Static task
static1
Behavioral task
behavioral1
Sample
8a247a04783a7f2c1bda188afc2193a523001e698543fc3175375767833f66a0.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
8a247a04783a7f2c1bda188afc2193a523001e698543fc3175375767833f66a0.exe
Resource
win10v2004-20220414-en
General
-
Target
8a247a04783a7f2c1bda188afc2193a523001e698543fc3175375767833f66a0
-
Size
323KB
-
MD5
d83653278606c5f648c78ad1b6555c64
-
SHA1
8446eca4631b6153560ad382f63274649e7426b3
-
SHA256
8a247a04783a7f2c1bda188afc2193a523001e698543fc3175375767833f66a0
-
SHA512
3ffdb5d5102db1d4e7b4c4e4f3cdb095dfa446cec8c22fc1707e3983b3bd39d85d33ff48d1a163a69ab81c3598d31188c1aee612b6cb1ec69016f768debce89e
-
SSDEEP
6144:oQCoLH76c74MJtPYD/D7S0TQvVHpR5xoAQzafK:oloqc7h5k/D7SQQDPI7
Malware Config
Signatures
Files
-
8a247a04783a7f2c1bda188afc2193a523001e698543fc3175375767833f66a0.exe windows x86
b1774d08863eb2be39620b5977383fac
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalAlloc
InterlockedIncrement
GetConsoleCP
GetPrivateProfileSectionW
SetEvent
DeleteCriticalSection
LocalLock
WriteFile
ReadFileEx
FindActCtxSectionGuid
FindActCtxSectionStringW
SetFileShortNameW
ResetEvent
ReleaseSemaphore
SleepEx
WaitForSingleObject
FindResourceExA
EndUpdateResourceA
GetConsoleTitleW
FreeConsole
SetConsoleTitleA
AttachConsole
ActivateActCtx
ReadConsoleW
ZombifyActCtx
ReleaseActCtx
HeapUnlock
HeapValidate
GetProcessHeaps
LoadLibraryA
GetProcAddress
CommConfigDialogA
HeapAlloc
GetCurrentProcess
lstrlenW
SetHandleInformation
GetModuleFileNameA
GetFileAttributesA
ReadFile
InterlockedDecrement
Sleep
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
RaiseException
RtlUnwind
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError
HeapFree
TerminateProcess
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapSize
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetLocaleInfoA
GetStringTypeA
MultiByteToWideChar
GetStringTypeW
InitializeCriticalSectionAndSpinCount
SetStdHandle
WideCharToMultiByte
CloseHandle
CreateFileA
LCMapStringA
LCMapStringW
GetConsoleMode
FlushFileBuffers
SetEndOfFile
GetProcessHeap
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
gdi32
GetCharWidthFloatW
advapi32
ReportEventW
Sections
.text Size: 87KB - Virtual size: 86KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 160KB - Virtual size: 73.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cediyon Size: 512B - Virtual size: 346B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tidam Size: 1024B - Virtual size: 626B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rut Size: 512B - Virtual size: 23B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.hadulu Size: 512B - Virtual size: 6B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zivica Size: 1024B - Virtual size: 963B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ