Behavioral task
behavioral1
Sample
137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46.exe
Resource
win10v2004-20220414-en
General
-
Target
137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46
-
Size
108KB
-
MD5
0a8fdbfbffe62f5e31cb908230eed094
-
SHA1
a1cba447dc1e40cf7745ac7fc3c52d0cebfb3165
-
SHA256
137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46
-
SHA512
d7a41966119e48a281efa191b83c71561f6f4d4437d0e46088265b219a062d0ef1ded09c4bb5f63ab69b4ba1c7978c33b1e0040f1f38bd9835c6df019adfb165
-
SSDEEP
1536:u5lYFkueCTMjAnuPOp0wcJy8czZItFBvN:u5lY9TMZzRy8i2t/1
Malware Config
Extracted
hancitor
20poi02
http://cetotrumo.com/4/forum.php
http://kedwronnading.ru/4/forum.php
http://toldbutheda.ru/4/forum.php
Signatures
-
Hancitor family
Files
-
137ae44ea6f625a3dae762a668b68c96b10f953e5b407d3f5600da096a014f46.exe windows x86
415c715b12d8448be852c88e3398f7d6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetWindowsDirectoryA
VirtualProtect
GetComputerNameExW
GetLongPathNameA
CreateProcessW
GetLocalTime
GetCurrentDirectoryW
gdi32
CreatePen
GetStockObject
GetDeviceCaps
CreateDIBSection
TextOutW
LineTo
MoveToEx
Polyline
GetTextExtentPointW
GetTextExtentPoint32W
GetTextMetricsW
SelectObject
DeleteObject
CreateFontIndirectW
PatBlt
SetBkColor
SetTextColor
PtVisible
CreateSolidBrush
user32
GetFocus
GetForegroundWindow
ole32
CoCreateInstance
CoTaskMemFree
CoInitializeEx
shell32
DragAcceptFiles
comctl32
InitCommonControlsEx
ImageList_LoadImageW
ImageList_Add
ImageList_Create
CreateStatusWindowW
PropertySheetW
mpr
WNetDisconnectDialog
msvcrt
malloc
realloc
memcpy
memset
puts
_vsnprintf
_beginthreadex
memmove
sprintf
_XcptFilter
__p__commode
_amsg_exit
__getmainargs
__set_app_type
_exit
_cexit
__p__fmode
__setusermatherr
_initterm
free
?terminate@@YAXXZ
_controlfp
getenv
atoi
exit
_snprintf
fputs
printf
fprintf
fgets
fflush
feof
strstr
strncpy
_strlwr
strchr
_memicmp
isalnum
strncat
__iob_func
Sections
.text Size: 52KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 12B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ