Static task
static1
Behavioral task
behavioral1
Sample
18faf22d7b96bfdb5fd806d4fe6fd9124b665b571d89cb53975bc3e23dd75ff1.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
18faf22d7b96bfdb5fd806d4fe6fd9124b665b571d89cb53975bc3e23dd75ff1.exe
Resource
win10v2004-en-20220113
General
-
Target
18faf22d7b96bfdb5fd806d4fe6fd9124b665b571d89cb53975bc3e23dd75ff1
-
Size
200KB
-
MD5
c8325c660ea72a8eb5281898f7a87f34
-
SHA1
dd318ffdd4b1081733dccf95cddb4e000814e005
-
SHA256
18faf22d7b96bfdb5fd806d4fe6fd9124b665b571d89cb53975bc3e23dd75ff1
-
SHA512
835ae5c5740c8a17973cb0e4265bd93925f59abdacdeb17b9d9eb53a3776c48ed7cfc0f5c044f9adf61be4d86f40059c6bca755faf3e9716bd46dc9dab6f328c
-
SSDEEP
3072:9FVOfXbtjE9gyOsDXSXdN4HKijSVIqDEExbXE2lLAa:jVQNE9VruNSFj7WEWL/LAa
Malware Config
Signatures
Files
-
18faf22d7b96bfdb5fd806d4fe6fd9124b665b571d89cb53975bc3e23dd75ff1.exe windows x64
140323b54ca264c55588b8c62dd1aacc
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
iphlpapi
GetIpNetTable
GetAdaptersAddresses
IcmpCloseHandle
IcmpCreateFile
IcmpSendEcho
kernel32
GetLastError
Process32NextW
GetCurrentThread
LoadLibraryA
GlobalAlloc
DeleteFileW
Process32FirstW
GlobalFree
Sleep
CreateThread
HeapAlloc
GetWindowsDirectoryW
GetProcAddress
VirtualAllocEx
LocalFree
ExitProcess
GetProcessHeap
FreeLibrary
CopyFileW
CreateRemoteThread
VirtualFreeEx
GetTickCount
CreateToolhelp32Snapshot
OpenProcess
GetModuleHandleA
GetVersionExW
CreateFileW
GetTempPathW
SetFilePointer
WaitForMultipleObjects
GetModuleFileNameW
VirtualAlloc
GetCurrentProcess
GetCommandLineW
VirtualFree
SetLastError
HeapFree
WriteProcessMemory
CloseHandle
SetFilePointerEx
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
TerminateProcess
GetModuleHandleExW
GetStdHandle
WriteFile
MultiByteToWideChar
WideCharToMultiByte
GetACP
LCMapStringW
GetStringTypeW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
advapi32
LookupAccountSidW
OpenThreadToken
EnumServicesStatusW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenSCManagerW
ImpersonateSelf
OpenProcessToken
GetTokenInformation
shell32
ShellExecuteW
CommandLineToArgvW
ws2_32
closesocket
WSAStartup
socket
bind
htons
sendto
setsockopt
WSACleanup
htonl
inet_addr
Sections
.text Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 188B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ