Static task
static1
Behavioral task
behavioral1
Sample
Extend_01.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
Extend_01.exe
Resource
win10v2004-en-20220113
General
-
Target
Extend_01.exe
-
Size
768KB
-
MD5
baae617efb95c885924e01791d884d46
-
SHA1
e6c92c1d83959708291e6f9b8eff123926c2fff9
-
SHA256
641a2225db0a4bb6cdcfc3dd853304f8cbe77bf93aea9308842672c89594b6d4
-
SHA512
561274b9cb5d8d790e5d837c07d9b36483e70113457d052b9e53fe4d54e0adc544739e4cf74c7ec61e4e842020e8f8b0878b97c765e90684753398f436abfd9f
-
SSDEEP
12288:rQ7nkmzIrVVyzxMP4S4W2a63HeeE9WJXvCnViXF:rQ7nXIhVy9MP3SuMXVXF
Malware Config
Signatures
Files
-
Extend_01.exe.exe windows x86
857afdf6d48cbb2777ecadd962c59b7a
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
CreateDirectoryW
FindFirstFileA
FindClose
GetPrivateProfileStringA
ReadFile
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetModuleHandleW
LoadLibraryW
GetProcAddress
GetModuleHandleA
LoadLibraryA
WritePrivateProfileStringW
GetPrivateProfileStringW
GetLocalTime
CloseHandle
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ExitProcess
GetCurrentProcess
LocalFree
GetCommandLineW
SetCurrentDirectoryW
VirtualFree
GetModuleFileNameW
HeapSize
SetEndOfFile
GetFileAttributesExW
WriteConsoleW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
Sleep
SleepEx
GetTickCount
WaitForSingleObject
FreeLibrary
GetLastError
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
ExpandEnvironmentStringsA
SetLastError
FormatMessageA
VerSetConditionMask
GetSystemDirectoryA
VerifyVersionInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EncodePointer
RaiseException
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
CreateFileW
GetDriveTypeW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetFilePointerEx
WriteFile
GetACP
GetConsoleMode
ReadConsoleW
GetConsoleCP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStringTypeW
GetTimeZoneInformation
HeapReAlloc
GetCurrentDirectoryW
GetFullPathNameW
SetStdHandle
FlushFileBuffers
DecodePointer
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetProcessHeap
user32
GetWindowThreadProcessId
GetShellWindow
GetDesktopWindow
GetWindowRect
GetForegroundWindow
GetSystemMetrics
advapi32
CryptAcquireContextA
RegOpenKeyExW
RegCloseKey
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptReleaseContext
shell32
SHGetSpecialFolderPathW
CommandLineToArgvW
shlwapi
PathRemoveFileSpecW
PathIsDirectoryW
ws2_32
WSAIoctl
socket
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
setsockopt
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
recv
WSASetLastError
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
getaddrinfo
ntohs
wldap32
ord200
ord30
ord79
ord35
ord301
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord33
ord143
Sections
.text Size: 539KB - Virtual size: 538KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 93KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 21KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ