Static task
static1
Behavioral task
behavioral1
Sample
1156e9951df46c4854cf9bc5bb96101b0b923c4e10adcffc286a0a1078fcb3da.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
1156e9951df46c4854cf9bc5bb96101b0b923c4e10adcffc286a0a1078fcb3da.exe
Resource
win10v2004-en-20220112
General
-
Target
1156e9951df46c4854cf9bc5bb96101b0b923c4e10adcffc286a0a1078fcb3da
-
Size
366KB
-
MD5
2332f770b014f21bcc63c7bee50d543a
-
SHA1
21ef6f89c9604acdd15ec430343ada05640cb869
-
SHA256
1156e9951df46c4854cf9bc5bb96101b0b923c4e10adcffc286a0a1078fcb3da
-
SHA512
294a23b72d0a0c19071e96c5e2743e54f959788e8e4c7fd1122bbed988460ddcf9ec063f604f1d6d98968d45c16ee237caac1a8641f8bd4c500e5e6d7fcd6d91
-
SSDEEP
6144:Z/L8psq6rLrLrLTUSioV/uOcF0uGKPhHM3V50DErlNg/ydlb4fQ6wFMv/Y:Z/oUUWeDINg6dNoQl+v
Malware Config
Signatures
Files
-
1156e9951df46c4854cf9bc5bb96101b0b923c4e10adcffc286a0a1078fcb3da.exe windows x86
0dfac6f87622499b733593b1e61e25a1
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
MessageBoxA
GetForegroundWindow
DeferWindowPos
PostQuitMessage
ShutdownBlockReasonCreate
DefWindowProcA
AdjustWindowRect
EnumChildWindows
wsprintfW
ShutdownBlockReasonDestroy
RegisterClassExW
CreateWindowExW
GetMessageA
TranslateMessage
DispatchMessageA
AnimateWindow
ReleaseDC
wsprintfA
MessageBoxW
DestroyWindow
CloseWindow
gdi32
SetPixel
DeleteObject
SelectPalette
SetPaletteEntries
GetDeviceCaps
kernel32
HeapAlloc
lstrcpyA
VirtualFree
GetLastError
WaitForSingleObject
lstrcatA
GetProcAddress
lstrcatW
lstrlenW
CreateDirectoryW
ExitProcess
VirtualAlloc
CloseHandle
CreateFileW
TlsGetValue
lstrcpynW
WriteFile
FindNextFileW
lstrcmpW
TlsSetValue
OutputDebugStringW
FindClose
GetTickCount
LoadLibraryA
CreateThread
LocalAlloc
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
GetModuleHandleW
GetSystemDirectoryW
CreateProcessW
GetShortPathNameW
GetModuleHandleA
Sleep
lstrlenA
GetCurrentProcessId
VirtualQuery
VirtualProtect
IsBadReadPtr
FreeLibrary
lstrcmpA
AllocConsole
GetStdHandle
WriteConsoleW
UnmapViewOfFile
lstrcmpiW
lstrcpyW
SetFileAttributesW
MoveFileExW
FindFirstFileW
WaitForMultipleObjects
GetDriveTypeW
GetTickCount64
SetThreadExecutionState
GetCommandLineW
CreateMutexW
GetFileSizeEx
IsProcessorFeaturePresent
ReadFile
CreateFileMappingW
MapViewOfFile
GetCurrentProcess
LocalFree
GetUserDefaultUILanguage
InitializeCriticalSection
DeleteCriticalSection
SetLastError
EnterCriticalSection
LeaveCriticalSection
TerminateThread
GlobalAlloc
GlobalFree
Beep
GetVersionExA
ExpandEnvironmentStringsW
ExitThread
SetFilePointerEx
advapi32
LsaQueryTrustedDomainInfo
LsaCreateTrustedDomainEx
EqualDomainSid
LsaFreeMemory
CryptGenRandom
CryptDecrypt
CryptEncrypt
CryptImportKey
GetSidSubAuthority
GetSidSubAuthorityCount
LsaAddAccountRights
CryptReleaseContext
CryptDestroyKey
AreAllAccessesGranted
CryptExportKey
CryptGenKey
CryptAcquireContextW
LsaClose
LookupAccountSidW
EncryptionDisable
shell32
ShellExecuteExW
SHGetFolderPathW
secur32
LsaConnectUntrusted
netapi32
DsRoleGetPrimaryDomainInformation
DsRoleFreeMemory
shlwapi
StrStrW
StrToIntA
mpr
WNetOpenEnumW
WNetEnumResourceW
WNetCloseEnum
WNetAddConnection2W
ws2_32
shutdown
closesocket
connect
htons
inet_addr
WSAGetLastError
WSACleanup
socket
WSAStartup
inet_pton
send
gethostbyname
inet_ntoa
recv
wininet
InternetReadFile
InternetCloseHandle
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetCrackUrlA
InternetOpenA
crypt32
CryptBinaryToStringW
CryptBinaryToStringA
CryptStringToBinaryA
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
VariantClear
VariantInit
Sections
.text Size: 234KB - Virtual size: 234KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 66KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE