?ReflectiveLoader@@YGKPAX@Z
Static task
static1
Behavioral task
behavioral1
Sample
e55fcf9315c52d2abd3431f7e4bb82cbd2b0d24d124e0e1a27b951030b2de162.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
e55fcf9315c52d2abd3431f7e4bb82cbd2b0d24d124e0e1a27b951030b2de162.exe
Resource
win10v2004-20220721-en
General
-
Target
7769606121.zip
-
Size
71KB
-
MD5
4e6f3ed15b2679235aee27281ca717b4
-
SHA1
6959fea57cc0e5d3ed7629f9bf20e424167648f6
-
SHA256
562b6736cb6b1abff6a98c29059ae0f6de997d9f3137de622c92f217510519a4
-
SHA512
dbd98bec47b539e5998148e1cf3c20a716ed2c0ed1ef4d604a84bb0bfcaebeb208bdfbd5d32479502b6af7c01679d3a472fa40683fc519fb16f7c8daf44f1920
-
SSDEEP
1536:f+vrhjToubgwVULTe1NGxV/8dNSpm+RnOHD/RDdT:f+vVwubTMTeDGxJ8BunaDTT
Malware Config
Signatures
Files
-
7769606121.zip.zip
Password: infected
-
e55fcf9315c52d2abd3431f7e4bb82cbd2b0d24d124e0e1a27b951030b2de162.exe windows x86
93736e6ffcbf0a539a73e55e921de1cb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateEventA
LeaveCriticalSection
FileTimeToSystemTime
EnterCriticalSection
FindClose
SetThreadPriorityBoost
GetSystemInfo
WaitForMultipleObjects
FindNextFileW
SetThreadAffinityMask
SetProcessShutdownParameters
GetSystemTime
ReadFile
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetSystemWindowsDirectoryA
CreateFileW
SetFileAttributesW
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
HeapFree
TlsGetValue
TlsSetValue
InterlockedIncrement
GetModuleHandleW
GetCurrentThreadId
InterlockedDecrement
GetProcAddress
WideCharToMultiByte
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
IsProcessorFeaturePresent
HeapAlloc
HeapReAlloc
MultiByteToWideChar
LoadLibraryW
GetModuleFileNameW
GetConsoleCP
GetConsoleMode
LCMapStringW
GetStringTypeW
SetFilePointer
GetModuleFileNameA
WriteConsoleW
SetStdHandle
GetCurrentThread
SetEvent
WaitForSingleObject
GetLogicalDriveStringsW
SystemTimeToTzSpecificLocalTime
FindFirstFileW
GetProcessHandleCount
GetProcessTimes
CloseHandle
GetSystemTimes
SwitchToThread
SetLastError
GetStdHandle
FlushFileBuffers
WriteFile
lstrlenA
GetSystemWindowsDirectoryW
GetEnvironmentVariableW
GetCurrentProcessId
GetLastError
Sleep
SetProcessPriorityBoost
GetTickCount
GetCurrentProcess
CreateMutexW
MoveFileW
DeleteFileA
lstrcpynA
Process32First
OpenProcess
Process32Next
GetModuleHandleA
GetComputerNameA
GetNativeSystemInfo
SetErrorMode
GetSystemDirectoryW
GetVolumeInformationA
GetVersionExW
GetEnvironmentVariableA
CreateThread
GetProcessHeap
MoveFileExA
SetFilePointerEx
GetFileSizeEx
FindFirstFileA
RemoveDirectoryA
SetFileAttributesA
FindNextFileA
ExitProcess
user32
wsprintfW
CharLowerA
CharUpperA
advapi32
CryptGetHashParam
CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptHashData
OpenProcessToken
GetTokenInformation
SetKernelObjectSecurity
GetUserNameA
RegQueryValueExA
CryptAcquireContextW
CryptGenRandom
ControlService
OpenSCManagerA
QueryServiceStatusEx
OpenServiceW
CloseServiceHandle
CryptReleaseContext
shell32
SHGetFolderPathW
ShellExecuteExW
ole32
StringFromGUID2
psapi
GetModuleFileNameExW
shlwapi
PathAddBackslashA
PathFindFileNameA
SHRegSetUSValueA
PathAppendA
PathIsDirectoryA
PathFindFileNameW
StrCpyNW
StrCpyW
PathFileExistsW
StrCatW
wvnsprintfA
StrCmpW
StrCmpIW
StrStrIW
PathFindExtensionW
StrStrIA
StrCatBuffA
StrNCatW
wnsprintfA
mpr
WNetEnumResourceW
WNetOpenEnumW
WNetCloseEnum
netapi32
NetApiBufferFree
NetWkstaGetInfo
NetServerGetInfo
ntdll
ZwQueryInformationProcess
ZwUnmapViewOfSection
Exports
Exports
Sections
.text Size: 94KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
gumrkvc Size: 9KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ