Static task
static1
Behavioral task
behavioral1
Sample
c7e52cc6f1f659ec5d30473e89b7136216de5fbe53ec77a62f1a486d8ffe78ed.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c7e52cc6f1f659ec5d30473e89b7136216de5fbe53ec77a62f1a486d8ffe78ed.exe
Resource
win10v2004-en-20220113
General
-
Target
c7e52cc6f1f659ec5d30473e89b7136216de5fbe53ec77a62f1a486d8ffe78ed
-
Size
100KB
-
MD5
bb0a17a7e856d61bd43c62a822d96b07
-
SHA1
aca43b3ca96ca6c80219d9e4ed8d498001313c5e
-
SHA256
c7e52cc6f1f659ec5d30473e89b7136216de5fbe53ec77a62f1a486d8ffe78ed
-
SHA512
8ee7b45476d3efdfdf3161c474c347b39a954ae04042f8f9b5a0a2db7291982a253c924d0668d942c253fd7c25fda7a3270cfaacd00de2a960d8065bb5c01f77
-
SSDEEP
1536:gHIPkRUedYttp2bd/B8quuaOY2IfpW+VQJFsW69cdCeRk28+axHPjsb5:EYtLqJSquu42CW+VwisCgk2DaxHPj+5
Malware Config
Signatures
Files
-
c7e52cc6f1f659ec5d30473e89b7136216de5fbe53ec77a62f1a486d8ffe78ed.exe windows x86
ecf8f06eaa7a27093275957985742b1a
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcatW
GlobalAlloc
DeleteFileW
lstrcpyA
GlobalFree
CloseHandle
CreateThread
MoveFileExW
lstrcpyW
CreateFileMappingW
MapViewOfFile
lstrcmpW
BeginUpdateResourceA
EraseTape
FindFirstVolumeW
GetProfileSectionW
GetCurrentProcess
lstrlenW
CancelDeviceWakeupRequest
TerminateProcess
GlobalUnWire
GetConsoleTitleW
EnumResourceNamesW
CreateMutexW
OpenFile
EnumSystemCodePagesW
CancelThreadpoolIo
GlobalDeleteAtom
QueryMemoryResourceNotification
GetACP
OpenProcess
FindFirstVolumeMountPointA
FindActCtxSectionStringA
CreateToolhelp32Snapshot
Sleep
SetFileAttributesW
GetConsoleAliasesLengthW
CreateFileW
CreateFileA
DefineDosDeviceA
GetSystemFileCacheSize
GetCurrentThread
GetSystemDirectoryA
Process32FirstW
GlobalFindAtomW
QueueUserAPC
LocalSize
FindAtomA
ExitProcess
FreeLibrary
GetSystemTime
GlobalUnlock
GetDriveTypeW
FindFirstFileTransactedA
CreateTimerQueue
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
DecodePointer
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetLastError
UnmapViewOfFile
WaitForSingleObject
ReadFile
FindClose
lstrlenA
SetFilePointer
SetErrorMode
VirtualAlloc
GetProcessHeap
GetStringTypeW
GetFileType
WriteFile
FindNextFileW
VirtualFree
FindFirstFileW
Process32NextW
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetModuleHandleExW
HeapFree
HeapAlloc
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
RaiseException
user32
EqualRect
DestroyIcon
EnumWindows
CharUpperBuffW
GetDesktopWindow
GetWindowTextW
wsprintfW
GetLastActivePopup
gdi32
CreateDIBPatternBrush
advapi32
CryptGenKey
CryptExportKey
CryptEncrypt
CryptAcquireContextW
CryptDestroyKey
CryptReleaseContext
shell32
SHGetSpecialFolderPathW
shlwapi
StrStrW
crypt32
CryptImportPublicKeyInfoEx
CryptStringToBinaryA
CryptDecodeObjectEx
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
Sections
.text Size: 51KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 172B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ