Static task
static1
Behavioral task
behavioral1
Sample
c3a3acd8241a5fa5c2f2d596e7b8aecb0e427e7b399ee5ef6c7dfea8d86ebdaa.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c3a3acd8241a5fa5c2f2d596e7b8aecb0e427e7b399ee5ef6c7dfea8d86ebdaa.exe
Resource
win10v2004-20220414-en
General
-
Target
c3a3acd8241a5fa5c2f2d596e7b8aecb0e427e7b399ee5ef6c7dfea8d86ebdaa
-
Size
1011KB
-
MD5
73528b74e4edb1c32a4d88abe34ae437
-
SHA1
b97c0fc8a34e88c03704e43829c550d765398a3c
-
SHA256
c3a3acd8241a5fa5c2f2d596e7b8aecb0e427e7b399ee5ef6c7dfea8d86ebdaa
-
SHA512
523cd56a44e91fc3084b76d68dbce6e77dac190716833cce455d2091894b403def7132475ec748b0d26fed90a4fcfc5d5f65f0eba098bc7d8ac4853ae9e547ec
-
SSDEEP
24576:Ah5jpOduRkWvdnnYccq+RXYZ0cap2IwufOOKqsc9H1aT:AhRpvNVnYnYdtI5wqDN1aT
Malware Config
Signatures
Files
-
c3a3acd8241a5fa5c2f2d596e7b8aecb0e427e7b399ee5ef6c7dfea8d86ebdaa.exe windows x86
d78be2161e8db64baed2febffc08cfe3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
CloseHandle
lstrcmpW
CreateProcessA
GetDriveTypeA
FindFirstFileW
FindNextFileW
FreeConsole
GetLogicalDrives
Process32First
Process32Next
GetLastError
SetLastError
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThread
GetThreadTimes
SetEndOfFile
WaitForSingleObject
TerminateProcess
CreateToolhelp32Snapshot
OpenProcess
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
HeapSize
HeapReAlloc
SetStdHandle
SetFilePointerEx
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
FormatMessageW
DuplicateHandle
WaitForSingleObjectEx
Sleep
GetCurrentProcess
SwitchToThread
GetCurrentThreadId
GetExitCodeThread
CreateDirectoryW
CreateFileW
DeleteFileW
FindFirstFileExW
GetDiskFreeSpaceExW
GetFileAttributesExW
GetFileInformationByHandle
RemoveDirectoryW
AreFileApisANSI
GetModuleHandleW
GetProcAddress
MoveFileExW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
InitializeSListHead
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
LoadLibraryW
RaiseException
RtlUnwind
ExitProcess
GetModuleHandleExW
ExitThread
GetModuleFileNameA
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
HeapAlloc
HeapFree
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetExitCodeProcess
GetFileType
advapi32
CryptReleaseContext
CryptAcquireContextA
CryptGenRandom
ws2_32
WSACleanup
WSAStartup
htons
ioctlsocket
closesocket
freeaddrinfo
getaddrinfo
inet_ntoa
inet_addr
WSAGetLastError
select
recv
ntohl
htonl
getpeername
connect
socket
setsockopt
send
Sections
.text Size: 742KB - Virtual size: 741KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 191KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ