Analysis Report

Overview

General Information

Analysis ID:	89665
Start time:	10:01:34
Start date:	11/11/2015
Overall analysis duration:	0h 3m 38s
Report type:	full
Sample file name:	yauz.bat
Cookbook file name:	default.jbs
Analysis system description:	Windows 7 (Office 2003 SP1, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 41, Firefox 36)
Number of analysed new started processes analysed:	4
Number of new started drivers analysed:	1
Number of existing processes analysed:	1
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
HCA enabled:	true
EGA enabled:	true
HDC enabled:	false
HCA success:	true, ratio: 100%
EGA success:	true, ratio: 100%
HDC success:	false
Cookbook Comments:	Found application associated with file extension: .bat
Warnings:	Show All Exclude process from analysis (whitelisted): mscorsvw.exe, spsys.sys, WmiPrvSE.exe, sppsvc.exe Report size getting too big, too many NtQueryValueKey calls found.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	52	0 - 100	Report FP / FN

Analysis Advice

Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox

Signature Overview

Networking:

Urls found in memory or binary data

Show sources

Source: yauz.bat

String found in binary or memory: http://www.msn.com/?ocid=iehp

Contains functionality to download additional files from the internet

Show sources

Source: C:\yauz.bat

Code function: 0_2_00807983 Sleep,socket,connect,recv,htons,htons,htons,send,htons,recv,closesocket,

0_2_00807983

Found strings which match to known social media urls

Show sources

Source: yauz.bat	String found in binary or memory: Twitter equals www.twitter.com (Twitter)
Source: yauz.bat	String found in binary or memory: Twitter equals www.twitter.com (Twitter)
Source: yauz.bat	String found in binary or memory: hotmail equals www.hotmail.com (Hotmail)
Source: yauz.bat	String found in binary or memory: yahoo.com equals www.yahoo.com (Yahoo)

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic	TCP traffic: 192.168.1.12:49167 -> 129.81.102.160:1042
Source: global traffic	TCP traffic: 192.168.1.12:49171 -> 15.246.57.42:1042
Source: global traffic	TCP traffic: 192.168.1.12:49173 -> 166.77.111.50:1042
Source: global traffic	TCP traffic: 192.168.1.12:49174 -> 167.193.151.116:1042
Source: global traffic	TCP traffic: 192.168.1.12:49176 -> 16.126.194.5:1042
Source: global traffic	TCP traffic: 192.168.1.12:49179 -> 15.228.71.140:1042
Source: global traffic	TCP traffic: 192.168.1.12:49180 -> 67.64.125.225:1042
Source: global traffic	TCP traffic: 192.168.1.12:49184 -> 141.240.12.247:1042
Source: global traffic	TCP traffic: 192.168.1.12:49185 -> 16.102.50.60:1042
Source: global traffic	TCP traffic: 192.168.1.12:49186 -> 16.83.200.38:1042
Source: global traffic	TCP traffic: 192.168.1.12:49187 -> 15.238.20.130:1042
Source: global traffic	TCP traffic: 192.168.1.12:49189 -> 15.228.173.71:1042

Boot Survival:

Creates an autostart registry key

Show sources

Source: C:\yauz.bat	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Traybar
Source: C:\yauz.bat	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Traybar

Creates an autostart registry key pointing to binary in C:\Windows

Show sources

Source: C:\yauz.bat

Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Traybar

Remote Access Functionality:

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Show sources

Source: C:\yauz.bat	Code function: 0_2_00807D81 malloc,memset,htons,socket,socket,bind,closesocket,Sleep,htons,socket,bind,listen,CreateThread,CreateThread,malloc,memset,accept,Sleep,free,		0_2_00807D81
Source: C:\yauz.bat	Code function: 0_1_00807D81 malloc,memset,htons,socket,socket,bind,closesocket,Sleep,htons,socket,bind,listen,CreateThread,CreateThread,malloc,memset,accept,Sleep,free,		0_1_00807D81

Stealing of Sensitive Information:

Contains functionality to search for IE or Outlook window (often done to steal information)

Show sources

Source: C:\yauz.bat	Code function: 0_2_00802C72 FindWindowA,FindWindowA,FindWindowA,FindWindowA,RtlExitUserThread,		0_2_00802C72
Source: C:\yauz.bat	Code function: 0_1_00802C72 FindWindowA,FindWindowA,FindWindowA,FindWindowA,RtlExitUserThread,		0_1_00802C72

Persistence and Installation Behavior:

Drops PE files

Show sources

Source: C:\yauz.bat

File created: C:\Windows\lsass.exe

Drops PE files to the windows directory (C:\Windows)

Show sources

Source: C:\yauz.bat

File created: C:\Windows\lsass.exe

Data Obfuscation:

Sample is packed with UPX

Show sources

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Contains functionality to dynamically determine API calls

Show sources

Source: C:\yauz.bat

Code function: 0_2_00803108 GetModuleHandleA,LoadLibraryA,GetProcAddress,InternetGetConnectedState,

0_2_00803108

PE file contains an invalid checksum

Show sources

Source: lsass.exe.3304.dr	Static PE information: real checksum: 0x0 should be: 0xf3d5
Source: yauz.bat	Static PE information: real checksum: 0x0 should be: 0xf3d5

Uses code obfuscation techniques (call, push, ret)

Show sources

Source: C:\yauz.bat	Code function: 0_2_00807EE0 push eax; ret		0_2_00807F0E
Source: C:\yauz.bat	Code function: 0_1_00807EE0 push eax; ret		0_1_00807F0E

Spreading:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\yauz.bat	Code function: 0_2_00804D32 lstrcat,Sleep,lstrcpy,lstrcpy,CharLowerA,strstr,strstr,strstr,strstr,strstr,lstrcpy,lstrlen,lstrcat,lstrcat,memset,FindFirstFileA,FindNextFileA,lstrcpy,lstrlen,lstrcat,lstrcat,Sleep,FindClose,		0_2_00804D32
Source: C:\yauz.bat	Code function: 0_1_00804D32 lstrcat,Sleep,lstrcpy,lstrcpy,CharLowerA,strstr,strstr,strstr,strstr,strstr,lstrcpy,lstrlen,lstrcat,lstrcat,memset,FindFirstFileA,FindNextFileA,lstrcpy,lstrlen,lstrcat,lstrcat,Sleep,FindClose,		0_1_00804D32

System Summary:

Creates temporary files

Show sources

Source: C:\yauz.bat

File created: C:\Users\admin\AppData\Local\Temp\xevrnswx.txt

Reads software policies

Show sources

Source: C:\yauz.bat

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

PE file has section (not .text) which is very likely to contain packed code (zlib compression ratio < 0.011)

Show sources

Source: yauz.bat	Static PE information: Section: UPX1 ZLIB complexity 0.992410714286
Source: lsass.exe.3304.dr	Static PE information: Section: UPX1 ZLIB complexity 0.992410714286

Creates files inside the system directory

Show sources

Source: C:\yauz.bat

File created: C:\Windows\lsass.exe

Deletes Windows files

Show sources

Source: C:\yauz.bat

File deleted: C:\Windows\lsass.exe

PE file contains strange resources

Show sources

Source: yauz.bat	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: lsass.exe.3304.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample reads its own file content

Show sources

Source: C:\yauz.bat

File read: C:\yauz.bat

Drops files with a known system name (to hide its detection)

Show sources

Source: C:\yauz.bat	File created: C:\Windows\lsass.exe
Source: C:\yauz.bat	File created: C:\Windows\lsass.exe

HIPS / PFW / Operating System Protection Evasion:

May try to detect the Windows Explorer process (often used for injection)

Show sources

Source: yauz.bat	Binary or memory string: Shell_TrayWnd@
Source: yauz.bat	Binary or memory string: Progman
Source: yauz.bat	Binary or memory string: Program Manager
Source: yauz.bat	Binary or memory string: Shell_TrayWnd

Anti Debugging:

Contains functionality to dynamically determine API calls

Show sources

Source: C:\yauz.bat

Code function: 0_2_00803108 GetModuleHandleA,LoadLibraryA,GetProcAddress,InternetGetConnectedState,

0_2_00803108

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Show sources

Source: C:\yauz.bat

Code function: 0_2_008036E5 GetProcessHeap,GetProcessHeap,RtlAllocateHeap,socket,htons,select,memset,recv,htons,htons,htons,GetProcessHeap,RtlAllocateHeap,memset,htons,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,closesocket,GetProcessHeap,HeapFree,

0_2_008036E5

Malware Analysis System Evasion:

Contains functionality to enumerate / list files inside a directory

Show sources

Source: C:\yauz.bat	Code function: 0_2_00804D32 lstrcat,Sleep,lstrcpy,lstrcpy,CharLowerA,strstr,strstr,strstr,strstr,strstr,lstrcpy,lstrlen,lstrcat,lstrcat,memset,FindFirstFileA,FindNextFileA,lstrcpy,lstrlen,lstrcat,lstrcat,Sleep,FindClose,		0_2_00804D32
Source: C:\yauz.bat	Code function: 0_1_00804D32 lstrcat,Sleep,lstrcpy,lstrcpy,CharLowerA,strstr,strstr,strstr,strstr,strstr,lstrcpy,lstrlen,lstrcat,lstrcat,memset,FindFirstFileA,FindNextFileA,lstrcpy,lstrlen,lstrcat,lstrcat,Sleep,FindClose,		0_1_00804D32

Found decision node followed by non-executed suspicious APIs

Show sources

Source: C:\yauz.bat

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_0-2598

Found dropped PE file which has not been started or loaded

Show sources

Source: C:\yauz.bat

Dropped PE file which has not been started: C:\Windows\lsass.exe

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\yauz.bat TID: 3308

Thread sleep time: -118000ms >= -60000ms

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Show sources

Source: C:\yauz.bat

Code function: 0_2_00802DB3 lstrlen,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeZoneInformation,lstrcat,wsprintfA,

0_2_00802DB3

Contains functionality to query time zone information

Show sources

Source: C:\yauz.bat

Code function: 0_2_00802DB3 lstrlen,GetLocalTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeZoneInformation,lstrcat,wsprintfA,

0_2_00802DB3

Yara Overview

No Yara matches

Startup

system is w7

yauz.bat (PID: 3304 MD5: 6071A0CF7861302564BD4FC44396E7A4)

cleanup

Created / dropped Files

File Path	Type and Hashes
C:\Users\admin\AppData\Local\Temp\xevrnswx.txt	Type: data MD5: D4228B21FA41A546E3311884F65F7872 SHA: AD40A546C9875512C49EF5FFE1979D9601F623F5 SHA-256: 317D235AB244076C47F18A633CEEAC7F10FC001976B34A8D81F6C67CF80E55B5 SHA-512: 0C8AA52BC8ECEAD8F691B62829F1FE5D2DFA42AA8A6515A1DB0487EA4C802E45CFBB3F8668A3FEECC1D65C7C89A56BBA1418B978A3203A437E73F863420F1738
C:\Windows\lsass.exe	Type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed MD5: 6071A0CF7861302564BD4FC44396E7A4 SHA: D173820980584951B5739D67955CE453B4F39312 SHA-256: BF92618F847F4C9A8ED09A390030466EE9A48215618F9602130C52CD6529CAE6 SHA-512: 751CF7C773DCCB14A3D48E17219144B7012032E9A049C321B834B8B94F59C85D8F20E7E8BBF671D5E19BF8110E40E3E63DD2BB9218F75D9145ED7DB6F66317BB

Contacted Domains/Contacted IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

IP	Country	ASN	ASN Name
15.238.20.130	United States	10782	Hewlett-PackardCompany
15.228.71.140	United States	10782	Hewlett-PackardCompany
141.240.12.247	United States	18454	AugsburgCollege
15.246.57.42	United States	10782	Hewlett-PackardCompany
15.228.173.71	United States	10782	Hewlett-PackardCompany
16.102.50.60	United States	71	unknown
167.193.151.116	United States	2897	unknown
16.126.194.5	United States	71	unknown
129.81.102.160	United States	10349	TulaneUniversity
16.83.200.38	United States	71	unknown
67.64.125.225	United States	7018	unknown
166.77.111.50	United States	7256	unknown

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
TrID:	Win32 Executable (generic) a (10002005/4) 99.37% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	yauz.bat
File size:	22024
MD5:	6071a0cf7861302564bd4fc44396e7a4
SHA1:	d173820980584951b5739d67955ce453b4f39312
SHA256:	bf92618f847f4c9a8ed09a390030466ee9a48215618f9602130c52cd6529cae6
SHA512:	751cf7c773dccb14a3d48e17219144b7012032e9a049c321b834b8b94f59c85d8f20e7e8bbf671d5e19bf8110e40e3e63dd2bb9218f75d9145ed7db6f66317bb

File Icon

Static PE Info

General
Entrypoint:	0x80b4a0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x800000
Subsystem:	windows gui 40
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x0 [Thu Jan 1 00:00:00 1970 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:
Subsystem Version Minor:
Import Hash:	5d02f6de12eb07fb22fe87e05e50d6a0

Entrypoint Preview

Instruction
pushad
mov esi, 00807000h
lea edi, dword ptr [esi-00006000h]
push edi
or ebp, FFFFFFFFh
jmp 00007F9D9CE8EEE2h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F9D9CE8EED9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F9D9CE8EEBFh
mov eax, 00000001h
add ebx, ebx
jne 00007F9D9CE8EED9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F9D9CE8EEC1h
jne 00007F9D9CE8EEDBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F9D9CE8EEB6h
xor ecx, ecx
sub eax, 03h
jc 00007F9D9CE8EEDFh
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F9D9CE8EF46h
mov ebp, eax
add ebx, ebx
jne 00007F9D9CE8EED9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 00007F9D9CE8EED9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jne 00007F9D9CE8EEF2h
inc ecx
add ebx, ebx
jne 00007F9D9CE8EED9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F9D9CE8EEC1h
jne 00007F9D9CE8EEDBh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F9D9CE8EEB6h
add ecx, 02h
cmp ebp, FFFFF300h
adc ecx, 01h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F9D9CE8EEE1h
mov al, byte ptr [edx]
inc edx
mov byte ptr [edi], al
inc edi
dec ecx
jne 00007F9D9CE8EEC9h
jmp 00007F9D9CE8EE38h
nop
mov eax, dword ptr [edx]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc514	0x130	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x514	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Xored PE	ZLIB Complexity	File Type	Characteristics
UPX0	0x1000	0x6000	0x0	0.0	False	0	empty	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
UPX1	0x7000	0x5000	0x4600	7.89790234125	False	0.992410714286	data	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x1000	0x800	2.64956945519	False	0.2783203125	data	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	Xored PE
RT_ICON	0xc0d8	0x2e8	data	English	United States	False
RT_ICON	0xc3c4	0x128	GLS_BINARY_LSB_FIRST	English	United States	False
RT_GROUP_ICON	0xc4f0	0x22	MS Windows icon resource - 2 icons, 32x32, 16-colors	English	United States	False

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, ExitProcess
ADVAPI32.dll	RegCloseKey
MSVCRT.dll	time
USER32.dll	wsprintfA
WS2_32.dll	gethostname

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 11, 2015 10:02:36.522761106 CET	49167	1042	192.168.1.12	129.81.102.160
Nov 11, 2015 10:02:36.522792101 CET	1042	49167	129.81.102.160	192.168.1.12
Nov 11, 2015 10:02:36.522880077 CET	49167	1042	192.168.1.12	129.81.102.160
Nov 11, 2015 10:02:43.616199970 CET	1042	49167	129.81.102.160	192.168.1.12
Nov 11, 2015 10:02:43.616286993 CET	49167	1042	192.168.1.12	129.81.102.160
Nov 11, 2015 10:02:43.616370916 CET	49167	1042	192.168.1.12	129.81.102.160
Nov 11, 2015 10:02:43.616391897 CET	1042	49167	129.81.102.160	192.168.1.12
Nov 11, 2015 10:03:06.632709026 CET	49171	1042	192.168.1.12	15.246.57.42
Nov 11, 2015 10:03:06.632744074 CET	1042	49171	15.246.57.42	192.168.1.12
Nov 11, 2015 10:03:06.632796049 CET	49171	1042	192.168.1.12	15.246.57.42
Nov 11, 2015 10:03:13.730776072 CET	1042	49171	15.246.57.42	192.168.1.12
Nov 11, 2015 10:03:13.730999947 CET	49171	1042	192.168.1.12	15.246.57.42
Nov 11, 2015 10:03:13.731173992 CET	49171	1042	192.168.1.12	15.246.57.42
Nov 11, 2015 10:03:13.731205940 CET	1042	49171	15.246.57.42	192.168.1.12
Nov 11, 2015 10:03:13.733666897 CET	49173	1042	192.168.1.12	166.77.111.50
Nov 11, 2015 10:03:13.733711004 CET	1042	49173	166.77.111.50	192.168.1.12
Nov 11, 2015 10:03:13.733896017 CET	49173	1042	192.168.1.12	166.77.111.50
Nov 11, 2015 10:03:20.818639994 CET	1042	49173	166.77.111.50	192.168.1.12
Nov 11, 2015 10:03:20.818861008 CET	49173	1042	192.168.1.12	166.77.111.50
Nov 11, 2015 10:03:20.819017887 CET	49173	1042	192.168.1.12	166.77.111.50
Nov 11, 2015 10:03:20.819047928 CET	1042	49173	166.77.111.50	192.168.1.12
Nov 11, 2015 10:03:20.819505930 CET	49174	1042	192.168.1.12	167.193.151.116
Nov 11, 2015 10:03:20.819530964 CET	1042	49174	167.193.151.116	192.168.1.12
Nov 11, 2015 10:03:20.819674015 CET	49174	1042	192.168.1.12	167.193.151.116
Nov 11, 2015 10:03:27.890386105 CET	1042	49174	167.193.151.116	192.168.1.12
Nov 11, 2015 10:03:27.890486002 CET	49174	1042	192.168.1.12	167.193.151.116
Nov 11, 2015 10:03:27.890561104 CET	49174	1042	192.168.1.12	167.193.151.116
Nov 11, 2015 10:03:27.890579939 CET	1042	49174	167.193.151.116	192.168.1.12
Nov 11, 2015 10:03:27.891585112 CET	49176	1042	192.168.1.12	16.126.194.5
Nov 11, 2015 10:03:27.891601086 CET	1042	49176	16.126.194.5	192.168.1.12
Nov 11, 2015 10:03:27.891670942 CET	49176	1042	192.168.1.12	16.126.194.5
Nov 11, 2015 10:03:34.995457888 CET	1042	49176	16.126.194.5	192.168.1.12
Nov 11, 2015 10:03:34.995536089 CET	49176	1042	192.168.1.12	16.126.194.5
Nov 11, 2015 10:03:35.005238056 CET	49176	1042	192.168.1.12	16.126.194.5
Nov 11, 2015 10:03:35.005254984 CET	1042	49176	16.126.194.5	192.168.1.12
Nov 11, 2015 10:03:35.006877899 CET	49179	1042	192.168.1.12	15.228.71.140
Nov 11, 2015 10:03:35.006895065 CET	1042	49179	15.228.71.140	192.168.1.12
Nov 11, 2015 10:03:35.006946087 CET	49179	1042	192.168.1.12	15.228.71.140
Nov 11, 2015 10:03:42.075124979 CET	1042	49179	15.228.71.140	192.168.1.12
Nov 11, 2015 10:03:42.075191021 CET	49179	1042	192.168.1.12	15.228.71.140
Nov 11, 2015 10:03:42.075270891 CET	49179	1042	192.168.1.12	15.228.71.140
Nov 11, 2015 10:03:42.075287104 CET	1042	49179	15.228.71.140	192.168.1.12
Nov 11, 2015 10:03:42.076817036 CET	49180	1042	192.168.1.12	67.64.125.225
Nov 11, 2015 10:03:42.076850891 CET	1042	49180	67.64.125.225	192.168.1.12
Nov 11, 2015 10:03:42.076909065 CET	49180	1042	192.168.1.12	67.64.125.225
Nov 11, 2015 10:03:49.148072004 CET	1042	49180	67.64.125.225	192.168.1.12
Nov 11, 2015 10:03:49.148324966 CET	49180	1042	192.168.1.12	67.64.125.225
Nov 11, 2015 10:03:49.154516935 CET	49180	1042	192.168.1.12	67.64.125.225
Nov 11, 2015 10:03:49.154555082 CET	1042	49180	67.64.125.225	192.168.1.12
Nov 11, 2015 10:04:10.927279949 CET	49184	1042	192.168.1.12	141.240.12.247
Nov 11, 2015 10:04:10.927323103 CET	1042	49184	141.240.12.247	192.168.1.12
Nov 11, 2015 10:04:10.927367926 CET	49184	1042	192.168.1.12	141.240.12.247
Nov 11, 2015 10:04:18.007769108 CET	1042	49184	141.240.12.247	192.168.1.12
Nov 11, 2015 10:04:18.007874966 CET	49184	1042	192.168.1.12	141.240.12.247
Nov 11, 2015 10:04:18.007952929 CET	49184	1042	192.168.1.12	141.240.12.247
Nov 11, 2015 10:04:18.007967949 CET	1042	49184	141.240.12.247	192.168.1.12
Nov 11, 2015 10:04:18.008326054 CET	49185	1042	192.168.1.12	16.102.50.60
Nov 11, 2015 10:04:18.008346081 CET	1042	49185	16.102.50.60	192.168.1.12
Nov 11, 2015 10:04:18.008434057 CET	49185	1042	192.168.1.12	16.102.50.60
Nov 11, 2015 10:04:25.065514088 CET	1042	49185	16.102.50.60	192.168.1.12
Nov 11, 2015 10:04:25.065643072 CET	49185	1042	192.168.1.12	16.102.50.60
Nov 11, 2015 10:04:25.065741062 CET	49185	1042	192.168.1.12	16.102.50.60
Nov 11, 2015 10:04:25.065761089 CET	1042	49185	16.102.50.60	192.168.1.12
Nov 11, 2015 10:04:25.066190004 CET	49186	1042	192.168.1.12	16.83.200.38
Nov 11, 2015 10:04:25.066216946 CET	1042	49186	16.83.200.38	192.168.1.12
Nov 11, 2015 10:04:25.066308022 CET	49186	1042	192.168.1.12	16.83.200.38
Nov 11, 2015 10:04:32.120498896 CET	1042	49186	16.83.200.38	192.168.1.12
Nov 11, 2015 10:04:32.120680094 CET	49186	1042	192.168.1.12	16.83.200.38
Nov 11, 2015 10:04:32.120836973 CET	49186	1042	192.168.1.12	16.83.200.38
Nov 11, 2015 10:04:32.120867014 CET	1042	49186	16.83.200.38	192.168.1.12
Nov 11, 2015 10:04:39.113207102 CET	49187	1042	192.168.1.12	15.238.20.130
Nov 11, 2015 10:04:39.113261938 CET	1042	49187	15.238.20.130	192.168.1.12
Nov 11, 2015 10:04:39.113383055 CET	49187	1042	192.168.1.12	15.238.20.130
Nov 11, 2015 10:04:46.178421974 CET	1042	49187	15.238.20.130	192.168.1.12
Nov 11, 2015 10:04:46.178494930 CET	49187	1042	192.168.1.12	15.238.20.130
Nov 11, 2015 10:04:46.178570986 CET	49187	1042	192.168.1.12	15.238.20.130
Nov 11, 2015 10:04:46.178586960 CET	1042	49187	15.238.20.130	192.168.1.12
Nov 11, 2015 10:04:46.179630041 CET	49189	1042	192.168.1.12	15.228.173.71
Nov 11, 2015 10:04:46.179647923 CET	1042	49189	15.228.173.71	192.168.1.12
Nov 11, 2015 10:04:46.179697990 CET	49189	1042	192.168.1.12	15.228.173.71
Nov 11, 2015 10:04:53.242748022 CET	1042	49189	15.228.173.71	192.168.1.12
Nov 11, 2015 10:04:53.242872953 CET	49189	1042	192.168.1.12	15.228.173.71
Nov 11, 2015 10:04:53.242935896 CET	49189	1042	192.168.1.12	15.228.173.71
Nov 11, 2015 10:04:53.242949963 CET	1042	49189	15.228.173.71	192.168.1.12

Hooks - Code Manipulation Behavior

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

System Behavior

Analysis Process: yauz.bat PID: 3304 Parent PID: 3080

General

Start time:	10:02:35
Start date:	11/11/2015
Path:	C:\yauz.bat
Wow64 process (32bit):	false
Commandline:	unknown
Imagebase:	0x800000
File size:	22024 bytes
MD5 hash:	6071A0CF7861302564BD4FC44396E7A4

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: yauz.bat PID: 3304 Parent PID: 3080

Execution Graph

Execution Coverage:	19.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	11%
Total number of Nodes:	711
Total number of Limit Nodes:	20

Executed Functions

Function 00804D32, Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 163

APIs

Sleep.KERNEL32(00000800,7703A739,00000184), ref: 00804D5C
lstrcpy.KERNEL32(?,?), ref: 00804D79
CharLowerA.USER32(?), ref: 00804D82
strstr.MSVCRT ref: 00804D9A
strstr.MSVCRT ref: 00804DAE

Part of subcall function 00803352: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00803369

lstrcpy.KERNEL32(?,?), ref: 00804DED
lstrlen.KERNEL32(?), ref: 00804DFD
lstrcat.KERNEL32(?,00801360), ref: 00804E15
lstrcat.KERNEL32(?,*.*), ref: 00804E27
memset.MSVCRT(?,00000000,00000140), ref: 00804E3B
FindFirstFileA.KERNELBASE(?,00000010), ref: 00804E5B
FindNextFileA.KERNELBASE(00000000,?), ref: 00804E7C
lstrcpy.KERNEL32(?,?), ref: 00804EB6
lstrlen.KERNEL32(?), ref: 00804EBF
lstrcat.KERNEL32(?,00801360), ref: 00804ED7
lstrcat.KERNEL32(?,0000002E), ref: 00804EEB
Sleep.KERNELBASE(0000004B), ref: 00804EFC

Part of subcall function 00804D32: strstr.MSVCRT ref: 00804DC2
Part of subcall function 00804D32: strstr.MSVCRT ref: 00804DD6

Part of subcall function 00804BB6: lstrcpyn.KERNEL32(?,00000070,0000000F,?,?,00804F2C,?), ref: 00804BFE
Part of subcall function 00804BB6: CharLowerA.USER32(?), ref: 00804C08
Part of subcall function 00804BB6: Sleep.KERNEL32(00000800,?,7703A6C7,?,?,00804F2C,?), ref: 00804D02

FindClose.KERNELBASE(00000000), ref: 00804F38

Strings

shar, xrefs: 00804D94
ftproot, xrefs: 00804DBC
download, xrefs: 00804DA8
*.*, xrefs: 00804E21
incoming, xrefs: 00804DD0
., xrefs: 00804E8A
., xrefs: 00804E9C

Memory Dump Source

Source File: 00000000.00000002.499564941.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.499560948.00800000.00000002.sdmp
Associated: 00000000.00000002.499569083.0080B000.00000080.sdmp
Associated: 00000000.00000002.499573002.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_yauz.jbxd

Function 00807D81, Relevance: 24.1, APIs: 16, Instructions: 101

APIs

malloc.MSVCRT(0000002C,?,?,?,?,?,00807EB1), ref: 00807D88
memset.MSVCRT(00000000,00000000,0000002C,?,?,?,?,?,00807EB1), ref: 00807D9B

Part of subcall function 008071E7: memset.MSVCRT(?,00000000,00000100,?,00000000), ref: 00807202
Part of subcall function 008071E7: gethostname.WS2_32(?,00000100), ref: 00807212
Part of subcall function 008071E7: malloc.MSVCRT(?,?,?,?,00000000,00000100,?,?,00000000), ref: 0080726D
Part of subcall function 008071E7: memset.MSVCRT(00000000,00000000,?), ref: 0080728D
Part of subcall function 008071E7: GetTempPathA.KERNEL32(00000100,00000000), ref: 00807297
Part of subcall function 008071E7: strlen.MSVCRT(00000000), ref: 0080729E
Part of subcall function 008071E7: _mbscat.MSVCRT ref: 008072BA
Part of subcall function 008071E7: _mbscpy.MSVCRT ref: 0080732D

Part of subcall function 00807D19: gethostname.WS2_32(?,00000100), ref: 00807D2E
Part of subcall function 00807D19: gethostbyname.WS2_32(?), ref: 00807D3B

Part of subcall function 00807C77: GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000), ref: 00807C91
Part of subcall function 00807C77: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00807CAE
Part of subcall function 00807C77: CloseHandle.KERNEL32(00000000), ref: 00807CC7
Part of subcall function 00807C77: SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00807CD4
Part of subcall function 00807C77: ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 00807D06
Part of subcall function 00807C77: CloseHandle.KERNEL32(00000000), ref: 00807D0E

Part of subcall function 00807400: fopen.MSVCRT(?,w,00000000,?,?,?,00807DBA,00000000,00000000,00000000,00000000,00000000,0000002C), ref: 0080741A
Part of subcall function 00807400: fread.MSVCRT ref: 00807438
Part of subcall function 00807400: htonl.WS2_32(00000000), ref: 00807440
Part of subcall function 00807400: fread.MSVCRT ref: 0080745E
Part of subcall function 00807400: htonl.WS2_32(F9138C5D), ref: 00807473
Part of subcall function 00807400: fclose.MSVCRT(00000000), ref: 00807492

Part of subcall function 008074A2: fopen.MSVCRT(?,u,?,0000000A,0000000A,00000001,00807B77,?,?,?,?,?,00807B8A,00000000), ref: 008074B8
Part of subcall function 008074A2: htonl.WS2_32(504F6C30), ref: 008074D4
Part of subcall function 008074A2: fwrite.MSVCRT ref: 008074EA
Part of subcall function 008074A2: htonl.WS2_32(F9138C5D), ref: 008074FE
Part of subcall function 008074A2: fwrite.MSVCRT ref: 00807517
Part of subcall function 008074A2: fclose.MSVCRT(00000000,?,?,?,?,00807B8A,00000000), ref: 0080752A
Part of subcall function 008074A2: time.MSVCRT(?,0000000A,00000001,00807B77,?,?,?,?,?,00807B8A,00000000), ref: 00807537

htons.WS2_32(00000412), ref: 00807DD7
socket.WS2_32(00000002,00000001,00000006), ref: 00807DE9
closesocket.WS2_32(?), ref: 00807DF6
Sleep.KERNEL32(000003E8), ref: 00807E01
htons.WS2_32(00000412), ref: 00807E15
socket.WS2_32(00000002,00000001,00000006), ref: 00807E21
bind.WS2_32(00000000,00000000,00000010), ref: 00807E2A
listen.WS2_32(?,7FFFFFFF), ref: 00807E38
CreateThread.KERNEL32(00000000,00000000,Function_00007B7A,00000000,00000000,?), ref: 00807E54
malloc.MSVCRT(0000001C), ref: 00807E58
memset.MSVCRT(00000000,00000000,0000001C), ref: 00807E64
accept.WS2_32(?,00000008,00000018), ref: 00807E7F
Sleep.KERNEL32(00000032), ref: 00807E8E
free.MSVCRT ref: 00807E95

Memory Dump Source

Source File: 00000000.00000002.499564941.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.499560948.00800000.00000002.sdmp
Associated: 00000000.00000002.499569083.0080B000.00000080.sdmp
Associated: 00000000.00000002.499573002.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_yauz.jbxd

Function 00807983, Relevance: 13.6, APIs: 9, Instructions: 101

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 00807996
connect.WS2_32(00000000,00000000,00000010), ref: 008079B3
recv.WS2_32(00000000,00000000,00000002,00000000), ref: 008079C8
htons.WS2_32(00000000), ref: 008079DF
htons.WS2_32(00000000), ref: 008079EC
send.WS2_32(00000000,?,00000002,00000000), ref: 008079FD
htons.WS2_32(?), ref: 00807A06
recv.WS2_32(?,?,00000001,00000000), ref: 00807A27
closesocket.WS2_32(?), ref: 00807A6E

Memory Dump Source

Source File: 00000000.00000002.499564941.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.499560948.00800000.00000002.sdmp
Associated: 00000000.00000002.499569083.0080B000.00000080.sdmp
Associated: 00000000.00000002.499573002.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_yauz.jbxd

Function 00802C72, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23

APIs

FindWindowA.USER32(rctrl_renwnd32,00000000), ref: 00802C80

Part of subcall function 00802C46: PostMessageA.USER32(?,00000012,00000000,00000000), ref: 00802C5E
Part of subcall function 00802C46: PostMessageA.USER32(?,00000010,00000000,00000000), ref: 00802C65
Part of subcall function 00802C46: PostMessageA.USER32(?,00000002,00000000,00000000), ref: 00802C6C

FindWindowA.USER32(ATH_Note,00000000), ref: 00802C90
FindWindowA.USER32(IEFrame,00000000), ref: 00802CA0
RtlExitUserThread.NTDLL(00000000), ref: 00802CAB

Strings

IEFrame, xrefs: 00802C9B
rctrl_renwnd32, xrefs: 00802C7B
ATH_Note, xrefs: 00802C8B

Memory Dump Source

Source File: 00000000.00000002.499564941.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.499560948.00800000.00000002.sdmp
Associated: 00000000.00000002.499569083.0080B000.00000080.sdmp
Associated: 00000000.00000002.499573002.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_yauz.jbxd

Function 00803108, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43

APIs

GetModuleHandleA.KERNEL32(?), ref: 00803142
LoadLibraryA.KERNEL32(wininet.dll), ref: 00803150
GetProcAddress.KERNEL32(00000000,InternetGetConnectedState), ref: 00803160
InternetGetConnectedState.WININET(?,00000000), ref: 00803175

Strings

InternetGetConnectedState, xrefs: 0080315A
wininet.dll, xrefs: 0080314C, 0080314F

Memory Dump Source

Source File: 00000000.00000002.499564941.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.499560948.00800000.00000002.sdmp
Associated: 00000000.00000002.499569083.0080B000.00000080.sdmp
Associated: 00000000.00000002.499573002.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_yauz.jbxd

Function 00804A7D, Relevance: 78.8, APIs: 4, Strings: 41, Instructions: 84

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?,7703C326), ref: 00804B43
memset.MSVCRT(?,00000000,00000100), ref: 00804B5A
RegQueryValueExA.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 00804B7A
RegCloseKey.KERNEL32(?), ref: 00804B83

Part of subcall function 0080496F: CreateFileA.KERNEL32(00000020,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00804991
Part of subcall function 0080496F: GetFileSize.KERNEL32(00000000,00000000), ref: 008049AF
Part of subcall function 0080496F: CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 008049BF
Part of subcall function 0080496F: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 008049E0
Part of subcall function 0080496F: memset.MSVCRT(?,00000000,00000080), ref: 00804A0E
Part of subcall function 0080496F: UnmapViewOfFile.KERNEL32(00000000), ref: 00804A51
Part of subcall function 0080496F: CloseHandle.KERNEL32(?), ref: 00804A5A
Part of subcall function 0080496F: CloseHandle.KERNEL32(?), ref: 00804A64

Strings

F, xrefs: 00804B1C
a, xrefs: 00804B10
l, xrefs: 00804B24
, xrefs: 00804B2C
e, xrefs: 00804B28
a, xrefs: 00804AB0
f, xrefs: 00804AA4
4, xrefs: 00804B04
\, xrefs: 00804ABC
s, xrefs: 00804AD4
B, xrefs: 00804B00
o, xrefs: 00804AD0
f, xrefs: 00804ADC
i, xrefs: 00804AC4
\, xrefs: 00804AF4
e, xrefs: 00804AB8
, xrefs: 00804B18
c, xrefs: 00804AC8
M, xrefs: 00804AC0
A, xrefs: 00804AFC
\, xrefs: 00804B08
A, xrefs: 00804AEC
W, xrefs: 00804AE8
B, xrefs: 00804AF0
S, xrefs: 00804A9C
t, xrefs: 00804AA8
t, xrefs: 00804AE0
W, xrefs: 00804B0C
r, xrefs: 00804ACC
e, xrefs: 00804B3C
r, xrefs: 00804AB4
\, xrefs: 00804AE4
W, xrefs: 00804AF8
o, xrefs: 00804AA0
m, xrefs: 00804B38
w, xrefs: 00804AAC
b, xrefs: 00804B14
o, xrefs: 00804AD8
a, xrefs: 00804B34
i, xrefs: 00804B20
N, xrefs: 00804B30

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 0080299E, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 108

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,?), ref: 008029E0
lstrcpy.KERNEL32(s.exe,?), ref: 008029FD
GetWindowsDirectoryA.KERNEL32(?,00000118,?,00000000,?), ref: 00802A19
GetTempPathA.KERNEL32(00000118,?), ref: 00802A27
lstrlen.KERNEL32(?,?,00000000,?), ref: 00802A40
lstrcat.KERNEL32(?,00801360), ref: 00802A5F
lstrcat.KERNEL32(?,lsass.exe), ref: 00802A6C
SetFileAttributesA.KERNELBASE(?,00000020,?,00000000,?), ref: 00802A77
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00802A94
CloseHandle.KERNEL32(00000000), ref: 00802AA4
DeleteFileA.KERNELBASE(?,?,00000000,?), ref: 00802AB1
CopyFileA.KERNEL32(?,?,00000000), ref: 00802AC6
GetFileAttributesA.KERNEL32(?,?,00000000,?), ref: 00802AD7
lstrcpy.KERNEL32(?,?), ref: 00802AFB

Strings

s.exe, xrefs: 008029E6, 008029F9
lsass.exe, xrefs: 00802A61, 00802A64

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00804F46, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 108

APIs

memset.MSVCRT(?,00000000,00000184,?,7703C326,7703C326), ref: 00805009
GetWindowsDirectoryA.KERNEL32(?,00000184,?,7703C326,7703C326), ref: 0080501E
GetEnvironmentVariableA.KERNEL32(USERPROFILE,?,00000184,?,7703C326,7703C326), ref: 0080502B
lstrlen.KERNEL32(?,?,7703C326,7703C326), ref: 00805040
lstrcat.KERNEL32(?,00801360), ref: 0080505F
lstrcat.KERNEL32(?,Local Settings), ref: 00805072
lstrcat.KERNEL32(?,00801360), ref: 00805080
lstrcat.KERNEL32(?,Temporary Internet Files), ref: 0080508D

Part of subcall function 00804D32: Sleep.KERNEL32(00000800,7703A739,00000184), ref: 00804D5C
Part of subcall function 00804D32: lstrcpy.KERNEL32(?,?), ref: 00804D79
Part of subcall function 00804D32: CharLowerA.USER32(?), ref: 00804D82
Part of subcall function 00804D32: strstr.MSVCRT ref: 00804D9A
Part of subcall function 00804D32: strstr.MSVCRT ref: 00804DAE
Part of subcall function 00804D32: strstr.MSVCRT ref: 00804DC2
Part of subcall function 00804D32: strstr.MSVCRT ref: 00804DD6
Part of subcall function 00804D32: lstrcpy.KERNEL32(?,?), ref: 00804DED
Part of subcall function 00804D32: lstrlen.KERNEL32(?), ref: 00804DFD
Part of subcall function 00804D32: lstrcat.KERNEL32(?,00801360), ref: 00804E15
Part of subcall function 00804D32: lstrcat.KERNEL32(?,*.*), ref: 00804E27
Part of subcall function 00804D32: memset.MSVCRT(?,00000000,00000140), ref: 00804E3B
Part of subcall function 00804D32: FindFirstFileA.KERNELBASE(?,00000010), ref: 00804E5B
Part of subcall function 00804D32: FindNextFileA.KERNELBASE(00000000,?), ref: 00804E7C
Part of subcall function 00804D32: lstrcpy.KERNEL32(?,?), ref: 00804EB6
Part of subcall function 00804D32: lstrlen.KERNEL32(?), ref: 00804EBF
Part of subcall function 00804D32: lstrcat.KERNEL32(?,00801360), ref: 00804ED7
Part of subcall function 00804D32: lstrcat.KERNEL32(?,0000002E), ref: 00804EEB
Part of subcall function 00804D32: Sleep.KERNELBASE(0000004B), ref: 00804EFC
Part of subcall function 00804D32: FindClose.KERNELBASE(00000000), ref: 00804F38

Strings

Temporary Internet Files, xrefs: 00805082, 00805085
USERPROFILE, xrefs: 00805026
Local Settings, xrefs: 00805067, 0080506A

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 008071E7, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132

APIs

memset.MSVCRT(?,00000000,00000100,?,00000000), ref: 00807202
gethostname.WS2_32(?,00000100), ref: 00807212
malloc.MSVCRT(?,?,?,?,00000000,00000100,?,?,00000000), ref: 0080726D
memset.MSVCRT(00000000,00000000,?), ref: 0080728D
GetTempPathA.KERNEL32(00000100,00000000), ref: 00807297
strlen.MSVCRT(00000000), ref: 0080729E
_mbscat.MSVCRT ref: 008072BA
_mbscpy.MSVCRT ref: 0080732D

Strings

.txt, xrefs: 00807327

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00802B02, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 103

APIs

RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020006,?,?,00000000,?), ref: 00802BFD
RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00020006,?,?,00000000,?), ref: 00802C12
lstrlen.KERNEL32(bar,?,00000000,?), ref: 00802C1F
RegSetValueExA.KERNEL32(?,Traybar,00000000,00000001,bar,00000001,?,00000000,?), ref: 00802C32
RegCloseKey.KERNEL32(?,?,00000000,?), ref: 00802C3B

Strings

Traybar, xrefs: 00802C2A, 00802C2E
bar, xrefs: 00802C18, 00802C1E, 00802C27
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00802C08, 00802C0C

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 008074A2, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 62

APIs

Part of subcall function 008073E8: Sleep.KERNEL32(00000005,00807BDC), ref: 008073EC

fopen.MSVCRT(?,u,?,0000000A,0000000A,00000001,00807B77,?,?,?,?,?,00807B8A,00000000), ref: 008074B8
htonl.WS2_32(504F6C30), ref: 008074D4
fwrite.MSVCRT ref: 008074EA
htonl.WS2_32(F9138C5D), ref: 008074FE
fwrite.MSVCRT ref: 00807517
fclose.MSVCRT(00000000,?,?,?,?,00807B8A,00000000), ref: 0080752A
time.MSVCRT(?,0000000A,00000001,00807B77,?,?,?,?,?,00807B8A,00000000), ref: 00807537

Strings

u, xrefs: 008074B0

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00807400, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 60

APIs

Part of subcall function 008073E8: Sleep.KERNEL32(00000005,00807BDC), ref: 008073EC

fopen.MSVCRT(?,w,00000000,?,?,?,00807DBA,00000000,00000000,00000000,00000000,00000000,0000002C), ref: 0080741A
fread.MSVCRT ref: 00807438
htonl.WS2_32(00000000), ref: 00807440
fread.MSVCRT ref: 0080745E
htonl.WS2_32(F9138C5D), ref: 00807473

Part of subcall function 0080733B: htonl.WS2_32(?), ref: 00807341
Part of subcall function 0080733B: realloc.MSVCRT ref: 0080738B
Part of subcall function 0080733B: malloc.MSVCRT(00000100,00000000), ref: 0080739A

fclose.MSVCRT(00000000), ref: 00807492

Strings

0lOP, xrefs: 00807446
w, xrefs: 00807412

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 0080317F, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 93

APIs

SetFilePointer.KERNELBASE(?,0000003C,00000000,00000000,?,?,00000000), ref: 00803197
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 008031B0
SetFilePointer.KERNELBASE(?,?,00000000,00000000,?,?,00000000), ref: 008031C4
ReadFile.KERNEL32(?,?,00000016,00000004,00000000), ref: 008031DD
SetFilePointer.KERNELBASE(?,?,00000000,00000000,?,?,00000000), ref: 0080321A
ReadFile.KERNEL32(?,?,00000028,00000500,00000000), ref: 00803238

Strings

(, xrefs: 0080323A

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00802CB2, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76

APIs

Part of subcall function 00802790: RegOpenKeyExA.KERNEL32(00000049,Software\Microsoft\Windows\CurrentVersion\POSIX,00000000,00020019,?,?,?,?), ref: 0080287F
Part of subcall function 00802790: RegCreateKeyExA.KERNEL32(00000002,00000053,00000000,00000000,00000000,00020006,00000000,?,?,?,?,?), ref: 008028BA
Part of subcall function 00802790: RegCloseKey.KERNEL32(?,?,?,?), ref: 008028C7
Part of subcall function 00802790: RegCloseKey.ADVAPI32(?,?,?,?), ref: 008028DE

GetFileAttributesA.KERNEL32(?), ref: 00802CC7
Sleep.KERNEL32(000001F4), ref: 00802D60

Part of subcall function 008028E6: memset.MSVCRT(?,00000000,00000100,00000000), ref: 008028FF
Part of subcall function 008028E6: gethostname.WS2_32(?,00000100), ref: 0080290F
Part of subcall function 008028E6: memset.MSVCRT(?,00000000,00000100,?,?,?,?,00000100,?,?,?,00000000), ref: 00802946
Part of subcall function 008028E6: CreateMutexA.KERNEL32(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00802986
Part of subcall function 008028E6: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0080298C

Part of subcall function 0080299E: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,?), ref: 008029E0
Part of subcall function 0080299E: lstrcpy.KERNEL32(s.exe,?), ref: 008029FD
Part of subcall function 0080299E: GetWindowsDirectoryA.KERNEL32(?,00000118,?,00000000,?), ref: 00802A19
Part of subcall function 0080299E: GetTempPathA.KERNEL32(00000118,?), ref: 00802A27
Part of subcall function 0080299E: lstrlen.KERNEL32(?,?,00000000,?), ref: 00802A40
Part of subcall function 0080299E: lstrcat.KERNEL32(?,00801360), ref: 00802A5F
Part of subcall function 0080299E: lstrcat.KERNEL32(?,lsass.exe), ref: 00802A6C
Part of subcall function 0080299E: SetFileAttributesA.KERNELBASE(?,00000020,?,00000000,?), ref: 00802A77
Part of subcall function 0080299E: CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00802A94
Part of subcall function 0080299E: CloseHandle.KERNEL32(00000000), ref: 00802AA4
Part of subcall function 0080299E: DeleteFileA.KERNELBASE(?,?,00000000,?), ref: 00802AB1
Part of subcall function 0080299E: CopyFileA.KERNEL32(?,?,00000000), ref: 00802AC6
Part of subcall function 0080299E: GetFileAttributesA.KERNEL32(?,?,00000000,?), ref: 00802AD7
Part of subcall function 0080299E: lstrcpy.KERNEL32(?,?), ref: 00802AFB

Part of subcall function 00802B02: RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020006,?,?,00000000,?), ref: 00802BFD
Part of subcall function 00802B02: RegOpenKeyExA.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,00020006,?,?,00000000,?), ref: 00802C12
Part of subcall function 00802B02: lstrlen.KERNEL32(bar,?,00000000,?), ref: 00802C1F
Part of subcall function 00802B02: RegSetValueExA.KERNEL32(?,Traybar,00000000,00000001,bar,00000001,?,00000000,?), ref: 00802C32
Part of subcall function 00802B02: RegCloseKey.KERNEL32(?,?,00000000,?), ref: 00802C3B

CreateThread.KERNEL32(00000000,00000000,00807EAC,00000000,00000000,?), ref: 00802D07
CreateThread.KERNEL32(00000000,00000000,00802C72,00000000,00000000,?), ref: 00802D20
Sleep.KERNELBASE ref: 00802D3A
CreateThread.KERNEL32(00000000,00000000,008046BB,00000000,00000000,?), ref: 00802D4E

Part of subcall function 00805158: GetFileAttributesA.KERNEL32(00000000,00802D5B), ref: 0080515F
Part of subcall function 00805158: DeleteFileA.KERNEL32 ref: 00805182
Part of subcall function 00805158: Sleep.KERNEL32(0001D4C0), ref: 0080518D
Part of subcall function 00805158: GetCurrentThread.KERNEL32(000000FF), ref: 00805191
Part of subcall function 00805158: SetThreadPriority.KERNEL32(00000000), ref: 00805198
Part of subcall function 00805158: Sleep.KERNEL32(00006F54), ref: 008051B8

Strings

c:\s, xrefs: 00802CC0

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00807C77, Relevance: 9.1, APIs: 6, Instructions: 65

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000100,00000000), ref: 00807C91
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00807CAE

Part of subcall function 0080317F: SetFilePointer.KERNELBASE(?,0000003C,00000000,00000000,?,?,00000000), ref: 00803197
Part of subcall function 0080317F: ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 008031B0
Part of subcall function 0080317F: SetFilePointer.KERNELBASE(?,?,00000000,00000000,?,?,00000000), ref: 008031C4
Part of subcall function 0080317F: ReadFile.KERNEL32(?,?,00000016,00000004,00000000), ref: 008031DD
Part of subcall function 0080317F: SetFilePointer.KERNELBASE(?,?,00000000,00000000,?,?,00000000), ref: 0080321A
Part of subcall function 0080317F: ReadFile.KERNEL32(?,?,00000028,00000500,00000000), ref: 00803238

CloseHandle.KERNEL32(00000000), ref: 00807CC7
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00807CD4
ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 00807D06
CloseHandle.KERNEL32(00000000), ref: 00807D0E

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00805158, Relevance: 9.0, APIs: 6, Instructions: 24

APIs

GetFileAttributesA.KERNEL32(00000000,00802D5B), ref: 0080515F
DeleteFileA.KERNEL32 ref: 00805182
Sleep.KERNEL32(0001D4C0), ref: 0080518D
GetCurrentThread.KERNEL32(000000FF), ref: 00805191
SetThreadPriority.KERNEL32(00000000), ref: 00805198

Part of subcall function 00804A7D: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?,7703C326), ref: 00804B43
Part of subcall function 00804A7D: memset.MSVCRT(?,00000000,00000100), ref: 00804B5A
Part of subcall function 00804A7D: RegQueryValueExA.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 00804B7A
Part of subcall function 00804A7D: RegCloseKey.KERNEL32(?), ref: 00804B83

Part of subcall function 00804F46: memset.MSVCRT(?,00000000,00000184,?,7703C326,7703C326), ref: 00805009
Part of subcall function 00804F46: GetWindowsDirectoryA.KERNEL32(?,00000184,?,7703C326,7703C326), ref: 0080501E
Part of subcall function 00804F46: GetEnvironmentVariableA.KERNEL32(USERPROFILE,?,00000184,?,7703C326,7703C326), ref: 0080502B
Part of subcall function 00804F46: lstrlen.KERNEL32(?,?,7703C326,7703C326), ref: 00805040
Part of subcall function 00804F46: lstrcat.KERNEL32(?,00801360), ref: 0080505F
Part of subcall function 00804F46: lstrcat.KERNEL32(?,Local Settings), ref: 00805072
Part of subcall function 00804F46: lstrcat.KERNEL32(?,00801360), ref: 00805080
Part of subcall function 00804F46: lstrcat.KERNEL32(?,Temporary Internet Files), ref: 0080508D

Part of subcall function 008050B1: memset.MSVCRT(?,00000000,00000104,7703C326,7703C326), ref: 008050CB
Part of subcall function 008050B1: GetWindowsDirectoryA.KERNEL32(?,00000104,?,7703C326,7703C326), ref: 008050DB
Part of subcall function 008050B1: lstrcpy.KERNEL32(?,00801A90), ref: 008050F3
Part of subcall function 008050B1: GetDriveTypeA.KERNEL32(00000043,?,7703C326,7703C326), ref: 0080511F
Part of subcall function 008050B1: Sleep.KERNEL32(00001194,?,7703C326,7703C326), ref: 0080512F

Sleep.KERNEL32(00006F54), ref: 008051B8

Part of subcall function 008048A0: CreateFileA.KERNEL32(00804D1E,80000000,00000003,00000000,00000003,00000080,00000000), ref: 008048C3
Part of subcall function 008048A0: ReadFile.KERNEL32(00000000,?,0000FFFD,e,00000000), ref: 00804951
Part of subcall function 008048A0: CloseHandle.KERNEL32(?), ref: 0080495D

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00802790, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110

APIs

RegOpenKeyExA.KERNEL32(00000049,Software\Microsoft\Windows\CurrentVersion\POSIX,00000000,00020019,?,?,?,?), ref: 0080287F
RegCreateKeyExA.KERNEL32(00000002,00000053,00000000,00000000,00000000,00020006,00000000,?,?,?,?,?), ref: 008028BA
RegCloseKey.KERNEL32(?,?,?,?), ref: 008028C7
RegCloseKey.ADVAPI32(?,?,?,?), ref: 008028DE

Strings

Software\Microsoft\Windows\CurrentVersion\POSIX, xrefs: 00802870, 00802874

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 0080277B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113

APIs

RegOpenKeyExA.KERNEL32(00000049,Software\Microsoft\Windows\CurrentVersion\POSIX,00000000,00020019,?,?,?,?), ref: 0080287F
RegCreateKeyExA.KERNEL32(00000002,00000053,00000000,00000000,00000000,00020006,00000000,?,?,?,?,?), ref: 008028BA
RegCloseKey.KERNEL32(?,?,?,?), ref: 008028C7
RegCloseKey.ADVAPI32(?,?,?,?), ref: 008028DE

Strings

Software\Microsoft\Windows\CurrentVersion\POSIX, xrefs: 00802870, 00802874

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 008048A0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73

APIs

CreateFileA.KERNEL32(00804D1E,80000000,00000003,00000000,00000003,00000080,00000000), ref: 008048C3
CloseHandle.KERNEL32(?), ref: 0080495D

Part of subcall function 008046C9: memcpy.MSVCRT(00804D1E,00801A50,00801840,0000FFFD,77039C76,00000000), ref: 0080473C

ReadFile.KERNEL32(00000000,?,0000FFFD,e,00000000), ref: 00804951

Strings

e, xrefs: 008048E9, 00804911, 00804942

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00804578, Relevance: 6.1, APIs: 4, Instructions: 105

APIs

Part of subcall function 00803108: GetModuleHandleA.KERNEL32(?), ref: 00803142
Part of subcall function 00803108: LoadLibraryA.KERNEL32(wininet.dll), ref: 00803150
Part of subcall function 00803108: GetProcAddress.KERNEL32(00000000,InternetGetConnectedState), ref: 00803160
Part of subcall function 00803108: InternetGetConnectedState.WININET(?,00000000), ref: 00803175

Sleep.KERNELBASE(00000001,?,?,?,?,?,?,008046C0), ref: 00804596

Part of subcall function 0080451B: GetTickCount.KERNEL32(00000000,00000000,008045FC,?,?,?,?,?,?,008046C0), ref: 00804530
Part of subcall function 0080451B: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,008046C0), ref: 00804564
Part of subcall function 0080451B: HeapFree.KERNEL32(00000000), ref: 0080456B

CreateThread.KERNEL32(00000000,00000000,008044DC,00000000,00000000,?), ref: 00804641
CloseHandle.KERNEL32(00000000), ref: 00804651
GetTickCount.KERNEL32(?,?,?,?,?,?,008046C0), ref: 00804682

Part of subcall function 00804253: lstrcpyn.KERNEL32(?,-00000009,0000007F,00000000), ref: 008042C2
Part of subcall function 00804253: lstrcpy.KERNEL32(?), ref: 008042E5
Part of subcall function 00804253: lstrcat.KERNEL32(?,00801730), ref: 008042FD
Part of subcall function 00804253: lstrcat.KERNEL32(?,?), ref: 0080430A

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00804BB6, Relevance: 4.6, APIs: 3, Instructions: 140

APIs

lstrcpyn.KERNEL32(?,00000070,0000000F,?,?,00804F2C,?), ref: 00804BFE
CharLowerA.USER32(?), ref: 00804C08
Sleep.KERNEL32(00000800,?,7703A6C7,?,?,00804F2C,?), ref: 00804D02

Part of subcall function 0080496F: CreateFileA.KERNEL32(00000020,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00804991
Part of subcall function 0080496F: GetFileSize.KERNEL32(00000000,00000000), ref: 008049AF
Part of subcall function 0080496F: CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 008049BF
Part of subcall function 0080496F: MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 008049E0
Part of subcall function 0080496F: memset.MSVCRT(?,00000000,00000080), ref: 00804A0E
Part of subcall function 0080496F: UnmapViewOfFile.KERNEL32(00000000), ref: 00804A51
Part of subcall function 0080496F: CloseHandle.KERNEL32(?), ref: 00804A5A
Part of subcall function 0080496F: CloseHandle.KERNEL32(?), ref: 00804A64

Part of subcall function 008048A0: CreateFileA.KERNEL32(00804D1E,80000000,00000003,00000000,00000003,00000080,00000000), ref: 008048C3
Part of subcall function 008048A0: ReadFile.KERNEL32(00000000,?,0000FFFD,e,00000000), ref: 00804951
Part of subcall function 008048A0: CloseHandle.KERNEL32(?), ref: 0080495D

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 0080733B, Relevance: 4.6, APIs: 3, Instructions: 67

APIs

htonl.WS2_32(?), ref: 00807341
realloc.MSVCRT ref: 0080738B
malloc.MSVCRT(00000100,00000000), ref: 0080739A

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00802D68, Relevance: 4.5, APIs: 3, Instructions: 19

APIs

WSAStartup.WS2_32(00000101,?), ref: 00802D7D

Part of subcall function 00802E90: GetTickCount.KERNEL32(00802D88), ref: 00802E90

memset.MSVCRT(?,00000000,00000108), ref: 00802D96

Part of subcall function 00802CB2: GetFileAttributesA.KERNEL32(?), ref: 00802CC7
Part of subcall function 00802CB2: CreateThread.KERNEL32(00000000,00000000,00807EAC,00000000,00000000,?), ref: 00802D07
Part of subcall function 00802CB2: CreateThread.KERNEL32(00000000,00000000,00802C72,00000000,00000000,?), ref: 00802D20
Part of subcall function 00802CB2: Sleep.KERNELBASE ref: 00802D3A
Part of subcall function 00802CB2: CreateThread.KERNEL32(00000000,00000000,008046BB,00000000,00000000,?), ref: 00802D4E
Part of subcall function 00802CB2: Sleep.KERNEL32(000001F4), ref: 00802D60

ExitProcess.KERNEL32 ref: 00802DAC

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00807D19, Relevance: 3.0, APIs: 2, Instructions: 41

APIs

gethostname.WS2_32(?,00000100), ref: 00807D2E
gethostbyname.WS2_32(?), ref: 00807D3B

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00807B09, Relevance: 2.5, APIs: 2, Instructions: 49

APIs

Part of subcall function 00803108: GetModuleHandleA.KERNEL32(?), ref: 00803142
Part of subcall function 00803108: LoadLibraryA.KERNEL32(wininet.dll), ref: 00803150
Part of subcall function 00803108: GetProcAddress.KERNEL32(00000000,InternetGetConnectedState), ref: 00803160
Part of subcall function 00803108: InternetGetConnectedState.WININET(?,00000000), ref: 00803175

Sleep.KERNEL32(00003A98,?,?,?,?,00807B8A,00000000), ref: 00807B27

Part of subcall function 00807A7B: htons.WS2_32(00000412), ref: 00807ABA

Sleep.KERNELBASE(00001388,?,?,?,?,00807B8A,00000000), ref: 00807B62

Part of subcall function 008074A2: fopen.MSVCRT(?,u,?,0000000A,0000000A,00000001,00807B77,?,?,?,?,?,00807B8A,00000000), ref: 008074B8
Part of subcall function 008074A2: htonl.WS2_32(504F6C30), ref: 008074D4
Part of subcall function 008074A2: fwrite.MSVCRT ref: 008074EA
Part of subcall function 008074A2: htonl.WS2_32(F9138C5D), ref: 008074FE
Part of subcall function 008074A2: fwrite.MSVCRT ref: 00807517
Part of subcall function 008074A2: fclose.MSVCRT(00000000,?,?,?,?,00807B8A,00000000), ref: 0080752A
Part of subcall function 008074A2: time.MSVCRT(?,0000000A,00000001,00807B77,?,?,?,?,?,00807B8A,00000000), ref: 00807537

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00807A7B, Relevance: 1.6, APIs: 1, Instructions: 51

APIs

Part of subcall function 008073E8: Sleep.KERNEL32(00000005,00807BDC), ref: 008073EC

htons.WS2_32(00000412), ref: 00807ABA

Part of subcall function 00807983: socket.WS2_32(00000002,00000001,00000006), ref: 00807996
Part of subcall function 00807983: connect.WS2_32(00000000,00000000,00000010), ref: 008079B3
Part of subcall function 00807983: recv.WS2_32(00000000,00000000,00000002,00000000), ref: 008079C8
Part of subcall function 00807983: htons.WS2_32(00000000), ref: 008079DF
Part of subcall function 00807983: htons.WS2_32(00000000), ref: 008079EC
Part of subcall function 00807983: send.WS2_32(00000000,?,00000002,00000000), ref: 008079FD
Part of subcall function 00807983: htons.WS2_32(?), ref: 00807A06
Part of subcall function 00807983: recv.WS2_32(?,?,00000001,00000000), ref: 00807A27
Part of subcall function 00807983: closesocket.WS2_32(?), ref: 00807A6E

Part of subcall function 00803108: GetModuleHandleA.KERNEL32(?), ref: 00803142
Part of subcall function 00803108: LoadLibraryA.KERNEL32(wininet.dll), ref: 00803150
Part of subcall function 00803108: GetProcAddress.KERNEL32(00000000,InternetGetConnectedState), ref: 00803160
Part of subcall function 00803108: InternetGetConnectedState.WININET(?,00000000), ref: 00803175

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Non-executed Functions

Function 008036E5, Relevance: 30.2, APIs: 20, Instructions: 197

APIs

GetProcessHeap.KERNEL32(00000000,00001000,00000000), ref: 00803706
RtlAllocateHeap.NTDLL(00000000), ref: 00803709
socket.WS2_32(00000002,00000002,00000011), ref: 00803723
htons.WS2_32(00000000), ref: 0080375E

Part of subcall function 00803382: memset.MSVCRT(?,00000000,00000400), ref: 008033A0
Part of subcall function 00803382: GetTickCount.KERNEL32 ref: 008033A8
Part of subcall function 00803382: htons.WS2_32(00000001), ref: 008033C2
Part of subcall function 00803382: htons.WS2_32(0000000F), ref: 00803453
Part of subcall function 00803382: htons.WS2_32(00000001), ref: 00803461
Part of subcall function 00803382: sendto.WS2_32(?,?,0000000D,00000000,?,00000010), ref: 0080347F

select.WS2_32 ref: 008037A8
memset.MSVCRT(00000000,00000000,00000004), ref: 008037BA
recv.WS2_32(?,00000000,00001000,00000000), ref: 008037CA
htons.WS2_32(?), ref: 008037F1
htons.WS2_32(?), ref: 0080380C

Part of subcall function 0080359E: memset.MSVCRT(?,00000000,00000114), ref: 00803619
Part of subcall function 0080359E: htons.WS2_32(?), ref: 0080364C
Part of subcall function 0080359E: htons.WS2_32(00000000), ref: 00803659
Part of subcall function 0080359E: htons.WS2_32(00000000), ref: 00803667
Part of subcall function 0080359E: GetProcessHeap.KERNEL32(00000000,00000124), ref: 00803684
Part of subcall function 0080359E: RtlAllocateHeap.NTDLL(00000000), ref: 0080368B
Part of subcall function 0080359E: memset.MSVCRT(00000000,00000000,00000124), ref: 0080369E

GetProcessHeap.KERNEL32(00000000,00000108), ref: 00803879
RtlAllocateHeap.NTDLL(00000000), ref: 00803880
memset.MSVCRT(00000000,00000000,00000108), ref: 00803890
htons.WS2_32(?), ref: 008038A5

Part of subcall function 008034EC: htons.WS2_32(00000000), ref: 00803549

GetProcessHeap.KERNEL32(00000000,00000000), ref: 008038CD
HeapFree.KERNEL32(00000000), ref: 008038D4

Part of subcall function 0080357F: GetProcessHeap.KERNEL32(00000000,?,00000000,0080390B), ref: 00803589
Part of subcall function 0080357F: HeapFree.KERNEL32(00000000), ref: 00803590

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00803933
HeapFree.KERNEL32(00000000), ref: 0080393A
closesocket.WS2_32(?), ref: 00803944
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00803952
HeapFree.KERNEL32(00000000), ref: 00803955

Memory Dump Source

Source File: 00000000.00000002.499564941.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.499560948.00800000.00000002.sdmp
Associated: 00000000.00000002.499569083.0080B000.00000080.sdmp
Associated: 00000000.00000002.499573002.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_yauz.jbxd

Function 00802DB3, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74

APIs

GetLocalTime.KERNEL32(?), ref: 00802DC8
FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 00802DD7
FileTimeToSystemTime.KERNEL32(?,?), ref: 00802DE5
GetTimeZoneInformation.KERNEL32(?), ref: 00802DF3
wsprintfA.USER32(?,%s, %u %s %u %.2u:%.2u:%.2u %c%.2u%.2u,?,?,?,?,?,?,?,?,7703A739), ref: 00802E81

Strings

%s, %u %s %u %.2u:%.2u:%.2u %c%.2u%.2u, xrefs: 00802E79

Memory Dump Source

Source File: 00000000.00000002.499564941.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000002.499560948.00800000.00000002.sdmp
Associated: 00000000.00000002.499569083.0080B000.00000080.sdmp
Associated: 00000000.00000002.499573002.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_800000_yauz.jbxd

Function 00805AA7, Relevance: 49.2, APIs: 22, Strings: 6, Instructions: 229

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,008044B6,00000000), ref: 00805AF5

Part of subcall function 00805A22: GetTempPathA.KERNEL32(00000104,?), ref: 00805A39
Part of subcall function 00805A22: GetTempFileNameA.KERNEL32(?,tmp,00000000,?), ref: 00805A54
Part of subcall function 00805A22: CopyFileA.KERNEL32(008060AC,?,00000000), ref: 00805A6D
Part of subcall function 00805A22: DeleteFileA.KERNEL32(008060AC), ref: 00805A8C
Part of subcall function 00805A22: lstrcpy.KERNEL32(008060AC,?), ref: 00805A9A

GetTempPathA.KERNEL32(00000104,?), ref: 00805B1B
GetTempFileNameA.KERNEL32(?,tmp,00000000,?), ref: 00805B41
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00805B50
CopyFileA.KERNEL32(?,?,00000000), ref: 00805B65

Part of subcall function 008059EB: CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00805A02
Part of subcall function 008059EB: CloseHandle.KERNEL32(00000000), ref: 00805A1A

GetTempPathA.KERNEL32(00000104,?), ref: 00805B86
GetTempFileNameA.KERNEL32(?,tmp,00000000,?), ref: 00805BA0
lstrcpy.KERNEL32(?,?), ref: 00805BF1
lstrcat.KERNEL32(?,008014B0), ref: 00805C09
lstrcat.KERNEL32(?,doc), ref: 00805C4A
lstrcat.KERNEL32(?,00801A50), ref: 00805C72
lstrcat.KERNEL32(?,008014B0), ref: 00805C85
lstrcat.KERNEL32(?,008022F0), ref: 00805CA8
lstrcat.KERNEL32(?,008022E8), ref: 00805CB7
lstrcat.KERNEL32(?,008022E0), ref: 00805CC6
lstrcat.KERNEL32(?,008022DC), ref: 00805CD4

Part of subcall function 00805316: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0080533E
Part of subcall function 00805316: CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00805363
Part of subcall function 00805316: memset.MSVCRT(?,00000000,0000001E), ref: 00805382
Part of subcall function 00805316: memset.MSVCRT(?,00000000,0000002E,?,00000000,0000001E), ref: 0080538E
Part of subcall function 00805316: memset.MSVCRT(?,00000000,00000016,?,00000000,0000002E,?,00000000,0000001E), ref: 0080539A
Part of subcall function 00805316: GetFileSize.KERNEL32(?,00000000), ref: 008053FA
Part of subcall function 00805316: GetFileSize.KERNEL32(?,00000000), ref: 00805406
Part of subcall function 00805316: lstrlen.KERNEL32(00805CF0), ref: 00805417
Part of subcall function 00805316: WriteFile.KERNEL32(00000000,04034B50,0000001E,?,00000000), ref: 0080543E
Part of subcall function 00805316: CloseHandle.KERNEL32(?), ref: 0080553A

DeleteFileA.KERNEL32(?), ref: 00805D02
wsprintfA.USER32(?,%s.zip,?), ref: 00805D1B
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00805D3E
GetFileSize.KERNEL32(00000000,00000000), ref: 00805D58
CloseHandle.KERNEL32(00806384), ref: 00805D63
DeleteFileA.KERNEL32(?), ref: 00805D8B

Strings

txt, xrefs: 00805C37
tmp, xrefs: 00805B3B, 00805B9A
doc, xrefs: 00805C3E
html, xrefs: 00805C29
%s.zip, xrefs: 00805D15
htm, xrefs: 00805C30

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 008075B2, Relevance: 45.7, APIs: 21, Strings: 5, Instructions: 183

APIs

memset.MSVCRT(?,00000000,00000040,76876F01,?,00000000), ref: 008075C9
recv.WS2_32(?,?,00000040,00000000), ref: 008075EA
GetTempPathA.KERNEL32(00000100,?), ref: 00807608
strlen.MSVCRT(?,?,00000000), ref: 00807615
_mbscat.MSVCRT ref: 0080763A
time.MSVCRT(00000000,00000065,00000078,00000065,?,00000000), ref: 00807649
strlen.MSVCRT(?,tmp%d.%c%c%c,00000000,00000000), ref: 0080765D
wsprintfA.USER32(?,tmp%d.%c%c%c,00000000,00000000), ref: 0080766B
fopen.MSVCRT(?,u), ref: 0080767D
fwrite.MSVCRT ref: 0080769D
recv.WS2_32(?,?,00000100,00000000), ref: 008076B3
fclose.MSVCRT(?), ref: 008076BC
memset.MSVCRT(?,00000000,00000040), ref: 008076CB

Part of subcall function 00807101: memset.MSVCRT(?,00000000,00000001,00000000), ref: 00807116
Part of subcall function 00807101: memcpy.MSVCRT(?,?,00000040,?,00000000,00000001,00000000), ref: 00807124
Part of subcall function 00807101: memset.MSVCRT(?,00000000,00000001,?,?,00000040,?,00000000,00000001,00000000), ref: 00807130
Part of subcall function 00807101: memcpy.MSVCRT(?,?,00000040,?,00000000,00000001,?,?,00000040,?,00000000,00000001,00000000), ref: 0080713E
Part of subcall function 00807101: memset.MSVCRT(?,00000000,00000001,?,?,00000040,?,00000000,00000001,?,?,00000040,?,00000000,00000001,00000000), ref: 0080714A
Part of subcall function 00807101: memcpy.MSVCRT(?,?,00000040,?,00000000,00000001,?,?,00000040,?,00000000,00000001,?,?,00000040,?), ref: 00807158
Part of subcall function 00807101: memcpy.MSVCRT(?,?,00000041), ref: 0080716D
Part of subcall function 00807101: memset.MSVCRT(?,00000000,00000041,?,?,00000041), ref: 00807179
Part of subcall function 00807101: memcpy.MSVCRT(?,?,00000040), ref: 008071D9

fopen.MSVCRT(?,w), ref: 00807703
htonl.WS2_32(?), ref: 00807710
fread.MSVCRT ref: 00807740
fclose.MSVCRT(00000000,?,?), ref: 0080777E
memcmp.MSVCRT(?,?,00000010), ref: 0080778E
wsprintfA.USER32(?,"%s",?), ref: 008077AD
system.MSVCRT ref: 008077BA
DeleteFileA.KERNEL32(?), ref: 008077CA

Strings

u, xrefs: 00807677
w, xrefs: 008076FD
tmp%d.%c%c%c, xrefs: 00807657
0000, xrefs: 008076EA
"%s", xrefs: 008077A7

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00805316, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 201

APIs

CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0080533E
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00805363
memset.MSVCRT(?,00000000,0000001E), ref: 00805382
memset.MSVCRT(?,00000000,0000002E,?,00000000,0000001E), ref: 0080538E
memset.MSVCRT(?,00000000,00000016,?,00000000,0000002E,?,00000000,0000001E), ref: 0080539A

Part of subcall function 00805247: GetSystemTime.KERNEL32(0000002E,0000002E,?,00000000,0000001E), ref: 00805251

Part of subcall function 008052A2: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,7703EB11), ref: 008052B6
Part of subcall function 008052A2: ReadFile.KERNEL32(00000000,?,00000400,0000001E,00000000), ref: 008052FC
Part of subcall function 008052A2: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00805308

GetFileSize.KERNEL32(?,00000000), ref: 008053FA
GetFileSize.KERNEL32(?,00000000), ref: 00805406
lstrlen.KERNEL32(00805CF0), ref: 00805417
WriteFile.KERNEL32(00000000,04034B50,0000001E,?,00000000), ref: 0080543E
lstrlen.KERNEL32(00805CF0,?,00000000), ref: 00805448
WriteFile.KERNEL32(?,00805CF0,00000000), ref: 00805451
lstrlen.KERNEL32(00805CF0), ref: 00805456
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 00805464
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00805483
ReadFile.KERNEL32(?,?,00000400,?,00000000), ref: 008054A2
WriteFile.KERNEL32(?,?,0000002E,?,00000000), ref: 008054D8
lstrlen.KERNEL32(00805CF0,?,00000000), ref: 008054E2
WriteFile.KERNEL32(?,00805CF0,00000000), ref: 008054EB
lstrlen.KERNEL32(00805CF0), ref: 008054F0
WriteFile.KERNEL32(?,06054B50,00000016,?,00000000), ref: 0080552C
CloseHandle.KERNEL32(?), ref: 00805531
CloseHandle.KERNEL32(?), ref: 0080553A

Strings

, xrefs: 008054D1

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00805575, Relevance: 34.6, APIs: 10, Strings: 13, Instructions: 148

APIs

lstrcpy.KERNEL32(?,"Postmaster"), ref: 008055E8
lstrcat.KERNEL32(?,00802200), ref: 008055FA
lstrcat.KERNEL32(?,postmaster), ref: 00805626
lstrcat.KERNEL32(?,00801730), ref: 0080562E
lstrcat.KERNEL32(?,?), ref: 00805635
lstrcpy.KERNEL32(?,?), ref: 00805642
lstrcat.KERNEL32(?,008021D8), ref: 0080564E
lstrcat.KERNEL32(?,yahoo.com), ref: 008056D4
lstrcpy.KERNEL32(?,yahoo.com), ref: 008056E2
lstrcpy.KERNEL32(?,0000000A), ref: 008056EF

Part of subcall function 00805551: lstrcpy.KERNEL32(?,?), ref: 0080556E

Strings

"Post Office", xrefs: 008055CD
"MAILER-DAEMON", xrefs: 008055B1
"Mail Delivery Subsystem", xrefs: 008055AA
postmaster, xrefs: 00805620
"Bounced mail", xrefs: 008055BF
yahoo.com, xrefs: 008056CD, 008056D2, 008056E0
"The Post Office", xrefs: 008055C6
noreply, xrefs: 00805612
"Automatic Email Delivery Software", xrefs: 008055D4
"Postmaster", xrefs: 008055E2
"Returned mail", xrefs: 008055B8
MAILER-DAEMON, xrefs: 00805619
"Mail Administrator", xrefs: 008055DB

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00803B98, Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 216

APIs

strlen.MSVCRT(?,00000000,?,?,00804127,?,?,?,?,008041B1), ref: 00803BA2
isspace.MSVCRT(00000000,?,00000000,00000000,?,?,00804127,?,?,?,?,008041B1), ref: 00803BC3
isalnum.MSVCRT ref: 00803BD3
strchr.MSVCRT ref: 00803C04
isalnum.MSVCRT ref: 00803C28
tolower.MSVCRT ref: 00803C4C
strlen.MSVCRT(?,00804127,?,?,?,?,008041B1), ref: 00803C79
isspace.MSVCRT(00000000,00804127,?,?,?,?,008041B1), ref: 00803C88
strchr.MSVCRT ref: 00803C9D
isalnum.MSVCRT ref: 00803CAE
isalnum.MSVCRT ref: 00803CEC
tolower.MSVCRT ref: 00803D1A
strlen.MSVCRT(?), ref: 00803D30
isspace.MSVCRT(00000000), ref: 00803D41
strchr.MSVCRT ref: 00803D55
isalnum.MSVCRT ref: 00803D65
lstrlen.KERNEL32(?), ref: 00803D91

Strings

_-!.@, xrefs: 00803BE2, 00803C37, 00803CBD, 00803CFA, 00803D73
_-!., xrefs: 00803BFF, 00803C98, 00803D50

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00806765, Relevance: 33.5, APIs: 7, Strings: 12, Instructions: 213

APIs

Part of subcall function 008064EC: lstrlen.KERNEL32(00000000,00000000,00000000), ref: 008065A9
Part of subcall function 008064EC: lstrlen.KERNEL32(00000000), ref: 008065B8
Part of subcall function 008064EC: CharLowerA.USER32(00000000), ref: 008065D7
Part of subcall function 008064EC: lstrcmpi.KERNEL32(00000000,?), ref: 008065E7

lstrcpy.KERNEL32(?,?), ref: 008067F8
socket.WS2_32(00000002,00000001,00000006), ref: 00806804
connect.WS2_32(00000000,00000002,00000010), ref: 00806823
closesocket.WS2_32(00000000), ref: 008069DD

Part of subcall function 008066C8: wvsprintfA.USER32(?,00000000,?), ref: 008066E5
Part of subcall function 008066C8: lstrlen.KERNEL32(?,00000000), ref: 008066F4
Part of subcall function 008066C8: send.WS2_32(00003A98,?,00000000), ref: 00806705

send.WS2_32(00000000,008014B0,00000001,00000000), ref: 00806972
send.WS2_32(00000000,00806B04,00806B05,00000000), ref: 00806982
send.WS2_32(00000000,.,00000005,00000000), ref: 0080699B

Strings

DATA, xrefs: 0080690D
PT T, xrefs: 008068E6
HLO, xrefs: 00806864
QUIT, xrefs: 008069BA
., xrefs: 00806993
MA%sROM:<%s>, xrefs: 008068BD
E%s %s, xrefs: 00806869
IL F, xrefs: 008068B8
%sO %s, xrefs: 0080688F
RC%sO:<%s>, xrefs: 008068EB
From, xrefs: 0080677F
HEL, xrefs: 0080688A

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00806125, Relevance: 31.6, APIs: 12, Strings: 9, Instructions: 82

APIs

wsprintfA.USER32(?,----=_%s_%.3u_%.4u_%.8X.%.8X,NextPart,00000000,?,00000000,00000000,008044B6,?,?,00000000,?,008063C8), ref: 0080616A
wsprintfA.USER32(?,From: %s,?,?,00000000,00000000,008044B6,?,?,00000000,?,008063C8), ref: 00806179
lstrlen.KERNEL32(?,To: %s,?), ref: 00806190
wsprintfA.USER32(00000000), ref: 00806195
lstrlen.KERNEL32(?,Subject: %s,?), ref: 008061A7
wsprintfA.USER32(00000000), ref: 008061AC
lstrcat.KERNEL32(?,Date: ), ref: 008061BD
lstrlen.KERNEL32(?), ref: 008061C0

Part of subcall function 00802DB3: GetLocalTime.KERNEL32(?), ref: 00802DC8
Part of subcall function 00802DB3: FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 00802DD7
Part of subcall function 00802DB3: FileTimeToSystemTime.KERNEL32(?,?), ref: 00802DE5
Part of subcall function 00802DB3: GetTimeZoneInformation.KERNEL32(?), ref: 00802DF3
Part of subcall function 00802DB3: wsprintfA.USER32(?,%s, %u %s %u %.2u:%.2u:%.2u %c%.2u%.2u,?,?,?,?,?,?,?,?,7703A739), ref: 00802E81

lstrcat.KERNEL32(?,MIME-Version: 1.0), ref: 008061D4
lstrlen.KERNEL32(?,Content-Type: multipart/mixed;boundary="%s",?), ref: 008061E0
wsprintfA.USER32(00000000), ref: 008061E5
lstrcat.KERNEL32(?,X-Priority: 3X-MSMail-Priority: NormalX-Mailer: Microsoft Outlook Express 6.00.2600.0000X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000), ref: 008061F0

Strings

X-Priority: 3X-MSMail-Priority: NormalX-Mailer: Microsoft Outlook Express 6.00.2600.0000X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000, xrefs: 008061EA
From: %s, xrefs: 00806173
Subject: %s, xrefs: 008061A1
Date: , xrefs: 008061B7
To: %s, xrefs: 0080618A
----=_%s_%.3u_%.4u_%.8X.%.8X, xrefs: 0080615E
Content-Type: multipart/mixed;boundary="%s", xrefs: 008061DA
MIME-Version: 1.0, xrefs: 008061CE
NextPart, xrefs: 00806159

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 008069EA, Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 116

APIs

wsprintfA.USER32(?,Software\Microsoft\%s %s Manager\%ss,Internet,Account,Account,?,?), ref: 00806A13
wsprintfA.USER32(?,%s %s,SMTP,Server), ref: 00806A2B
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00806A48
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 00806A91
memset.MSVCRT(?,00000000,00000100), ref: 00806AA8
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?), ref: 00806ACA
RegCloseKey.ADVAPI32(?), ref: 00806B16

Part of subcall function 008064B7: inet_addr.WS2_32(?), ref: 008064B9
Part of subcall function 008064B7: gethostbyname.WS2_32(?), ref: 008064D0

htons.WS2_32(00000019), ref: 00806AEE

Part of subcall function 00806765: lstrcpy.KERNEL32(?,?), ref: 008067F8
Part of subcall function 00806765: socket.WS2_32(00000002,00000001,00000006), ref: 00806804
Part of subcall function 00806765: connect.WS2_32(00000000,00000002,00000010), ref: 00806823
Part of subcall function 00806765: send.WS2_32(00000000,008014B0,00000001,00000000), ref: 00806972
Part of subcall function 00806765: send.WS2_32(00000000,00806B04,00806B05,00000000), ref: 00806982
Part of subcall function 00806765: send.WS2_32(00000000,.,00000005,00000000), ref: 0080699B
Part of subcall function 00806765: closesocket.WS2_32(00000000), ref: 008069DD

RegEnumKeyA.ADVAPI32(?,00000000,?,00000100), ref: 00806B2F
RegCloseKey.ADVAPI32(?), ref: 00806B3C

Strings

%s %s, xrefs: 00806A25
Account, xrefs: 008069FA, 00806A00, 00806A01
Server, xrefs: 00806A15
SMTP, xrefs: 00806A1A
Internet, xrefs: 00806A02
Software\Microsoft\%s %s Manager\%ss, xrefs: 00806A0D

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 008061F8, Relevance: 27.1, APIs: 11, Strings: 7, Instructions: 84

APIs

lstrlen.KERNEL32(?,This is a multi-part message in MIME format.,008044B6,?,00000000,?,?,008063D3), ref: 00806213
wsprintfA.USER32(00000000,?,00000000,?,?,008063D3), ref: 00806218
lstrlen.KERNEL32(?,--%sContent-Type: text/plain;charset=us-asciiContent-Transfer-Encoding: 7bit,?,?,?,008063D3), ref: 0080622D
wsprintfA.USER32(00000000,?,?,008063D3), ref: 00806232
lstrlen.KERNEL32(?), ref: 0080623C

Part of subcall function 00805D98: lstrcpy.KERNEL32(00000000,?), ref: 00805EAF
Part of subcall function 00805D98: wsprintfA.USER32(00000000,%d.%d.%d.%d,?,00000000,00000000,?,?,7703A142,?,00806245), ref: 00805F49
Part of subcall function 00805D98: lstrlen.KERNEL32(00000000,?,?,?,?,?,00806245), ref: 00805F53

lstrcat.KERNEL32(?,), ref: 0080624B
lstrlen.KERNEL32(?,--%sContent-Type: application/octet-stream;name="%s"Content-Transfer-Encoding: base64Content-Disposition: %s;filename="%s",?,?,attachment,?), ref: 00806287
wsprintfA.USER32(00000000), ref: 0080628C
lstrlen.KERNEL32(?,?), ref: 00806297

Part of subcall function 00805FD0: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00805FF1
Part of subcall function 00805FD0: ReadFile.KERNEL32(?,?,00000400,?,00000000), ref: 00806032
Part of subcall function 00805FD0: memset.MSVCRT(?,00000000,00000003,7703A142,?), ref: 008060D1
Part of subcall function 00805FD0: CloseHandle.KERNEL32(?), ref: 00806118

lstrlen.KERNEL32(?,--%s--,?), ref: 008062B5
wsprintfA.USER32(00000000), ref: 008062BA

Strings

attachment, xrefs: 0080625F
--%sContent-Type: application/octet-stream;name="%s"Content-Transfer-Encoding: base64Content-Disposition: %s;filename="%s", xrefs: 0080627E
inline, xrefs: 00806269, 00806275
This is a multi-part message in MIME format., xrefs: 0080620D
--%s--, xrefs: 008062AF
, xrefs: 00806245
--%sContent-Type: text/plain;charset=us-asciiContent-Transfer-Encoding: 7bit, xrefs: 00806227

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00803A5C, Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 95

APIs

GetModuleHandleA.KERNEL32(iphlpapi.dll), ref: 00803A6B
LoadLibraryA.KERNEL32(iphlpapi.dll), ref: 00803A7B
GetProcAddress.KERNEL32(00000000,GetNetworkParams), ref: 00803A98
GetProcessHeap.KERNEL32(00000000,00004000), ref: 00803AB6
RtlAllocateHeap.NTDLL(00000000), ref: 00803AB9
htons.WS2_32(00000035), ref: 00803AF1
inet_addr.WS2_32(?), ref: 00803AFC
gethostbyname.WS2_32(?), ref: 00803B0F

Part of subcall function 00803968: Sleep.KERNEL32(00000064), ref: 0080398D

GetProcessHeap.KERNEL32(00000000,?), ref: 00803B4C
HeapFree.KERNEL32(00000000), ref: 00803B4F

Strings

GetNetworkParams, xrefs: 00803A92
iphlpapi.dll, xrefs: 00803A64, 00803A6A, 00803A7A

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00803265, Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 77

APIs

lstrcpy.KERNEL32(?,0080337E), ref: 00803278
lstrlen.KERNEL32(00000000,76A3DE4A,?,7703A6C7), ref: 008032A2
lstrlen.KERNEL32(00000000), ref: 008032B7
lstrcat.KERNEL32(00000000,00801360), ref: 008032CB
lstrcat.KERNEL32(00000000), ref: 008032E9
lstrcat.KERNEL32(00000000,008014B0), ref: 008032F7
lstrcat.KERNEL32(00000000,exe), ref: 00803339
CopyFileA.KERNEL32(?,00000000,00000001), ref: 00803347

Strings

exe, xrefs: 0080332D
ShareReactor.com, xrefs: 0080331F
com, xrefs: 00803326
scr, xrefs: 00803318

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00805729, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 163

APIs

strstr.MSVCRT ref: 00805736
lstrcpy.KERNEL32(?,?), ref: 00805775
lstrcpy.KERNEL32(?,00000000), ref: 00805830
lstrcpy.KERNEL32(?), ref: 0080588F
wsprintfA.USER32(?,%s.%s,?,?), ref: 008058A9
CharUpperBuffA.USER32(?,00000001), ref: 008058CD
CharUpperA.USER32(?), ref: 008058DB

Strings

.com, xrefs: 0080572D
%s.%s, xrefs: 008058A3

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00806B4F, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 136

APIs

Part of subcall function 008064EC: lstrlen.KERNEL32(00000000,00000000,00000000), ref: 008065A9
Part of subcall function 008064EC: lstrlen.KERNEL32(00000000), ref: 008065B8
Part of subcall function 008064EC: CharLowerA.USER32(00000000), ref: 008065D7
Part of subcall function 008064EC: lstrcmpi.KERNEL32(00000000,?), ref: 008065E7

lstrcpy.KERNEL32(?,?), ref: 00806BBB

Part of subcall function 008064B7: inet_addr.WS2_32(?), ref: 008064B9
Part of subcall function 008064B7: gethostbyname.WS2_32(?), ref: 008064D0

htons.WS2_32(00000019), ref: 00806BE3
_mbscpy.MSVCRT ref: 00806C21
_mbscat.MSVCRT ref: 00806C34
_mbscpy.MSVCRT ref: 00806C61
htons.WS2_32(00000019), ref: 00806C8B

Part of subcall function 00806765: lstrcpy.KERNEL32(?,?), ref: 008067F8
Part of subcall function 00806765: socket.WS2_32(00000002,00000001,00000006), ref: 00806804
Part of subcall function 00806765: connect.WS2_32(00000000,00000002,00000010), ref: 00806823
Part of subcall function 00806765: send.WS2_32(00000000,008014B0,00000001,00000000), ref: 00806972
Part of subcall function 00806765: send.WS2_32(00000000,00806B04,00806B05,00000000), ref: 00806982
Part of subcall function 00806765: send.WS2_32(00000000,.,00000005,00000000), ref: 0080699B
Part of subcall function 00806765: closesocket.WS2_32(00000000), ref: 008069DD

Part of subcall function 008069EA: wsprintfA.USER32(?,Software\Microsoft\%s %s Manager\%ss,Internet,Account,Account,?,?), ref: 00806A13
Part of subcall function 008069EA: wsprintfA.USER32(?,%s %s,SMTP,Server), ref: 00806A2B
Part of subcall function 008069EA: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00806A48
Part of subcall function 008069EA: RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 00806A91
Part of subcall function 008069EA: memset.MSVCRT(?,00000000,00000100), ref: 00806AA8
Part of subcall function 008069EA: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?), ref: 00806ACA
Part of subcall function 008069EA: htons.WS2_32(00000019), ref: 00806AEE
Part of subcall function 008069EA: RegCloseKey.ADVAPI32(?), ref: 00806B16
Part of subcall function 008069EA: RegEnumKeyA.ADVAPI32(?,00000000,?,00000100), ref: 00806B2F
Part of subcall function 008069EA: RegCloseKey.ADVAPI32(?), ref: 00806B3C

Strings

mail., xrefs: 00806C45
smtp., xrefs: 00806C15
mx., xrefs: 00806C4C

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 0080399E, Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77

APIs

GetModuleHandleA.KERNEL32(dnsapi.dll,008044A9,?,008044A9,008044A9,00803B6A,?,00804435,008044A9,?,?,008044A9,?), ref: 008039A8
LoadLibraryA.KERNEL32(dnsapi.dll), ref: 008039B5
GetProcAddress.KERNEL32(00000000,DnsQuery_A,?,008044A9,008044A9,00803B6A,?,00804435,008044A9,?,?,008044A9,?), ref: 008039C5
GetProcessHeap.KERNEL32(00000000,00000108,?,?,?,008044A9,008044A9,00803B6A,?,00804435,008044A9,?,?,008044A9,?), ref: 00803A04
RtlAllocateHeap.NTDLL(00000000,?,?), ref: 00803A0B
memset.MSVCRT(00000000,00000000,00000108,?,?,?,008044A9,008044A9,00803B6A,?,00804435,008044A9,?,?,008044A9,?), ref: 00803A1B
lstrcpyn.KERNEL32(00000008,?,000000FF,?,008044A9,?), ref: 00803A36

Strings

DnsQuery_A, xrefs: 008039BF
dnsapi.dll, xrefs: 008039A2, 008039A7, 008039B4

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 0080783E, Relevance: 15.1, APIs: 10, Instructions: 119

APIs

free.MSVCRT ref: 00807860
time.MSVCRT(00000000), ref: 0080786D
time.MSVCRT(00000000), ref: 00807875
htons.WS2_32(00000000), ref: 008078A2
send.WS2_32(?,?,00000002,00000000), ref: 008078BB
recv.WS2_32(?,?,00000002,00000000), ref: 008078CA
htons.WS2_32(?), ref: 008078D3
send.WS2_32(?,?,00000004,00000000), ref: 00807966
closesocket.WS2_32(?), ref: 00807975

Part of subcall function 008075B2: memset.MSVCRT(?,00000000,00000040,76876F01,?,00000000), ref: 008075C9
Part of subcall function 008075B2: recv.WS2_32(?,?,00000040,00000000), ref: 008075EA
Part of subcall function 008075B2: GetTempPathA.KERNEL32(00000100,?), ref: 00807608
Part of subcall function 008075B2: strlen.MSVCRT(?,?,00000000), ref: 00807615
Part of subcall function 008075B2: _mbscat.MSVCRT ref: 0080763A
Part of subcall function 008075B2: time.MSVCRT(00000000,00000065,00000078,00000065,?,00000000), ref: 00807649
Part of subcall function 008075B2: strlen.MSVCRT(?,tmp%d.%c%c%c,00000000,00000000), ref: 0080765D
Part of subcall function 008075B2: wsprintfA.USER32(?,tmp%d.%c%c%c,00000000,00000000), ref: 0080766B
Part of subcall function 008075B2: fopen.MSVCRT(?,u), ref: 0080767D
Part of subcall function 008075B2: fwrite.MSVCRT ref: 0080769D
Part of subcall function 008075B2: recv.WS2_32(?,?,00000100,00000000), ref: 008076B3
Part of subcall function 008075B2: fclose.MSVCRT(?), ref: 008076BC
Part of subcall function 008075B2: memset.MSVCRT(?,00000000,00000040), ref: 008076CB
Part of subcall function 008075B2: fopen.MSVCRT(?,w), ref: 00807703
Part of subcall function 008075B2: htonl.WS2_32(?), ref: 00807710
Part of subcall function 008075B2: fread.MSVCRT ref: 00807740
Part of subcall function 008075B2: fclose.MSVCRT(00000000,?,?), ref: 0080777E
Part of subcall function 008075B2: memcmp.MSVCRT(?,?,00000010), ref: 0080778E
Part of subcall function 008075B2: wsprintfA.USER32(?,"%s",?), ref: 008077AD
Part of subcall function 008075B2: system.MSVCRT ref: 008077BA
Part of subcall function 008075B2: DeleteFileA.KERNEL32(?), ref: 008077CA

RtlExitUserThread.NTDLL(00000000), ref: 0080797C

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00805FD0, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 122

APIs

CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000), ref: 00805FF1
ReadFile.KERNEL32(?,?,00000400,?,00000000), ref: 00806032
memset.MSVCRT(?,00000000,00000003,7703A142,?), ref: 008060D1
CloseHandle.KERNEL32(?), ref: 00806118

Strings

=, xrefs: 008060FD
L, xrefs: 008060B1
=, xrefs: 008060F4

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 0080496F, Relevance: 12.1, APIs: 8, Instructions: 107

APIs

CreateFileA.KERNEL32(00000020,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00804991
GetFileSize.KERNEL32(00000000,00000000), ref: 008049AF
CreateFileMappingA.KERNEL32(00000000,00000000,00000002,00000000,00000000,00000000), ref: 008049BF
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 008049E0
memset.MSVCRT(?,00000000,00000080), ref: 00804A0E

Part of subcall function 0080418A: strlen.MSVCRT(?), ref: 00804196
Part of subcall function 0080418A: lstrcmpi.KERNEL32(0000000A,?,00000000,?), ref: 008041CF
Part of subcall function 0080418A: lstrlen.KERNEL32(?), ref: 008041E7
Part of subcall function 0080418A: GetProcessHeap.KERNEL32(?,-0000000F), ref: 008041F4
Part of subcall function 0080418A: RtlAllocateHeap.NTDLL(00000000), ref: 008041FB
Part of subcall function 0080418A: memset.MSVCRT(00000000,00000000,-0000000F), ref: 00804213
Part of subcall function 0080418A: GetTickCount.KERNEL32 ref: 0080421F
Part of subcall function 0080418A: _mbscpy.MSVCRT ref: 00804238

UnmapViewOfFile.KERNEL32(00000000), ref: 00804A51
CloseHandle.KERNEL32(?), ref: 00804A5A
CloseHandle.KERNEL32(?), ref: 00804A64

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 0080418A, Relevance: 12.1, APIs: 8, Instructions: 74

APIs

strlen.MSVCRT(?), ref: 00804196

Part of subcall function 0080411A: strlen.MSVCRT(?,?,?,?,008041B1), ref: 0080413E

lstrcmpi.KERNEL32(0000000A,?,00000000,?), ref: 008041CF
lstrlen.KERNEL32(?), ref: 008041E7
GetProcessHeap.KERNEL32(?,-0000000F), ref: 008041F4
RtlAllocateHeap.NTDLL(00000000), ref: 008041FB
memset.MSVCRT(00000000,00000000,-0000000F), ref: 00804213
GetTickCount.KERNEL32 ref: 0080421F
_mbscpy.MSVCRT ref: 00804238

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00807101, Relevance: 11.3, APIs: 9, Instructions: 86

APIs

memset.MSVCRT(?,00000000,00000001,00000000), ref: 00807116
memcpy.MSVCRT(?,?,00000040,?,00000000,00000001,00000000), ref: 00807124
memset.MSVCRT(?,00000000,00000001,?,?,00000040,?,00000000,00000001,00000000), ref: 00807130
memcpy.MSVCRT(?,?,00000040,?,00000000,00000001,?,?,00000040,?,00000000,00000001,00000000), ref: 0080713E
memset.MSVCRT(?,00000000,00000001,?,?,00000040,?,00000000,00000001,?,?,00000040,?,00000000,00000001,00000000), ref: 0080714A
memcpy.MSVCRT(?,?,00000040,?,00000000,00000001,?,?,00000040,?,00000000,00000001,?,?,00000040,?), ref: 00807158
memcpy.MSVCRT(?,?,00000041), ref: 0080716D
memset.MSVCRT(?,00000000,00000041,?,?,00000041), ref: 00807179
memcpy.MSVCRT(?,?,00000040), ref: 008071D9

Part of subcall function 00807031: memcpy.MSVCRT(?,?,00000041,00000100), ref: 00807046
Part of subcall function 00807031: memcpy.MSVCRT(?,?,00000041,?,?,00000041,00000100), ref: 00807053
Part of subcall function 00807031: memset.MSVCRT(?,00000000,00000041,?,?,00000041,?,?,00000041,00000100), ref: 00807072

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00802FA0, Relevance: 10.6, APIs: 7, Instructions: 141

APIs

isdigit.MSVCRT ref: 00802FDA
memset.MSVCRT(00000000,00000000,00000014), ref: 00803030
WideCharToMultiByte.KERNEL32(00000000,00000000,77039C76,00000001,00000000,00000014,00000000,00000000), ref: 0080305A
lstrlen.KERNEL32(00000000), ref: 00803076
lstrlen.KERNEL32(77039C76), ref: 00803091
lstrlen.KERNEL32(00000000), ref: 008030D8
memcpy.MSVCRT(00000000,00000000,00000000), ref: 008030EA

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 0080359E, Relevance: 10.6, APIs: 7, Instructions: 118

APIs

Part of subcall function 00803493: htons.WS2_32(00000000), ref: 008034AA
Part of subcall function 00803493: htons.WS2_32(00000000), ref: 008034DC

memset.MSVCRT(?,00000000,00000114), ref: 00803619

Part of subcall function 008034EC: htons.WS2_32(00000000), ref: 00803549

htons.WS2_32(?), ref: 0080364C
htons.WS2_32(00000000), ref: 00803659
htons.WS2_32(00000000), ref: 00803667
GetProcessHeap.KERNEL32(00000000,00000124), ref: 00803684
RtlAllocateHeap.NTDLL(00000000), ref: 0080368B
memset.MSVCRT(00000000,00000000,00000124), ref: 0080369E

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00804349, Relevance: 10.6, APIs: 7, Instructions: 78

APIs

GetProcessHeap.KERNEL32(00000000,00000090,00000000,008044A9,?,00804451,008044A9,00000000,?,?,008044A9,?), ref: 0080438C
RtlAllocateHeap.NTDLL(00000000,?,00804451), ref: 00804393
memset.MSVCRT(00000000,00000000,00000090,?,00804451,008044A9,00000000,?,?,008044A9,?), ref: 008043A7
lstrcpyn.KERNEL32(00000010,?,0000007F,?,008044A9,?), ref: 008043C0
GetTickCount.KERNEL32 ref: 008043C6
GetTickCount.KERNEL32(00000000,008044A9,?,00804451,008044A9,00000000,?,?,008044A9,?), ref: 008043EC

Part of subcall function 00803B75: GetProcessHeap.KERNEL32(00000000,?,00000000,008043FD,?,?,00804451,008044A9,00000000,?,?,008044A9,?), ref: 00803B83
Part of subcall function 00803B75: HeapFree.KERNEL32(00000000,?,00804451), ref: 00803B8A

lstrcpyn.KERNEL32(00000010,00000000,0000007F,?,00804451,008044A9,00000000,?,?,008044A9,?), ref: 00804405

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 008050B1, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50

APIs

memset.MSVCRT(?,00000000,00000104,7703C326,7703C326), ref: 008050CB
GetWindowsDirectoryA.KERNEL32(?,00000104,?,7703C326,7703C326), ref: 008050DB
lstrcpy.KERNEL32(?,00801A90), ref: 008050F3

Part of subcall function 00804D32: Sleep.KERNEL32(00000800,7703A739,00000184), ref: 00804D5C
Part of subcall function 00804D32: lstrcpy.KERNEL32(?,?), ref: 00804D79
Part of subcall function 00804D32: CharLowerA.USER32(?), ref: 00804D82
Part of subcall function 00804D32: strstr.MSVCRT ref: 00804D9A
Part of subcall function 00804D32: strstr.MSVCRT ref: 00804DAE
Part of subcall function 00804D32: strstr.MSVCRT ref: 00804DC2
Part of subcall function 00804D32: strstr.MSVCRT ref: 00804DD6
Part of subcall function 00804D32: lstrcpy.KERNEL32(?,?), ref: 00804DED
Part of subcall function 00804D32: lstrlen.KERNEL32(?), ref: 00804DFD
Part of subcall function 00804D32: lstrcat.KERNEL32(?,00801360), ref: 00804E15
Part of subcall function 00804D32: lstrcat.KERNEL32(?,*.*), ref: 00804E27
Part of subcall function 00804D32: memset.MSVCRT(?,00000000,00000140), ref: 00804E3B
Part of subcall function 00804D32: FindFirstFileA.KERNELBASE(?,00000010), ref: 00804E5B
Part of subcall function 00804D32: FindNextFileA.KERNELBASE(00000000,?), ref: 00804E7C
Part of subcall function 00804D32: lstrcpy.KERNEL32(?,?), ref: 00804EB6
Part of subcall function 00804D32: lstrlen.KERNEL32(?), ref: 00804EBF
Part of subcall function 00804D32: lstrcat.KERNEL32(?,00801360), ref: 00804ED7
Part of subcall function 00804D32: lstrcat.KERNEL32(?,0000002E), ref: 00804EEB
Part of subcall function 00804D32: Sleep.KERNELBASE(0000004B), ref: 00804EFC
Part of subcall function 00804D32: FindClose.KERNELBASE(00000000), ref: 00804F38

GetDriveTypeA.KERNEL32(00000043,?,7703C326,7703C326), ref: 0080511F
Sleep.KERNEL32(00001194,?,7703C326,7703C326), ref: 0080512F

Strings

Z, xrefs: 0080514B

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00805A22, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 41

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 00805A39
GetTempFileNameA.KERNEL32(?,tmp,00000000,?), ref: 00805A54
CopyFileA.KERNEL32(008060AC,?,00000000), ref: 00805A6D

Part of subcall function 008059EB: CreateFileA.KERNEL32(00000003,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00805A02
Part of subcall function 008059EB: CloseHandle.KERNEL32(00000000), ref: 00805A1A

DeleteFileA.KERNEL32(008060AC), ref: 00805A8C
lstrcpy.KERNEL32(008060AC,?), ref: 00805A9A

Strings

tmp, xrefs: 00805A4E

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00803E39, Relevance: 10.1, APIs: 8, Instructions: 131

APIs

strlen.MSVCRT(?,?,00000000,00000000,00804136,?,?,?,008041B1), ref: 00803E79
strlen.MSVCRT(?,?,00000000,00000000,00804136,?,?,?,008041B1), ref: 00803EA6

Part of subcall function 00803DAF: isspace.MSVCRT(00807F30,00808038,?,00807F30,00803EE1,00808038,?,00000000,00000000,00804136,?,?,?,008041B1), ref: 00803DCC
Part of subcall function 00803DAF: isspace.MSVCRT(00000001,00808038,?,00807F30,00803EE1,00808038,?,00000000,00000000,00804136,?,?,?,008041B1), ref: 00803E08
Part of subcall function 00803DAF: lstrcpy.KERNEL32(00804136,?), ref: 00803E2F

strlen.MSVCRT(00807F30,00808038,?,00000000,00000000,00804136,?,?,?,008041B1), ref: 00803EE2
strlen.MSVCRT(00808038,?,00000000,00000000,00804136,?,?,?,008041B1), ref: 00803F01
strlen.MSVCRT(00808038,?,00000000,00000000,00804136,?,?,?,008041B1), ref: 00803F1F
strlen.MSVCRT(00807F30,?,00000000,00000000,00804136,?,?,?,008041B1), ref: 00803F7F
strlen.MSVCRT(00807F30,00807F30,?,00000000,00000000,00804136,?,?,?,008041B1), ref: 00803F98
strlen.MSVCRT(00807F30,?,00000000,00000000,00804136,?,?,?,008041B1), ref: 00803FAE

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 008062CA, Relevance: 9.1, APIs: 6, Instructions: 106

APIs

lstrlen.KERNEL32(008044B6,?), ref: 008062E3
memset.MSVCRT(?,00000000,000007C0,00000000), ref: 00806300

Part of subcall function 00805551: lstrcpy.KERNEL32(?,?), ref: 0080556E

Part of subcall function 00805575: lstrcpy.KERNEL32(?,"Postmaster"), ref: 008055E8
Part of subcall function 00805575: lstrcat.KERNEL32(?,00802200), ref: 008055FA
Part of subcall function 00805575: lstrcat.KERNEL32(?,postmaster), ref: 00805626
Part of subcall function 00805575: lstrcat.KERNEL32(?,00801730), ref: 0080562E
Part of subcall function 00805575: lstrcat.KERNEL32(?,?), ref: 00805635
Part of subcall function 00805575: lstrcpy.KERNEL32(?,?), ref: 00805642
Part of subcall function 00805575: lstrcat.KERNEL32(?,008021D8), ref: 0080564E
Part of subcall function 00805575: lstrcat.KERNEL32(?,yahoo.com), ref: 008056D4
Part of subcall function 00805575: lstrcpy.KERNEL32(?,yahoo.com), ref: 008056E2
Part of subcall function 00805575: lstrcpy.KERNEL32(?,0000000A), ref: 008056EF

Part of subcall function 00805729: strstr.MSVCRT ref: 00805736
Part of subcall function 00805729: lstrcpy.KERNEL32(?,?), ref: 00805775
Part of subcall function 00805729: lstrcpy.KERNEL32(?,00000000), ref: 00805830
Part of subcall function 00805729: lstrcpy.KERNEL32(?), ref: 0080588F
Part of subcall function 00805729: wsprintfA.USER32(?,%s.%s,?,?), ref: 008058A9
Part of subcall function 00805729: CharUpperBuffA.USER32(?,00000001), ref: 008058CD
Part of subcall function 00805729: CharUpperA.USER32(?), ref: 008058DB

Part of subcall function 008058E5: _mbscpy.MSVCRT ref: 008059A6
Part of subcall function 008058E5: CharUpperBuffA.USER32(?,00000001), ref: 008059CE
Part of subcall function 008058E5: CharUpperA.USER32(?), ref: 008059E2

Part of subcall function 00805AA7: GetModuleFileNameA.KERNEL32(00000000,?,00000104,008044B6,00000000), ref: 00805AF5
Part of subcall function 00805AA7: GetTempPathA.KERNEL32(00000104,?), ref: 00805B1B
Part of subcall function 00805AA7: GetTempFileNameA.KERNEL32(?,tmp,00000000,?), ref: 00805B41
Part of subcall function 00805AA7: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00805B50
Part of subcall function 00805AA7: CopyFileA.KERNEL32(?,?,00000000), ref: 00805B65
Part of subcall function 00805AA7: GetTempPathA.KERNEL32(00000104,?), ref: 00805B86
Part of subcall function 00805AA7: GetTempFileNameA.KERNEL32(?,tmp,00000000,?), ref: 00805BA0
Part of subcall function 00805AA7: lstrcpy.KERNEL32(?,?), ref: 00805BF1
Part of subcall function 00805AA7: lstrcat.KERNEL32(?,008014B0), ref: 00805C09
Part of subcall function 00805AA7: lstrcat.KERNEL32(?,doc), ref: 00805C4A
Part of subcall function 00805AA7: lstrcat.KERNEL32(?,00801A50), ref: 00805C72
Part of subcall function 00805AA7: lstrcat.KERNEL32(?,008014B0), ref: 00805C85
Part of subcall function 00805AA7: lstrcat.KERNEL32(?,008022F0), ref: 00805CA8
Part of subcall function 00805AA7: lstrcat.KERNEL32(?,008022E8), ref: 00805CB7
Part of subcall function 00805AA7: lstrcat.KERNEL32(?,008022E0), ref: 00805CC6
Part of subcall function 00805AA7: lstrcat.KERNEL32(?,008022DC), ref: 00805CD4
Part of subcall function 00805AA7: DeleteFileA.KERNEL32(?), ref: 00805D02
Part of subcall function 00805AA7: wsprintfA.USER32(?,%s.zip,?), ref: 00805D1B
Part of subcall function 00805AA7: CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 00805D3E
Part of subcall function 00805AA7: GetFileSize.KERNEL32(00000000,00000000), ref: 00805D58
Part of subcall function 00805AA7: CloseHandle.KERNEL32(00806384), ref: 00805D63
Part of subcall function 00805AA7: DeleteFileA.KERNEL32(?), ref: 00805D8B

GlobalAlloc.KERNEL32(00000040,?,00000000), ref: 008063AE
GlobalFree.KERNEL32(?), ref: 008063F4

Part of subcall function 00806125: wsprintfA.USER32(?,----=_%s_%.3u_%.4u_%.8X.%.8X,NextPart,00000000,?,00000000,00000000,008044B6,?,?,00000000,?,008063C8), ref: 0080616A
Part of subcall function 00806125: wsprintfA.USER32(?,From: %s,?,?,00000000,00000000,008044B6,?,?,00000000,?,008063C8), ref: 00806179
Part of subcall function 00806125: lstrlen.KERNEL32(?,To: %s,?), ref: 00806190
Part of subcall function 00806125: wsprintfA.USER32(00000000), ref: 00806195
Part of subcall function 00806125: lstrlen.KERNEL32(?,Subject: %s,?), ref: 008061A7
Part of subcall function 00806125: wsprintfA.USER32(00000000), ref: 008061AC
Part of subcall function 00806125: lstrcat.KERNEL32(?,Date: ), ref: 008061BD
Part of subcall function 00806125: lstrlen.KERNEL32(?), ref: 008061C0
Part of subcall function 00806125: lstrcat.KERNEL32(?,MIME-Version: 1.0), ref: 008061D4
Part of subcall function 00806125: lstrlen.KERNEL32(?,Content-Type: multipart/mixed;boundary="%s",?), ref: 008061E0
Part of subcall function 00806125: wsprintfA.USER32(00000000), ref: 008061E5
Part of subcall function 00806125: lstrcat.KERNEL32(?,X-Priority: 3X-MSMail-Priority: NormalX-Mailer: Microsoft Outlook Express 6.00.2600.0000X-MIMEOLE: Produced By Microsoft MimeOLE V6.00.2600.0000), ref: 008061F0

Part of subcall function 008061F8: lstrlen.KERNEL32(?,This is a multi-part message in MIME format.,008044B6,?,00000000,?,?,008063D3), ref: 00806213
Part of subcall function 008061F8: wsprintfA.USER32(00000000,?,00000000,?,?,008063D3), ref: 00806218
Part of subcall function 008061F8: lstrlen.KERNEL32(?,--%sContent-Type: text/plain;charset=us-asciiContent-Transfer-Encoding: 7bit,?,?,?,008063D3), ref: 0080622D
Part of subcall function 008061F8: wsprintfA.USER32(00000000,?,?,008063D3), ref: 00806232
Part of subcall function 008061F8: lstrlen.KERNEL32(?), ref: 0080623C
Part of subcall function 008061F8: lstrcat.KERNEL32(?,), ref: 0080624B
Part of subcall function 008061F8: lstrlen.KERNEL32(?,--%sContent-Type: application/octet-stream;name="%s"Content-Transfer-Encoding: base64Content-Disposition: %s;filename="%s",?,?,attachment,?), ref: 00806287
Part of subcall function 008061F8: wsprintfA.USER32(00000000), ref: 0080628C
Part of subcall function 008061F8: lstrlen.KERNEL32(?,?), ref: 00806297
Part of subcall function 008061F8: lstrlen.KERNEL32(?,--%s--,?), ref: 008062B5
Part of subcall function 008061F8: wsprintfA.USER32(00000000), ref: 008062BA

DeleteFileA.KERNEL32(?), ref: 008063E6
DeleteFileA.KERNEL32(?), ref: 0080640D

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00803382, Relevance: 9.1, APIs: 6, Instructions: 90

APIs

memset.MSVCRT(?,00000000,00000400), ref: 008033A0
GetTickCount.KERNEL32 ref: 008033A8
htons.WS2_32(00000001), ref: 008033C2
htons.WS2_32(0000000F), ref: 00803453
htons.WS2_32(00000001), ref: 00803461
sendto.WS2_32(?,?,0000000D,00000000,?,00000010), ref: 0080347F

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00807B94, Relevance: 9.1, APIs: 6, Instructions: 85

APIs

Part of subcall function 0080317F: SetFilePointer.KERNELBASE(?,0000003C,00000000,00000000,?,?,00000000), ref: 00803197
Part of subcall function 0080317F: ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 008031B0
Part of subcall function 0080317F: SetFilePointer.KERNELBASE(?,?,00000000,00000000,?,?,00000000), ref: 008031C4
Part of subcall function 0080317F: ReadFile.KERNEL32(?,?,00000016,00000004,00000000), ref: 008031DD
Part of subcall function 0080317F: SetFilePointer.KERNELBASE(?,?,00000000,00000000,?,?,00000000), ref: 0080321A
Part of subcall function 0080317F: ReadFile.KERNEL32(?,?,00000028,00000500,00000000), ref: 00803238

SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 00807BD1

Part of subcall function 008073E8: Sleep.KERNEL32(00000005,00807BDC), ref: 008073EC

WriteFile.KERNEL32(?,?,00000004,?,00000000), ref: 00807BFA
gethostname.WS2_32(?,00000100), ref: 00807C15
gethostbyname.WS2_32(?), ref: 00807C22
WriteFile.KERNEL32(?,?,00000004,?,00000000), ref: 00807C60
SetEndOfFile.KERNEL32(?), ref: 00807C6C

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 008028E6, Relevance: 7.6, APIs: 5, Instructions: 62

APIs

memset.MSVCRT(?,00000000,00000100,00000000), ref: 008028FF
gethostname.WS2_32(?,00000100), ref: 0080290F
memset.MSVCRT(?,00000000,00000100,?,?,?,?,00000100,?,?,?,00000000), ref: 00802946
CreateMutexA.KERNEL32(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00802986
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0080298C

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00805D98, Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 181

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00805EAF

Part of subcall function 00802DB3: GetLocalTime.KERNEL32(?), ref: 00802DC8
Part of subcall function 00802DB3: FileTimeToLocalFileTime.KERNEL32(00000000,?), ref: 00802DD7
Part of subcall function 00802DB3: FileTimeToSystemTime.KERNEL32(?,?), ref: 00802DE5
Part of subcall function 00802DB3: GetTimeZoneInformation.KERNEL32(?), ref: 00802DF3
Part of subcall function 00802DB3: wsprintfA.USER32(?,%s, %u %s %u %.2u:%.2u:%.2u %c%.2u%.2u,?,?,?,?,?,?,?,?,7703A739), ref: 00802E81

wsprintfA.USER32(00000000,%d.%d.%d.%d,?,00000000,00000000,?,?,7703A142,?,00806245), ref: 00805F49
lstrlen.KERNEL32(00000000,?,?,?,?,?,00806245), ref: 00805F53

Strings

%d.%d.%d.%d, xrefs: 00805F43

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 008064EC, Relevance: 6.2, APIs: 4, Instructions: 173

APIs

lstrlen.KERNEL32(00000000,00000000,00000000), ref: 008065A9
lstrlen.KERNEL32(00000000), ref: 008065B8
CharLowerA.USER32(00000000), ref: 008065D7
lstrcmpi.KERNEL32(00000000,?), ref: 008065E7

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Function 00804253, Relevance: 5.1, APIs: 4, Instructions: 74

APIs

lstrcpyn.KERNEL32(?,-00000009,0000007F,00000000), ref: 008042C2
lstrcpy.KERNEL32(?), ref: 008042E5
lstrcat.KERNEL32(?,00801730), ref: 008042FD
lstrcat.KERNEL32(?,?), ref: 0080430A

Part of subcall function 0080418A: strlen.MSVCRT(?), ref: 00804196
Part of subcall function 0080418A: lstrcmpi.KERNEL32(0000000A,?,00000000,?), ref: 008041CF
Part of subcall function 0080418A: lstrlen.KERNEL32(?), ref: 008041E7
Part of subcall function 0080418A: GetProcessHeap.KERNEL32(?,-0000000F), ref: 008041F4
Part of subcall function 0080418A: RtlAllocateHeap.NTDLL(00000000), ref: 008041FB
Part of subcall function 0080418A: memset.MSVCRT(00000000,00000000,-0000000F), ref: 00804213
Part of subcall function 0080418A: GetTickCount.KERNEL32 ref: 0080421F
Part of subcall function 0080418A: _mbscpy.MSVCRT ref: 00804238

Memory Dump Source

Source File: 00000000.00000001.191327174.00801000.00000040.sdmp, Offset: 00800000, based on PE: true

Associated: 00000000.00000001.191318710.00800000.00000002.sdmp
Associated: 00000000.00000001.191333667.0080B000.00000080.sdmp
Associated: 00000000.00000001.191338983.0080C000.00000004.sdmp

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_1_800000_yauz.jbxd

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Loading ...

Warning!

Error!

Analysis Report

Overview

General Information

Detection

Analysis Advice

Signature Overview

Networking:

Boot Survival:

Remote Access Functionality:

Stealing of Sensitive Information:

Persistence and Installation Behavior:

Data Obfuscation:

Spreading:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Anti Debugging:

Malware Analysis System Evasion:

Language, Device and Operating System Detection:

Yara Overview

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

TCP Packets

Hooks - Code Manipulation Behavior

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

System Behavior

Analysis Process: yauz.bat PID: 3304 Parent PID: 3080

General

Chronological Activities

Disassembly

Code Analysis

Analysis Process: yauz.bat PID: 3304 Parent PID: 3080

Execution Graph

Executed Functions

Function 00804D32, Relevance: 47.4, APIs: 20, Strings: 7, Instructions: 163

Function 00807D81, Relevance: 24.1, APIs: 16, Instructions: 101

Function 00807983, Relevance: 13.6, APIs: 9, Instructions: 101

Function 00802C72, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 23

Function 00803108, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43

Function 00804A7D, Relevance: 78.8, APIs: 4, Strings: 41, Instructions: 84

Function 0080299E, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 108

Function 00804F46, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 108

Function 008071E7, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132

Function 00802B02, Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 103

Function 008074A2, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 62

Function 00807400, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 60

Function 0080317F, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 93

Function 00802CB2, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 76

Function 00807C77, Relevance: 9.1, APIs: 6, Instructions: 65

Function 00805158, Relevance: 9.0, APIs: 6, Instructions: 24

Function 00802790, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110

Function 0080277B, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113

Function 008048A0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 73

Function 00804578, Relevance: 6.1, APIs: 4, Instructions: 105

Function 00804BB6, Relevance: 4.6, APIs: 3, Instructions: 140