Static task
static1
Behavioral task
behavioral1
Sample
f4c863f065eaa1fdc7124de0d94b4ca2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f4c863f065eaa1fdc7124de0d94b4ca2.exe
Resource
win10v2004-en-20220113
General
-
Target
f4c863f065eaa1fdc7124de0d94b4ca2.exe
-
Size
140KB
-
MD5
f4c863f065eaa1fdc7124de0d94b4ca2
-
SHA1
b7c701a86dae269ecfa405376080dd2eb4e761b1
-
SHA256
22a6e850b9deb9d6682f795349d23c1f660ba5253028a99a62a43a64f2950fc3
-
SHA512
65847c5bb894ae984592699b0296f99ee071bbe28e368ac00cef5501655b8db0d0a54661e40e63444fde57de9e778a5852bdb24c6f3ede81cb576fbf62695c72
-
SSDEEP
3072:UD5kBd2HbR0X7h/1ky7YGccSXb2hp+CQQUk:UpWX7MZH6hJQNk
Malware Config
Signatures
Files
-
f4c863f065eaa1fdc7124de0d94b4ca2.exe.exe windows x86
9fa6fda3b52d9c76911daaba6b825179
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
HeapReAlloc
FindVolumeClose
FindFirstChangeNotificationW
FindResourceExW
HeapAlloc
EndUpdateResourceW
SetEnvironmentVariableW
GetEnvironmentStringsW
AddConsoleAliasW
SetEvent
FlushConsoleInputBuffer
SleepEx
GetTickCount
GetProcessHeap
FindActCtxSectionStringA
GlobalAlloc
InitAtomTable
FindNextVolumeW
GetTapePosition
WriteConsoleW
GetMailslotInfo
GetModuleFileNameW
CreateActCtxA
BindIoCompletionCallback
GetProcAddress
VirtualAlloc
BeginUpdateResourceW
GetAtomNameA
LoadLibraryA
GetModuleFileNameA
GetProcessAffinityMask
TlsFree
lstrcpyA
CreateFileW
HeapSize
DecodePointer
EncodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
GetLastError
WideCharToMultiByte
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
RtlUnwind
SetFilePointer
TlsAlloc
TlsGetValue
TlsSetValue
InterlockedIncrement
GetModuleHandleW
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapFree
CloseHandle
ExitProcess
WriteFile
FreeEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
CreateFileA
SetStdHandle
FlushFileBuffers
LoadLibraryW
RaiseException
MultiByteToWideChar
LCMapStringW
GetStringTypeW
SetEndOfFile
ReadFile
user32
SetCursorPos
Sections
.text Size: 78KB - Virtual size: 78KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gufav Size: 1024B - Virtual size: 626B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ