Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
ac4e6130232c4f7f8d7166b0004366c1e078f93b51addcf8080c28b1fac5d12c.exe
Resource
win7-20220414-en
General
-
Target
ac4e6130232c4f7f8d7166b0004366c1e078f93b51addcf8080c28b1fac5d12c
-
Size
362KB
-
MD5
0a0503dce0e780c82d119fa033577cfe
-
SHA1
0e577608c1f0766c6d1e88f8a081fc58663517e8
-
SHA256
ac4e6130232c4f7f8d7166b0004366c1e078f93b51addcf8080c28b1fac5d12c
-
SHA512
220674cdda4162e2130b96a40340966d78bb0962edcf0ec50bf0b9e210b5b8f25b4d4863ef6118c48614833dd10c4fbae7f305043f13d1c831040a02954bbbbe
-
SSDEEP
6144:etDXIlcSxyZBkcvsCL5thCsMgc6sT/vhUDx+OoBk42WBp+r2q16rI:elXWnxkT3XMg9sT/aN+Onm+2L
Malware Config
Signatures
Files
-
ac4e6130232c4f7f8d7166b0004366c1e078f93b51addcf8080c28b1fac5d12c.exe windows x86
43854f2321b6780212334d3666e9e1f3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
OpenProcess
GetNamedPipeHandleStateW
GetQueuedCompletionStatus
FillConsoleOutputCharacterW
EnumSystemCodePagesW
LocalLock
GetVolumeNameForVolumeMountPointA
GetVersionExA
VerifyVersionInfoA
WriteConsoleInputW
EnumDateFormatsW
FindNextFileA
CopyFileExW
BuildCommDCBAndTimeoutsW
VirtualLock
WriteProfileStringA
VerifyVersionInfoW
GetDriveTypeW
GetFileInformationByHandle
DeleteFileW
FindNextVolumeMountPointW
TlsGetValue
ResetWriteWatch
GetConsoleTitleW
GetComputerNameExW
OpenEventA
GetModuleHandleA
GetSystemDirectoryA
GetDriveTypeA
BuildCommDCBAndTimeoutsA
LoadLibraryA
GetShortPathNameW
ReleaseActCtx
GetProfileSectionW
GetCommandLineA
InterlockedExchangeAdd
InterlockedDecrement
CreateActCtxW
FindResourceA
FormatMessageW
GetModuleFileNameA
CreateJobObjectW
InitializeCriticalSection
GetNumberOfConsoleMouseButtons
FindNextVolumeA
CreateNamedPipeW
WritePrivateProfileStringA
GetConsoleAliasesLengthW
WriteProfileSectionW
AddAtomA
InterlockedIncrement
GetVersionExW
HeapFree
_hwrite
InterlockedCompareExchange
GetStartupInfoW
ConnectNamedPipe
GetCPInfoExA
GetSystemWow64DirectoryW
GetLastError
GetPrivateProfileIntW
GetConsoleAliasExesW
DebugBreak
EndUpdateResourceA
GetTickCount
VirtualQueryEx
DeleteVolumeMountPointA
OpenFileMappingA
GetModuleHandleW
SetDefaultCommConfigA
VirtualAlloc
lstrcpyW
GetSystemWindowsDirectoryW
TerminateProcess
GetACP
GetDiskFreeSpaceExA
EnumResourceTypesA
IsProcessInJob
lstrcpynW
WriteConsoleW
GetProcAddress
lstrcatA
LoadLibraryW
ReadConsoleOutputW
SetHandleInformation
WritePrivateProfileStructA
DeleteCriticalSection
GetFileAttributesA
DeactivateActCtx
CopyFileW
GlobalMemoryStatus
SetTapeParameters
GetDevicePowerState
ResetEvent
LockFile
MoveFileW
DisableThreadLibraryCalls
GetOverlappedResult
SetCommTimeouts
FormatMessageA
GlobalAlloc
SetThreadPriorityBoost
SetFileShortNameW
GetFileAttributesW
SetCalendarInfoA
ConvertFiberToThread
GetConsoleTitleA
SetComputerNameW
GetConsoleAliasesW
EnumDateFormatsA
SetTimeZoneInformation
SetConsoleOutputCP
MoveFileWithProgressW
GetStdHandle
GetLocalTime
EnumSystemLocalesW
ActivateActCtx
CreateMemoryResourceNotification
OpenSemaphoreA
GetModuleHandleExA
AddAtomW
FoldStringW
_hread
GetFileSize
SetUnhandledExceptionFilter
GetConsoleAliasesLengthA
SetProcessShutdownParameters
lstrcpynA
GlobalUnWire
GetCompressedFileSizeA
ReadConsoleA
FreeUserPhysicalPages
WriteConsoleOutputCharacterW
TerminateJobObject
CreateFileA
SetTimerQueueTimer
SetLastError
UnhandledExceptionFilter
RaiseException
GetStartupInfoA
HeapValidate
IsBadReadPtr
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
GetCurrentProcess
IsDebuggerPresent
SetFilePointer
SetStdHandle
GetFileType
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
Sleep
ExitProcess
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
TlsAlloc
TlsSetValue
TlsFree
HeapDestroy
HeapCreate
VirtualFree
HeapAlloc
HeapSize
HeapReAlloc
GetOEMCP
GetCPInfo
IsValidCodePage
RtlUnwind
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
OutputDebugStringW
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
CloseHandle
DeleteFileA
user32
CharUpperA
Sections
.text Size: 189KB - Virtual size: 189KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 137KB - Virtual size: 6.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.wivov Size: 512B - Virtual size: 5B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.kesogo Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.nunaha Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.texic Size: 512B - Virtual size: 50B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ