weyuhiadsjmkajui
Static task
static1
Behavioral task
behavioral1
Sample
cmd.bat
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
cmd.bat
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
labor-.dll
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
labor-.dll
Resource
win10v2004-20220414-en
General
-
Target
core.zip
-
Size
799KB
-
MD5
55154da8cc3ed9ea00bffa66ece1ef42
-
SHA1
611f7884e5d979c542d2448264e97ee13559a923
-
SHA256
1d6a67bfae44e5e9b8b6351737fb90472c7b62b38952e21b141fd7de2e4e2781
-
SHA512
634ada110238d9fe28718248dd1ef8d20cffb3a4c87df528aad7b74faf23550a1b62860d531ae136ef17a8359cd81b43ec6d59827af3b23c9b865fee54ec73ec
-
SSDEEP
12288:nYeQ2dMlUsi35TDhjDQX2Rwak7cMQpsVU7mhfIIEhbOO90/BTu7ZmD3lLr2qI8GF:zvdMdiJTh8GtkcMimh4B90JTqSr2q9A
Malware Config
Signatures
Files
-
core.zip.zip
Password: infected
-
cmd.bat
-
labor-.tmp.dll windows x64
Password: infected
c5e44af7585fc2de3bac4cb691986a5e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
imm32
ImmGetCompositionStringA
ImmGetCandidateListW
ImmGetCompositionWindow
ImmGetProperty
msvfw32
ICInfo
ICInstall
ICDraw
ICLocate
ICSeqCompressFrameEnd
DrawDibOpen
DrawDibRealize
DrawDibStart
DrawDibBegin
GetOpenFileNamePreviewA
rasapi32
RasHangUpA
RasCreatePhonebookEntryW
RasGetEntryDialParamsA
RasDeleteEntryA
RasConnectionNotificationW
RasGetEapUserDataA
RasSetCustomAuthDataA
RasSetCustomAuthDataW
ole32
HICON_UserMarshal
GetHGlobalFromILockBytes
CoGetInstanceFromIStorage
DcomChannelSetHResult
CoDosDateTimeToFileTime
CoRegisterMessageFilter
StgOpenAsyncDocfileOnIFillLockBytes
BindMoniker
HACCEL_UserFree
Exports
Exports
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 440KB - Virtual size: 440KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
license.dat