Static task
static1
Behavioral task
behavioral1
Sample
7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe
Resource
win10v2004-20220310-en
General
-
Target
7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe
-
Size
586KB
-
MD5
55b95e36469a3600abb995e58f61d4c9
-
SHA1
de6717493246599d8702e7d1fd6914aab5bd015d
-
SHA256
7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a
-
SHA512
9b2eceff54340057b3eae7391b7c5205c3b2d6d13299b4b918fb1d1a5f6f1006079fc4c58b9dd589738927cf0580f5050c4e61448dd82a8d089f2ea9ddcb5e0a
Malware Config
Signatures
Files
-
7862d6e083c5792c40a6a570c1d3824ddab12cebc902ea965393fe057b717c0a.exe.exe windows x64
c26403ea8cfe82591aff1eaca9fb0431
Code Sign
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FindClose
CreateFileW
MultiByteToWideChar
GetLastError
lstrcatW
DeleteFileW
HeapReAlloc
CloseHandle
HeapAlloc
GetProcessHeap
GetModuleHandleW
lstrcpyW
GetTickCount
lstrcmpW
lstrlenA
lstrcpynW
TerminateProcess
WaitForMultipleObjects
GetEnvironmentVariableW
GetComputerNameExW
lstrcatA
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
CreateThread
SetFilePointerEx
ExitProcess
GlobalMemoryStatusEx
CreateProcessW
WideCharToMultiByte
WinExec
lstrcmpiW
MoveFileW
GetModuleFileNameW
RemoveDirectoryW
WriteFile
lstrlenW
FindNextFileW
HeapFree
FindFirstFileW
GetTempPathW
DecodePointer
ResetEvent
GetLogicalDrives
ReadFile
LoadLibraryW
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
ReleaseSemaphore
DuplicateHandle
VirtualFree
VirtualProtect
VirtualAlloc
GetVersionExW
GetModuleHandleA
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
DeleteTimerQueueTimer
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SetThreadPriority
SignalObjectAndWait
SetEvent
CreateTimerQueue
WriteConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
WaitForSingleObjectEx
Sleep
SwitchToThread
GetExitCodeThread
GetNativeSystemInfo
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetProcAddress
QueryPerformanceFrequency
GetCurrentThread
GetThreadTimes
RtlUnwindEx
InterlockedPushEntrySList
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
EncodePointer
FreeLibrary
LoadLibraryExW
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
LCMapStringW
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
advapi32
CryptAcquireContextA
CryptDestroyKey
CloseServiceHandle
CryptEncrypt
OpenSCManagerW
ControlService
CryptImportKey
OpenServiceW
CryptReleaseContext
CryptAcquireContextW
CryptGenRandom
shell32
SHGetFolderPathW
ShellExecuteW
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
SysAllocString
VariantClear
mpr
WNetEnumResourceW
WNetCloseEnum
WNetOpenEnumW
shlwapi
PathCombineW
wnsprintfW
wnsprintfA
StrCmpNA
StrStrA
StrStrW
wininet
InternetCrackUrlA
HttpOpenRequestW
InternetQueryOptionW
InternetQueryDataAvailable
InternetOpenW
InternetCrackUrlW
HttpSendRequestW
InternetCloseHandle
InternetConnectW
InternetSetOptionW
InternetReadFile
ws2_32
recv
connect
closesocket
inet_addr
send
socket
htons
Sections
.text Size: 380KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 139KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 38KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ