Behavioral task
behavioral1
Sample
0x00060000000231dd-137.exe
Resource
win7-20220414-en
General
-
Target
0x00060000000231dd-137.dat
-
Size
301KB
-
MD5
a28dd9f9e5e5b9cd4ed4678f272ae95b
-
SHA1
8baf92898954d076879daf50bcd2b895ecd15f83
-
SHA256
503f345095e5aa479b922a79aa479394a7ecedc9eba9d396a2a82c4649a479d1
-
SHA512
a20b9661804f8b787434d70c7beccddef9a013bd76cab31f94e7da1162b8ed764e195d626e3ae7522e5f4581c169cd34ae190eb60f2b370859d2994f5ab7e310
-
SSDEEP
6144:eseUsm5KWQFn3X5KhXfFsVWAylCMiL4t/xedj4OlWzfosa:eseDV3X5KhXfFs0lILa/xel4OlWzgv
Malware Config
Signatures
Files
-
0x00060000000231dd-137.dat.exe windows x86
daf766c710ab43c33f43ee5bbe293518
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
VirtualAlloc
LoadLibraryA
lstrcmpiW
LocalAlloc
FreeLibrary
VirtualProtect
HeapAlloc
HeapFree
GetProcessHeap
WideCharToMultiByte
LocalFree
CreateFileA
SetFilePointer
SystemTimeToFileTime
SetFileTime
WriteFile
GetFileAttributesA
ReadFile
CreateDirectoryA
GetCurrentDirectoryA
CloseHandle
LocalFileTimeToFileTime
GetFileSize
FindFirstFileW
lstrlenA
GetDriveTypeA
lstrcatA
lstrcmpW
SetCurrentDirectoryA
FindFirstFileA
GetLogicalDriveStringsA
GetLastError
CopyFileA
FindClose
FindNextFileA
lstrcatW
CreateMutexA
FindNextFileW
DeleteFileW
GetCurrentProcessId
GetSystemTime
lstrcpyW
DeleteFileA
CreateThread
CopyFileW
Process32First
OpenProcess
TerminateProcess
Sleep
GetFileSizeEx
Process32Next
GetPrivateProfileSectionNamesA
CreateToolhelp32Snapshot
lstrcpyA
GetComputerNameA
GetUserDefaultLocaleName
GlobalMemoryStatus
GetLocaleInfoA
TzSpecificLocalTimeToSystemTime
GetTimeZoneInformation
IsWow64Process
GetSystemInfo
GetModuleHandleA
GetTickCount
GetFileAttributesW
CreateFileW
MultiByteToWideChar
UnmapViewOfFile
GetLocalTime
GetFileInformationByHandle
VirtualAllocExNuma
VirtualFree
GetCurrentProcess
WriteConsoleW
SetEndOfFile
CompareStringW
SetStdHandle
LoadLibraryW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetLocaleInfoW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
SetEnvironmentVariableA
SetEnvironmentVariableW
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetCurrentThreadId
FileTimeToSystemTime
ExitProcess
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
HeapReAlloc
GetCommandLineA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
LCMapStringW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
GetModuleHandleW
HeapCreate
GetStdHandle
GetModuleFileNameW
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetFileType
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
shell32
ShellExecuteA
SHGetFolderPathA
SHFileOperationA
ShellExecuteExA
shlwapi
ord155
PathMatchSpecA
PathMatchSpecW
gdiplus
GdipGetImageEncodersSize
GdiplusShutdown
GdipAlloc
GdipFree
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipGetImageEncoders
GdipSaveImageToFile
GdipCloneImage
GdiplusStartup
Sections
.text Size: 219KB - Virtual size: 218KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ