Static task
static1
Behavioral task
behavioral1
Sample
4eadab98bb726919ff7748c567a9635981a538e92b83d273b7c5ac02c0b7e40e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
4eadab98bb726919ff7748c567a9635981a538e92b83d273b7c5ac02c0b7e40e.exe
Resource
win10v2004-en-20220113
General
-
Target
4eadab98bb726919ff7748c567a9635981a538e92b83d273b7c5ac02c0b7e40e
-
Size
736KB
-
MD5
a4ed08dd58d17c8c8b5ab9c98fb65829
-
SHA1
5ce970bf1623baee0c6025a7c6316bc4a2532e8a
-
SHA256
4eadab98bb726919ff7748c567a9635981a538e92b83d273b7c5ac02c0b7e40e
-
SHA512
3a4940bf14d1c091d2d6c3c0a9e2ee07c9835142bcdd192731880dfe7ca68a31deabc94ef0ef1edcdf8dc4af26822dd928de56be8fe9c36a3c17978f787d8733
-
SSDEEP
12288:OfvxwVee32twtyZXBWo3V4egOPDcI+hUYGmge/rUB0UW4jHeETs7ju6RKqiKvIo:OfB92ty6uuzhEooB0UW4DeETOjJR3ko
Malware Config
Signatures
Files
-
4eadab98bb726919ff7748c567a9635981a538e92b83d273b7c5ac02c0b7e40e.exe windows x86
6e3086672ec8625cc086cf37febd4303
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
WriteConsoleOutputCharacterW
lstrcmp
FindFirstVolumeMountPointW
ReadConsoleInputA
SetEndOfFile
CreateFileW
ReadConsoleW
WriteConsoleW
SetStdHandle
LoadLibraryW
LoadLibraryExW
OutputDebugStringW
CreatePipe
HeapReAlloc
EnumSystemLocalesEx
IsValidLocaleName
LCMapStringEx
GetUserDefaultLocaleName
GetModuleHandleW
TerminateProcess
GetCurrentProcess
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount64
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetProcessHeap
SetFilePointerEx
CreateJobObjectW
ReadFile
SetFilePointer
GetStartupInfoW
InitOnceExecuteOnce
LocalCompact
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
Sleep
EncodePointer
DecodePointer
GetLocaleInfoEx
MultiByteToWideChar
GetStringTypeW
GetLastError
HeapFree
RaiseException
RtlUnwind
GetCommandLineW
InitializeCriticalSectionAndSpinCount
GetCPInfo
HeapAlloc
IsProcessorFeaturePresent
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
HeapSize
IsDebuggerPresent
IsValidCodePage
GetACP
GetOEMCP
SetLastError
GetCurrentThreadId
CloseHandle
FlushFileBuffers
GetConsoleCP
GetConsoleMode
GetFileType
SetConsoleMode
comdlg32
ChooseColorA
PageSetupDlgA
FindTextA
GetOpenFileNameA
rtutils
TracePrintfExW
RouterLogRegisterA
TraceRegisterExA
TraceDumpExA
loadperf
UnloadPerfCounterTextStringsW
UnloadPerfCounterTextStringsA
LoadPerfCounterTextStringsW
LoadPerfCounterTextStringsA
msacm32
acmDriverAddW
acmFormatTagEnumW
acmFormatTagDetailsW
acmDriverDetailsW
acmDriverMessage
acmStreamConvert
acmFormatChooseA
acmStreamMessage
user32
UnpackDDElParam
ChangeMenuA
GetMenuState
LoadIconW
CallWindowProcW
GetClipCursor
IsCharAlphaA
CreateMDIWindowA
OemToCharBuffW
shlwapi
UrlHashW
PathUnmakeSystemFolderW
StrCatW
SHRegOpenUSKeyW
UrlApplySchemeW
UrlCombineW
SHRegEnumUSKeyW
StrDupW
msvfw32
DrawDibSetPalette
MCIWndCreate
DrawDibGetBuffer
ICSeqCompressFrame
avifil32
AVIStreamWrite
AVIFileAddRef
Sections
.code Size: 139KB - Virtual size: 138KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 579KB - Virtual size: 579KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ