Static task
static1
Behavioral task
behavioral1
Sample
21d376f0ec63236e590e58add44c00647588fdeb52b59f34efa43d5219520fb4.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
21d376f0ec63236e590e58add44c00647588fdeb52b59f34efa43d5219520fb4.exe
Resource
win10v2004-20220414-en
General
-
Target
21d376f0ec63236e590e58add44c00647588fdeb52b59f34efa43d5219520fb4
-
Size
616KB
-
MD5
87e30ba93b9ebff6e00c0a802530e5fe
-
SHA1
e54d3e6f3f7033b03db038a6ea43192e26c7792e
-
SHA256
21d376f0ec63236e590e58add44c00647588fdeb52b59f34efa43d5219520fb4
-
SHA512
5471ca2af9c61913cd5449a9d49d275a4bcdcc042e109a66e077a57a989bdf9e7a153c6c9ba8837d03927e8177d4e66245f290b83f2c3dc92793f66e210c2bef
-
SSDEEP
12288:LaR/DXT3c9E2Zgj+x+rC1Zhr2yd0dsKIfi95ukk4N:L4/7T3c9E2kziGy0iji9o4N
Malware Config
Signatures
Files
-
21d376f0ec63236e590e58add44c00647588fdeb52b59f34efa43d5219520fb4.exe windows x86
12a69483b4e40791a8546ca254a808af
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetFolderPathW
ShellExecuteW
kernel32
InitializeCriticalSection
InterlockedDecrement
MulDiv
LeaveCriticalSection
EnterCriticalSection
FlushInstructionCache
GetCurrentProcess
LocalFree
GetTempPathW
CloseHandle
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetExitCodeThread
CreateThread
TlsAlloc
TlsFree
TlsGetValue
GlobalFree
CreateFileW
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
GetWindowsDirectoryW
DeviceIoControl
GetLastError
GetVersionExW
GetVolumeInformationW
WaitForSingleObject
CreateRemoteThread
GetProcAddress
GetCurrentThreadId
CompareFileTime
SystemTimeToFileTime
GetStartupInfoW
lstrlenA
MultiByteToWideChar
GetSystemDirectoryW
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenW
Sleep
user32
GetDC
GetActiveWindow
DialogBoxParamW
PostThreadMessageW
FindWindowW
GetWindowThreadProcessId
PostMessageW
ShowWindow
InvalidateRect
UpdateWindow
GetMessageW
DispatchMessageW
DestroyWindow
CallWindowProcW
ReleaseDC
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
RedrawWindow
IsWindow
FillRect
MessageBoxW
GetWindowTextW
SetFocus
HideCaret
SetWindowLongW
CreateWindowExW
GetWindowDC
DefWindowProcW
GetWindowLongW
GetParent
GetWindow
SystemParametersInfoW
MapWindowPoints
SetWindowPos
EndDialog
GetWindowRect
MoveWindow
GetClientRect
SendMessageW
SetWindowTextW
gdi32
GetDeviceCaps
CreateFontIndirectW
CreateSolidBrush
GetTextExtentPoint32W
DeleteDC
DeleteObject
CreateFontW
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
IsTextUnicode
ole32
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromProgID
oleaut32
OleLoadPicture
SysAllocString
VariantInit
VariantCopy
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysFreeString
VariantChangeType
CreateErrorInfo
msvcp60
?do_scan_not@?$ctype@G@std@@MBEPBGFPBG0@Z
?do_tolower@?$ctype@G@std@@MBEPBGPAGPBG@Z
?do_tolower@?$ctype@G@std@@MBEGG@Z
?do_toupper@?$ctype@G@std@@MBEPBGPAGPBG@Z
?do_toupper@?$ctype@G@std@@MBEGG@Z
?do_widen@?$ctype@G@std@@MBEPBDPBD0PAG@Z
?do_widen@?$ctype@G@std@@MBEGD@Z
?do_narrow@?$ctype@G@std@@MBEPBGPBG0DPAD@Z
?do_narrow@?$ctype@G@std@@MBEDGD@Z
??1?$ctype@D@std@@UAE@XZ
??0_Lockit@std@@QAE@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I_N@Z
?_Iscloc@locale@std@@QBE_NXZ
??0?$ctype@D@std@@QAE@PBF_NI@Z
??1_Lockit@std@@QAE@XZ
??_7bad_cast@std@@6B@
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z
?do_tolower@?$ctype@D@std@@MBEDD@Z
?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z
?do_toupper@?$ctype@D@std@@MBEDD@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??1locale@std@@QAE@XZ
??0locale@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?do_is@?$ctype@G@std@@MBE_NFG@Z
?do_is@?$ctype@G@std@@MBEPBGPBG0PAF@Z
??0?$ctype@G@std@@QAE@I@Z
?_Xran@std@@YAXXZ
?id@?$ctype@G@std@@2V0locale@2@A
??1?$ctype@G@std@@UAE@XZ
?_Incref@facet@locale@std@@QAEXXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBGI@Z
?do_scan_is@?$ctype@G@std@@MBEPBGFPBG0@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0runtime_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0runtime_error@std@@QAE@ABV01@@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Xlen@std@@YAXXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_Doraise@runtime_error@std@@MBEXXZ
?what@runtime_error@std@@UBEPBDXZ
??_7runtime_error@std@@6B@
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
msvcrt
fclose
fwrite
_wfopen
srand
clock
_wgetenv
??0exception@@QAE@ABV0@@Z
abs
time
_CxxThrowException
_wtol
_lrotr
malloc
free
wcstok
_wsplitpath
strcpy
rand
??0exception@@QAE@ABQBD@Z
sprintf
strncpy
memcmp
strcat
isalnum
_lrotl
wcscat
localtime
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_findclose
wcscmp
_wfindnext
_wfindfirst
_wgetcwd
__CxxFrameHandler
swprintf
memcpy
wcslen
wcschr
??2@YAPAXI@Z
_ftol
strlen
__p___wargv
__p___argc
_wremove
_waccess
_wcsicmp
??1exception@@UAE@XZ
wcscpy
memset
fabs
wcsncpy
_wcsnicmp
_wmkdir
_wchdir
Sections
.text Size: 76KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 496KB - Virtual size: 492KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ