Analysis Report

Overview

General Information

Analysis ID:	51561
Start time:	13:40:36
Start date:	20/04/2015
Overall analysis duration:	0h 2m 35s
Report type:	full
Sample file name:	virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe (renamed file extension from vir to exe)
Cookbook file name:	default.jbs
Analysis system description:	XP SP3, up to date 08.10.2013 (Office 2003 SP3, Java 1.7.0_25, Acrobat Reader 10.1.8, Flash 11.8.800.168, Internet Explorer 8.0.6001, Firefox 24, Chrome 30.0.1599.69))
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
HCA enabled:	true
HCA success:	true, ratio: 100% Number of executed functions: 3 Number of non-executed functions: 30

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	56	0 - 100	Report FP / FN

Signature Overview

Networking:

Urls found in memory or binary data

Show sources

Source: virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe, virussign.com_0af4ef5069f47a371a0caf22ae2006a6.dontrun	String found in binary or memory: http://cnc.cyberdrill.my/phish
Source: virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe, virussign.com_0af4ef5069f47a371a0caf22ae2006a6.dontrun	String found in binary or memory: http://infected.cyberdrill.my/mailer/email.php?target=%s

Contains functionality to download additional files from the internet

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

Code function: 0_1_00409270 sprintf,sprintf,MakeSureDirectoryPathExists,sprintf,sprintf,URLDownloadToFileA,

0_1_00409270

Found API chain matching a thread downloading files from the Internet

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

Internet file download: CreateThread, URLDownloadToFile

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

Code function: 0_1_00406E00 LoadLibraryA,GetProcAddress,FreeLibrary,

0_1_00406E00

Entry point lies outside standard sections

Show sources

Source: initial sample

Static PE information: section where entry point is pointing to: .data

PE file contains an invalid checksum

Show sources

Source: initial sample

Static PE information: real checksum: 0xa3d0 should be: 0x3aa0f

Spreading:

Found possible USB drive infection routine

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

USB drive infection routine: GetDriveType, CopyFile, SetFileAttributes

System Summary:

Contains functionality to adjust token privileges (e.g. debug / backup)

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

Code function: 0_1_00409900 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,CloseHandle,AdjustTokenPrivileges,CloseHandle,

0_1_00409900

Contains functionality to enum processes or threads

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

Code function: 0_1_00409510 CreateToolhelp32Snapshot,Process32First,_strlwr,OpenProcess,TerminateProcess,sprintf,MessageBoxA,strstr,OpenProcess,TerminateProcess,MessageBoxA,CloseHandle,Process32Next,CloseHandle,

0_1_00409510

Anti Debugging:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

Code function: 0_1_00406E00 LoadLibraryA,GetProcAddress,FreeLibrary,

0_1_00406E00

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

Memory protected: page read and write and page guard

Program does not show much activity (idle)

Show sources

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Checks for debuggers (window names)

Show sources

Source: virussign.com_0af4ef5069f47a371a0caf22ae2006a6.dontrun

Binary or memory string: ollydbg

Found API chain indicative of termination of specific processes

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe	Termination of specific process: EnumWindows, GetWindowText, GetCurrentProcessId, OpenProcess, TerminateProcess
Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe	Termination of specific process: CreateThread, CreateToolhelp32Snapshot, OpenProcess, TerminateProcess

Malware Analysis System Evasion:

May tried to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: virussign.com_0af4ef5069f47a371a0caf22ae2006a6.dontrun

Binary or memory string: vmware

Found API chain indicative of evasive behavior

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe	Evasive API call chain: RegOpenKey,...,DecisionNode,Sleep
Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe	Evasive API call chain: GetSystemTime,DecisionNodes,ExitProcess
Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Found decision node followed by non-executed suspicious APIs

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

Found large amount of non-executed APIs

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

API coverage: 5.7 %

Program does not show much activity (idle)

Show sources

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

Code function: 0_1_0040912A GetSystemTime,ExitProcess,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,Sleep,

0_1_0040912A

Contains functionality to query the account / user name

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

Code function: 0_1_00406E70 GetComputerNameA,GetUserNameA,_strrev,_strrev,_strrev,sprintf,sprintf,_strlwr,sprintf,

0_1_00406E70

Contains functionality to query windows version

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

Code function: 0_1_004070C0 GetVersionExA,

0_1_004070C0

Uses the system / local time for branch decision (may execute only at specific dates)

Show sources

Source: C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe

Code function: 0_1_0040912A GetSystemTime followed by cmp: cmp word ptr [ebp-1ah], 000bh and CTI: jc 0040915Ch

0_1_0040912A

Yara Overview

No Yara matches

Startup

system is xp11

virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe (PID: 1188 MD5: 0AF4EF5069F47A371A0CAF22AE2006A6)

cleanup

Created / dropped Files

No created / dropped files found

Contacted Domains/Contacted IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

Static File Info

General
File type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:	Win32 Executable (generic) (4510/7) 52.92% Generic Win/DOS Executable (2004/3) 23.51% DOS Executable Generic (2002/1) 23.49% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.08%
File name:	virussign.com_0af4ef5069f47a371a0caf22ae2006a6.dontrun
File size:	204372
MD5:	0af4ef5069f47a371a0caf22ae2006a6
SHA1:	ad75972ed87ca3f167c442765c0969b19dae4761
SHA256:	b51bed35b874ba43ba186f1b8c40e98d0eb5bb9b6ab60a1539206ef37f95baee
SHA512:	a371e920b2e2f3bbb56844939ff705a5cf4e8a45d411da225c6ad125ea05ecd4c30c2549bf7bfa0dd86ae3310912aa44918ba6bb3b40f7b00091c9fcafae744d

Static PE Info

General
Entrypoint:	0x40a42f
Entrypoint Section:	.data
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui 40
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4C444631 [Mon Jul 19 12:33:53 2010 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00402568h
push 0040A5B0h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [004010E8h]
pop ecx
or dword ptr [04E6D908h], FFFFFFFFh
or dword ptr [04E6D90Ch], FFFFFFFFh
call dword ptr [004010ECh]
mov ecx, dword ptr [0040A5F8h]
mov dword ptr [eax], ecx
call dword ptr [004010F0h]
mov ecx, dword ptr [0040A5F4h]
mov dword ptr [eax], ecx
mov eax, dword ptr [004010F4h]
mov eax, dword ptr [eax]
mov dword ptr [04E6D904h], eax
call 0FC80FC6h
cmp dword ptr [00406820h], ebx
jne 0FC80EBEh
push 0040A5ACh
call dword ptr [004010F8h]
pop ecx
call 0FC80F98h
push 0040300Ch
push 00403008h
call 0FC80F83h
mov eax, dword ptr [0040A5F0h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [0040A5ECh]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00401100h]
push 00403004h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2574	0xc8	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4a6e000	0x458	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x1c8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Xored PE	ZLIB Complexity	File Type	Characteristics
.rdata	0x1000	0x1e3a	0x2000	6.96092703302	False	0.765014648438	ump; data	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x4a6a910	0x7600	6.32074066653	False	0.506190413136	ump; data	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x4a6e000	0x458	0x600	2.6360548432	False	0.3203125	ump; data	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	Nbr Of Functions	Xored PE
RT_VERSION	0x4a6e060	0x3f4	ump; data	English	United States	0	False

Imports

DLL	Import
USER32.dll	EnumWindows, GetWindowTextA, GetWindowThreadProcessId, CharUpperA, MessageBoxA, GetWindowTextLengthA
SHELL32.dll	ShellExecuteA
dbghelp.dll	MakeSureDirectoryPathExists
urlmon.dll	URLDownloadToFileA
MSVCRT.dll	_controlfp, _except_handler3, __set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, fwrite, srand, rand, strstr, _splitpath, atoi, tolower, fopen, fclose, strchr, sprintf, _strlwr, _strrev, _strupr
WININET.dll	InternetGetConnectedState
WSOCK32.dll	connect, gethostbyname, recv, shutdown, closesocket, WSACleanup, htons, socket, WSAStartup, __WSAFDIsSet, select, WSAGetLastError, inet_ntoa, send
ADVAPI32.dll	RegCreateKeyA, AdjustTokenPrivileges, RegOpenKeyExA, RegQueryValueExA, GetUserNameA, RegCloseKey, LookupPrivilegeValueA, OpenProcessToken, RegSetValueExA
KERNEL32.dll	WinExec, GetCurrentThread, SetThreadPriority, ExitThread, CreateThread, Sleep, GetVersionExA, GetComputerNameA, FreeLibrary, LoadLibraryA, GetProcAddress, GetModuleFileNameA, GetSystemDirectoryA, GetWindowsDirectoryA, GetTempPathA, CreateSemaphoreA, ReleaseSemaphore, CreateEventA, ExitProcess, CreateMutexA, GetLastError, lstrlenA, GetTickCount, lstrcpyA, GetCurrentProcess, GetModuleHandleA, GetCurrentProcessId, CreateToolhelp32Snapshot, Process32First, OpenProcess, TerminateProcess, Process32Next, GetSystemTime, CreateProcessA, WritePrivateProfileStringA, CreateDirectoryA, CreateFileA, CloseHandle, GlobalFree, GlobalAlloc, GetStartupInfoA, SetFileAttributesA, CopyFileA, ReleaseMutex, GetDriveTypeA

Version Infos

Description	Data
LegalCopyright	Copyright (C) Microsoft Corp. 1981-2000
InternalName	servicess
FileVersion	5.50.4134.100
CompanyName	Microsoft Corporation
PrivateBuild
LegalTrademarks
Comments
ProductName	Microsoft(R) Windows(R) 2000 Operating System
SpecialBuild
ProductVersion	5.50.4134.100
FileDescription	Microsoft (R) Windows Explorer
OriginalFilename	servicess.exe
Translation	0x0419 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Hooks - Code Manipulation Behavior

Statistics

System Behavior

Analysis Process: virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe PID: 1188 Parent PID: 736

General

Start time:	13:40:59
Start date:	30/12/2014
Path:	C:\virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe
Wow64 process (32bit):	false
Commandline:	unknown
Imagebase:	0x400000
File size:	204372 bytes
MD5 hash:	0AF4EF5069F47A371A0CAF22AE2006A6

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe PID: 1188 Parent PID: 736

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	14.3%
Total number of Nodes:	322
Total number of Limit Nodes:	2

Executed Functions

Function 0040912A, Relevance: 10.6, APIs: 7, Instructions: 85

APIs

Part of subcall function 00406DB0: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00406DBD
Part of subcall function 00406DB0: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406DCF
Part of subcall function 00406DB0: GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,?,?,?,0040923F,?), ref: 00406DE1
Part of subcall function 00406DB0: GetTempPathA.KERNEL32(00000104,?), ref: 00406DF3

GetSystemTime.KERNEL32(?), ref: 0040913F
ExitProcess.KERNEL32 ref: 00409156

Part of subcall function 004070C0: GetVersionExA.KERNEL32(00000000), ref: 004070D3

Part of subcall function 00408A06: sprintf.MSVCRT ref: 00408A5B
Part of subcall function 00408A06: sprintf.MSVCRT ref: 00408A83
Part of subcall function 00408A06: sprintf.MSVCRT ref: 00408A93
Part of subcall function 00408A06: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 00408AB6
Part of subcall function 00408A06: sprintf.MSVCRT ref: 00408AD1
Part of subcall function 00408A06: lstrlenA.KERNEL32(?), ref: 00408ADD
Part of subcall function 00408A06: RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000001), ref: 00408AFA
Part of subcall function 00408A06: RegCloseKey.ADVAPI32(?), ref: 00408B03
Part of subcall function 00408A06: sprintf.MSVCRT ref: 00408B15
Part of subcall function 00408A06: sprintf.MSVCRT ref: 00408B2D
Part of subcall function 00408A06: RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 00408B3E

Part of subcall function 004084F7: sprintf.MSVCRT ref: 00408555
Part of subcall function 004084F7: CreateDirectoryA.KERNEL32(?,00000000), ref: 00408563
Part of subcall function 004084F7: SetFileAttributesA.KERNEL32(?,00000006), ref: 00408578
Part of subcall function 004084F7: sprintf.MSVCRT ref: 004085AF
Part of subcall function 004084F7: CreateDirectoryA.KERNEL32(?,00000000), ref: 004085BD
Part of subcall function 004084F7: SetFileAttributesA.KERNEL32(?,00000006), ref: 004085CC
Part of subcall function 004084F7: sprintf.MSVCRT ref: 00408601
Part of subcall function 004084F7: CopyFileA.KERNEL32(00000000,?,00000000), ref: 00408612
Part of subcall function 004084F7: SetFileAttributesA.KERNEL32(?,00000006), ref: 0040862A

Sleep.KERNEL32(00003AB0), ref: 004091FB

Part of subcall function 00409900: GetCurrentProcess.KERNEL32 ref: 0040990A
Part of subcall function 00409900: OpenProcessToken.ADVAPI32(00000000), ref: 00409911
Part of subcall function 00409900: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00409927
Part of subcall function 00409900: CloseHandle.KERNEL32 ref: 00409936
Part of subcall function 00409900: AdjustTokenPrivileges.ADVAPI32 ref: 00409972
Part of subcall function 00409900: CloseHandle.KERNEL32 ref: 0040997D

Part of subcall function 00406E00: LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 00406E2D
Part of subcall function 00406E00: GetProcAddress.KERNEL32(00000000,?), ref: 00406E45
Part of subcall function 00406E00: FreeLibrary.KERNEL32(00000000), ref: 00406E5C

Part of subcall function 00409029: GetModuleFileNameA.KERNEL32(00000000,?,000000FF), ref: 00409044
Part of subcall function 00409029: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00409056
Part of subcall function 00409029: sprintf.MSVCRT ref: 004090A8
Part of subcall function 00409029: _strlwr.MSVCRT ref: 004090D6
Part of subcall function 00409029: _strlwr.MSVCRT ref: 004090E3
Part of subcall function 00409029: strstr.MSVCRT ref: 004090E7
Part of subcall function 00409029: CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00409110
Part of subcall function 00409029: CloseHandle.KERNEL32(?), ref: 0040911D
Part of subcall function 00409029: ExitThread.KERNEL32 ref: 00409124

Part of subcall function 00408220: _strrev.MSVCRT ref: 0040824F
Part of subcall function 00408220: sprintf.MSVCRT ref: 00408268
Part of subcall function 00408220: GetLastError.KERNEL32 ref: 0040827D

CreateThread.KERNEL32(00000000,00000000,004098A0,00000000), ref: 004091BD
CreateThread.KERNEL32(00000000,00000000,00407180,00000000), ref: 004091CC
CreateThread.KERNEL32(00000000,00000000,00407230,00000000), ref: 004091DB
CreateThread.KERNEL32(00000000,00000000,00407A80,00000000), ref: 004091F3

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 0040A42F, Relevance: 16.6, APIs: 11, Instructions: 111

APIs

__set_app_type.MSVCRT ref: 0040A45C
__p__fmode.MSVCRT ref: 0040A471
__p__commode.MSVCRT ref: 0040A47F
__setusermatherr.MSVCRT ref: 0040A4AB

Part of subcall function 0040A59A: _controlfp.MSVCRT ref: 0040A5A4

_initterm.MSVCRT ref: 0040A4C1
__getmainargs.MSVCRT ref: 0040A4E4
_initterm.MSVCRT ref: 0040A4F4
GetStartupInfoA.KERNEL32(?), ref: 0040A533
GetModuleHandleA.KERNEL32(00000000), ref: 0040A557

Part of subcall function 00409206: #115.WSOCK32(00000002,?), ref: 00409219
Part of subcall function 00409206: ExitProcess.KERNEL32 ref: 00409242

exit.MSVCRT ref: 0040A567
_XcptFilter.MSVCRT ref: 0040A579

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00409206, Relevance: 3.0, APIs: 2, Instructions: 19

APIs

#115.WSOCK32(00000002,?), ref: 00409219

Part of subcall function 00406830: GetTickCount.KERNEL32 ref: 00406830

Part of subcall function 0040912A: GetSystemTime.KERNEL32(?), ref: 0040913F
Part of subcall function 0040912A: ExitProcess.KERNEL32 ref: 00409156
Part of subcall function 0040912A: CreateThread.KERNEL32(00000000,00000000,004098A0,00000000), ref: 004091BD
Part of subcall function 0040912A: CreateThread.KERNEL32(00000000,00000000,00407180,00000000), ref: 004091CC
Part of subcall function 0040912A: CreateThread.KERNEL32(00000000,00000000,00407230,00000000), ref: 004091DB
Part of subcall function 0040912A: CreateThread.KERNEL32(00000000,00000000,00407A80,00000000), ref: 004091F3
Part of subcall function 0040912A: Sleep.KERNEL32(00003AB0), ref: 004091FB

ExitProcess.KERNEL32 ref: 00409242

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Non-executed Functions

Function 00409510, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 59

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409514
Process32First.KERNEL32(00000000,0040A720), ref: 0040952E
strstr.MSVCRT ref: 00409560
OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 0040957A
TerminateProcess.KERNEL32(00000000,00000000), ref: 00409588
MessageBoxA.USER32(00000000,Woops! You are phohibited to use such skill. Be pray and patient.,MyB0t [Part of CyberDrill],00000000), ref: 00409598
CloseHandle.KERNEL32(00000000), ref: 004095A0
Process32Next.KERNEL32(00000000,0040A720), ref: 004095B2
CloseHandle.KERNEL32(00000000), ref: 004095CB

Strings

Woops! You are phohibited to use such skill. Be pray and patient., xrefs: 00409591
MyB0t [Part of CyberDrill], xrefs: 0040958C
<e@, xrefs: 0040954C

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00406E70, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 79

APIs

GetComputerNameA.KERNEL32(?,?), ref: 00406EAB
GetUserNameA.ADVAPI32(?,?), ref: 00406EBE
_strrev.MSVCRT ref: 00406EE8
_strrev.MSVCRT ref: 00406EFD
sprintf.MSVCRT ref: 00406F44
_strlwr.MSVCRT ref: 00406F4E
sprintf.MSVCRT ref: 00406F7E

Strings

%s%d%d, xrefs: 00406F3E

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00409900, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41

APIs

GetCurrentProcess.KERNEL32 ref: 0040990A
OpenProcessToken.ADVAPI32(00000000), ref: 00409911
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 00409927
CloseHandle.KERNEL32 ref: 00409936
AdjustTokenPrivileges.ADVAPI32 ref: 00409972
CloseHandle.KERNEL32 ref: 0040997D

Strings

SeDebugPrivilege, xrefs: 00409920

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00409270, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58

APIs

sprintf.MSVCRT ref: 0040929A
sprintf.MSVCRT ref: 004092E2
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 004092FA

Strings

%s%s, xrefs: 004092DC
%s/%s, xrefs: 00409294

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00406E00, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44

APIs

LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 00406E2D
GetProcAddress.KERNEL32(00000000,?), ref: 00406E45
FreeLibrary.KERNEL32(00000000), ref: 00406E5C

Strings

KERNEL32.DLL, xrefs: 00406E27
RegisterServiceProcess, xrefs: 00406E0C

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 004070C0, Relevance: 1.5, APIs: 1, Instructions: 16

APIs

GetVersionExA.KERNEL32(00000000), ref: 004070D3

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00408A06, Relevance: 163.2, APIs: 72, Strings: 21, Instructions: 481

APIs

Part of subcall function 00406E70: GetComputerNameA.KERNEL32(?,?), ref: 00406EAB
Part of subcall function 00406E70: GetUserNameA.ADVAPI32(?,?), ref: 00406EBE
Part of subcall function 00406E70: _strrev.MSVCRT ref: 00406EE8
Part of subcall function 00406E70: _strrev.MSVCRT ref: 00406EFD
Part of subcall function 00406E70: sprintf.MSVCRT ref: 00406F44
Part of subcall function 00406E70: _strlwr.MSVCRT ref: 00406F4E
Part of subcall function 00406E70: sprintf.MSVCRT ref: 00406F7E

Part of subcall function 00407100: sprintf.MSVCRT ref: 00407164

sprintf.MSVCRT ref: 00408A5B
sprintf.MSVCRT ref: 00408A83
sprintf.MSVCRT ref: 00408A93
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 00408AB6
sprintf.MSVCRT ref: 00408AD1
lstrlenA.KERNEL32(?), ref: 00408ADD
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000001), ref: 00408AFA
RegCloseKey.ADVAPI32(?), ref: 00408B03
sprintf.MSVCRT ref: 00408B15
sprintf.MSVCRT ref: 00408B2D
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 00408B3E
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 00408B5F
RegSetValueExA.ADVAPI32(?,Debugger,00000000,00000001,?), ref: 00408B90
RegCloseKey.ADVAPI32(?), ref: 00408B95
sprintf.MSVCRT ref: 00408BB4
sprintf.MSVCRT ref: 00408BC2
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 00408BDA
sprintf.MSVCRT ref: 00408BFE
lstrlenA.KERNEL32(?), ref: 00408C0A
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000001), ref: 00408C27
RegCloseKey.ADVAPI32(?), ref: 00408C2C
sprintf.MSVCRT ref: 00408C3E
sprintf.MSVCRT ref: 00408C4C
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 00408C64
sprintf.MSVCRT ref: 00408C88
lstrlenA.KERNEL32(?), ref: 00408C94
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000001), ref: 00408CB1
RegCloseKey.ADVAPI32(?), ref: 00408CB6
sprintf.MSVCRT ref: 00408CC8
sprintf.MSVCRT ref: 00408CD6
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 00408CEE
sprintf.MSVCRT ref: 00408D12
lstrlenA.KERNEL32(?), ref: 00408D1E
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000001), ref: 00408D3B
RegCloseKey.ADVAPI32(?), ref: 00408D40
sprintf.MSVCRT ref: 00408D52
sprintf.MSVCRT ref: 00408D60
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 00408D78
sprintf.MSVCRT ref: 00408D9C
lstrlenA.KERNEL32(?), ref: 00408DA8
RegSetValueExA.ADVAPI32(?,?,00000000,00000002,?,00000001), ref: 00408DC5
RegCloseKey.ADVAPI32(?), ref: 00408DCA
sprintf.MSVCRT ref: 00408DDC
sprintf.MSVCRT ref: 00408DEA
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 00408E02
sprintf.MSVCRT ref: 00408E26
lstrlenA.KERNEL32(?), ref: 00408E32
RegSetValueExA.ADVAPI32(?,?,00000000,00000002,?,00000001), ref: 00408E4F
RegCloseKey.ADVAPI32(?), ref: 00408E54
sprintf.MSVCRT ref: 00408E66
sprintf.MSVCRT ref: 00408E74
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 00408E8C
sprintf.MSVCRT ref: 00408EB0
lstrlenA.KERNEL32(?), ref: 00408EBC
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000001), ref: 00408ED9
RegCloseKey.ADVAPI32(?), ref: 00408EDE
sprintf.MSVCRT ref: 00408EF0
sprintf.MSVCRT ref: 00408EFE
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 00408F0F
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 00408F30
sprintf.MSVCRT ref: 00408F54
lstrlenA.KERNEL32(?), ref: 00408F60
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000001), ref: 00408F7D
RegCloseKey.ADVAPI32(?), ref: 00408F82
sprintf.MSVCRT ref: 00408F94
sprintf.MSVCRT ref: 00408FA2
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 00408FB3
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 00408FD0
sprintf.MSVCRT ref: 00408FF0
lstrlenA.KERNEL32(?), ref: 00408FFC
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000001), ref: 00409019
RegCloseKey.ADVAPI32(?), ref: 0040901E

Strings

SYSTEM\CurrentControlSet\Control\SafeBoot, xrefs: 00408BAE
Shell, xrefs: 00408CD0
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Your Image File Name Here without a path, xrefs: 00408E60
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon, xrefs: 00408C38, 00408CC2
%s\%s\services.exe, xrefs: 00408B27
%s\%s.exe, xrefs: 00408A7D
SYSTEM\CurrentControlSet\Services\srservice, xrefs: 00408DD6
userinit.exe, %s\%s\mirror.exe, xrefs: 00408C82
Userinit, xrefs: 00408C46
%s\%s\servicess.exe, xrefs: 00408D96, 00408E20, 00408EAA, 00408F4E, 00408FEA
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00408A55
%s\%s\netdhcp.exe, xrefs: 00408BF8
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe, xrefs: 00408B0F
AlternateShell, xrefs: 00408BBC
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run, xrefs: 00408F8E
Explorer.exe %s\%s\servicess.exe, xrefs: 00408D0C
Debugger, xrefs: 00408B88, 00408E6E, 00408EF8
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe, xrefs: 00408EEA
RunTimeDebugger, xrefs: 00408F9C
SYSTEM\CurrentControlSet\Services\ERSvc\Enum, xrefs: 00408D4C
ImagePath, xrefs: 00408D5A, 00408DE4

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 004095E0, Relevance: 103.4, APIs: 11, Strings: 48, Instructions: 129

APIs

GetWindowTextLengthA.USER32 ref: 004097A5
GetWindowTextA.USER32(?,?,00000001), ref: 004097B6
GetWindowThreadProcessId.USER32(?,?), ref: 004097C2
GetCurrentProcessId.KERNEL32 ref: 004097F6
_strupr.MSVCRT ref: 00409805
_strupr.MSVCRT ref: 00409817
strstr.MSVCRT ref: 00409821
OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 0040983A
TerminateProcess.KERNEL32(00000000,00000000), ref: 00409841
CloseHandle.KERNEL32(00000000), ref: 00409844
MessageBoxA.USER32(00000000,Woops! You are phohibited to use such skill. Be pray and patient.,MyB0t [Part of CyberDrill],00000000), ref: 00409854

Strings

xvi32, xrefs: 00409793
atool, xrefs: 0040961A
avast, xrefs: 00409622
f-secure, xrefs: 0040965A
norton, xrefs: 0040969A
defender, xrefs: 0040964A
B.E late, xrefs: 00409632
trojan ana, xrefs: 0040975C
process hacker, xrefs: 004096B2
norman, xrefs: 00409692
startuplist, xrefs: 0040970F
avira, xrefs: 0040962A
file manager, xrefs: 00409662
regmon, xrefs: 004096E3
MyB0t [Part of CyberDrill], xrefs: 00409848
antivir, xrefs: 00409612
system.ini, xrefs: 00409730
process explorer, xrefs: 004096AA
process killer, xrefs: 004096BA
symantec, xrefs: 0040971A
registry monitor, xrefs: 004096D8
win.ini, xrefs: 00409788
disassemb, xrefs: 00409652
ollyd, xrefs: 004096A2
scan for vir, xrefs: 00409704
registry, xrefs: 004096CD
luke file, xrefs: 00409682
taskkill, xrefs: 0040973B
Woops! You are phohibited to use such skill. Be pray and patient., xrefs: 0040984D
anti repla, xrefs: 004095FA
system configuration, xrefs: 00409725
task manager, xrefs: 00409746
visual basi, xrefs: 00409767
decompi, xrefs: 00409642
vmware, xrefs: 0040977D
mcafee, xrefs: 0040968A
kaspersky, xrefs: 0040967A
antispy, xrefs: 00409602
regrun, xrefs: 004096EE
visual c, xrefs: 00409772
debugger, xrefs: 0040963A
trend micro, xrefs: 00409751
anti spy, xrefs: 0040960A
anti..., xrefs: 004095F2, 004097CA
internet secur, xrefs: 00409672
hijackth, xrefs: 0040966A
protection scan, xrefs: 004096C2
resource hack, xrefs: 004096F9

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 004086AC, Relevance: 93.0, APIs: 32, Strings: 21, Instructions: 260

APIs

Part of subcall function 00406E70: GetComputerNameA.KERNEL32(?,?), ref: 00406EAB
Part of subcall function 00406E70: GetUserNameA.ADVAPI32(?,?), ref: 00406EBE
Part of subcall function 00406E70: _strrev.MSVCRT ref: 00406EE8
Part of subcall function 00406E70: _strrev.MSVCRT ref: 00406EFD
Part of subcall function 00406E70: sprintf.MSVCRT ref: 00406F44
Part of subcall function 00406E70: _strlwr.MSVCRT ref: 00406F4E
Part of subcall function 00406E70: sprintf.MSVCRT ref: 00406F7E

Part of subcall function 00407100: sprintf.MSVCRT ref: 00407164

sprintf.MSVCRT ref: 00408724
sprintf.MSVCRT ref: 0040874C
sprintf.MSVCRT ref: 0040875F
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 0040877C
sprintf.MSVCRT ref: 00408799
lstrlenA.KERNEL32(?), ref: 004087A5
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000001), ref: 004087BF
RegCloseKey.ADVAPI32(?), ref: 004087C8
sprintf.MSVCRT ref: 004087DA
sprintf.MSVCRT ref: 004087F9
RegCreateKeyA.ADVAPI32(80000002,?,?), ref: 0040880A
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 0040882B
RegSetValueExA.ADVAPI32(?,Debugger,00000000,00000001,?), ref: 00408860
RegCloseKey.ADVAPI32(?), ref: 00408865
sprintf.MSVCRT ref: 0040888E
WritePrivateProfileStringA.KERNEL32(windows,run,?,win.ini), ref: 004088A9
sprintf.MSVCRT ref: 004088C2
WritePrivateProfileStringA.KERNEL32(boot,shell,?,system.ini), ref: 004088DD
sprintf.MSVCRT ref: 004088EF
sprintf.MSVCRT ref: 00408907
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 0040891F
sprintf.MSVCRT ref: 00408943
lstrlenA.KERNEL32(?), ref: 0040894F
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000001), ref: 00408969
RegCloseKey.ADVAPI32(?), ref: 0040896E
sprintf.MSVCRT ref: 00408980
sprintf.MSVCRT ref: 00408998
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020006,?), ref: 004089B0
sprintf.MSVCRT ref: 004089D0
lstrlenA.KERNEL32(?), ref: 004089DC
RegSetValueExA.ADVAPI32(?,?,00000000,00000001,?,00000001), ref: 004089F6
RegCloseKey.ADVAPI32(?), ref: 004089FB

Strings

DHCPNetServer, xrefs: 004086C6
boot, xrefs: 004088D8
FireFoxPro, xrefs: 004086CD
USBUpdates, xrefs: 004086DB
run, xrefs: 0040889F
%s\%s\servicess.exe, xrefs: 00408888
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0040871E, 004088E9
%s\%s\netdhcp.exe, xrefs: 004089CA
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe, xrefs: 004087D4
system.ini, xrefs: 004088CD
OLE-COM, xrefs: 004086D4
%s\%s\%s.exe, xrefs: 00408746, 004087F3
shell, xrefs: 004088D3
Software\Microsoft\Windows\CurrentVersion\RunServices, xrefs: 0040897A
win.ini, xrefs: 00408899
%s\%s\mirror.exe, xrefs: 0040893D
ShellWindows, xrefs: 004086BF
Debugger, xrefs: 00408858
windows, xrefs: 004088A4
L@@, xrefs: 00408726, 004087F0, 0040873F
Explorer.exe %s, xrefs: 004088BC

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00408030, Relevance: 68.3, APIs: 5, Strings: 34, Instructions: 98

APIs

GetSystemDirectoryA.KERNEL32 ref: 00408161
sprintf.MSVCRT ref: 00408197
WinExec.KERNEL32(?,00000000), ref: 004081A9
sprintf.MSVCRT ref: 004081F5
WinExec.KERNEL32(?,00000000), ref: 00408204

Strings

mcmc.cyberdrill.my, xrefs: 004080E6
kdn.cyberdrill.my, xrefs: 00408126
moa.cyberdrill.my, xrefs: 0040814F
cimb.cyberdrill.my, xrefs: 004080AE
mbb.cyberdrill.my, xrefs: 004080B6
mindef.cyberdrill.my, xrefs: 0040812E
mas.cyberdrill.my, xrefs: 0040804E
marine.cyberdrill.my, xrefs: 00408116
jpn.cyberdrill.my, xrefs: 00408139
mosti.cyberdrill.my, xrefs: 004080EE
mampu.cyberdrill.my, xrefs: 004080C6
span.cyberdrill.my, xrefs: 00408066
indahwater.cyberdrill.my, xrefs: 0040807E
moh.cyberdrill.my, xrefs: 00408056
kpj.cyberdrill.my, xrefs: 0040805E
ptp.cyberdrill.my, xrefs: 0040811E
mynic.cyberdrill.my, xrefs: 004080FE
tnb.cyberdrill.my, xrefs: 004080DE
sc.cyberdrill.my, xrefs: 004080BE
%s\ping.exe %s -l 65500 -n %i, xrefs: 00408191, 004081EF
jaring.cyberdrill.my, xrefs: 00408144
bursa.cyberdrill.my, xrefs: 004080A6
petronas.cyberdrill.my, xrefs: 004080D6
tm.cyberdrill.my, xrefs: 00408106
celcom.cyberdrill.my, xrefs: 004080F6
bnm.cyberdrill.my, xrefs: 00408096
mot.cyberdrill.my, xrefs: 0040810E
syabas.cyberdrill.my, xrefs: 00408086
pbapp.cyberdrill.my, xrefs: 00408076
rhb.cyberdrill.my, xrefs: 00408046, 004081BE, 004081D5, 004081E6
muamalat.cyberdrill.my, xrefs: 0040809E
st.cyberdrill.my, xrefs: 004080CE
sajholding.cyberdrill.my, xrefs: 0040808E
hselayang.cyberdrill.my, xrefs: 0040806E

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 0040828F, Relevance: 54.4, APIs: 8, Strings: 23, Instructions: 154

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 0040834B
lstrcpyA.KERNEL32(?,00403E30,?,00002C48), ref: 0040835D
GetDriveTypeA.KERNEL32(00000044), ref: 00408385
sprintf.MSVCRT ref: 004083E5
_splitpath.MSVCRT ref: 00408443
sprintf.MSVCRT ref: 00408473

Part of subcall function 004084CC: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 004084DE
Part of subcall function 004084CC: CloseHandle.KERNEL32(00000000), ref: 004084ED

CopyFileA.KERNEL32(?,?,00000000), ref: 0040849C
SetFileAttributesA.KERNEL32(?,00000080), ref: 004084AE

Strings

exe, xrefs: 00408328
workfiles, xrefs: 004082CD
Duty, xrefs: 0040830C
pif, xrefs: 0040833D
assignment, xrefs: 004082C6
db1, xrefs: 004082F7
Task, xrefs: 00408305
untitled, xrefs: 004082D4
D>@@>@<>@8>@4>@, xrefs: 00408461, 004083B8
young_and_dangerous, xrefs: 0040831A
Z, xrefs: 004084BA
com, xrefs: 00408336
scr, xrefs: 0040832F
new_page_1, xrefs: 004082FE
sex_toy_for_men, xrefs: 00408313
Presentation1, xrefs: 004082E9
bat, xrefs: 00408344
pictures, xrefs: 004082DB
%s%s.%s, xrefs: 004083DF, 0040846D
Book1, xrefs: 004082F0
HotBaby...xxx, xrefs: 00408321
thelover, xrefs: 004082E2
document05, xrefs: 004082B3

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00407370, Relevance: 51.0, APIs: 18, Strings: 11, Instructions: 274

APIs

Part of subcall function 00407350: GetComputerNameA.KERNEL32(00002C48,P,H,), ref: 0040735A

sprintf.MSVCRT ref: 004073CF
sprintf.MSVCRT ref: 004073E4
sprintf.MSVCRT ref: 004073FA
#115.WSOCK32(00000202,?), ref: 0040740C
#116.WSOCK32 ref: 00407423
#23.WSOCK32(00000002,00000001,00000006), ref: 0040743C
#116.WSOCK32 ref: 00407456
#52.WSOCK32(?), ref: 00407471
#116.WSOCK32 ref: 0040748A
#9.WSOCK32(00000050), ref: 004074B1
#4.WSOCK32(00000000,?,00000010), ref: 004074D6
#116.WSOCK32 ref: 004074ED
#19.WSOCK32(00000000,?,?,00000000), ref: 0040761E
#16.WSOCK32(00000000,?,000003E8,00000000,?,00000000), ref: 00407647
#22.WSOCK32(00000000,00000001,?,00000000), ref: 0040766A
#3.WSOCK32(00000000,?,00000000), ref: 00407671
#116.WSOCK32(?,00000000), ref: 00407677

Part of subcall function 00407280: _strrev.MSVCRT ref: 004072A8
Part of subcall function 00407280: sprintf.MSVCRT ref: 004072E9
Part of subcall function 00407280: _strrev.MSVCRT ref: 00407329
Part of subcall function 00407280: sprintf.MSVCRT ref: 0040733D

sprintf.MSVCRT ref: 004076A7

Strings

Connection: Keep-Alive, xrefs: 004075C9
HTTP/1.0User-Agent: Wget/1.11.4Accept: */*, xrefs: 00407569
%s?host=%s&state=on, xrefs: 004073C9
Winsock error - Winsock initialization failed, xrefs: 00407416
d, xrefs: 004073A0
------, xrefs: 0040765A
Failed to resolve hostname., xrefs: 0040747D
Failed to establish connection with server, xrefs: 004074E0
Host: %s, xrefs: 004073F4
GET , xrefs: 00407503
Winsock error - Socket creation Failed!, xrefs: 00407449

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00407A80, Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 207

APIs

Part of subcall function 00407370: sprintf.MSVCRT ref: 004073CF
Part of subcall function 00407370: sprintf.MSVCRT ref: 004073E4
Part of subcall function 00407370: sprintf.MSVCRT ref: 004073FA
Part of subcall function 00407370: #115.WSOCK32(00000202,?), ref: 0040740C
Part of subcall function 00407370: #116.WSOCK32 ref: 00407423
Part of subcall function 00407370: #23.WSOCK32(00000002,00000001,00000006), ref: 0040743C
Part of subcall function 00407370: #116.WSOCK32 ref: 00407456
Part of subcall function 00407370: #52.WSOCK32(?), ref: 00407471
Part of subcall function 00407370: #116.WSOCK32 ref: 0040748A
Part of subcall function 00407370: #9.WSOCK32(00000050), ref: 004074B1
Part of subcall function 00407370: #4.WSOCK32(00000000,?,00000010), ref: 004074D6
Part of subcall function 00407370: #116.WSOCK32 ref: 004074ED

sprintf.MSVCRT ref: 00407ABE

Part of subcall function 004076C0: tolower.MSVCRT ref: 004076E2
Part of subcall function 004076C0: tolower.MSVCRT ref: 0040770D

Sleep.KERNEL32(0001D4C0), ref: 00407B32
sprintf.MSVCRT ref: 00407B79
Sleep.KERNEL32(0001D4C0), ref: 00407B8D
Sleep.KERNEL32(0001D4C0), ref: 00407BDC
Sleep.KERNEL32(0001D4C0), ref: 00407C2B
CreateThread.KERNEL32(00000000,00000000,00409250,00000000), ref: 00407C7A
Sleep.KERNEL32(0001D4C0), ref: 00407C81
CreateThread.KERNEL32(00000000,00000000,00409250,00000000), ref: 00407C9A
sprintf.MSVCRT ref: 00407CA6

Part of subcall function 00407920: sprintf.MSVCRT ref: 0040794F
Part of subcall function 00407920: ShellExecuteA.SHELL32(00000000,open,iexplore.exe,?,0040A5E8,00000000), ref: 00407973

sprintf.MSVCRT ref: 00407CBC

Part of subcall function 00407730: atoi.MSVCRT(?,?,?,?,?,?,?,000028E8,?,00002C50,00002C48), ref: 004077A4
Part of subcall function 00407730: atoi.MSVCRT(?,?,?,?), ref: 004077F4
Part of subcall function 00407730: atoi.MSVCRT(?,?,?,?), ref: 00407844

Part of subcall function 00407730: atoi.MSVCRT(?), ref: 00407895
Part of subcall function 00407730: Sleep.KERNEL32(00000400), ref: 00407902

Sleep.KERNEL32(0001D4C0), ref: 00407CD0

Strings

start_ddos_all, xrefs: 00407B3D
127.0.0.1:80:2:5:1, xrefs: 00407B73, 00407CB6
phish, xrefs: 00407C36
start_ddos, xrefs: 00407AEE
download_exec, xrefs: 00407BE7
ceo@cyberdrill.my, xrefs: 00407CA0
newCmd=%s, xrefs: 00407AB8
email_spam, xrefs: 00407B98

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 004084F7, Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 132

APIs

Part of subcall function 00407100: sprintf.MSVCRT ref: 00407164

sprintf.MSVCRT ref: 00408555
CreateDirectoryA.KERNEL32(?,00000000), ref: 00408563
SetFileAttributesA.KERNEL32(?,00000006), ref: 00408578
sprintf.MSVCRT ref: 004085AF
CreateDirectoryA.KERNEL32(?,00000000), ref: 004085BD
SetFileAttributesA.KERNEL32(?,00000006), ref: 004085CC
sprintf.MSVCRT ref: 00408601
CopyFileA.KERNEL32(00000000,?,00000000), ref: 00408612

Part of subcall function 004099A0: GlobalAlloc.KERNEL32(00000040,00001000), ref: 004099B0
Part of subcall function 004099A0: GetTickCount.KERNEL32 ref: 004099B8
Part of subcall function 004099A0: srand.MSVCRT ref: 004099BF
Part of subcall function 004099A0: GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 004099F5
Part of subcall function 004099A0: fopen.MSVCRT ref: 00409A08
Part of subcall function 004099A0: fwrite.MSVCRT ref: 00409A1C
Part of subcall function 004099A0: fclose.MSVCRT ref: 00409A23
Part of subcall function 004099A0: GlobalFree.KERNEL32(00000000), ref: 00409A2D

SetFileAttributesA.KERNEL32(?,00000006), ref: 0040862A

Part of subcall function 00406E70: GetComputerNameA.KERNEL32(?,?), ref: 00406EAB
Part of subcall function 00406E70: GetUserNameA.ADVAPI32(?,?), ref: 00406EBE
Part of subcall function 00406E70: _strrev.MSVCRT ref: 00406EE8
Part of subcall function 00406E70: _strrev.MSVCRT ref: 00406EFD
Part of subcall function 00406E70: sprintf.MSVCRT ref: 00406F44
Part of subcall function 00406E70: _strlwr.MSVCRT ref: 00406F4E
Part of subcall function 00406E70: sprintf.MSVCRT ref: 00406F7E

sprintf.MSVCRT ref: 0040865B
CopyFileA.KERNEL32(00000000,?,00000000), ref: 0040866C
SetFileAttributesA.KERNEL32(?,00000006), ref: 00408684
lstrcpyA.KERNEL32(00000000,?), ref: 00408690

Strings

servicess, xrefs: 00408516
netdhcp, xrefs: 00408524
scservice, xrefs: 0040850D, 004085E4
%s\%s\%s.exe, xrefs: 004085FB, 00408655
mirror, xrefs: 0040851D
%s\%s, xrefs: 0040854F, 004085A9

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00409310, Relevance: 29.8, APIs: 5, Strings: 12, Instructions: 92

APIs

_splitpath.MSVCRT ref: 00409340
sprintf.MSVCRT ref: 00409366
MakeSureDirectoryPathExists.DBGHELP(?), ref: 00409376
sprintf.MSVCRT ref: 00409395
MakeSureDirectoryPathExists.DBGHELP(?), ref: 004093A2

Part of subcall function 00409270: sprintf.MSVCRT ref: 0040929A
Part of subcall function 00409270: sprintf.MSVCRT ref: 004092E2
Part of subcall function 00409270: URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 004092FA

Strings

%s%simages\, xrefs: 0040938F
images/login_box.gif, xrefs: 0040940C
images/banner.gif, xrefs: 004093D0
xmayabank.html, xrefs: 004093A8
%s%s, xrefs: 00409360
images/notes.gif, xrefs: 00409437
images/footer.png, xrefs: 004093E4
images/login_button.gif, xrefs: 00409423
http://cnc.cyberdrill.my/phish, xrefs: 004093AE, 004093C2, 004093D6, 004093EA, 004093FE, 00409412, 00409429, 0040943D, 00409451
images/secure.png, xrefs: 0040944B
images/arrow.png, xrefs: 004093BC
images/keys_icon.gif, xrefs: 004093F8

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00409029, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 89

APIs

GetModuleFileNameA.KERNEL32(00000000,?,000000FF), ref: 00409044
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00409056

Part of subcall function 00406E70: GetComputerNameA.KERNEL32(?,?), ref: 00406EAB
Part of subcall function 00406E70: GetUserNameA.ADVAPI32(?,?), ref: 00406EBE
Part of subcall function 00406E70: _strrev.MSVCRT ref: 00406EE8
Part of subcall function 00406E70: _strrev.MSVCRT ref: 00406EFD
Part of subcall function 00406E70: sprintf.MSVCRT ref: 00406F44
Part of subcall function 00406E70: _strlwr.MSVCRT ref: 00406F4E
Part of subcall function 00406E70: sprintf.MSVCRT ref: 00406F7E

Part of subcall function 00407100: sprintf.MSVCRT ref: 00407164

sprintf.MSVCRT ref: 004090A8
_strlwr.MSVCRT ref: 004090D6
_strlwr.MSVCRT ref: 004090E3
strstr.MSVCRT ref: 004090E7
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 00409110
CloseHandle.KERNEL32(?), ref: 0040911D
ExitThread.KERNEL32 ref: 00409124

Strings

D, xrefs: 004090C8
%s\%s\%s.exe, xrefs: 004090A2

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00407ED0, Relevance: 16.6, APIs: 11, Instructions: 109

APIs

#23.WSOCK32(00000002,00000001,00000006,80000013,00002C48,00002C48,00002B1E), ref: 00407EE0
#12.WSOCK32 ref: 00407F30
#4.WSOCK32(00000000,?,00000010), ref: 00407F47
#111.WSOCK32 ref: 00407F5C
Sleep.KERNEL32(00000032), ref: 00407F6F
#4.WSOCK32(00000000,?,00000010), ref: 00407F75
#18.WSOCK32(00000001,00000000,?,00000001,?), ref: 00407FC0
#151.WSOCK32(00000000,00000001), ref: 00407FD9
#151.WSOCK32(00000000,?,00000000,00000001), ref: 00407FEB
#12.WSOCK32(00000000,8004667E,?), ref: 00408007
#3.WSOCK32(00000000), ref: 0040801B

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00407DF0, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 66

APIs

sprintf.MSVCRT ref: 00407E05
GetCurrentThread.KERNEL32 ref: 00407E10
SetThreadPriority.KERNEL32(00000000), ref: 00407E17
ExitThread.KERNEL32 ref: 00407EBC

Part of subcall function 00407ED0: #23.WSOCK32(00000002,00000001,00000006,80000013,00002C48,00002C48,00002B1E), ref: 00407EE0
Part of subcall function 00407ED0: #12.WSOCK32 ref: 00407F30
Part of subcall function 00407ED0: #4.WSOCK32(00000000,?,00000010), ref: 00407F47
Part of subcall function 00407ED0: #111.WSOCK32 ref: 00407F5C
Part of subcall function 00407ED0: Sleep.KERNEL32(00000032), ref: 00407F6F
Part of subcall function 00407ED0: #4.WSOCK32(00000000,?,00000010), ref: 00407F75
Part of subcall function 00407ED0: #18.WSOCK32(00000001,00000000,?,00000001,?), ref: 00407FC0
Part of subcall function 00407ED0: #151.WSOCK32(00000000,00000001), ref: 00407FD9
Part of subcall function 00407ED0: #151.WSOCK32(00000000,?,00000000,00000001), ref: 00407FEB
Part of subcall function 00407ED0: #12.WSOCK32(00000000,8004667E,?), ref: 00408007
Part of subcall function 00407ED0: #3.WSOCK32(00000000), ref: 0040801B

lstrlenA.KERNEL32(?,00000000,00000000,00002918), ref: 00407E8A
#19.WSOCK32(00000000,?,00000000), ref: 00407E93
Sleep.KERNEL32(0000012C), ref: 00407E9A
#3.WSOCK32(00000000), ref: 00407E9D

Strings

GET / HTTP/1.1Host: %s, xrefs: 00407DFF

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 004099A0, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 51

APIs

GlobalAlloc.KERNEL32(00000040,00001000), ref: 004099B0
GetTickCount.KERNEL32 ref: 004099B8
srand.MSVCRT ref: 004099BF
GetSystemDirectoryA.KERNEL32(?,000000FF), ref: 004099F5
fopen.MSVCRT ref: 00409A08
fwrite.MSVCRT ref: 00409A1C
fclose.MSVCRT ref: 00409A23
GlobalFree.KERNEL32(00000000), ref: 00409A2D

Strings

0000111122223333, xrefs: 004099D3

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00409470, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 51

APIs

sprintf.MSVCRT ref: 0040949E
CharUpperA.USER32(?), ref: 004094A8
sprintf.MSVCRT ref: 004094DF
_strlwr.MSVCRT ref: 004094E9

Part of subcall function 00409510: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00409514
Part of subcall function 00409510: Process32First.KERNEL32(00000000,0040A720), ref: 0040952E
Part of subcall function 00409510: strstr.MSVCRT ref: 00409560
Part of subcall function 00409510: OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 0040957A
Part of subcall function 00409510: TerminateProcess.KERNEL32(00000000,00000000), ref: 00409588
Part of subcall function 00409510: MessageBoxA.USER32(00000000,Woops! You are phohibited to use such skill. Be pray and patient.,MyB0t [Part of CyberDrill],00000000), ref: 00409598
Part of subcall function 00409510: CloseHandle.KERNEL32(00000000), ref: 004095A0
Part of subcall function 00409510: Process32Next.KERNEL32(00000000,0040A720), ref: 004095B2
Part of subcall function 00409510: CloseHandle.KERNEL32(00000000), ref: 004095CB

Strings

%s.exe, xrefs: 004094D9
<e@, xrefs: 00409470, 0040948E, 004094BD, 004094CC
%s.EXE, xrefs: 00409498

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00406F90, Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 90

APIs

strchr.MSVCRT ref: 00406FF7
strchr.MSVCRT ref: 00407022
strchr.MSVCRT ref: 0040704D

Strings

1234567890, xrefs: 00406FC3
ABCDEFGHIJKLMNOPQRSTUVWXYZ, xrefs: 00406F9B
io@, xrefs: 00406F94, 00406F95
abcdefghijklmnopqrstuvwxyz, xrefs: 00406FAE, 00406FEC, 00407020, 0040704B

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00407CE0, Relevance: 9.1, APIs: 6, Instructions: 80

APIs

sprintf.MSVCRT ref: 00407D2B
Sleep.KERNEL32(00008000), ref: 00407D4E
#52.WSOCK32(?), ref: 00407D5E
Sleep.KERNEL32(00008000), ref: 00407D69
#9.WSOCK32(?), ref: 00407D99
CreateThread.KERNEL32(00000000,00000000,Function_00007DF0,00000002), ref: 00407DCE

Part of subcall function 00407DF0: sprintf.MSVCRT ref: 00407E05
Part of subcall function 00407DF0: GetCurrentThread.KERNEL32 ref: 00407E10
Part of subcall function 00407DF0: SetThreadPriority.KERNEL32(00000000), ref: 00407E17
Part of subcall function 00407DF0: lstrlenA.KERNEL32(?,00000000,00000000,00002918), ref: 00407E8A
Part of subcall function 00407DF0: #19.WSOCK32(00000000,?,00000000), ref: 00407E93
Part of subcall function 00407DF0: Sleep.KERNEL32(0000012C), ref: 00407E9A
Part of subcall function 00407DF0: #3.WSOCK32(00000000), ref: 00407E9D
Part of subcall function 00407DF0: ExitThread.KERNEL32 ref: 00407EBC

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00407280, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75

APIs

_strrev.MSVCRT ref: 004072A8
sprintf.MSVCRT ref: 004072E9
_strrev.MSVCRT ref: 00407329
sprintf.MSVCRT ref: 0040733D

Strings

Connection: Keep-Alive, xrefs: 0040728A

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00407920, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26

APIs

Part of subcall function 004076C0: tolower.MSVCRT ref: 004076E2
Part of subcall function 004076C0: tolower.MSVCRT ref: 0040770D

sprintf.MSVCRT ref: 0040794F
ShellExecuteA.SHELL32(00000000,open,iexplore.exe,?,0040A5E8,00000000), ref: 00407973

Strings

iexplore.exe, xrefs: 00407967
open, xrefs: 0040796C
http://infected.cyberdrill.my/mailer/email.php?target=%s, xrefs: 00407949

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00406CF0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 14

APIs

CreateMutexA.KERNEL32(00000000,00000001,\0@), ref: 00406CFA
GetLastError.KERNEL32 ref: 00406D02
ReleaseMutex.KERNEL32 ref: 00406D0D

Strings

\0@, xrefs: 00406CF4
\0@, xrefs: 00406CF0, 00406CF5

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00406D80, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17

APIs

CreateSemaphoreA.KERNEL32(00000000,00000000,00000000,_###_MCAGENT_Client_###_), ref: 00406D8C
GetLastError.KERNEL32 ref: 00406D94
ReleaseSemaphore.KERNEL32(00000000,00000001,00000000), ref: 00406DA3

Strings

_###_MCAGENT_Client_###_, xrefs: 00406D84, 00406D85

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00407730, Relevance: 6.4, APIs: 5, Instructions: 165

APIs

Part of subcall function 004076C0: tolower.MSVCRT ref: 004076E2
Part of subcall function 004076C0: tolower.MSVCRT ref: 0040770D

atoi.MSVCRT(?,?,?,?,?,?,?,000028E8,?,00002C50,00002C48), ref: 004077A4
atoi.MSVCRT(?,?,?,?), ref: 004077F4
atoi.MSVCRT(?,?,?,?), ref: 00407844
atoi.MSVCRT(?), ref: 00407895
Sleep.KERNEL32(00000400), ref: 00407902

Part of subcall function 00408030: GetSystemDirectoryA.KERNEL32 ref: 00408161
Part of subcall function 00408030: sprintf.MSVCRT ref: 00408197
Part of subcall function 00408030: WinExec.KERNEL32(?,00000000), ref: 004081A9
Part of subcall function 00408030: sprintf.MSVCRT ref: 004081F5
Part of subcall function 00408030: WinExec.KERNEL32(?,00000000), ref: 00408204

Part of subcall function 00407CE0: sprintf.MSVCRT ref: 00407D2B
Part of subcall function 00407CE0: Sleep.KERNEL32(00008000), ref: 00407D4E
Part of subcall function 00407CE0: #52.WSOCK32(?), ref: 00407D5E
Part of subcall function 00407CE0: Sleep.KERNEL32(00008000), ref: 00407D69
Part of subcall function 00407CE0: #9.WSOCK32(?), ref: 00407D99
Part of subcall function 00407CE0: CreateThread.KERNEL32(00000000,00000000,Function_00007DF0,00000002), ref: 00407DCE

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 004071A0, Relevance: 6.0, APIs: 4, Instructions: 39

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000001,?), ref: 004071C9
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?), ref: 004071EE
sprintf.MSVCRT ref: 00407206
RegCloseKey.ADVAPI32(?), ref: 00407214

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00406DB0, Relevance: 6.0, APIs: 4, Instructions: 21

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00406DBD
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 00406DCF
GetWindowsDirectoryA.KERNEL32(?,00000104,?,?,?,?,?,0040923F,?), ref: 00406DE1
GetTempPathA.KERNEL32(00000104,?), ref: 00406DF3

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Function 00406D20, Relevance: 6.0, APIs: 4, Instructions: 18

APIs

CreateMutexA.KERNEL32(00000000,00000001,?), ref: 00406D2A
GetLastError.KERNEL32 ref: 00406D32
ExitProcess.KERNEL32 ref: 00406D41
ReleaseMutex.KERNEL32 ref: 00406D4C

Memory Dump Source

Source File: 00000000.00000001.410027860057.00403000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000001.410019832911.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_400000_virussign.jbxd

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Loading ...

Warning!

Error!

Analysis Report

Overview

General Information

Detection

Signature Overview

Networking:

Data Obfuscation:

Spreading:

System Summary:

Anti Debugging:

Malware Analysis System Evasion:

Language, Device and Operating System Detection:

Yara Overview

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Hooks - Code Manipulation Behavior

Statistics

System Behavior

Analysis Process: virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe PID: 1188 Parent PID: 736

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: virussign.com_0af4ef5069f47a371a0caf22ae2006a6.exe PID: 1188 Parent PID: 736

Execution Graph

Executed Functions

Function 0040912A, Relevance: 10.6, APIs: 7, Instructions: 85

Function 0040A42F, Relevance: 16.6, APIs: 11, Instructions: 111

Function 00409206, Relevance: 3.0, APIs: 2, Instructions: 19

Non-executed Functions

Function 00409510, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 59

Function 00406E70, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 79

Function 00409900, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41

Function 00409270, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58

Function 00406E00, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44

Function 004070C0, Relevance: 1.5, APIs: 1, Instructions: 16

Function 00408A06, Relevance: 163.2, APIs: 72, Strings: 21, Instructions: 481

Function 004095E0, Relevance: 103.4, APIs: 11, Strings: 48, Instructions: 129

Function 004086AC, Relevance: 93.0, APIs: 32, Strings: 21, Instructions: 260

Function 00408030, Relevance: 68.3, APIs: 5, Strings: 34, Instructions: 98

Function 0040828F, Relevance: 54.4, APIs: 8, Strings: 23, Instructions: 154

Function 00407370, Relevance: 51.0, APIs: 18, Strings: 11, Instructions: 274

Function 00407A80, Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 207

Function 004084F7, Relevance: 33.4, APIs: 13, Strings: 6, Instructions: 132

Function 00409310, Relevance: 29.8, APIs: 5, Strings: 12, Instructions: 92

Function 00409029, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 89

Function 00407ED0, Relevance: 16.6, APIs: 11, Instructions: 109

Function 00407DF0, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 66

Function 004099A0, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 51

Function 00409470, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 51

Function 00406F90, Relevance: 10.6, APIs: 3, Strings: 4, Instructions: 90

Function 00407CE0, Relevance: 9.1, APIs: 6, Instructions: 80

Function 00407280, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75

Function 00407920, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26

Function 00406CF0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 14

Function 00406D80, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 17

Function 00407730, Relevance: 6.4, APIs: 5, Instructions: 165

Function 004071A0, Relevance: 6.0, APIs: 4, Instructions: 39