@shutting@0
Static task
static1
Behavioral task
behavioral1
Sample
3168462b40b11698b32fa1f90b8d684cba056ff88837ad67efad1d203641deec.exe
Resource
win7-en-20211208
General
-
Target
3168462b40b11698b32fa1f90b8d684cba056ff88837ad67efad1d203641deec
-
Size
979KB
-
MD5
adc8c26038ab606b280ce3ea693b5bc4
-
SHA1
b2a2a0c749adb844e94b33c141e3044387b688b2
-
SHA256
3168462b40b11698b32fa1f90b8d684cba056ff88837ad67efad1d203641deec
-
SHA512
d0e46ebf72244663c58a320d81e631f731a3ab84bd9e9be05e69259fa0d7166d6213b9c61e4f8e6dde0400f94a92afdbcee36190d97ef141e0ec4cad7797c70c
-
SSDEEP
24576:UCI+NoTJ7MSDmgQ9+ywYIyriG9OsAVNC/o2JXLCA2EKjvIPsamli9:XIqkJJmguENCjB2Z0Ei
Malware Config
Signatures
Files
-
3168462b40b11698b32fa1f90b8d684cba056ff88837ad67efad1d203641deec.exe windows x86
866e5d92f245e7bba51bf44e358ab7a3
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
_lcreat
GetProcessPriorityBoost
FindAtomA
OpenFileMappingA
GetLongPathNameW
GetLargestConsoleWindowSize
GetConsoleAliasA
MapViewOfFile
GetNumaNodeProcessorMask
SetNamedPipeHandleState
ConnectNamedPipe
CreatePipe
DisconnectNamedPipe
IsBadStringPtrA
OpenProcess
GetProcessAffinityMask
GetProcessIoCounters
GetVolumeInformationA
SetVolumeLabelA
GetPrivateProfileStringA
GetQueuedCompletionStatus
CreateIoCompletionPort
WideCharToMultiByte
MultiByteToWideChar
GetConsoleOutputCP
SetCommBreak
ClearCommError
HeapAlloc
SetConsoleWindowInfo
GetTickCount
FindFirstFileExA
LoadResource
GlobalAlloc
GetProcAddress
GetModuleHandleW
GetThreadSelectorEntry
GetExitCodeThread
GetEnvironmentVariableW
GetAtomNameA
SetConsoleScreenBufferSize
BuildCommDCBAndTimeoutsW
GetLastError
CreateMailslotW
SetPriorityClass
FindFirstVolumeMountPointA
WriteConsoleW
CloseHandle
FlushFileBuffers
PurgeComm
SleepEx
GetConsoleMode
GetConsoleCP
LoadLibraryW
InterlockedIncrement
InterlockedDecrement
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
HeapFree
RaiseException
GetCommandLineW
HeapSetInformation
GetStartupInfoW
LCMapStringW
GetCPInfo
RtlUnwind
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
SetFilePointer
ExitProcess
WriteFile
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
GetLocaleInfoW
HeapReAlloc
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetStdHandle
CreateFileW
user32
GetCaretPos
ClientToScreen
advapi32
RegisterEventSourceW
msimg32
TransparentBlt
AlphaBlend
Exports
Exports
Sections
.text Size: 89KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 836KB - Virtual size: 40.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ