Static task
static1
Behavioral task
behavioral1
Sample
9651b11d911a149d32c48b23f0f60c3d049122fbad1157d6f523de0025fd5165.exe
Resource
win10-en-20211208
General
-
Target
9651b11d911a149d32c48b23f0f60c3d049122fbad1157d6f523de0025fd5165
-
Size
441KB
-
MD5
b9c0a397dcc8250901a7d6ca91a7fcae
-
SHA1
ee60159c6f091757f13a6d176008b8cc8bc5659d
-
SHA256
9651b11d911a149d32c48b23f0f60c3d049122fbad1157d6f523de0025fd5165
-
SHA512
82f683aef5bcd35c1a18ea53c27c45af3766dc497db20f0c6c8a2cfba4233fbc3b89ae48d3df3f413c36cdc3f6f4388a97e6f84f4f6df9daf1d959e380978142
-
SSDEEP
6144:KLzdIGZaXC5dF/teNuWZVCEEDLI6QJ2jlT9O+llGrds6qu4PF/EJleunLo:GqGZkA7/teNu/EEDLIrJ+TLSds6/0s
Malware Config
Signatures
Files
-
9651b11d911a149d32c48b23f0f60c3d049122fbad1157d6f523de0025fd5165.exe windows x86
d157c0a5c61be6cf8862631968209884
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LoadLibraryA
WriteProfileSectionW
GetNumaProcessorNode
FindFirstVolumeA
SetConsoleCursorInfo
HeapLock
FindFirstChangeNotificationW
WaitForSingleObject
GetNamedPipeHandleStateW
DosDateTimeToFileTime
CallNamedPipeW
EnumResourceTypesW
EnumResourceNamesW
TerminateProcess
ZombifyActCtx
GetConsoleAliasesLengthW
GetVersionExA
GetConsoleOutputCP
GetDefaultCommConfigA
GetCommConfig
WritePrivateProfileStructA
FreeEnvironmentStringsA
CreateTimerQueueTimer
FindNextVolumeA
LeaveCriticalSection
WriteConsoleInputW
TlsSetValue
SetComputerNameExW
FindAtomA
BuildCommDCBAndTimeoutsA
GlobalAlloc
EnterCriticalSection
TlsGetValue
GetCommandLineA
InterlockedExchange
GetCalendarInfoA
CopyFileW
ReleaseActCtx
OutputDebugStringA
FormatMessageW
GetPriorityClass
WritePrivateProfileStringA
HeapSize
TerminateThread
GlobalUnfix
HeapCompact
GetStartupInfoA
CreatePipe
GetCPInfoExA
GetWindowsDirectoryA
GetSystemWow64DirectoryA
WriteProfileSectionA
GetCalendarInfoW
DebugBreak
GetConsoleCursorInfo
SetLastError
DeleteVolumeMountPointW
DebugActiveProcessStop
lstrcmpA
GetPrivateProfileSectionNamesW
IsBadHugeWritePtr
GetProcAddress
GetSystemWindowsDirectoryW
CopyFileA
FindCloseChangeNotification
CreateActCtxW
GetMailslotInfo
GetPrivateProfileIntA
_lread
InterlockedDecrement
DefineDosDeviceW
SetVolumeMountPointA
EndUpdateResourceW
WriteConsoleA
VirtualProtect
InterlockedPushEntrySList
DeleteCriticalSection
GetFileAttributesExA
FileTimeToSystemTime
GetVolumePathNameA
GetConsoleMode
HeapWalk
GetComputerNameA
FindActCtxSectionStringW
WriteProcessMemory
MoveFileExA
DisableThreadLibraryCalls
GetOverlappedResult
GlobalCompact
UnregisterWait
FatalExit
InterlockedCompareExchange
WaitNamedPipeW
SetLocalTime
EnumCalendarInfoExA
OpenSemaphoreA
FreeEnvironmentStringsW
GetPrivateProfileStructA
SetMailslotInfo
lstrcpyW
VerLanguageNameW
LockFile
GetFileType
SetConsoleCP
GetConsoleAliasA
GetLargestConsoleWindowSize
FindAtomW
CreateMailslotW
EnumDateFormatsW
GetCommState
GetFileInformationByHandle
_lopen
GetConsoleAliasExesLengthA
GetWriteWatch
GetPrivateProfileStringA
ClearCommError
ChangeTimerQueueTimer
SetSystemTime
CreateIoCompletionPort
WriteConsoleInputA
GetLastError
SetFirmwareEnvironmentVariableA
MoveFileW
GetConsoleDisplayMode
GetSystemDefaultLangID
SetFilePointer
GetQueuedCompletionStatus
AreFileApisANSI
OpenWaitableTimerA
GetProcessVersion
GetNamedPipeHandleStateA
FillConsoleOutputCharacterA
FindNextVolumeMountPointW
WriteProfileStringW
InitAtomTable
AddAtomA
WriteConsoleOutputCharacterA
QueryInformationJobObject
QueryDosDeviceW
GetBinaryTypeW
VirtualAlloc
CreateFileA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
DeleteFileA
RaiseException
HeapValidate
IsBadReadPtr
GetModuleFileNameW
GetCurrentProcess
IsDebuggerPresent
GetModuleHandleW
Sleep
InterlockedIncrement
ExitProcess
GetModuleFileNameA
WriteFile
GetStdHandle
SetHandleCount
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStrings
WideCharToMultiByte
GetEnvironmentStringsW
TlsAlloc
TlsFree
HeapDestroy
HeapCreate
HeapFree
VirtualFree
HeapAlloc
HeapReAlloc
GetACP
GetOEMCP
GetCPInfo
IsValidCodePage
RtlUnwind
InitializeCriticalSectionAndSpinCount
WriteConsoleW
OutputDebugStringW
LoadLibraryW
GetConsoleCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
FlushFileBuffers
SetStdHandle
CloseHandle
user32
OemToCharW
winhttp
WinHttpReadData
Sections
.text Size: 156KB - Virtual size: 156KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 176KB - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 83KB - Virtual size: 82KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ