Analysis Report

Overview

General Information

Analysis ID:	58913
Start time:	19:34:25
Start date:	20/04/2015
Overall analysis duration:	0h 4m 2s
Report type:	full
Sample file name:	6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe
Cookbook file name:	VM Aware.jbs
Analysis system description:	Windows 7 (Office 2003 SP1, Java 1.6.0, Acrobat Reader 9.3.4, Internet Explorer 8)
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	2
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
HCA enabled:	true
HCA success:	true, ratio: 65% Number of executed functions: 9 Number of non-executed functions: 30
Warnings:	Show All Exclude process from analysis (whitelisted): slui.exe, mscorsvw.exe, spsys.sys, sppsvc.exe, asyncmac.sys, WmiApSrv.exe, WatAdminSvc.exe, WMIADAP.exe, wmpnetwk.exe

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	60	0 - 100	Report FP / FN

Signature Overview

Networking:

Urls found in memory or binary data

Show sources

Source: 6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	String found in binary or memory: http://
Source: 6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	String found in binary or memory: http://www.msn.com/

Contains functionality to download additional files from the internet

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Code function: 2_2_00161470 GetProcessHeap,RtlZeroMemory,lstrlen,RtlMoveMemory,atoi,socket,gethostbyname,htons,connect,RtlZeroMemory,wsprintfA,wsprintfA,wsprintfA,RtlMoveMemory,send,RtlAllocateHeap,RtlReAllocateHeap,recv,closesocket,RtlMoveMemory,RtlMoveMemory,RtlFreeHeap,

2_2_00161470

Remote Access Functionality:

Contains strings related to BOT control commands

Show sources

Source: 6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

String found in binary or memory: cmd=getload&login=

Data Obfuscation:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Code function: 2_2_0016243C VirtualAlloc,VirtualAlloc,RtlMoveMemory,RtlZeroMemory,RtlMoveMemory,LoadLibraryA,GetProcAddress,GetProcAddress,

2_2_0016243C

Generates new code (likely due to unpacking of malware or shellcode)

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Code execution: Found new code

PE file contains sections with non-standard names

Show sources

Source: initial sample	Static PE information: section name: .dataG
Source: initial sample	Static PE information: section name: .rdataW

System Summary:

Contains functionality to enum processes or threads

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Code function: 2_2_00163268 RtlZeroMemory,CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,Sleep,

2_2_00163268

PE file has an executable .text section and no other executable section

Show sources

Source: initial sample

Static PE information: Section: .text IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_MEM_READ

Contains functionality to call native functions

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Code function: 2_2_0040100D NtTerminateProcess,	2_2_0040100D
Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Code function: 2_2_0040113F NtAllocateVirtualMemory,	2_2_0040113F
Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Code function: 2_2_00401000 NtAllocateVirtualMemory,NtTerminateProcess,	2_2_00401000
Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Code function: 2_2_00162087 wsprintfW,RtlInitUnicodeString,NtOpenSection,NtMapViewOfSection,VirtualQuery,	2_2_00162087
Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Code function: 2_2_00162A28 RtlZeroMemory,RtlMoveMemory,FindWindowA,GetWindowThreadProcessId,atan,_alloca_probe,WriteProcessMemory,OpenFileMappingA,MapViewOfFile,CloseHandle,CreateThread,SetWindowLongA,lstrcat,GetWindowLongA,CreateFileMappingA,MapViewOfFile,RtlMoveMemory,SetWindowLongA,SendNotifyMessageA,Sleep,GetWindowLongA,RtlZeroMemory,RtlZeroMemory,CreateProcessInternalA,NtCreateSection,NtMapViewOfSection,RtlMoveMemory,NtUnmapViewOfSection,NtMapViewOfSection,CloseHandle,NtQueueApcThread,ResumeThread,ExitProcess,	2_2_00162A28
Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Code function: 2_2_00163D6C Sleep,lstrlen,lstrlen,RtlComputeCrc32,atoi,MapViewOfFile,RtlZeroMemory,lstrcat,NtUnmapViewOfSection,RtlMoveMemory,DeleteFileW,CreateFileW,WriteFile,CloseHandle,RtlZeroMemory,wsprintfA,RtlZeroMemory,wsprintfA,CloseHandle,CloseHandle,DeleteFileW,DeleteFileW,DeleteFileW,RtlZeroMemory,wsprintfA,ExitProcess,atoi,RtlZeroMemory,wsprintfA,Sleep,	2_2_00163D6C
Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Code function: 2_2_001630B0 OpenProcess,lstrlen,lstrlenW,NtCreateSection,NtMapViewOfSection,LoadLibraryA,GetProcAddress,VirtualAlloc,NtUnmapViewOfSection,NtMapViewOfSection,CreateRemoteThread,CloseHandle,CloseHandle,CloseHandle,	2_2_001630B0
Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Code function: 2_2_001620A8 wsprintfW,RtlInitUnicodeString,NtOpenSection,NtMapViewOfSection,VirtualQuery,CloseHandle,	2_2_001620A8
Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Code function: 2_2_00162958 VirtualQuery,lstrlenW,VirtualAlloc,CreateProcessInternalA,NtCreateSection,NtMapViewOfSection,NtQueueApcThread,ResumeThread,Sleep,	2_2_00162958

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: 6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Binary or memory string: Progman
Source: 6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Binary or memory string: Program Manager
Source: 6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Binary or memory string: Shell_TrayWnd

Contains functionality to inject code into explorer (shared memory section, SetWindowLong, SendNotifyMessage technique)

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Code function: 2_2_00162A26 RtlZeroMemory,RtlMoveMemory,FindWindowA,GetWindowThreadProcessId,atan,_alloca_probe,WriteProcessMemory,OpenFileMappingA,MapViewOfFile,CloseHandle,CreateThread,SetWindowLongA,lstrcat,GetWindowLongA,CreateFileMappingA,MapViewOfFile,RtlMoveMemory,SetWindowLongA,SendNotifyMessageA,Sleep,GetWindowLongA,ExitProcess,

2_2_00162A26

Anti Debugging:

Contains functionality to register its own exception handler

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Code function: 2_2_001645FA CreateFileMappingA,GetCurrentThreadId,RtlAddVectoredExceptionHandler,GetCurrentProcessId,RtlRemoveVectoredExceptionHandler,Sleep,RtlRemoveVectoredExceptionHandler,Sleep,		2_2_001645FA
Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Code function: 2_2_00163A14 RtlAddVectoredExceptionHandler,RtlZeroMemory,RtlZeroMemory,GetTempPathW,GetTempFileNameW,DeleteFileW,lstrcatW,CreateFileW,WriteFile,CloseHandle,RtlZeroMemory,RtlZeroMemory,LoadLibraryW,wsprintfW,CreateProcessInternalW,lstrcat,ExitProcess,lstrcat,DeleteFileW,		2_2_00163A14

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Code function: 2_2_001633E7 LdrGetDllHandle,LoadLibraryA,

2_2_001633E7

Contains functionality to dynamically determine API calls

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Code function: 2_2_0016243C VirtualAlloc,VirtualAlloc,RtlMoveMemory,RtlZeroMemory,RtlMoveMemory,LoadLibraryA,GetProcAddress,GetProcAddress,

2_2_0016243C

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

2_2_00161470

Program does not show much activity (idle)

Show sources

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Malware Analysis System Evasion:

May tried to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: 6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Binary or memory string: vmware

Contains capabilities to detect virtual machines

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\Disk\Enum name: 0

Found decision node followed by non-executed suspicious APIs

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_2-2063

Found evasive API chain (may stop execution after accessing registry keys)

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep			graph_2-2283
Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe	Evasive API call chain: RegOpenKey,DecisionNodes,ExitProcess			graph_2-2283

Found large amount of non-executed APIs

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

API coverage: 5.8 %

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe TID: 3220	Thread sleep count: 174 > 100
Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe TID: 3220	Thread sleep time: -104400ms >= -60000ms

Program does not show much activity (idle)

Show sources

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Contains functionality to generate a fingerprint of the current system

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Code function: 2_2_00161B96 GetComputerNameA,GetVolumeInformationA,lstrlen,RtlComputeCrc32,wsprintfA,

2_2_00161B96

Found evasive API chain (may stop execution after checking a module file name)

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_2-1925

Found evasive API chain (may stop execution after checking volume information)

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Evasive API call chain: GetVolumeInformation,DecisionNodes,Sleep

graph_2-1928

Language, Device and Operating System Detection:

Contains functionality to query windows version

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Code function: 2_2_00163588 RegOpenKeyExA,RegCloseKey,GetVersion,RtlMoveMemory,RtlMoveMemory,SHGetFolderPathW,wsprintfW,ExpandEnvironmentStringsW,ExpandEnvironmentStringsW,wsprintfW,wsprintfW,CreateDirectoryW,wsprintfW,lstrcatW,lstrlen,RtlComputeCrc32,lstrcmpW,DeleteFileW,CopyFileW,wsprintfW,DeleteFileW,DeleteFileW,lstrlenW,RegCreateKeyA,RegSetValueExW,RegCloseKey,RegCreateKeyA,RegSetValueExW,RegCloseKey,CreateFileW,CreateFileW,

2_2_00163588

Queries the volume information (name, serial number etc) of a device

Show sources

Source: C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe

Qeruies volume information: C:\ VolumeInformation

Yara Overview

No Yara matches

Startup

system is w7

6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe (PID: 3244 MD5: D80E956259C858EACCB53C1AFFAF8141)

cleanup

Created / dropped Files

No created / dropped files found

Contacted Domains/Contacted IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

Static File Info

General
File type:	PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:	Win32 Executable MS Visual C++ (generic) (31208/45) 78.55% Win32 Executable (generic) (4510/7) 11.35% Generic Win/DOS Executable (2004/3) 5.04% DOS Executable Generic (2002/1) 5.04% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.02%
File name:	6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe
File size:	121856
MD5:	d80e956259c858eaccb53c1affaf8141
SHA1:	7358e2d4879d4109c89400a4361ba8bb8e71b357
SHA256:	6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7
SHA512:	eeda45b97914e7a00e6166f2e46070faabbff45eb6957dc0052383d17d0e5137b81ba268974f34bdc4c617397ad6e5cf0e241054145cd9dff93477b30a0660c1

Static PE Info

General
Entrypoint:	0x40b3c9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui 40
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x4D6622A4 [Thu Feb 24 09:19:32 2011 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0

Entrypoint Preview

Instruction
cmp ecx, 0000011Ch
je 0E2B23E5h
jmp 0E2B23E3h
add byte ptr [eax], al
add byte ptr [eax], al
std
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], bl
add byte ptr [eax], al
add byte ptr [eax], al
int3
add byte ptr [eax], al
add byte ptr [eax], al
dec esp
add byte ptr [esi], bl
add byte ptr [eax], al
add byte ptr [ebx+00D10000h], al
add byte ptr [eax], al
mov dword ptr [004144ACh], edx
cmp esi, A4600200h
jnbe 0E2B23F2h
jmp 0E2B23F0h
add byte ptr [eax], al
add byte ptr [esi+00000000h], bh
add al, ah
add byte ptr [eax+00h], dh
arpl word ptr [eax], ax
add byte ptr [eax], al
add byte ptr [eax], al
inc esp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax+1F000000h], bh
add byte ptr [eax], al
arpl word ptr [eax], ax
jle 0E2B23C2h
jnc 0E2B23C2h
add byte ptr [eax], al
iretd
add byte ptr [eax], al
add byte ptr [ebx+4146C83Dh], cl
add byte ptr [ebx], bh
cmp eax, 0041433Ch
je 0E2B23E5h
jmp 0E2B23E3h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], cl
add byte ptr [eax], al
add byte ptr [eax+eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
stosb
add byte ptr [eax], al
add byte ptr [eax], al
pop dword ptr [eax]
add byte ptr [esi+5C000000h], cl
add byte ptr [eax], al
insd
add byte ptr [eax], al
mov ebx, dword ptr [00415228h]
cmp ebx, dword ptr [00415228h]
jnbe 0E2B23C2h
cmp edi, 00000000h
jnbe 0E2B23E5h
jmp 0E2B23E3h
add cl, bh
add byte ptr [eax], al
xchg dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [edi+00h], ch
mov dl, 00h
test al, 00h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x325ec	0x154	.rdataW
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x37000	0x3a4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x192ac	0x70	.dataG
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x32000	0x5ec	.rdataW
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Xored PE	ZLIB Complexity	File Type	Characteristics
.text	0x1000	0xeb4c	0xec00	6.58454534451	False	0.685248940678	ump; data	IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_MEM_READ
.dataG	0x10000	0x21810	0x9a00	6.17317294259	False	0.72653713474	ump; data	IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_MEM_PRELOAD, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_TYPE_COPY, IMAGE_SCN_GPREL, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ
.rdataW	0x32000	0x4d19	0x4e00	3.58893178542	False	0.214643429487	ump; data	IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_MEM_LOCKED, IMAGE_SCN_TYPE_GROUP, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_LNK_OTHER, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_LNK_OVER, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_GPREL, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_MEM_READ
.rsrc	0x37000	0x3a4	0x400	3.13216794898	False	0.462890625	ump; data	IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_TYPE_NOLOAD, IMAGE_SCN_MEM_SYSHEAP, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_MEM_FARDATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_MEM_PRELOAD, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_MEM_16BIT, IMAGE_SCN_MEM_PROTECTED, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_GPREL, IMAGE_SCN_MEM_PURGEABLE, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_NO_DEFER_SPEC_EXC, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	Nbr Of Functions	Xored PE
RT_VERSION	0x37058	0x34c	ump; data	English	Australia	0	False

Imports

DLL	Import
IMM32.dll	ImmConfigureIMEW, ImmIsUIMessageA, ImmRegisterWordA, ImmGetIMEFileNameW, ImmEscapeW, ImmUnlockIMC, ImmLockIMC, ImmGetCandidateListCountA, ImmSetConversionStatus, ImmGetRegisterWordStyleW, ImmNotifyIME, ImmGetCompositionFontW, ImmGetIMEFileNameA, ImmSetCompositionFontA, ImmGetCandidateListW, ImmGetImeMenuItemsW, ImmShowSoftKeyboard, ImmRequestMessageA, ImmGetCandidateWindow, ImmGetConversionListA, ImmSetCompositionFontW, ImmAssociateContextEx, ImmSetOpenStatus, ImmGetStatusWindowPos, ImmReleaseContext
ADVPACK.dll	ExecuteCab, GetVersionFromFile, RegSaveRestore, RegSaveRestoreOnINF, IsNTAdmin, FileSaveMarkNotExist, ExtractFiles, LaunchINFSectionEx, TranslateInfStringEx, FileSaveRestore, RunSetupCommand, SetPerUserSecValues, AddDelBackupEntry, NeedRebootInit, DoInfInstall
NTDLL.dll	NtReplyWaitReplyPort, RtlSetSecurityObject, RtlCheckRegistryKey, NtOpenSymbolicLinkObject, RtlInitializeCriticalSectionAndSpinCount, DbgUiConnectToDbg, NtSetIoCompletion, ZwDuplicateObject, ZwOpenEvent, ZwQueryKey, ZwSetSystemInformation, RtlAddAuditAccessAce, NtSetDefaultLocale, RtlLargeIntegerNegate, ZwOpenMutant, RtlSetUserFlagsHeap, RtlInitCodePageTable, RtlUpperString, RtlGetLongestNtPathLength, RtlDumpResource, ZwUnmapViewOfSection, NtCreateNamedPipeFile, NtFlushVirtualMemory, RtlPrefixUnicodeString, RtlFormatMessage, ZwSetInformationFile, ZwRegisterThreadTerminatePort, ZwCreateEvent, ZwSetIntervalProfile, NtAreMappedFilesTheSame, ZwQuerySemaphore, NtReadVirtualMemory
WINSTA.dll	_WinStationBreakPoint, WinStationServerPing, WinStationGetProcessSid, _WinStationWaitForConnect, WinStationTerminateProcess, WinStationDisconnect, WinStationConnectW, _WinStationReadRegistry, WinStationNameFromLogonIdW, WinStationQueryInformationW, WinStationQueryLicense, WinStationOpenServerW, WinStationEnumerateA, WinStationFreeMemory, _WinStationNotifyNewSession, _WinStationShadowTargetSetup, _WinStationNotifyLogon, WinStationReset, WinStationQueryInformationA, WinStationEnumerateLicenses, ServerGetInternetConnectorStatus, LogonIdFromWinStationNameW, WinStationOpenServerA, _WinStationCallback, WinStationRenameA
KERNEL32.dll	ExitProcess, _lwrite, IsDBCSLeadByteEx, ContinueDebugEvent, FindResourceExW, EnumResourceLanguagesW
SECUR32.dll	LsaLogonUser, EncryptMessage, AcquireCredentialsHandleW, EnumerateSecurityPackagesW, InitSecurityInterfaceW, LsaDeregisterLogonProcess, ExportSecurityContext, EnumerateSecurityPackagesA, SaslEnumerateProfilesA, SaslInitializeSecurityContextA, LsaUnregisterPolicyChangeNotification, CompleteAuthToken, InitializeSecurityContextA, FreeCredentialsHandle, LsaFreeReturnBuffer, SaslInitializeSecurityContextW, LsaCallAuthenticationPackage, SaslGetProfilePackageW, AcquireCredentialsHandleA, GetComputerObjectNameA, QuerySecurityPackageInfoW, GetComputerObjectNameW, QueryContextAttributesW, TranslateNameW
USER32.dll	ImpersonateDdeClientWindow
NETAPI32.dll	NetFileGetInfo, NetServerTransportEnum, NetMessageNameEnum, NetDfsEnum, NetWkstaUserEnum, NetQueryDisplayInformation, NetWkstaUserSetInfo, NetLocalGroupDel, NetReplSetInfo, NetConfigGetAll, NetGroupDelUser, NetUserEnum, NetUserModalsSet, NetAlertRaise, NetGroupEnum, I_BrowserQueryStatistics, NetUserSetGroups, NetLocalGroupSetInfo, NetLocalGroupDelMembers, NetLocalGroupEnum, NetDfsGetDcAddress, NetReplImportDirLock, NetWkstaTransportAdd, NetGroupDel, NetServerTransportDel, NetScheduleJobAdd, NetApiBufferAllocate, NetUserGetGroups, DsEnumerateDomainTrustsW
MSCMS.dll	GetColorProfileFromHandle, CheckBitmapBits, CreateProfileFromLogColorSpaceW, InternalGetPS2CSAFromLCS, InternalGetPS2PreviewCRD, SelectCMM, GetColorProfileElementTag, IsColorProfileValid, EnumColorProfilesA, GetPS2ColorSpaceArray, SetStandardColorSpaceProfileW, SetColorProfileElementSize, RegisterCMMA, GetPS2ColorRenderingDictionary, EnumColorProfilesW, GetColorDirectoryW, UninstallColorProfileW, UnregisterCMMA, SpoolerCopyFileEvent, IsColorProfileTagPresent, GetStandardColorSpaceProfileA, ConvertColorNameToIndex, OpenColorProfileA, SetColorProfileElement, GetColorDirectoryA, CreateColorTransformA, DisassociateColorProfileFromDeviceA, CreateProfileFromLogColorSpaceA
PDH.dll	PdhVbAddCounter, PdhGetDefaultPerfObjectA, PdhVbCreateCounterPathList, PdhBrowseCountersW, PdhGetRawCounterValue, PdhGetCounterInfoW, PdhGetFormattedCounterArrayA, PdhGetCounterInfoA, PdhVbGetCounterPathElements, PdhLookupPerfNameByIndexW, PdhOpenQueryA, PdhExpandCounterPathA, PdhParseInstanceNameW, PdhEnumObjectsA, PdhIsRealTimeQuery, PdhRemoveCounter, PdhCloseLog, PdhComputeCounterStatistics, PdhGetDataSourceTimeRangeA, PdhParseInstanceNameA, PdhUpdateLogFileCatalog, PdhEnumObjectItemsA, PdhVbIsGoodStatus, PdhSetQueryTimeRange, PdhCollectQueryData
WINSPOOL.drv	FindFirstPrinterChangeNotification, DeletePortA, EnumFormsA, PlayGdiScriptOnPrinterIC, QueryColorProfile, AddPrinterDriverA, EnumPrintersW, GetSpoolFileHandle, SetPortW, SetFormA, QueryRemoteFonts, DocumentPropertySheets, GetDefaultPrinterW, DeviceMode, SetPrinterDataExW, DeletePrinterDriverExA, OpenPrinterA, DeletePrinter, SetJobA, StartPagePrinter, SpoolerDevQueryPrintW, GetPrintProcessorDirectoryA, AddFormW, DeleteMonitorW, StartDocDlgA, AddPrinterDriverExW, EnumPortsW, FreePrinterNotifyInfo, DeletePrinterKeyA, DeletePrinterDataW, DevQueryPrint
SHLWAPI.dll	SHOpenRegStreamA, SHDeleteOrphanKeyA, PathStripPathA, PathIsSystemFolderW, SHEnumValueA, PathMakePrettyA, UrlCompareW, PathGetCharTypeW, SHRegCloseUSKey, StrFormatKBSizeA, SHEnumKeyExA, StrCatW, PathFileExistsW, StrNCatA, PathIsDirectoryW, StrFromTimeIntervalW, PathIsUNCA, PathAddExtensionA, PathSearchAndQualifyW, PathCommonPrefixW, SHQueryValueExA, PathRemoveBackslashA, StrCmpIW, ChrCmpIA, AssocQueryStringByKeyA, PathCommonPrefixA, StrSpnW, StrChrIW, StrStrIW, StrCmpW, SHDeleteOrphanKeyW
QUERY.dll	CICreateCommand, DoneCIPerformanceData, LocateCatalogsA, SetupCacheEx, BindIFilterFromStorage, InitializeCIPerformanceData, CIState, CITextToSelectTreeEx, CITextToFullTree, SetupCache, CITextToSelectTree, BeginCacheTransaction, SvcEntry_CiSvc, CollectCIISAPIPerformanceData, SetCatalogState, InitializeFILTERPerformanceData, CITextToFullTreeEx, BindIFilterFromStream, CIBuildQueryNode, InitializeCIISAPIPerformanceData, LoadTextFilter
MPR.dll	WNetGetUserW, WNetEnumResourceA, WNetGetUserA, WNetGetUniversalNameW, WNetGetConnectionA, WNetGetConnectionW, WNetEnumResourceW, WNetGetResourceParentA, WNetCancelConnectionA, WNetConnectionDialog, WNetGetResourceInformationW, WNetGetLastErrorW, WNetGetNetworkInformationA, WNetCancelConnection2W, WNetCancelConnectionW, WNetCancelConnection2A, WNetDisconnectDialog, WNetOpenEnumW, WNetAddConnection3A, WNetGetLastErrorA, WNetCloseEnum, WNetAddConnectionW, WNetOpenEnumA
CLUSAPI.dll	ClusterNetworkControl, GetClusterNetInterface, ClusterNetworkEnum, CreateClusterNotifyPort, CreateClusterGroup, ClusterResourceOpenEnum, ClusterRegEnumValue, ClusterRegCloseKey, RegisterClusterNotify, ClusterRegQueryInfoKey, GetClusterNetworkKey, GetClusterNodeId, ClusterOpenEnum, GetClusterGroupState, GetClusterNodeKey
WINMM.dll	mmioSetInfo, midiInReset, midiInGetErrorTextW, midiOutGetID, auxGetDevCapsW, mmioAscend, mciSendCommandA, midiOutGetErrorTextA, midiOutGetVolume, mmioAdvance, mixerGetControlDetailsA, mciGetDriverData, joyGetPosEx, NotifyCallbackData, midiDisconnect, DrvGetModuleHandle, SendDriverMessage, mixerMessage, mciDriverYield, waveOutGetPitch, joyConfigChanged, mmioSeek, PlaySoundA, waveOutGetErrorTextA, waveOutGetID, waveOutGetVolume, midiInGetErrorTextA, mixerClose, mciLoadCommandResource, joySetThreshold, waveInGetNumDevs, mixerGetLineControlsW

Version Infos

Description	Data
LegalCopyright	1999
InternalName	Obyhi
FileVersion	4, 8, 2
CompanyName	Max Secure Software www.maxpcsecure.com
LegalTrademarks	Ejecogu Vor Yjydo Efab Bam Ocadode Yzamop
ProductName	Avukab
ProductVersion	4
FileDescription	Yfak Ehocaqi Adimy
OriginalFilename	Gdgkcdowg.exe
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Australia

Network Behavior

No network behavior found

Hooks - Code Manipulation Behavior

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: 6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe PID: 3244 Parent PID: 3472

General

Start time:	19:35:28
Start date:	10/03/2015
Path:	C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe
Wow64 process (32bit):	false
Commandline:	unknown
Imagebase:	0x755d0000
File size:	121856 bytes
MD5 hash:	D80E956259C858EACCB53C1AFFAF8141

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: 6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe PID: 3244 Parent PID: 3472

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	99%
Signature Coverage:	33%
Total number of Nodes:	775
Total number of Limit Nodes:	2

Executed Functions

Function 0040100D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92

APIs

Part of subcall function 0040113F: NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00003000,00000040), ref: 0040115D

NtTerminateProcess.NTDLL ref: 004010EB

Strings

sel2, xrefs: 004010E0

Memory Dump Source

Source File: 00000002.00000002.932945573.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.932943388.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 001633E7, Relevance: 3.1, APIs: 2, Instructions: 73

APIs

LdrGetDllHandle.NTDLL(00000000,00000000,?,?), ref: 001633FF
LoadLibraryA.KERNEL32(00000000), ref: 0016343D

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 0040113F, Relevance: 1.5, APIs: 1, Instructions: 19

APIs

NtAllocateVirtualMemory.NTDLL(000000FF,?,00000000,?,00003000,00000040), ref: 0040115D

Memory Dump Source

Source File: 00000002.00000002.932945573.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.932943388.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00401000, Relevance: 1.3, Strings: 1, Instructions: 84

Strings

v, xrefs: 00401005

Memory Dump Source

Source File: 00000002.00000002.932945573.00401000.00000040.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.932943388.00400000.00000002.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00164848, Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 121

APIs

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,00000001), ref: 00164865

Part of subcall function 00161C68: lstrlen.KERNEL32(00170618), ref: 00161C82
Part of subcall function 00161C68: lstrlen.KERNEL32(0016182C), ref: 00161C8D

GetVolumeInformationA.KERNEL32(C:\,00000000,00000080,00000000,00000000,00000000,00000000,00000000), ref: 0016489D

Part of subcall function 00164838: Sleep.KERNELBASE(00000258,001648BA), ref: 0016483D

GetModuleHandleA.KERNEL32(00000000), ref: 001648C7
RegOpenKeyExA.KERNEL32(80000002,System\CurrentControlSet\Services\Disk\Enum,00000000,00000001,?), ref: 001648EF
RegQueryValueExA.KERNEL32(?,001649E8,00000000,00000000,00000000,000000FF), ref: 0016490E
RegCloseKey.KERNEL32(?), ref: 00164916
CharLowerA.USER32(00000000), ref: 0016491A
RegOpenKeyExA.ADVAPI32(80000002,00161344,00000000,00000008,?), ref: 0016495E
RegEnumKeyA.ADVAPI32(?,00000000,00000000,000000FF), ref: 00164985
RegCloseKey.KERNEL32(?), ref: 00164994

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

Strings

AutoItv3CCleanerWIC, xrefs: 00164963
sample, xrefs: 0016486B
System\CurrentControlSet\Services\Disk\Enum, xrefs: 001648E5
C:\, xrefs: 00164898

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00164A00, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39

APIs

Part of subcall function 0016339C: LdrGetDllHandle.NTDLL(00000000,00000000,?,?), ref: 001633FF
Part of subcall function 0016339C: LoadLibraryA.KERNEL32(00000000), ref: 0016343D

RtlMoveMemory.NTDLL(sel2,?,00000005), ref: 00164A18
GetModuleFileNameW.KERNEL32(00000000,C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe,00000104), ref: 00164A35
Sleep.KERNELBASE(00000064), ref: 00164A42

Part of subcall function 001646EC: WSAStartup.WS2_32(00000202,00166038), ref: 00164709
Part of subcall function 001646EC: Sleep.KERNEL32(00001770,00000000), ref: 00164741
Part of subcall function 001646EC: wsprintfA.USER32(00166230,%s%s,001661CC,00164824,00000000), ref: 00164772
Part of subcall function 001646EC: CreateMutexA.KERNEL32(00000000,00000000,001661CC), ref: 00164784
Part of subcall function 001646EC: RtlGetLastWin32Error.NTDLL ref: 0016478A
Part of subcall function 001646EC: wsprintfA.USER32(00000000,%s%s%s,00161150,001661CC,00161278,00000001), ref: 001647B7
Part of subcall function 001646EC: ExitProcess.KERNEL32 ref: 001647DB
Part of subcall function 001646EC: CreateThread.KERNEL32(00000000,00000000,001645FC,00000000,00000000,00166004), ref: 00164803
Part of subcall function 001646EC: CloseHandle.KERNEL32(00000000), ref: 0016480A

Part of subcall function 00164848: GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,00000001), ref: 00164865
Part of subcall function 00164848: GetVolumeInformationA.KERNEL32(C:\,00000000,00000080,00000000,00000000,00000000,00000000,00000000), ref: 0016489D
Part of subcall function 00164848: GetModuleHandleA.KERNEL32(00000000), ref: 001648C7
Part of subcall function 00164848: RegOpenKeyExA.KERNEL32(80000002,System\CurrentControlSet\Services\Disk\Enum,00000000,00000001,?), ref: 001648EF
Part of subcall function 00164848: RegQueryValueExA.KERNEL32(?,001649E8,00000000,00000000,00000000,000000FF), ref: 0016490E
Part of subcall function 00164848: RegCloseKey.KERNEL32(?), ref: 00164916
Part of subcall function 00164848: CharLowerA.USER32(00000000), ref: 0016491A
Part of subcall function 00164848: RegOpenKeyExA.ADVAPI32(80000002,00161344,00000000,00000008,?), ref: 0016495E
Part of subcall function 00164848: RegEnumKeyA.ADVAPI32(?,00000000,00000000,000000FF), ref: 00164985
Part of subcall function 00164848: RegCloseKey.KERNEL32(?), ref: 00164994

Part of subcall function 00162A28: RtlZeroMemory.NTDLL(?,001627F4), ref: 00162A77
Part of subcall function 00162A28: RtlMoveMemory.NTDLL(?,001626C4,00162714), ref: 00162A86
Part of subcall function 00162A28: FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 00162A93
Part of subcall function 00162A28: GetWindowThreadProcessId.USER32(00000000,?), ref: 00162AA0
Part of subcall function 00162A28: lstrcat.KERNEL32(?,s2k13), ref: 00162BE7
Part of subcall function 00162A28: GetWindowLongA.USER32(00000000,00000000), ref: 00162BF0
Part of subcall function 00162A28: CreateFileMappingA.KERNEL32(00000000,00000000,08000040,00000000,00013000,s2k13), ref: 00162C56
Part of subcall function 00162A28: MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 00162C6C
Part of subcall function 00162A28: RtlMoveMemory.NTDLL(00000000,00000000,00013000), ref: 00162C98
Part of subcall function 00162A28: SetWindowLongA.USER32(00000000,00000000,00000080), ref: 00162CA8
Part of subcall function 00162A28: SendNotifyMessageA.USER32(00000000,0000000F,00000000,00000000), ref: 00162CB5
Part of subcall function 00162A28: Sleep.KERNEL32(00000064), ref: 00162CBD
Part of subcall function 00162A28: GetWindowLongA.USER32(00000000,00000000), ref: 00162CC6
Part of subcall function 00162A28: RtlZeroMemory.NTDLL(?,00000044), ref: 00162CDF
Part of subcall function 00162A28: RtlZeroMemory.NTDLL(?,00000010), ref: 00162CF2
Part of subcall function 00162A28: CreateProcessInternalA.KERNEL32(00000000,00000000,svchost.exe,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?,00000000), ref: 00162D17
Part of subcall function 00162A28: NtCreateSection.NTDLL(?,000F001F,00000000,00013000), ref: 00162D4E
Part of subcall function 00162A28: NtMapViewOfSection.NTDLL ref: 00162D78
Part of subcall function 00162A28: RtlMoveMemory.NTDLL(?,00000000,00013000), ref: 00162D9B
Part of subcall function 00162A28: NtUnmapViewOfSection.NTDLL ref: 00162DA7
Part of subcall function 00162A28: NtMapViewOfSection.NTDLL ref: 00162DD3
Part of subcall function 00162A28: CloseHandle.KERNEL32(?), ref: 00162DDD
Part of subcall function 00162A28: NtQueueApcThread.NTDLL ref: 00162DF1
Part of subcall function 00162A28: ResumeThread.KERNEL32(?), ref: 00162DFB
Part of subcall function 00162A28: ExitProcess.KERNEL32 ref: 00162E03

Strings

sel2, xrefs: 00164A13, 00164A1E, 00164A55, 00164A66
C:\6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe, xrefs: 00164A2E, 00164A5A

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 0016339C, Relevance: 3.1, APIs: 2, Instructions: 102

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00161A64, Relevance: 1.3, APIs: 1, Instructions: 9

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00164838, Relevance: 1.3, APIs: 1, Instructions: 3

APIs

Sleep.KERNELBASE(00000258,001648BA), ref: 0016483D

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Non-executed Functions

Function 00163D6C, Relevance: 66.9, APIs: 30, Strings: 8, Instructions: 357

APIs

Part of subcall function 001634D4: Sleep.KERNEL32(-000000C8,00000000,00000000,000000C8), ref: 0016353D

Part of subcall function 00161470: GetProcessHeap.KERNEL32 ref: 0016148D
Part of subcall function 00161470: RtlZeroMemory.NTDLL(00170618,00000400), ref: 0016149C
Part of subcall function 00161470: lstrlen.KERNEL32(?), ref: 001614A3
Part of subcall function 00161470: RtlMoveMemory.NTDLL(00170618,?,-00000007), ref: 001614B2
Part of subcall function 00161470: atoi.NTDLL(000000FF), ref: 0016151F
Part of subcall function 00161470: socket.WS2_32(00000002,00000001,00000000), ref: 0016152F
Part of subcall function 00161470: gethostbyname.WS2_32(00170618), ref: 00161539
Part of subcall function 00161470: htons.WS2_32(?), ref: 00161554
Part of subcall function 00161470: connect.WS2_32(?,00000002,00000010), ref: 00161572
Part of subcall function 00161470: RtlZeroMemory.NTDLL(00170A18,00000400), ref: 00161589
Part of subcall function 00161470: wsprintfA.USER32(00170A18,00161178,?,00000000,00170618), ref: 001615AB
Part of subcall function 00161470: wsprintfA.USER32(00000000,%s%s,000000FF,?,00000001,00000100), ref: 001615DF
Part of subcall function 00161470: wsprintfA.USER32(00170A18,001611BC,?,00000000,00170618,?,00000000,?), ref: 0016160E
Part of subcall function 00161470: RtlMoveMemory.NTDLL(00170A18,00000000,?), ref: 00161626
Part of subcall function 00161470: send.WS2_32(?,00170A18,?,00000000), ref: 00161650
Part of subcall function 00161470: RtlAllocateHeap.NTDLL(00000000,00000008,00002800), ref: 0016166A
Part of subcall function 00161470: RtlReAllocateHeap.NTDLL(00000000,00000008,00000000,00002800), ref: 00161690
Part of subcall function 00161470: recv.WS2_32(?,00000000,00002800,00000000), ref: 001616A8
Part of subcall function 00161470: closesocket.WS2_32(?), ref: 001616C1
Part of subcall function 00161470: RtlMoveMemory.NTDLL(00000000,000000FC,?), ref: 001617CB
Part of subcall function 00161470: RtlMoveMemory.NTDLL(00000000,000000FE,-00000001), ref: 00161807
Part of subcall function 00161470: RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 00161817

Sleep.KERNEL32(000007D0), ref: 00163DA5
lstrlen.KERNEL32(00000000), ref: 00163DCC

Part of subcall function 00161D5C: RtlMoveMemory.NTDLL(?,?,00000003), ref: 00161D7C
Part of subcall function 00161D5C: atoi.NTDLL(?), ref: 00161D86
Part of subcall function 00161D5C: lstrlen.KERNEL32(?), ref: 00161D9C
Part of subcall function 00161D5C: RtlMoveMemory.NTDLL(?,?,00000003), ref: 00161DBD
Part of subcall function 00161D5C: atoi.NTDLL(?), ref: 00161DC7

Part of subcall function 00161C68: lstrlen.KERNEL32(00170618), ref: 00161C82
Part of subcall function 00161C68: lstrlen.KERNEL32(0016182C), ref: 00161C8D

lstrlen.KERNEL32(00000000), ref: 00163E00
RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 00163E0A
atoi.NTDLL(-0000000C), ref: 00163E4B
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 00163EA8
RtlZeroMemory.NTDLL(00000000,000FA000), ref: 00163EC4
lstrcat.KERNEL32(00000000,-00000003), ref: 00163ED1
NtUnmapViewOfSection.NTDLL ref: 00163EDF

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

RtlMoveMemory.NTDLL(00000000,?,00000000), ref: 00163F12
DeleteFileW.KERNEL32(00000000), ref: 00163F1E
CreateFileW.KERNEL32(00000000,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00163F3C
WriteFile.KERNEL32(000000FF,00000000,00000000,?,00000000), ref: 00163F77
CloseHandle.KERNEL32(000000FF), ref: 00163F81

Part of subcall function 00161894: SetFileAttributesW.KERNEL32(?,00000006), ref: 001618A3
Part of subcall function 00161894: GetSystemDirectoryA.KERNEL32(00000000,00000400,00000400), ref: 001618BB
Part of subcall function 00161894: lstrcat.KERNEL32(00000000,0016192C), ref: 001618C9
Part of subcall function 00161894: lstrcat.KERNEL32(00000000,?), ref: 001618D4
Part of subcall function 00161894: CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,02000000,00000000), ref: 001618ED
Part of subcall function 00161894: GetFileAttributesExA.KERNEL32(00000000,00000000,?), ref: 001618FC
Part of subcall function 00161894: SetFileTime.KERNEL32(00000000,?,?,?), ref: 0016190F
Part of subcall function 00161894: CloseHandle.KERNEL32(00000000), ref: 00161916

RtlZeroMemory.NTDLL(00172124,00001000,00000000), ref: 00163FCB
wsprintfA.USER32(00172124,%s%s%c,?,00161244,00000075), ref: 00163FEF
RtlZeroMemory.NTDLL(00172124,00001000,00000000), ref: 00164040
wsprintfA.USER32(00172124,%s%s,?,00161284), ref: 0016405A
CloseHandle.KERNEL32(00000000), ref: 001640AB
CloseHandle.KERNEL32(00000000), ref: 001640B7
DeleteFileW.KERNEL32(00000000), ref: 001640C3
DeleteFileW.KERNEL32(00000000), ref: 001640D7
DeleteFileW.KERNEL32(00000000), ref: 001640E3
RtlZeroMemory.NTDLL(00172124,00001000), ref: 001640F3
wsprintfA.USER32(00172124,%s%s,?,00161294), ref: 0016410D
ExitProcess.KERNEL32 ref: 0016412E
atoi.NTDLL(-00000003), ref: 0016413A
RtlZeroMemory.NTDLL(00172124,00001000,00000000), ref: 00164176
wsprintfA.USER32(00172124,%s%s%d,?,00161244,00000000), ref: 00164196

Part of subcall function 00163A14: RtlAddVectoredExceptionHandler.NTDLL(00000000,Function_000039F8), ref: 00163AF0
Part of subcall function 00163A14: RtlZeroMemory.NTDLL(00171124,00001000), ref: 00163B24
Part of subcall function 00163A14: RtlZeroMemory.NTDLL(00173124,00001000), ref: 00163B34
Part of subcall function 00163A14: GetTempPathW.KERNEL32(00000200,00171124), ref: 00163B44
Part of subcall function 00163A14: GetTempFileNameW.KERNEL32(00171124,00000000,00000000,00171124), ref: 00163B58
Part of subcall function 00163A14: DeleteFileW.KERNEL32(00171124), ref: 00163B8E
Part of subcall function 00163A14: lstrcatW.KERNEL32(00171124,001610A0), ref: 00163B9A
Part of subcall function 00163A14: CreateFileW.KERNEL32(00171124,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00163BB7
Part of subcall function 00163A14: WriteFile.KERNEL32(?,00000000,00000400,?,00000000), ref: 00163BEE
Part of subcall function 00163A14: CloseHandle.KERNEL32(?), ref: 00163BFB
Part of subcall function 00163A14: RtlZeroMemory.NTDLL(?,00000044,00000000), ref: 00163C16
Part of subcall function 00163A14: RtlZeroMemory.NTDLL(?,00000010), ref: 00163C2F
Part of subcall function 00163A14: LoadLibraryW.KERNEL32(00171124), ref: 00163C43
Part of subcall function 00163A14: wsprintfW.USER32(00173124,0016103C,00171124), ref: 00163C72
Part of subcall function 00163A14: CreateProcessInternalW.KERNEL32(00000000,00171124,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?,00000000), ref: 00163CA2
Part of subcall function 00163A14: lstrcat.KERNEL32(00172124,0016124C), ref: 00163CC7
Part of subcall function 00163A14: ExitProcess.KERNEL32 ref: 00163CF6
Part of subcall function 00163A14: lstrcat.KERNEL32(00172124,00161254), ref: 00163D15
Part of subcall function 00163A14: DeleteFileW.KERNEL32(00171124), ref: 00163D42

Sleep.KERNEL32(000003E8,00000000), ref: 001641D5

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

Strings

u, xrefs: 00163FD1
advapi32.dll, xrefs: 00163F87, 00163F97
%s%s, xrefs: 00164050, 00164103
%s%s%c, xrefs: 00163FE5
%s%s%d, xrefs: 0016418C
Smk, xrefs: 00163DEB
|:|, xrefs: 00163E68
plugin_size, xrefs: 00163E2A

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00163588, Relevance: 59.8, APIs: 31, Strings: 3, Instructions: 326

APIs

RegOpenKeyExA.ADVAPI32(80000002,System,00000000,00020006,?), ref: 001635B0
RegCloseKey.ADVAPI32(?), ref: 001635C5

Part of subcall function 00163550: ExitProcess.KERNEL32 ref: 00163562
Part of subcall function 00163550: Sleep.KERNEL32(-00000064,?,001635D0), ref: 0016357B

GetVersion.KERNEL32 ref: 001635D0
RtlMoveMemory.NTDLL(001662A0,001661AC,00000008), ref: 001635F1

Part of subcall function 00161F4C: lstrlen.KERNEL32(?), ref: 00161F5D
Part of subcall function 00161F4C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,?,?), ref: 00161F83

RtlMoveMemory.NTDLL(001662C0,001661CC,00000008), ref: 00163630

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

SHGetFolderPathW.SHELL32(00000000,00000007,00000000,00000000,00000000), ref: 00163669
wsprintfW.USER32(00000000,0016105C,00000000,00000000), ref: 00163697

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

ExpandEnvironmentStringsW.KERNEL32(00161070,00000000,00001000,00000001,00000000), ref: 001636C2
ExpandEnvironmentStringsW.KERNEL32(00161084,00000000,00001000), ref: 001636DC
wsprintfW.USER32(00000000,00161024,00000000,00000000), ref: 001636F8
wsprintfW.USER32(00000000,00161024,00000000,00000000,00000001), ref: 0016371B
CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0016372D
wsprintfW.USER32(00000000,00161024,00000000,00000000,00000001), ref: 00163752
lstrcatW.KERNEL32(00000000,00000000), ref: 0016376E

Part of subcall function 001619B4: RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 001619D4
Part of subcall function 001619B4: lstrcmpW.KERNEL32(?,00000000), ref: 00161A15
Part of subcall function 001619B4: RegEnumValueW.ADVAPI32(?,00000000,00000000,00000400,00000000,?,00000000,?,00000400,00000400), ref: 00161A39
Part of subcall function 001619B4: RegCloseKey.ADVAPI32(?), ref: 00161A4A

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000), ref: 001639C3

Part of subcall function 00161930: RegOpenKeyA.ADVAPI32(80000001,001612B4), ref: 00161947
Part of subcall function 00161930: RegEnumKeyA.ADVAPI32(00000000,00000000,00000000,000000FF), ref: 0016196E
Part of subcall function 00161930: RegEnumKeyA.ADVAPI32(00000000,00000000,00000000,000000FF), ref: 0016198E
Part of subcall function 00161930: lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,001637B7), ref: 00161995
Part of subcall function 00161930: RegCloseKey.ADVAPI32(00000000,?,?,?,00000000,00000000,001637B7), ref: 001619A5

lstrlen.KERNEL32(00000000), ref: 001637E8
RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 001637F2
lstrcmpW.KERNEL32(?,00000000,00000000), ref: 00163812
DeleteFileW.KERNEL32(00000000), ref: 00163826
CopyFileW.KERNEL32(?,00000000,00000000), ref: 00163835
wsprintfW.USER32(00000000,00161030,00000000,00000000,00000001), ref: 0016386F
DeleteFileW.KERNEL32(00000000), ref: 00163879
DeleteFileW.KERNEL32(?,00000000,00000000), ref: 00163891

Part of subcall function 00161894: SetFileAttributesW.KERNEL32(?,00000006), ref: 001618A3
Part of subcall function 00161894: GetSystemDirectoryA.KERNEL32(00000000,00000400,00000400), ref: 001618BB
Part of subcall function 00161894: lstrcat.KERNEL32(00000000,0016192C), ref: 001618C9
Part of subcall function 00161894: lstrcat.KERNEL32(00000000,?), ref: 001618D4
Part of subcall function 00161894: CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,02000000,00000000), ref: 001618ED
Part of subcall function 00161894: GetFileAttributesExA.KERNEL32(00000000,00000000,?), ref: 001618FC
Part of subcall function 00161894: SetFileTime.KERNEL32(00000000,?,?,?), ref: 0016190F
Part of subcall function 00161894: CloseHandle.KERNEL32(00000000), ref: 00161916

lstrlenW.KERNEL32(00000000), ref: 001638B8
RegCreateKeyA.ADVAPI32(80000001,001612C0,?), ref: 001638DA
RegSetValueExW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000), ref: 001638F9
RegCloseKey.ADVAPI32(?), ref: 00163907
RegCreateKeyA.ADVAPI32(80000001,00161300,?), ref: 00163929
RegSetValueExW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000), ref: 00163944
RegCloseKey.ADVAPI32(?), ref: 00163956

Part of subcall function 00162004: CoInitialize.OLE32(00000000), ref: 0016200C
Part of subcall function 00162004: CoCreateInstance.OLE32(00165000,00000000,00000001,00162088,?), ref: 00162025
Part of subcall function 00162004: CoUninitialize.OLE32 ref: 0016207A

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0016399B

Part of subcall function 00161EA4: lstrcatW.KERNEL32(00170F24,00000000), ref: 00161EC2
Part of subcall function 00161EA4: lstrcat.KERNEL32(00171024,001612C0), ref: 00161ED3
Part of subcall function 00161EA4: CreateThread.KERNEL32(00000000,00000000,00161DF0,00000000,00000000,00166004), ref: 00161EEB
Part of subcall function 00161EA4: lstrcatW.KERNEL32(00170F24,00000000), ref: 00161F10
Part of subcall function 00161EA4: lstrcat.KERNEL32(00171024,00161300), ref: 00161F21
Part of subcall function 00161EA4: CreateThread.KERNEL32(00000000,00000000,00161DF0,00000000,00000000,00166004), ref: 00161F39

Strings

System, xrefs: 001635A6
advapi32.dll, xrefs: 00163897, 001638A7, 00163973
%, xrefs: 001636C8

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00161470, Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 307

APIs

GetProcessHeap.KERNEL32 ref: 0016148D
RtlZeroMemory.NTDLL(00170618,00000400), ref: 0016149C
lstrlen.KERNEL32(?), ref: 001614A3
RtlMoveMemory.NTDLL(00170618,?,-00000007), ref: 001614B2

Part of subcall function 00161C68: lstrlen.KERNEL32(00170618), ref: 00161C82
Part of subcall function 00161C68: lstrlen.KERNEL32(0016182C), ref: 00161C8D

atoi.NTDLL(000000FF), ref: 0016151F
socket.WS2_32(00000002,00000001,00000000), ref: 0016152F
gethostbyname.WS2_32(00170618), ref: 00161539
htons.WS2_32(?), ref: 00161554
connect.WS2_32(?,00000002,00000010), ref: 00161572
RtlZeroMemory.NTDLL(00170A18,00000400), ref: 00161589
wsprintfA.USER32(00170A18,00161178,?,00000000,00170618), ref: 001615AB

Part of subcall function 001623E8: lstrcat.KERNEL32(00000000,001612B0), ref: 00162401

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

wsprintfA.USER32(00000000,%s%s,000000FF,?,00000001,00000100), ref: 001615DF

Part of subcall function 00161CE0: lstrlen.KERNEL32(00000000,00000001,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161CFA
Part of subcall function 00161CE0: RtlMoveMemory.NTDLL(-00000008,00000000,00000000), ref: 00161D39

wsprintfA.USER32(00170A18,001611BC,?,00000000,00170618,?,00000000,?), ref: 0016160E
RtlMoveMemory.NTDLL(00170A18,00000000,?), ref: 00161626

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

send.WS2_32(?,00170A18,?,00000000), ref: 00161650
RtlAllocateHeap.NTDLL(00000000,00000008,00002800), ref: 0016166A
RtlReAllocateHeap.NTDLL(00000000,00000008,00000000,00002800), ref: 00161690
recv.WS2_32(?,00000000,00002800,00000000), ref: 001616A8
closesocket.WS2_32(?), ref: 001616C1
RtlMoveMemory.NTDLL(00000000,000000FC,?), ref: 001617CB
RtlMoveMemory.NTDLL(00000000,000000FE,-00000001), ref: 00161807
RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 00161817

Strings

0-ALLOWD, xrefs: 0016174E
0-CCCCCC, xrefs: 00161710
0-BBBBBB, xrefs: 001616F0
P, xrefs: 00161507
%s%s, xrefs: 001615D9
0-DDDDDD, xrefs: 00161730
Location:, xrefs: 0016176F
, xrefs: 00161789
0-AAAAAA, xrefs: 001616D0

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00162A28, Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 311

APIs

RtlZeroMemory.NTDLL(?,001627F4), ref: 00162A77
RtlMoveMemory.NTDLL(?,001626C4,00162714), ref: 00162A86
FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 00162A93
GetWindowThreadProcessId.USER32(00000000,?), ref: 00162AA0

Part of subcall function 0016219C: OpenProcess.KERNEL32(00000410,00000000,?), ref: 001621B8
Part of subcall function 0016219C: ReadProcessMemory.KERNEL32(00000000,?,00000000,?,?,?), ref: 00162206
Part of subcall function 0016219C: RtlCompareMemory.NTDLL(00000000,?,?), ref: 00162224
Part of subcall function 0016219C: VirtualQueryEx.KERNEL32(00000000,?,?,0000001C), ref: 00162288
Part of subcall function 0016219C: CloseHandle.KERNEL32(00000000), ref: 0016229A

lstrcat.KERNEL32(?,s2k13), ref: 00162BE7
GetWindowLongA.USER32(00000000,00000000), ref: 00162BF0
CreateFileMappingA.KERNEL32(00000000,00000000,08000040,00000000,00013000,s2k13), ref: 00162C56
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 00162C6C
RtlMoveMemory.NTDLL(00000000,00000000,00013000), ref: 00162C98
SetWindowLongA.USER32(00000000,00000000,00000080), ref: 00162CA8
SendNotifyMessageA.USER32(00000000,0000000F,00000000,00000000), ref: 00162CB5
Sleep.KERNEL32(00000064), ref: 00162CBD
GetWindowLongA.USER32(00000000,00000000), ref: 00162CC6
RtlZeroMemory.NTDLL(?,00000044), ref: 00162CDF
RtlZeroMemory.NTDLL(?,00000010), ref: 00162CF2
CreateProcessInternalA.KERNEL32(00000000,00000000,svchost.exe,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?,00000000), ref: 00162D17
NtCreateSection.NTDLL(?,000F001F,00000000,00013000), ref: 00162D4E
NtMapViewOfSection.NTDLL ref: 00162D78

Part of subcall function 00162958: VirtualQuery.KERNEL32(?,?,0000001C,00013000), ref: 00162983
Part of subcall function 00162958: lstrlenW.KERNEL32(?), ref: 0016298D

RtlMoveMemory.NTDLL(?,00000000,00013000), ref: 00162D9B
NtUnmapViewOfSection.NTDLL ref: 00162DA7
NtMapViewOfSection.NTDLL ref: 00162DD3
CloseHandle.KERNEL32(?), ref: 00162DDD
NtQueueApcThread.NTDLL ref: 00162DF1
ResumeThread.KERNEL32(?), ref: 00162DFB
ExitProcess.KERNEL32 ref: 00162E03

Part of subcall function 001620A8: wsprintfW.USER32(?,00161378,?), ref: 001620E3
Part of subcall function 001620A8: RtlInitUnicodeString.NTDLL(?,?), ref: 001620F7
Part of subcall function 001620A8: NtOpenSection.NTDLL ref: 00162127
Part of subcall function 001620A8: NtMapViewOfSection.NTDLL ref: 00162158
Part of subcall function 001620A8: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0016216E
Part of subcall function 001620A8: CloseHandle.KERNEL32(00000000), ref: 00162181

Strings

p, xrefs: 00162AAD
svchost.exe, xrefs: 00162D0E
s2k13, xrefs: 00162BDB, 00162C41
D, xrefs: 00162CE5
Shell_TrayWnd, xrefs: 00162A8E

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00163A14, Relevance: 35.3, APIs: 19, Strings: 1, Instructions: 251

APIs

Part of subcall function 00161C68: lstrlen.KERNEL32(00170618), ref: 00161C82
Part of subcall function 00161C68: lstrlen.KERNEL32(0016182C), ref: 00161C8D

RtlAddVectoredExceptionHandler.NTDLL(00000000,Function_000039F8), ref: 00163AF0

Part of subcall function 0016243C: VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 0016246E
Part of subcall function 0016243C: VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 0016248B
Part of subcall function 0016243C: RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 0016249F
Part of subcall function 0016243C: RtlZeroMemory.NTDLL(?,?), ref: 001624E0
Part of subcall function 0016243C: RtlMoveMemory.NTDLL(?,?,?), ref: 001624F5
Part of subcall function 0016243C: LoadLibraryA.KERNEL32(?), ref: 0016251E
Part of subcall function 0016243C: GetProcAddress.KERNEL32(?,?), ref: 00162554
Part of subcall function 0016243C: GetProcAddress.KERNEL32(?,?), ref: 0016256B

RtlZeroMemory.NTDLL(00171124,00001000), ref: 00163B24
RtlZeroMemory.NTDLL(00173124,00001000), ref: 00163B34
GetTempPathW.KERNEL32(00000200,00171124), ref: 00163B44
GetTempFileNameW.KERNEL32(00171124,00000000,00000000,00171124), ref: 00163B58
DeleteFileW.KERNEL32(00171124), ref: 00163B8E
lstrcatW.KERNEL32(00171124,001610A0), ref: 00163B9A
CreateFileW.KERNEL32(00171124,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00163BB7
WriteFile.KERNEL32(?,00000000,00000400,?,00000000), ref: 00163BEE
CloseHandle.KERNEL32(?), ref: 00163BFB
RtlZeroMemory.NTDLL(?,00000044,00000000), ref: 00163C16
RtlZeroMemory.NTDLL(?,00000010), ref: 00163C2F
LoadLibraryW.KERNEL32(00171124), ref: 00163C43
wsprintfW.USER32(00173124,0016103C,00171124), ref: 00163C72
CreateProcessInternalW.KERNEL32(00000000,00171124,00000000,00000000,00000000,00000000,00000020,00000000,00000000,?,?,00000000), ref: 00163CA2
lstrcat.KERNEL32(00172124,0016124C), ref: 00163CC7
ExitProcess.KERNEL32 ref: 00163CF6
lstrcat.KERNEL32(00172124,00161254), ref: 00163D15

Part of subcall function 00161470: GetProcessHeap.KERNEL32 ref: 0016148D
Part of subcall function 00161470: RtlZeroMemory.NTDLL(00170618,00000400), ref: 0016149C
Part of subcall function 00161470: lstrlen.KERNEL32(?), ref: 001614A3
Part of subcall function 00161470: RtlMoveMemory.NTDLL(00170618,?,-00000007), ref: 001614B2
Part of subcall function 00161470: atoi.NTDLL(000000FF), ref: 0016151F
Part of subcall function 00161470: socket.WS2_32(00000002,00000001,00000000), ref: 0016152F
Part of subcall function 00161470: gethostbyname.WS2_32(00170618), ref: 00161539
Part of subcall function 00161470: htons.WS2_32(?), ref: 00161554
Part of subcall function 00161470: connect.WS2_32(?,00000002,00000010), ref: 00161572
Part of subcall function 00161470: RtlZeroMemory.NTDLL(00170A18,00000400), ref: 00161589
Part of subcall function 00161470: wsprintfA.USER32(00170A18,00161178,?,00000000,00170618), ref: 001615AB
Part of subcall function 00161470: wsprintfA.USER32(00000000,%s%s,000000FF,?,00000001,00000100), ref: 001615DF
Part of subcall function 00161470: wsprintfA.USER32(00170A18,001611BC,?,00000000,00170618,?,00000000,?), ref: 0016160E
Part of subcall function 00161470: RtlMoveMemory.NTDLL(00170A18,00000000,?), ref: 00161626
Part of subcall function 00161470: send.WS2_32(?,00170A18,?,00000000), ref: 00161650
Part of subcall function 00161470: RtlAllocateHeap.NTDLL(00000000,00000008,00002800), ref: 0016166A
Part of subcall function 00161470: RtlReAllocateHeap.NTDLL(00000000,00000008,00000000,00002800), ref: 00161690
Part of subcall function 00161470: recv.WS2_32(?,00000000,00002800,00000000), ref: 001616A8
Part of subcall function 00161470: closesocket.WS2_32(?), ref: 001616C1
Part of subcall function 00161470: RtlMoveMemory.NTDLL(00000000,000000FC,?), ref: 001617CB
Part of subcall function 00161470: RtlMoveMemory.NTDLL(00000000,000000FE,-00000001), ref: 00161807
Part of subcall function 00161470: RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 00161817

DeleteFileW.KERNEL32(00171124), ref: 00163D42

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

Strings

Location:, xrefs: 00163A29

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00162A26, Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 203

APIs

RtlZeroMemory.NTDLL(?,001627F4), ref: 00162A77
RtlMoveMemory.NTDLL(?,001626C4,00162714), ref: 00162A86
FindWindowA.USER32(Shell_TrayWnd,00000000), ref: 00162A93
GetWindowThreadProcessId.USER32(00000000,?), ref: 00162AA0

Part of subcall function 0016219C: OpenProcess.KERNEL32(00000410,00000000,?), ref: 001621B8
Part of subcall function 0016219C: ReadProcessMemory.KERNEL32(00000000,?,00000000,?,?,?), ref: 00162206
Part of subcall function 0016219C: RtlCompareMemory.NTDLL(00000000,?,?), ref: 00162224
Part of subcall function 0016219C: VirtualQueryEx.KERNEL32(00000000,?,?,0000001C), ref: 00162288
Part of subcall function 0016219C: CloseHandle.KERNEL32(00000000), ref: 0016229A

lstrcat.KERNEL32(?,s2k13), ref: 00162BE7
GetWindowLongA.USER32(00000000,00000000), ref: 00162BF0
CreateFileMappingA.KERNEL32(00000000,00000000,08000040,00000000,00013000,s2k13), ref: 00162C56
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 00162C6C
NtMapViewOfSection.NTDLL ref: 00162D78

Part of subcall function 00162958: VirtualQuery.KERNEL32(?,?,0000001C,00013000), ref: 00162983
Part of subcall function 00162958: lstrlenW.KERNEL32(?), ref: 0016298D

RtlMoveMemory.NTDLL(00000000,00000000,00013000), ref: 00162C98
SetWindowLongA.USER32(00000000,00000000,00000080), ref: 00162CA8
SendNotifyMessageA.USER32(00000000,0000000F,00000000,00000000), ref: 00162CB5
Sleep.KERNEL32(00000064), ref: 00162CBD
GetWindowLongA.USER32(00000000,00000000), ref: 00162CC6
RtlZeroMemory.NTDLL(?,00000044), ref: 00162CDF
RtlZeroMemory.NTDLL(?,00000010), ref: 00162CF2
CreateProcessInternalA.KERNEL32(00000000,00000000,svchost.exe,00000000,00000000,00000000,00000004,00000000,00000000,00000044,?,00000000), ref: 00162D17
NtCreateSection.NTDLL(?,000F001F,00000000,00013000), ref: 00162D4E
RtlMoveMemory.NTDLL(?,00000000,00013000), ref: 00162D9B
NtUnmapViewOfSection.NTDLL ref: 00162DA7
NtMapViewOfSection.NTDLL ref: 00162DD3
CloseHandle.KERNEL32(?), ref: 00162DDD
NtQueueApcThread.NTDLL ref: 00162DF1
ResumeThread.KERNEL32(?), ref: 00162DFB
ExitProcess.KERNEL32 ref: 00162E03

Part of subcall function 001620A8: wsprintfW.USER32(?,00161378,?), ref: 001620E3
Part of subcall function 001620A8: RtlInitUnicodeString.NTDLL(?,?), ref: 001620F7
Part of subcall function 001620A8: NtOpenSection.NTDLL ref: 00162127
Part of subcall function 001620A8: NtMapViewOfSection.NTDLL ref: 00162158
Part of subcall function 001620A8: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0016216E
Part of subcall function 001620A8: CloseHandle.KERNEL32(00000000), ref: 00162181

Strings

p, xrefs: 00162AAD
s2k13, xrefs: 00162BDB, 00162C41
Shell_TrayWnd, xrefs: 00162A8E

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 001630B0, Relevance: 16.7, APIs: 11, Instructions: 158

APIs

OpenProcess.KERNEL32(001F0FFF,00000000), ref: 001630BF
lstrlen.KERNEL32(00000000), ref: 001630D5
lstrlenW.KERNEL32(00000000), ref: 001630E4
NtCreateSection.NTDLL(?,000F001F,00000000,?), ref: 00163123
NtMapViewOfSection.NTDLL ref: 00163155
NtUnmapViewOfSection.NTDLL ref: 00163200
NtMapViewOfSection.NTDLL ref: 00163229
CreateRemoteThread.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?), ref: 00163244
CloseHandle.KERNEL32(00000000), ref: 0016324B
CloseHandle.KERNEL32(?), ref: 00163255
CloseHandle.KERNEL32(00000000), ref: 0016325C

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00161B96, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48

APIs

GetComputerNameA.KERNEL32(001661CC,00000010), ref: 00161BB2
GetVolumeInformationA.KERNEL32(C:\,00000000,00000080,?,00000000,00000000,00000000,00000000), ref: 00161BD0
lstrlen.KERNEL32(001661CC), ref: 00161BDB
RtlComputeCrc32.NTDLL(00000000,001661CC,00000000), ref: 00161BE9
wsprintfA.USER32(00000010,%08X%08X%08X%08X%08X,?,00000000,?,?,?), ref: 00161C0C

Strings

C:\, xrefs: 00161BCB
%08X%08X%08X%08X%08X, xrefs: 00161C03

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 0016243C, Relevance: 12.2, APIs: 8, Instructions: 188

APIs

VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 0016246E
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 0016248B
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 0016249F
RtlZeroMemory.NTDLL(?,?), ref: 001624E0
RtlMoveMemory.NTDLL(?,?,?), ref: 001624F5
LoadLibraryA.KERNEL32(?), ref: 0016251E
GetProcAddress.KERNEL32(?,?), ref: 00162554
GetProcAddress.KERNEL32(?,?), ref: 0016256B

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 001645FA, Relevance: 12.1, APIs: 8, Instructions: 55

APIs

CreateFileMappingA.KERNEL32(00000000), ref: 00164626
GetCurrentThreadId.KERNEL32 ref: 00164631
RtlAddVectoredExceptionHandler.NTDLL(00000000,Function_000039F8), ref: 00164655
GetCurrentProcessId.KERNEL32 ref: 00164660

Part of subcall function 001645B8: CreateThread.KERNEL32(00000000,00000000,Function_00003268,00000000,00000000), ref: 001645EB
Part of subcall function 001645B8: CloseHandle.KERNEL32(00000000), ref: 001645F2

RtlRemoveVectoredExceptionHandler.NTDLL(00000000), ref: 0016468A

Part of subcall function 00164354: wsprintfA.USER32(00000000,%s%s%s%s%s%d%s%d,00161260,sel2,00161268,00000000,00161270,00000000,001612A0,00000000,00000001), ref: 001643AF
Part of subcall function 00164354: wsprintfA.USER32(00000000,%s%s%s%s%s,00161150,001661CC,00000000,001612A8,00000000,00000001), ref: 001643F1

Part of subcall function 00164450: RtlMoveMemory.NTDLL(?,-00000015,00000015), ref: 001644EE
Part of subcall function 00164450: lstrlen.KERNEL32(?), ref: 0016450F
Part of subcall function 00164450: RtlComputeCrc32.NTDLL(00000000,?,00000000), ref: 0016451C
Part of subcall function 00164450: Sleep.KERNEL32(00000064), ref: 00164570

Sleep.KERNEL32(000007D0), ref: 001646B6
RtlRemoveVectoredExceptionHandler.NTDLL(00000000), ref: 001646C8
Sleep.KERNEL32(00000258), ref: 001646D8

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 001620A8, Relevance: 9.1, APIs: 6, Instructions: 92

APIs

wsprintfW.USER32(?,00161378,?), ref: 001620E3
RtlInitUnicodeString.NTDLL(?,?), ref: 001620F7
NtOpenSection.NTDLL ref: 00162127
NtMapViewOfSection.NTDLL ref: 00162158
VirtualQuery.KERNEL32(?,?,0000001C), ref: 0016216E
CloseHandle.KERNEL32(00000000), ref: 00162181

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00163268, Relevance: 9.0, APIs: 6, Instructions: 42

APIs

RtlZeroMemory.NTDLL(?,00000128), ref: 00163280
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00163291
Process32First.KERNEL32(00000000), ref: 0016329B

Part of subcall function 001630B0: OpenProcess.KERNEL32(001F0FFF,00000000), ref: 001630BF
Part of subcall function 001630B0: lstrlen.KERNEL32(00000000), ref: 001630D5
Part of subcall function 001630B0: lstrlenW.KERNEL32(00000000), ref: 001630E4
Part of subcall function 001630B0: NtCreateSection.NTDLL(?,000F001F,00000000,?), ref: 00163123
Part of subcall function 001630B0: NtMapViewOfSection.NTDLL ref: 00163155

Process32Next.KERNEL32(00000000), ref: 001632D4
CloseHandle.KERNEL32(00000000), ref: 001632DF
Sleep.KERNEL32(000003E8), ref: 001632E7

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00162087, Relevance: 7.6, APIs: 5, Instructions: 103

APIs

wsprintfW.USER32(?,00161378,?), ref: 001620E3
RtlInitUnicodeString.NTDLL(?,?), ref: 001620F7
NtOpenSection.NTDLL ref: 00162127
NtMapViewOfSection.NTDLL ref: 00162158
VirtualQuery.KERNEL32(?,?,0000001C), ref: 0016216E
CloseHandle.KERNEL32(00000000), ref: 00162181

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00162958, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74

APIs

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

VirtualQuery.KERNEL32(?,?,0000001C,00013000), ref: 00162983
lstrlenW.KERNEL32(?), ref: 0016298D

Strings

`$, xrefs: 0016299C

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00163586, Relevance: 59.8, APIs: 31, Strings: 3, Instructions: 322

APIs

RegOpenKeyExA.ADVAPI32(80000002,System,00000000,00020006,?), ref: 001635B0
RegCloseKey.ADVAPI32(?), ref: 001635C5

Part of subcall function 00163550: ExitProcess.KERNEL32 ref: 00163562
Part of subcall function 00163550: Sleep.KERNEL32(-00000064,?,001635D0), ref: 0016357B

GetVersion.KERNEL32 ref: 001635D0
RtlMoveMemory.NTDLL(001662A0,001661AC,00000008), ref: 001635F1

Part of subcall function 00161F4C: lstrlen.KERNEL32(?), ref: 00161F5D
Part of subcall function 00161F4C: MultiByteToWideChar.KERNEL32(00000000,00000000,?,00000001,00000000,?,?), ref: 00161F83

RtlMoveMemory.NTDLL(001662C0,001661CC,00000008), ref: 00163630

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

SHGetFolderPathW.SHELL32(00000000,00000007,00000000,00000000,00000000), ref: 00163669
wsprintfW.USER32(00000000,0016105C,00000000,00000000), ref: 00163697
ExpandEnvironmentStringsW.KERNEL32(00161070,00000000,00001000,00000001,00000000), ref: 001636C2
ExpandEnvironmentStringsW.KERNEL32(00161084,00000000,00001000), ref: 001636DC
wsprintfW.USER32(00000000,00161024,00000000,00000000), ref: 001636F8
wsprintfW.USER32(00000000,00161024,00000000,00000000,00000001), ref: 0016371B

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0016372D
wsprintfW.USER32(00000000,00161024,00000000,00000000,00000001), ref: 00163752
lstrcatW.KERNEL32(00000000,00000000), ref: 0016376E

Part of subcall function 001619B4: RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 001619D4
Part of subcall function 001619B4: lstrcmpW.KERNEL32(?,00000000), ref: 00161A15
Part of subcall function 001619B4: RegEnumValueW.ADVAPI32(?,00000000,00000000,00000400,00000000,?,00000000,?,00000400,00000400), ref: 00161A39
Part of subcall function 001619B4: RegCloseKey.ADVAPI32(?), ref: 00161A4A

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000), ref: 001639C3

Part of subcall function 00161930: RegOpenKeyA.ADVAPI32(80000001,001612B4), ref: 00161947
Part of subcall function 00161930: RegEnumKeyA.ADVAPI32(00000000,00000000,00000000,000000FF), ref: 0016196E
Part of subcall function 00161930: RegEnumKeyA.ADVAPI32(00000000,00000000,00000000,000000FF), ref: 0016198E
Part of subcall function 00161930: lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,001637B7), ref: 00161995
Part of subcall function 00161930: RegCloseKey.ADVAPI32(00000000,?,?,?,00000000,00000000,001637B7), ref: 001619A5

lstrlen.KERNEL32(00000000), ref: 001637E8
RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 001637F2
lstrcmpW.KERNEL32(?,00000000,00000000), ref: 00163812
DeleteFileW.KERNEL32(00000000), ref: 00163826
CopyFileW.KERNEL32(?,00000000,00000000), ref: 00163835
wsprintfW.USER32(00000000,00161030,00000000,00000000,00000001), ref: 0016386F
DeleteFileW.KERNEL32(00000000), ref: 00163879
DeleteFileW.KERNEL32(?,00000000,00000000), ref: 00163891

Part of subcall function 00161894: SetFileAttributesW.KERNEL32(?,00000006), ref: 001618A3
Part of subcall function 00161894: GetSystemDirectoryA.KERNEL32(00000000,00000400,00000400), ref: 001618BB
Part of subcall function 00161894: lstrcat.KERNEL32(00000000,0016192C), ref: 001618C9
Part of subcall function 00161894: lstrcat.KERNEL32(00000000,?), ref: 001618D4
Part of subcall function 00161894: CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,02000000,00000000), ref: 001618ED
Part of subcall function 00161894: GetFileAttributesExA.KERNEL32(00000000,00000000,?), ref: 001618FC
Part of subcall function 00161894: SetFileTime.KERNEL32(00000000,?,?,?), ref: 0016190F
Part of subcall function 00161894: CloseHandle.KERNEL32(00000000), ref: 00161916

lstrlenW.KERNEL32(00000000), ref: 001638B8
RegCreateKeyA.ADVAPI32(80000001,001612C0,?), ref: 001638DA
RegSetValueExW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000), ref: 001638F9
RegCloseKey.ADVAPI32(?), ref: 00163907
RegCreateKeyA.ADVAPI32(80000001,00161300,?), ref: 00163929
RegSetValueExW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000), ref: 00163944
RegCloseKey.ADVAPI32(?), ref: 00163956

Part of subcall function 00162004: CoInitialize.OLE32(00000000), ref: 0016200C
Part of subcall function 00162004: CoCreateInstance.OLE32(00165000,00000000,00000001,00162088,?), ref: 00162025
Part of subcall function 00162004: CoUninitialize.OLE32 ref: 0016207A

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0016399B

Part of subcall function 00161EA4: lstrcatW.KERNEL32(00170F24,00000000), ref: 00161EC2
Part of subcall function 00161EA4: lstrcat.KERNEL32(00171024,001612C0), ref: 00161ED3
Part of subcall function 00161EA4: CreateThread.KERNEL32(00000000,00000000,00161DF0,00000000,00000000,00166004), ref: 00161EEB
Part of subcall function 00161EA4: lstrcatW.KERNEL32(00170F24,00000000), ref: 00161F10
Part of subcall function 00161EA4: lstrcat.KERNEL32(00171024,00161300), ref: 00161F21
Part of subcall function 00161EA4: CreateThread.KERNEL32(00000000,00000000,00161DF0,00000000,00000000,00166004), ref: 00161F39

Strings

System, xrefs: 001635A6
advapi32.dll, xrefs: 00163897, 001638A7, 00163973
%, xrefs: 001636C8

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 0016146E, Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 202

APIs

Part of subcall function 001623E8: lstrcat.KERNEL32(00000000,001612B0), ref: 00162401

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

GetProcessHeap.KERNEL32 ref: 0016148D
RtlZeroMemory.NTDLL(00170618,00000400), ref: 0016149C
lstrlen.KERNEL32(?), ref: 001614A3
RtlMoveMemory.NTDLL(00170618,?,-00000007), ref: 001614B2

Part of subcall function 00161C68: lstrlen.KERNEL32(00170618), ref: 00161C82
Part of subcall function 00161C68: lstrlen.KERNEL32(0016182C), ref: 00161C8D

atoi.NTDLL(000000FF), ref: 0016151F
socket.WS2_32(00000002,00000001,00000000), ref: 0016152F
gethostbyname.WS2_32(00170618), ref: 00161539
htons.WS2_32(?), ref: 00161554
connect.WS2_32(?,00000002,00000010), ref: 00161572
RtlZeroMemory.NTDLL(00170A18,00000400), ref: 00161589
wsprintfA.USER32(00170A18,00161178,?,00000000,00170618), ref: 001615AB
wsprintfA.USER32(00000000,%s%s,000000FF,?,00000001,00000100), ref: 001615DF

Part of subcall function 00161CE0: lstrlen.KERNEL32(00000000,00000001,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161CFA
Part of subcall function 00161CE0: RtlMoveMemory.NTDLL(-00000008,00000000,00000000), ref: 00161D39

wsprintfA.USER32(00170A18,001611BC,?,00000000,00170618,?,00000000,?), ref: 0016160E
RtlMoveMemory.NTDLL(00170A18,00000000,?), ref: 00161626

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

send.WS2_32(?,00170A18,?,00000000), ref: 00161650
RtlAllocateHeap.NTDLL(00000000,00000008,00002800), ref: 0016166A
RtlReAllocateHeap.NTDLL(00000000,00000008,00000000,00002800), ref: 00161690
recv.WS2_32(?,00000000,00002800,00000000), ref: 001616A8
closesocket.WS2_32(?), ref: 001616C1
RtlMoveMemory.NTDLL(00000000,000000FC,?), ref: 001617CB
RtlMoveMemory.NTDLL(00000000,000000FE,-00000001), ref: 00161807
RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 00161817

Strings

0-ALLOWD, xrefs: 0016174E
P, xrefs: 00161507
Location:, xrefs: 0016176F
, xrefs: 00161789
0-AAAAAA, xrefs: 001616D0

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 001646EC, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 87

APIs

WSAStartup.WS2_32(00000202,00166038), ref: 00164709

Part of subcall function 00161F94: ObtainUserAgentString.URLMON(00000000,00000000), ref: 00161FAA

Part of subcall function 00161470: GetProcessHeap.KERNEL32 ref: 0016148D
Part of subcall function 00161470: RtlZeroMemory.NTDLL(00170618,00000400), ref: 0016149C
Part of subcall function 00161470: lstrlen.KERNEL32(?), ref: 001614A3
Part of subcall function 00161470: RtlMoveMemory.NTDLL(00170618,?,-00000007), ref: 001614B2
Part of subcall function 00161470: atoi.NTDLL(000000FF), ref: 0016151F
Part of subcall function 00161470: socket.WS2_32(00000002,00000001,00000000), ref: 0016152F
Part of subcall function 00161470: gethostbyname.WS2_32(00170618), ref: 00161539
Part of subcall function 00161470: htons.WS2_32(?), ref: 00161554
Part of subcall function 00161470: connect.WS2_32(?,00000002,00000010), ref: 00161572
Part of subcall function 00161470: RtlZeroMemory.NTDLL(00170A18,00000400), ref: 00161589
Part of subcall function 00161470: wsprintfA.USER32(00170A18,00161178,?,00000000,00170618), ref: 001615AB
Part of subcall function 00161470: wsprintfA.USER32(00000000,%s%s,000000FF,?,00000001,00000100), ref: 001615DF
Part of subcall function 00161470: wsprintfA.USER32(00170A18,001611BC,?,00000000,00170618,?,00000000,?), ref: 0016160E
Part of subcall function 00161470: RtlMoveMemory.NTDLL(00170A18,00000000,?), ref: 00161626
Part of subcall function 00161470: send.WS2_32(?,00170A18,?,00000000), ref: 00161650
Part of subcall function 00161470: RtlAllocateHeap.NTDLL(00000000,00000008,00002800), ref: 0016166A
Part of subcall function 00161470: RtlReAllocateHeap.NTDLL(00000000,00000008,00000000,00002800), ref: 00161690
Part of subcall function 00161470: recv.WS2_32(?,00000000,00002800,00000000), ref: 001616A8
Part of subcall function 00161470: closesocket.WS2_32(?), ref: 001616C1
Part of subcall function 00161470: RtlMoveMemory.NTDLL(00000000,000000FC,?), ref: 001617CB
Part of subcall function 00161470: RtlMoveMemory.NTDLL(00000000,000000FE,-00000001), ref: 00161807
Part of subcall function 00161470: RtlFreeHeap.NTDLL(00000000,00000000,00000000), ref: 00161817

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

Sleep.KERNEL32(00001770,00000000), ref: 00164741

Part of subcall function 00161B98: GetComputerNameA.KERNEL32(001661CC,00000010), ref: 00161BB2
Part of subcall function 00161B98: GetVolumeInformationA.KERNEL32(C:\,00000000,00000080,?,00000000,00000000,00000000,00000000), ref: 00161BD0
Part of subcall function 00161B98: lstrlen.KERNEL32(001661CC), ref: 00161BDB
Part of subcall function 00161B98: RtlComputeCrc32.NTDLL(00000000,001661CC,00000000), ref: 00161BE9
Part of subcall function 00161B98: wsprintfA.USER32(00000010,%08X%08X%08X%08X%08X,?,00000000,?,?,?), ref: 00161C0C

wsprintfA.USER32(00166230,%s%s,001661CC,00164824,00000000), ref: 00164772
CreateMutexA.KERNEL32(00000000,00000000,001661CC), ref: 00164784
RtlGetLastWin32Error.NTDLL ref: 0016478A
CloseHandle.KERNEL32(00000000), ref: 0016480A

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

wsprintfA.USER32(00000000,%s%s%s,00161150,001661CC,00161278,00000001), ref: 001647B7
ExitProcess.KERNEL32 ref: 001647DB

Part of subcall function 00163588: RegOpenKeyExA.ADVAPI32(80000002,System,00000000,00020006,?), ref: 001635B0
Part of subcall function 00163588: RegCloseKey.ADVAPI32(?), ref: 001635C5
Part of subcall function 00163588: GetVersion.KERNEL32 ref: 001635D0
Part of subcall function 00163588: RtlMoveMemory.NTDLL(001662A0,001661AC,00000008), ref: 001635F1
Part of subcall function 00163588: RtlMoveMemory.NTDLL(001662C0,001661CC,00000008), ref: 00163630
Part of subcall function 00163588: SHGetFolderPathW.SHELL32(00000000,00000007,00000000,00000000,00000000), ref: 00163669
Part of subcall function 00163588: wsprintfW.USER32(00000000,0016105C,00000000,00000000), ref: 00163697
Part of subcall function 00163588: ExpandEnvironmentStringsW.KERNEL32(00161070,00000000,00001000,00000001,00000000), ref: 001636C2
Part of subcall function 00163588: ExpandEnvironmentStringsW.KERNEL32(00161084,00000000,00001000), ref: 001636DC
Part of subcall function 00163588: wsprintfW.USER32(00000000,00161024,00000000,00000000), ref: 001636F8
Part of subcall function 00163588: wsprintfW.USER32(00000000,00161024,00000000,00000000,00000001), ref: 0016371B
Part of subcall function 00163588: CreateDirectoryW.KERNEL32(00000000,00000000,00000000), ref: 0016372D
Part of subcall function 00163588: wsprintfW.USER32(00000000,00161024,00000000,00000000,00000001), ref: 00163752
Part of subcall function 00163588: lstrcatW.KERNEL32(00000000,00000000), ref: 0016376E
Part of subcall function 00163588: lstrlen.KERNEL32(00000000), ref: 001637E8
Part of subcall function 00163588: RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 001637F2
Part of subcall function 00163588: lstrcmpW.KERNEL32(?,00000000,00000000), ref: 00163812
Part of subcall function 00163588: DeleteFileW.KERNEL32(00000000), ref: 00163826
Part of subcall function 00163588: CopyFileW.KERNEL32(?,00000000,00000000), ref: 00163835
Part of subcall function 00163588: wsprintfW.USER32(00000000,00161030,00000000,00000000,00000001), ref: 0016386F
Part of subcall function 00163588: DeleteFileW.KERNEL32(00000000), ref: 00163879
Part of subcall function 00163588: DeleteFileW.KERNEL32(?,00000000,00000000), ref: 00163891
Part of subcall function 00163588: lstrlenW.KERNEL32(00000000), ref: 001638B8
Part of subcall function 00163588: RegCreateKeyA.ADVAPI32(80000001,001612C0,?), ref: 001638DA
Part of subcall function 00163588: RegSetValueExW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000), ref: 001638F9
Part of subcall function 00163588: RegCloseKey.ADVAPI32(?), ref: 00163907
Part of subcall function 00163588: RegCreateKeyA.ADVAPI32(80000001,00161300,?), ref: 00163929
Part of subcall function 00163588: RegSetValueExW.ADVAPI32(?,00000000,00000000,00000001,00000000,00000000), ref: 00163944
Part of subcall function 00163588: RegCloseKey.ADVAPI32(?), ref: 00163956
Part of subcall function 00163588: CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0016399B
Part of subcall function 00163588: CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000080,00000000), ref: 001639C3

CreateThread.KERNEL32(00000000,00000000,001645FC,00000000,00000000,00166004), ref: 00164803

Strings

%s%s%s, xrefs: 001647B1
%s%s, xrefs: 00164768

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 001622AC, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 99

APIs

RegOpenKeyA.ADVAPI32(80000002,00161344), ref: 001622C4

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

wsprintfA.USER32(00000000,%s\%s,00161344,00000000), ref: 00162306
RegOpenKeyA.ADVAPI32(80000002,00000000,?), ref: 00162320
RegQueryValueExA.ADVAPI32(?,00001000,00000000,00000000,00000000,00001000), ref: 0016234E
lstrlen.KERNEL32(00000000), ref: 00162359
RegCloseKey.ADVAPI32(?), ref: 0016238F

Part of subcall function 00161C68: lstrlen.KERNEL32(00170618), ref: 00161C82
Part of subcall function 00161C68: lstrlen.KERNEL32(0016182C), ref: 00161C8D

Part of subcall function 00163304: lstrlen.KERNEL32(?), ref: 0016333F
Part of subcall function 00163304: RtlMoveMemory.NTDLL(?,?,00000000), ref: 00163348

RegEnumKeyA.ADVAPI32(00000001,000000FF,00000000,000000FF), ref: 001623A9
RegCloseKey.ADVAPI32(00000000), ref: 001623BE

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

Strings

%s\%s, xrefs: 00162300
http://, xrefs: 00162364

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00161DEE, Relevance: 13.6, APIs: 9, Instructions: 63

APIs

RegOpenKeyA.ADVAPI32(80000001,00171024), ref: 00161DFF
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00161E15
RegNotifyChangeKeyValue.ADVAPI32(00000004,000000FF,00000004,00000000,000000FF), ref: 00161E29
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,000000FF), ref: 00161E38
RegCreateKeyA.ADVAPI32(80000001,00171024,?), ref: 00161E51
lstrlenW.KERNEL32(00000000), ref: 00161E5D
RegSetValueExW.ADVAPI32(00170F24,00170F24,00000000,00000001,00000000,00000000), ref: 00161E7A
RegCloseKey.ADVAPI32(?), ref: 00161E85
RegNotifyChangeKeyValue.ADVAPI32(00000004,000000FF,00000004,00000000,000000FF), ref: 00161E97

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00164254, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 82

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00164275
GetFileSize.KERNEL32(00000000,00000000), ref: 00164285
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 001642A2
CloseHandle.KERNEL32(00000000), ref: 001642C1

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

wsprintfA.USER32(?,%02x,?,00000001), ref: 001642F8
lstrcat.KERNEL32(00000000,?), ref: 00164306

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

Strings

%02x, xrefs: 001642EF

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00161B98, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 47

APIs

GetComputerNameA.KERNEL32(001661CC,00000010), ref: 00161BB2
GetVolumeInformationA.KERNEL32(C:\,00000000,00000080,?,00000000,00000000,00000000,00000000), ref: 00161BD0
lstrlen.KERNEL32(001661CC), ref: 00161BDB
RtlComputeCrc32.NTDLL(00000000,001661CC,00000000), ref: 00161BE9
wsprintfA.USER32(00000010,%08X%08X%08X%08X%08X,?,00000000,?,?,?), ref: 00161C0C

Strings

C:\, xrefs: 00161BCB
%08X%08X%08X%08X%08X, xrefs: 00161C03

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00161894, Relevance: 12.1, APIs: 8, Instructions: 56

APIs

SetFileAttributesW.KERNEL32(?,00000006), ref: 001618A3

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

GetSystemDirectoryA.KERNEL32(00000000,00000400,00000400), ref: 001618BB
lstrcat.KERNEL32(00000000,0016192C), ref: 001618C9
lstrcat.KERNEL32(00000000,?), ref: 001618D4
CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,02000000,00000000), ref: 001618ED
GetFileAttributesExA.KERNEL32(00000000,00000000,?), ref: 001618FC
SetFileTime.KERNEL32(00000000,?,?,?), ref: 0016190F
CloseHandle.KERNEL32(00000000), ref: 00161916

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 0016219C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99

APIs

OpenProcess.KERNEL32(00000410,00000000,?), ref: 001621B8
CloseHandle.KERNEL32(00000000), ref: 0016229A

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

ReadProcessMemory.KERNEL32(00000000,?,00000000,?,?,?), ref: 00162206
RtlCompareMemory.NTDLL(00000000,?,?), ref: 00162224

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

VirtualQueryEx.KERNEL32(00000000,?,?,0000001C), ref: 00162288

Strings

, xrefs: 00162234

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00161EA4, Relevance: 9.1, APIs: 6, Instructions: 52

APIs

Part of subcall function 001619B4: RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 001619D4
Part of subcall function 001619B4: lstrcmpW.KERNEL32(?,00000000), ref: 00161A15
Part of subcall function 001619B4: RegEnumValueW.ADVAPI32(?,00000000,00000000,00000400,00000000,?,00000000,?,00000400,00000400), ref: 00161A39
Part of subcall function 001619B4: RegCloseKey.ADVAPI32(?), ref: 00161A4A

lstrcatW.KERNEL32(00170F24,00000000), ref: 00161EC2
lstrcat.KERNEL32(00171024,001612C0), ref: 00161ED3
CreateThread.KERNEL32(00000000,00000000,00161DF0,00000000,00000000,00166004), ref: 00161EEB
lstrcatW.KERNEL32(00170F24,00000000), ref: 00161F10
lstrcat.KERNEL32(00171024,00161300), ref: 00161F21
CreateThread.KERNEL32(00000000,00000000,00161DF0,00000000,00000000,00166004), ref: 00161F39

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00164450, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 111

APIs

Part of subcall function 00164254: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00164275
Part of subcall function 00164254: GetFileSize.KERNEL32(00000000,00000000), ref: 00164285
Part of subcall function 00164254: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 001642A2
Part of subcall function 00164254: CloseHandle.KERNEL32(00000000), ref: 001642C1
Part of subcall function 00164254: wsprintfA.USER32(?,%02x,?,00000001), ref: 001642F8
Part of subcall function 00164254: lstrcat.KERNEL32(00000000,?), ref: 00164306

RtlMoveMemory.NTDLL(?,-00000015,00000015), ref: 001644EE
lstrlen.KERNEL32(?), ref: 0016450F
RtlComputeCrc32.NTDLL(00000000,?,00000000), ref: 0016451C

Part of subcall function 0016243C: VirtualAlloc.KERNEL32(?,?,00003000,00000040), ref: 0016246E
Part of subcall function 0016243C: VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 0016248B
Part of subcall function 0016243C: RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 0016249F
Part of subcall function 0016243C: RtlZeroMemory.NTDLL(?,?), ref: 001624E0
Part of subcall function 0016243C: RtlMoveMemory.NTDLL(?,?,?), ref: 001624F5
Part of subcall function 0016243C: LoadLibraryA.KERNEL32(?), ref: 0016251E
Part of subcall function 0016243C: GetProcAddress.KERNEL32(?,?), ref: 00162554
Part of subcall function 0016243C: GetProcAddress.KERNEL32(?,?), ref: 0016256B

Part of subcall function 00162644: lstrcmp.KERNEL32(?,?), ref: 00162688

Sleep.KERNEL32(00000064), ref: 00164570

Part of subcall function 001626B4: VirtualFree.KERNEL32(00000000,00000000,00008000,00164583), ref: 001626BC

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

Strings

Work, xrefs: 00164552

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00164354, Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 72

APIs

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

wsprintfA.USER32(00000000,%s%s%s%s%s%d%s%d,00161260,sel2,00161268,00000000,00161270,00000000,001612A0,00000000,00000001), ref: 001643AF

Part of subcall function 00164254: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00164275
Part of subcall function 00164254: GetFileSize.KERNEL32(00000000,00000000), ref: 00164285
Part of subcall function 00164254: ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 001642A2
Part of subcall function 00164254: CloseHandle.KERNEL32(00000000), ref: 001642C1
Part of subcall function 00164254: wsprintfA.USER32(?,%02x,?,00000001), ref: 001642F8
Part of subcall function 00164254: lstrcat.KERNEL32(00000000,?), ref: 00164306

wsprintfA.USER32(00000000,%s%s%s%s%s,00161150,001661CC,00000000,001612A8,00000000,00000001), ref: 001643F1

Part of subcall function 00163D6C: Sleep.KERNEL32(000007D0), ref: 00163DA5
Part of subcall function 00163D6C: lstrlen.KERNEL32(00000000), ref: 00163DCC
Part of subcall function 00163D6C: lstrlen.KERNEL32(00000000), ref: 00163E00
Part of subcall function 00163D6C: RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 00163E0A
Part of subcall function 00163D6C: atoi.NTDLL(-0000000C), ref: 00163E4B
Part of subcall function 00163D6C: MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00000000), ref: 00163EA8
Part of subcall function 00163D6C: RtlZeroMemory.NTDLL(00000000,000FA000), ref: 00163EC4
Part of subcall function 00163D6C: lstrcat.KERNEL32(00000000,-00000003), ref: 00163ED1
Part of subcall function 00163D6C: NtUnmapViewOfSection.NTDLL ref: 00163EDF
Part of subcall function 00163D6C: RtlMoveMemory.NTDLL(00000000,?,00000000), ref: 00163F12
Part of subcall function 00163D6C: DeleteFileW.KERNEL32(00000000), ref: 00163F1E
Part of subcall function 00163D6C: CreateFileW.KERNEL32(00000000,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00163F3C
Part of subcall function 00163D6C: WriteFile.KERNEL32(000000FF,00000000,00000000,?,00000000), ref: 00163F77
Part of subcall function 00163D6C: CloseHandle.KERNEL32(000000FF), ref: 00163F81
Part of subcall function 00163D6C: RtlZeroMemory.NTDLL(00172124,00001000,00000000), ref: 00163FCB
Part of subcall function 00163D6C: wsprintfA.USER32(00172124,%s%s%c,?,00161244,00000075), ref: 00163FEF
Part of subcall function 00163D6C: RtlZeroMemory.NTDLL(00172124,00001000,00000000), ref: 00164040
Part of subcall function 00163D6C: wsprintfA.USER32(00172124,%s%s,?,00161284), ref: 0016405A
Part of subcall function 00163D6C: CloseHandle.KERNEL32(00000000), ref: 001640AB
Part of subcall function 00163D6C: CloseHandle.KERNEL32(00000000), ref: 001640B7
Part of subcall function 00163D6C: DeleteFileW.KERNEL32(00000000), ref: 001640C3
Part of subcall function 00163D6C: DeleteFileW.KERNEL32(00000000), ref: 001640D7
Part of subcall function 00163D6C: DeleteFileW.KERNEL32(00000000), ref: 001640E3
Part of subcall function 00163D6C: RtlZeroMemory.NTDLL(00172124,00001000), ref: 001640F3
Part of subcall function 00163D6C: wsprintfA.USER32(00172124,%s%s,?,00161294), ref: 0016410D
Part of subcall function 00163D6C: ExitProcess.KERNEL32 ref: 0016412E
Part of subcall function 00163D6C: atoi.NTDLL(-00000003), ref: 0016413A
Part of subcall function 00163D6C: RtlZeroMemory.NTDLL(00172124,00001000,00000000), ref: 00164176
Part of subcall function 00163D6C: wsprintfA.USER32(00172124,%s%s%d,?,00161244,00000000), ref: 00164196
Part of subcall function 00163D6C: Sleep.KERNEL32(000003E8,00000000), ref: 001641D5

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

Strings

sel2, xrefs: 0016439E
%s%s%s%s%s%d%s%d, xrefs: 001643A9
%s%s%s%s%s, xrefs: 001643E6

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00161D5C, Relevance: 7.6, APIs: 5, Instructions: 61

APIs

RtlMoveMemory.NTDLL(?,?,00000003), ref: 00161D7C
atoi.NTDLL(?), ref: 00161D86
lstrlen.KERNEL32(?), ref: 00161D9C
RtlMoveMemory.NTDLL(?,?,00000003), ref: 00161DBD
atoi.NTDLL(?), ref: 00161DC7

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 0016192C, Relevance: 7.6, APIs: 5, Instructions: 50

APIs

RegOpenKeyA.ADVAPI32(80000001,001612B4), ref: 00161947

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

RegEnumKeyA.ADVAPI32(00000000,00000000,00000000,000000FF), ref: 0016196E
RegEnumKeyA.ADVAPI32(00000000,00000000,00000000,000000FF), ref: 0016198E
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,001637B7), ref: 00161995
RegCloseKey.ADVAPI32(00000000,?,?,?,00000000,00000000,001637B7), ref: 001619A5

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 00161930, Relevance: 7.6, APIs: 5, Instructions: 50

APIs

RegOpenKeyA.ADVAPI32(80000001,001612B4), ref: 00161947

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

RegEnumKeyA.ADVAPI32(00000000,00000000,00000000,000000FF), ref: 0016196E
RegEnumKeyA.ADVAPI32(00000000,00000000,00000000,000000FF), ref: 0016198E
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,001637B7), ref: 00161995
RegCloseKey.ADVAPI32(00000000,?,?,?,00000000,00000000,001637B7), ref: 001619A5

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Function 001619B4, Relevance: 6.1, APIs: 4, Instructions: 65

APIs

RegOpenKeyA.ADVAPI32(80000001,?,?), ref: 001619D4

Part of subcall function 00161A64: VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,?,001623F8,?,?,00000000,00170618,?,001615C5,00000100), ref: 00161A73

lstrcmpW.KERNEL32(?,00000000), ref: 00161A15
RegEnumValueW.ADVAPI32(?,00000000,00000000,00000400,00000000,?,00000000,?,00000400,00000400), ref: 00161A39
RegCloseKey.ADVAPI32(?), ref: 00161A4A

Part of subcall function 00161A80: VirtualFree.KERNEL32(00000000,00000000,00008000,?,00161D52,-00000003,-00000003,-00000008,00000000,?,00000000,00170618,?,001615F2,00000000,?), ref: 00161A8D

Memory Dump Source

Source File: 00000002.00000002.932922366.00160000.00000040.sdmp, Offset: 00160000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_160000_6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.jbxd

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Signature Overview

Networking:

Remote Access Functionality:

Data Obfuscation:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Language, Device and Operating System Detection:

Yara Overview

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Hooks - Code Manipulation Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: 6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe PID: 3244 Parent PID: 3472

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: 6307c172aeabf69da9cc136691268842eebff98b5aa884749b18f9de9209a0b7.exe PID: 3244 Parent PID: 3472

Execution Graph

Executed Functions

Function 0040100D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 92

Function 001633E7, Relevance: 3.1, APIs: 2, Instructions: 73

Function 0040113F, Relevance: 1.5, APIs: 1, Instructions: 19

Function 00401000, Relevance: 1.3, Strings: 1, Instructions: 84

Function 00164848, Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 121

Function 00164A00, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39

Function 0016339C, Relevance: 3.1, APIs: 2, Instructions: 102

Function 00161A64, Relevance: 1.3, APIs: 1, Instructions: 9

Function 00164838, Relevance: 1.3, APIs: 1, Instructions: 3

Non-executed Functions

Function 00163D6C, Relevance: 66.9, APIs: 30, Strings: 8, Instructions: 357

Function 00163588, Relevance: 59.8, APIs: 31, Strings: 3, Instructions: 326

Function 00161470, Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 307

Function 00162A28, Relevance: 52.8, APIs: 25, Strings: 5, Instructions: 311

Function 00163A14, Relevance: 35.3, APIs: 19, Strings: 1, Instructions: 251

Function 00162A26, Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 203

Function 001630B0, Relevance: 16.7, APIs: 11, Instructions: 158

Function 00161B96, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 48

Function 0016243C, Relevance: 12.2, APIs: 8, Instructions: 188

Function 001645FA, Relevance: 12.1, APIs: 8, Instructions: 55

Function 001620A8, Relevance: 9.1, APIs: 6, Instructions: 92

Function 00163268, Relevance: 9.0, APIs: 6, Instructions: 42

Function 00162087, Relevance: 7.6, APIs: 5, Instructions: 103

Function 00162958, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74

Function 00163586, Relevance: 59.8, APIs: 31, Strings: 3, Instructions: 322

Function 0016146E, Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 202

Function 001646EC, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 87

Function 001622AC, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 99