Behavioral task
behavioral1
Sample
b02494ffc1dab60510e6caee3c54695e24408e5bfa6621adcd19301cfc18e329.exe
Resource
win7-en-20211208
General
-
Target
b02494ffc1dab60510e6caee3c54695e24408e5bfa6621adcd19301cfc18e329
-
Size
162KB
-
MD5
ae48b4d1d0da879512b495ec1f80cf67
-
SHA1
b388243bf5899c99091ac2df13339f141659bbd4
-
SHA256
b02494ffc1dab60510e6caee3c54695e24408e5bfa6621adcd19301cfc18e329
-
SHA512
463df35f9275cd96a65d6db32ab33d8664daa413e4d0ff8c2da670c804468c8b8181db3a140f5d156300701b0647e52c0d15042ff81cb72bbac8e32f4aa643d4
-
SSDEEP
3072:7/gh9/7DnAiGOVnywTvTY/PCHc0DChGx5E1hJAPJ5z6kb/SrKS:zu9/7Dn/nywPYXJ0DWU5IkzNDSGS
Malware Config
Signatures
Files
-
b02494ffc1dab60510e6caee3c54695e24408e5bfa6621adcd19301cfc18e329.exe windows x86
3ca0b9f4c6370d5891b4cff3cbfe250f
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ole32
CoInitializeEx
CoInitializeSecurity
CoTaskMemFree
CoCreateInstance
CoUninitialize
oleaut32
VariantClear
VariantInit
SysFreeString
SysAllocString
shell32
SHGetKnownFolderPath
ws2_32
htonl
WSAStartup
WSACleanup
getaddrinfo
WSAGetLastError
rpcrt4
UuidCreate
winhttp
WinHttpSetOption
WinHttpSendRequest
WinHttpOpenRequest
WinHttpReadData
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpOpen
WinHttpReceiveResponse
WinHttpConnect
advapi32
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
GetUserNameW
SetSecurityDescriptorGroup
SetSecurityDescriptorDacl
kernel32
GetConsoleCP
HeapReAlloc
HeapSize
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetConsoleMode
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetStringTypeW
LCMapStringW
GetFileType
SetFilePointerEx
FlushFileBuffers
DecodePointer
WriteConsoleW
GetCPInfo
GetCurrentProcess
GetComputerNameExW
GetModuleHandleA
GetLastError
LoadLibraryA
GetProcAddress
FreeLibrary
WideCharToMultiByte
GetTickCount
ReadFile
GetModuleFileNameA
FindFirstFileW
FindNextFileW
lstrlenW
WriteFile
InterlockedDecrement
GetModuleFileNameW
SetFilePointer
FindClose
WaitForSingleObject
GetFileAttributesW
GetSystemWindowsDirectoryA
MultiByteToWideChar
Sleep
GetTempPathA
CopyFileA
CreateFileA
SetEvent
GetSystemDirectoryA
DeleteFileA
CloseHandle
GetLocalTime
GetSystemWow64DirectoryA
CreateProcessW
CreateEventA
GetSystemWindowsDirectoryW
EnterCriticalSection
LeaveCriticalSection
CreateFileW
GetShortPathNameA
GetTickCount64
TerminateThread
GetTempFileNameA
DeleteCriticalSection
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
RaiseException
RtlUnwind
SetLastError
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
GetACP
HeapFree
HeapAlloc
Sections
.text Size: 114KB - Virtual size: 113KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 320B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 648B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ