Static task
static1
Behavioral task
behavioral1
Sample
0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe
Resource
win10v2004-en-20220113
General
-
Target
0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076
-
Size
594KB
-
MD5
0faf60f6b58a9280cd519653658a95a7
-
SHA1
5f24e4075ebc1e44747093a996e346e013004821
-
SHA256
0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076
-
SHA512
b1ee924b7a13819e8d0bbd36226093183bd9e5cb4d91021866d1f61aa69ada6174c19854ba30469e232c6e15e4f0f2ad040f315d47484a27c9dc97fbc337ead5
Malware Config
Signatures
Files
-
0ba919e648d9ff676a60f464bbc4dda922bfabd3b9a082edc61d6bafdcaad076.exe windows x86
dcf092b576329b73157729f2065702c4
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetConsoleCP
FlushFileBuffers
LCMapStringEx
HeapSize
GetStringTypeW
HeapReAlloc
HeapAlloc
RtlUnwind
LoadLibraryW
OutputDebugStringW
GetConsoleMode
LoadLibraryExW
IsDebuggerPresent
GetCPInfo
SetStdHandle
SetFilePointerEx
WriteConsoleW
CloseHandle
GetOEMCP
GetACP
IsValidCodePage
Sleep
HeapFree
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
TerminateProcess
GetCurrentProcess
FlsFree
FlsSetValue
FindResourceW
LoadResource
VirtualProtect
FlsGetValue
FlsAlloc
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTickCount64
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
InitOnceExecuteOnce
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetFileType
GetCommandLineA
IsProcessorFeaturePresent
GetLastError
SetLastError
InterlockedIncrement
InterlockedDecrement
GetCurrentThreadId
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
GetProcessHeap
CreateFileW
oleaut32
VarBstrFromCy
VarUI4FromCy
VarDecFromI1
VarUI1FromR8
shell32
SHGetPathFromIDListW
SHBrowseForFolder
winspool.drv
ord208
OpenPrinterW
WaitForPrinterChange
AddPrinterDriverExA
DeletePrinterDataW
mpr
WNetCloseEnum
WNetGetConnectionA
WNetGetNetworkInformationW
WNetDisconnectDialog1A
odbc32
ord30
ord241
ord106
ord75
ord140
ord206
ord221
OpenODBCPerfData
crypt32
CertSerializeCTLStoreElement
CryptExportPublicKeyInfoEx
CryptDecodeObject
CryptEncodeObject
wsnmp32
ord402
ord301
ord605
ord102
ord101
ord320
rtm
RtmDequeueRouteChangeMessage
RtmGetFirstRoute
MgmGetNextMfe
MgmInitialize
RtmDeregisterClient
gdi32
GetDeviceCaps
GetFontUnicodeRanges
GetEnhMetaFileDescriptionW
netapi32
NetAuditClear
NetErrorLogClear
NetAuditWrite
shlwapi
ord432
StrChrW
StrRChrIA
rpcrt4
RpcNsBindingInqEntryNameW
I_RpcMapWin32Status
usp10
ScriptIsComplex
winmm
waveOutSetVolume
mmioWrite
Sections
.text Size: 47KB - Virtual size: 46KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 525KB - Virtual size: 525KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ