Static task
static1
Behavioral task
behavioral1
Sample
a641c3189ae0259507e027e65de7e214d2a5a9b394c3489700d6847c7297a18e.exe
Resource
win10-en-20211208
General
-
Target
a641c3189ae0259507e027e65de7e214d2a5a9b394c3489700d6847c7297a18e
-
Size
334KB
-
MD5
0bc66b21901b127a1ebc4097e9ed4790
-
SHA1
16f499816b778c7b7a6a28c3b60e7e44dc414c7e
-
SHA256
a641c3189ae0259507e027e65de7e214d2a5a9b394c3489700d6847c7297a18e
-
SHA512
363c785efe9cefe8c5f773e7fe5c603fc97c9d4688d263362a89276cb50ca60d25a60f6d42a1d03fcf04ddc948dc95a43c6f46ac3b1bfe5671ceb1a998c14d01
-
SSDEEP
6144:v4IwvrvXG4Mb+JAB7xNkM4lxTVU0M5LNdew6GjLt+ptuXWlZvT:vXo+++pTB4lxTVU0MzdehGjR+p8ml
Malware Config
Signatures
Files
-
a641c3189ae0259507e027e65de7e214d2a5a9b394c3489700d6847c7297a18e.exe windows x86
aa2b22e8e3b96fd546a63d71626f45a6
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateNamedPipeW
TerminateThread
DeactivateActCtx
GetConsoleAliasesLengthW
GetVersionExW
GetConsoleOutputCP
GetDefaultCommConfigW
FindFirstFileExW
GetDriveTypeW
FreeEnvironmentStringsW
GetProcessPriorityBoost
SetVolumeMountPointW
SetCurrentDirectoryW
GetLongPathNameA
TlsGetValue
SetComputerNameExW
FindAtomA
BuildCommDCBAndTimeoutsW
VirtualProtect
GetModuleHandleA
GlobalAlloc
InitializeCriticalSection
TlsSetValue
GetCommandLineA
InterlockedDecrement
GetCalendarInfoA
CopyFileW
ZombifyActCtx
OutputDebugStringW
GetSystemTimeAdjustment
GetPriorityClass
WritePrivateProfileStringW
GetProcessHeap
GetProcessHeaps
GlobalUnWire
HeapCompact
GetStartupInfoA
GetDiskFreeSpaceExW
GetCPInfoExW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
GetLastError
GetProfileStringW
WriteProfileSectionW
GetProfileStringA
GetConsoleCursorInfo
SetLastError
DeleteVolumeMountPointA
DebugBreak
GetPrivateProfileSectionW
ReadFileScatter
GetNumberOfConsoleInputEvents
GetSystemWindowsDirectoryW
TerminateProcess
GlobalFindAtomA
FindCloseChangeNotification
CreateActCtxA
SetMailslotInfo
InterlockedExchange
DefineDosDeviceA
SetVolumeMountPointA
EndUpdateResourceA
WriteConsoleW
GetPrivateProfileSectionA
WritePrivateProfileSectionW
GetPrivateProfileStructA
TryEnterCriticalSection
GetFileAttributesExW
FileTimeToLocalFileTime
MoveFileA
GetVolumePathNameW
HeapUnlock
GetComputerNameA
FindActCtxSectionStringA
SetThreadContext
MoveFileExA
GetOverlappedResult
GlobalUnlock
UnregisterWait
BuildCommDCBW
GlobalDeleteAtom
GetShortPathNameA
OpenEventW
SetCommTimeouts
WaitNamedPipeA
CreateIoCompletionPort
FindResourceExW
GetSystemTimeAsFileTime
GetSystemInfo
SetLocalTime
OpenSemaphoreA
FreeEnvironmentStringsA
lstrcmpW
GetProcAddress
GetPrivateProfileSectionNamesA
SetFileShortNameW
lstrcpyW
VerLanguageNameA
GetThreadSelectorEntry
SetSystemTime
UnlockFile
GetConsoleCP
GetConsoleAliasW
SetConsoleScreenBufferSize
AllocConsole
GetAtomNameA
WriteConsoleInputW
TransactNamedPipe
SetCommState
SetHandleCount
_lopen
ResetWriteWatch
EnumDateFormatsW
GetConsoleAliasExesLengthA
WriteConsoleOutputCharacterW
HeapReAlloc
OpenMutexA
GetStringTypeW
SetFilePointer
PostQueuedCompletionStatus
AreFileApisANSI
CancelWaitableTimer
GetCurrentProcess
GetNamedPipeHandleStateA
GetCompressedFileSizeW
FindNextVolumeMountPointA
GetFullPathNameW
WriteProfileStringW
DeleteAtom
GlobalAddAtomA
TerminateJobObject
QueryDosDeviceW
LeaveCriticalSection
SetFirmwareEnvironmentVariableW
GetBinaryTypeW
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
InterlockedCompareExchange
Sleep
DeleteCriticalSection
EnterCriticalSection
RaiseException
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleFileNameW
LCMapStringA
LCMapStringW
GetCPInfo
HeapValidate
IsBadReadPtr
GetModuleHandleW
TlsAlloc
GetCurrentThreadId
TlsFree
GetStdHandle
WriteFile
OutputDebugStringA
GetFileType
ExitProcess
LoadLibraryW
GetModuleFileNameA
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetEnvironmentStrings
GetEnvironmentStringsW
HeapDestroy
HeapCreate
HeapFree
VirtualFree
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
HeapAlloc
HeapSize
VirtualAlloc
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
FlushFileBuffers
GetConsoleMode
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetLocaleInfoW
SetStdHandle
WriteConsoleA
CloseHandle
CreateFileA
DeleteFileA
user32
OemToCharA
msimg32
AlphaBlend
Sections
.text Size: 211KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 67KB - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ritaga Size: 512B - Virtual size: 5B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ