdd3a1c6c9baaeb88650e360eab727da7302c719f862e3763c5c5c27370bf4a6
Instruction ID: f463e7af99a2065749f2a7dee43c03c112505e4eb290a76a54a458165ede95f5
Opcode Fuzzy Hash: fdd3a1c6c9baaeb88650e360eab727da7302c719f862e3763c5c5c27370bf4a6
Instruction Fuzzy Hash: 4BA143729097819BDB169F70D892167BF61FB83300B6985BEC9868B453D3249843EFD3

Uniqueness

Uniqueness Score: -1.00%

Function 0057488B Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 290libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(ws2_32.dll,00000000,0000000C,LoadLibraryAws2_32.dll,00000000,0000000E,GetProcAddressLoadLibraryAws2_32.dll), ref: 00574975

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 1029625771-3754766082
Opcode ID: 4c014591a30ecb7556fa1188f1d7f8c435a20ef473124c4d47e50945f916db56
Instruction ID: 2361d1b7538af5c2478a73daa2ff3bfe05e790d316ae3652dac0a33e662d7101
Opcode Fuzzy Hash: 4c014591a30ecb7556fa1188f1d7f8c435a20ef473124c4d47e50945f916db56
Instruction Fuzzy Hash: 64A1FE724487819FCB12DF64D892557BFB0FF07304BA984AED9868B523D370A852DBC2

Uniqueness

Uniqueness Score: -1.00%

Function 005746E3 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 279COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 2d866722678908ede4fdb361d4b2313939fcced674a1d7946a5499ffa115d5e6
Instruction ID: b9c13f2f57608ba8fea632cabee63e1a6d5b5833a439f56059e095489b65175d
Opcode Fuzzy Hash: 2d866722678908ede4fdb361d4b2313939fcced674a1d7946a5499ffa115d5e6
Instruction Fuzzy Hash: 179120725493819FDB129F70D892157BF71FB87300B6984BECA868B463D3249803EBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00574709 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 279COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 7c7eaa56d766ec3440f04d971dbbf81a819ae5914d32939910fe5111742f958d
Instruction ID: a9b2f5c8b526766e58fc11f02707cdfaaf14b0049d80f0ef90ce26163ed58df7
Opcode Fuzzy Hash: 7c7eaa56d766ec3440f04d971dbbf81a819ae5914d32939910fe5111742f958d
Instruction Fuzzy Hash: 829131725493819FDB129F70D892157BF70FB47300B6985BECA868A463D324A803EBD2

Uniqueness

Uniqueness Score: -1.00%

Function 005746FF Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 275COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: 4a5dddf4b069c30214768154ce2bbb52a9797c1905e2702715aaecc07c54a6dc
Instruction ID: 96ad57fe160d0a5fea2a18adebc5d72c51f0d8e55a0378eee3d6bd2a6e75b9f5
Opcode Fuzzy Hash: 4a5dddf4b069c30214768154ce2bbb52a9797c1905e2702715aaecc07c54a6dc
Instruction Fuzzy Hash: 6F9121725493819FDB129F70D892157BF71FB47300B6984BECA868A463D3249813EBD3

Uniqueness

Uniqueness Score: -1.00%

Function 00574726 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 275COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: ec10f789db6a838c3f7883f9cfe6d49012f2c0a799b57ba405b437db89cdbc10
Instruction ID: 650e8d4237b781eb1a0ecc7a8d9c9895af0748cc11597bc3ebb268d46030982b
Opcode Fuzzy Hash: ec10f789db6a838c3f7883f9cfe6d49012f2c0a799b57ba405b437db89cdbc10
Instruction Fuzzy Hash: 109121725093819FDB129F70D892157BF71FB87300B6984BEC9868B463D3249803EBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00574797 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 271COMMON

Download Yara Rule

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 0-3754766082
Opcode ID: b8c772ed7525bb27e30ee6f4af8938eb8505138353bbda6aa62d3c59da55ef7a
Instruction ID: 99d07dc8c3bf785cdad77f49cb3d9662d4c5a34d58ef43cf350826d00d4d0390
Opcode Fuzzy Hash: b8c772ed7525bb27e30ee6f4af8938eb8505138353bbda6aa62d3c59da55ef7a
Instruction Fuzzy Hash: 609120728483819EDB129F70D892557BF70FB47300BA945BEDA868B463D3649843EBD3

Uniqueness

Uniqueness Score: -1.00%

Function 0057476B Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 251libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(ws2_32.dll,00000000,0000000C,LoadLibraryAws2_32.dll,00000000,0000000E,GetProcAddressLoadLibraryAws2_32.dll), ref: 00574975

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 1029625771-3754766082
Opcode ID: 0ddc38f8b50b525a7adf97f53d290c01e9fefa86f487a1b104a58cba2f52492b
Instruction ID: 024e92cc52d493fade70135facf0cec4f63fd8da8b7f5c4b1ae15523a4f45e1d
Opcode Fuzzy Hash: 0ddc38f8b50b525a7adf97f53d290c01e9fefa86f487a1b104a58cba2f52492b
Instruction Fuzzy Hash: AC8111724493C19EDB129F70D892557BF70FF47300BA544EEDA824A463D364A852DBD3

Uniqueness

Uniqueness Score: -1.00%

Function 00574847 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 226libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(ws2_32.dll,00000000,0000000C,LoadLibraryAws2_32.dll,00000000,0000000E,GetProcAddressLoadLibraryAws2_32.dll), ref: 00574975

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 1029625771-3754766082
Opcode ID: 8415f51abacc3218dd0ac0ce5a7cb2b56eccd9f6fb82fe7e4be8133927dd7e4a
Instruction ID: 79dcfc86926e0c41f9fbaf8c2578f4e7a0e78b6e20d8ef474ffc4fd9b382821e
Opcode Fuzzy Hash: 8415f51abacc3218dd0ac0ce5a7cb2b56eccd9f6fb82fe7e4be8133927dd7e4a
Instruction Fuzzy Hash: 2E71CFB24493819EDB12DF70D892557BFB0FF07304BA544EED9824A463D364A853EBD2

Uniqueness

Uniqueness Score: -1.00%

Function 0057492D Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 165libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(ws2_32.dll,00000000,0000000C,LoadLibraryAws2_32.dll,00000000,0000000E,GetProcAddressLoadLibraryAws2_32.dll), ref: 00574975

Strings

GetProcAddressLoadLibraryAws2_32.dll, xrefs: 0057495C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: GetProcAddressLoadLibraryAws2_32.dll
API String ID: 1029625771-3754766082
Opcode ID: f8128c776b1ca251a3c62b2291695990439ab74e2bb201a5cb4ec8fb22b5503d
Instruction ID: aab30e94375cc3b8c1e6971a9566de25032e76ee98e3ceb6c631d6e627c9b35b
Opcode Fuzzy Hash: f8128c776b1ca251a3c62b2291695990439ab74e2bb201a5cb4ec8fb22b5503d
Instruction Fuzzy Hash: 9A51BB724893C2AECB239FB09491643BF70FF07714BA605FED8818E813D3649952DB92

Uniqueness

Uniqueness Score: -1.00%

Function 0058C1E4 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

getaddrinfo.WS2_32 ref: 0058C26F

Strings

, xrefs: 0058C22C

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID: getaddrinfo
String ID:
API String ID: 300660673-3916222277
Opcode ID: d335221b2713c32d90ba0b7bdf633bd8acd41b6554dfd69253b3214692a32e0b
Instruction ID: 2ac08219827719baf499d4864010d21eca999d38d2a04a6b6c71bf7e5a598952
Opcode Fuzzy Hash: d335221b2713c32d90ba0b7bdf633bd8acd41b6554dfd69253b3214692a32e0b
Instruction Fuzzy Hash: C351C8B4A0460A8FDB10EFA8C48569EBBF0FF88310F158625EC55AB395D734D951CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0058B39F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 30memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 0058B3D5

Strings

@, xrefs: 0058B3BA

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: @
API String ID: 4275171209-2766056989
Opcode ID: 8f02c63b59fdc5112a07eac400efd3203f3af23da34a01cfe61ffdf0dcfdfd1a
Instruction ID: 2762acfcb5f286e396e4a1582ff590d54056951f98c2274bf8a7b808ac8d6cd5
Opcode Fuzzy Hash: 8f02c63b59fdc5112a07eac400efd3203f3af23da34a01cfe61ffdf0dcfdfd1a
Instruction Fuzzy Hash: 39F0E7B09042059FDB40FF65C48575DBFF4EB88354F018568E8A8AB282D77899818F52

Uniqueness

Uniqueness Score: -1.00%

Function 0058D5BC Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

select.WS2_32 ref: 0058D6D5

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 92bc18b051cd890b56e6a2886effe010e1807ae52aa105ed77365a68887fa37d
Instruction ID: 98113bd7af8173a74b5fadac458509b90fada970623fa5aa062cf70b770651b6
Opcode Fuzzy Hash: 92bc18b051cd890b56e6a2886effe010e1807ae52aa105ed77365a68887fa37d
Instruction Fuzzy Hash: DF4199B490424ADFDB10EF69C58569EBBF0FF44314F108559E8A8E7280E378DA85DF62

Uniqueness

Uniqueness Score: -1.00%

Function 0058A905 Relevance: 1.6, APIs: 1, Instructions: 53networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 0058A97D

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID: socket
String ID:
API String ID: 98920635-0
Opcode ID: 9cbf97c23e0ba64384716f35724c0de185de1455548f97b57e2de6305acf75d6
Instruction ID: 087249e7569ab75a591dd9ef30dff7d5ddc3d5c76eef481f37c585ac5856a531
Opcode Fuzzy Hash: 9cbf97c23e0ba64384716f35724c0de185de1455548f97b57e2de6305acf75d6
Instruction Fuzzy Hash: 90219AB49086169BDB00FFB8C48956EBBF0BF44320F114A69E8A5A73C1D7349941CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0058AA5D Relevance: 1.5, APIs: 1, Instructions: 44networkCOMMON

Download Yara Rule

APIs

connect.WS2_32 ref: 0058AACF

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID: connect
String ID:
API String ID: 1959786783-0
Opcode ID: 2fdd97c581636c48f49bf532c5505122f45d34172c8fb7d55c36e9b4fcbec193
Instruction ID: 965d2aabfe938a8a265e2e43bf2bfdd3f8f024b0c7dac1802f99480b50ca3e59
Opcode Fuzzy Hash: 2fdd97c581636c48f49bf532c5505122f45d34172c8fb7d55c36e9b4fcbec193
Instruction Fuzzy Hash: 0511CCB49047059BDB10EF78C88569ABBF4FF85320F10866AECA997381D774D984CF92

Uniqueness

Uniqueness Score: -1.00%

Function 005888EF Relevance: 1.3, APIs: 1, Instructions: 99sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 005889E3

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8fb081675a50429f135a4c4e2265cc52e6beaf6a86bcdef7811bf3aa03c07ce8
Instruction ID: 037eccdf6927943050d1f38b46a4bef573b8e2715c1e065adc3c21b667a772ed
Opcode Fuzzy Hash: 8fb081675a50429f135a4c4e2265cc52e6beaf6a86bcdef7811bf3aa03c07ce8
Instruction Fuzzy Hash: 9241BAB4D052099FCF00EFA4D5856EEBBF0FF48304F508969E894A7244E7349A45CF92

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00586E3F Relevance: 1.8, Strings: 1, Instructions: 547COMMON

Download Yara Rule

Strings

, xrefs: 005874FD

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c5781bb0fd7776b2a7d12a38eb91c1cbe028eda350875746d2b97cd5e3be3d5d
Instruction ID: bb696cdec240314a7c382e7ea9190fb09ee209b63b652b48f592f9199bd02874
Opcode Fuzzy Hash: c5781bb0fd7776b2a7d12a38eb91c1cbe028eda350875746d2b97cd5e3be3d5d
Instruction Fuzzy Hash: C9327D706044668FDB04DF5DC880A6EBBB2FFCA309F04C5A9E4259B39AC638D951DF94

Uniqueness

Uniqueness Score: -1.00%

Function 00587F6A Relevance: 1.8, Strings: 1, Instructions: 502COMMON

Download Yara Rule

Strings

, xrefs: 0058820D

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: f6f75e7c1264529f4ac4a26bdd149b76c7027108290046790093ae6c92995f6f
Instruction ID: 03a24dca99d75b023dec8891253c0e4932a45a3d313c8b0153adc65e82378b9e
Opcode Fuzzy Hash: f6f75e7c1264529f4ac4a26bdd149b76c7027108290046790093ae6c92995f6f
Instruction Fuzzy Hash: 1D220631A101598FDB40CF6DC880ABD7BF1EF8D308F9481A5F058EB642D639EA56DB60

Uniqueness

Uniqueness Score: -1.00%

Function 005878ED Relevance: 1.7, Strings: 1, Instructions: 486COMMON

Download Yara Rule

Strings

, xrefs: 00587B90

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: c76e5d72cc35e2c52be2bde45e4d78162da3714c9cc0b5bab6d0ea734a674c75
Instruction ID: 35fc0a8abaefb839613bd6b8bc106e2b5b1cdcc75a64114cd4eb841e6ea3d7c6
Opcode Fuzzy Hash: c76e5d72cc35e2c52be2bde45e4d78162da3714c9cc0b5bab6d0ea734a674c75
Instruction Fuzzy Hash: BB220431A1014A8FDB51CF6DC881AAD7BF1EF8D308F5880A4E058EF706D639EA56DB14

Uniqueness

Uniqueness Score: -1.00%

Function 00587511 Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed05b9532375df56ed812edde2549f652ad7c42c874df0ae4decb8ebf764d6fc
Instruction ID: 9b894c629c5b5f1dd472e117644400256c162e76c719f6e0a5087c944bba96c3
Opcode Fuzzy Hash: ed05b9532375df56ed812edde2549f652ad7c42c874df0ae4decb8ebf764d6fc
Instruction Fuzzy Hash: 06C1C772A0550B8FDB10CF88C881AAEB7B2FFD9345F5481B4D815AB70AD239E952CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00574A0D Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf13e6aa46301f98f3f8513a76b3b0981edbdec15bec0ed598b2c60ee7e741f6
Instruction ID: ea6049a9e1e2ea5b40c7ff1246be7c2474227db7643480ea8f0a6adf55e587f1
Opcode Fuzzy Hash: bf13e6aa46301f98f3f8513a76b3b0981edbdec15bec0ed598b2c60ee7e741f6
Instruction Fuzzy Hash: FF4168728897D2DECB62AF708191143BF71FF17704BA615FED8824A813D3759492DB82

Uniqueness

Uniqueness Score: -1.00%

Function 00574A36 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.516789881.0000000000570000.00000040.00001000.00020000.00000000.sdmp, Offset: 00570000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_570000_empudh9lY5.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7dc22d4eeda10fa89659e2c6d8bcba775cd11d48cf265ff676b4a192e6778cbc
Instruction ID: 0d718b23a7e052309dc296c01dded08b073b9f05f271bf5c7756ef2a54059ddc
Opcode Fuzzy Hash: 7dc22d4eeda10fa89659e2c6d8bcba775cd11d48cf265ff676b4a192e6778cbc
Instruction Fuzzy Hash: 3B314972849792DADB62AF70C185643BB71FF0B704BB519FED8824E813D3719492DB82

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping or `net view` using Net . Adversaries may also use local host files (ex: `C:\Windows\System32\Drivers\etc\hosts` or `/etc/hosts` ) in order to discover the hostname to IP address mappings of remote systems.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report empudh9lY5

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Malware Analysis System Evasion

Anti Debugging

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: empudh9lY5.exePID: 2560, Parent PID: 3452

General

Chronological Activities

Disassembly

Windows Analysis Report
empudh9lY5

Function 00570861 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 1049
COMMON

Function 00573536 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 1001
COMMON

Function 0057357D Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 999
COMMON

Function 00573563 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 999
COMMON

Function 00573595 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 998
COMMON

Function 0057355C Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 992
COMMON

Function 005735D4 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 990
COMMON

Function 00573609 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 983
COMMON

Function 00573628 Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 973
COMMON

Function 005736EE Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 954
COMMON

Function 005736DC Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 952
COMMON

Function 005736CF Relevance: 4.5, APIs: 1, Strings: 1, Instructions: 951
COMMON

Function 0057374B Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 947
COMMON

Function 0057372B Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 947
COMMON

Function 00573719 Relevance: 4.4, APIs: 1, Strings: 1, Instructions: 944
COMMON