Static task
static1
Behavioral task
behavioral1
Sample
eb7590c206c7da569c4d3de38ce65903.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
eb7590c206c7da569c4d3de38ce65903.exe
Resource
win10v2004-20220901-en
General
-
Target
eb7590c206c7da569c4d3de38ce65903
-
Size
348KB
-
MD5
eb7590c206c7da569c4d3de38ce65903
-
SHA1
3f264866134dc5cf70253dad81c307ff85f6bd2c
-
SHA256
967f1dfb598f0ac4fc9de43814bde0d2e6fcca04c99217e8995dc36373fb792e
-
SHA512
2bdb27d20d0772840f90c5c6807bf71902182f0a616a6ce032eff8f10880c7d470b1c36f100f192d5d6ed88046ac145808bfb3b80b8586d095aefe4cb534f93f
-
SSDEEP
6144:P45rA5FSkJY8R/kpM3kRaWV/wEsNbqw8QlRTFiPurp+EStS3sth:5FSkB/kBubqw8vm+EKS3s
Malware Config
Signatures
Files
-
eb7590c206c7da569c4d3de38ce65903.exe windows x86
257ea21f64dde694bae577e3a7755e5a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strstr
_snprintf
memcpy
memset
netapi32
NetUserGetInfo
NetApiBufferFree
NetQueryDisplayInformation
ws2_32
send
WSAGetLastError
closesocket
select
__WSAFDIsSet
shell32
ord680
shlwapi
StrStrIA
PathFileExistsA
ntdll
RtlImageNtHeader
RtlAdjustPrivilege
RtlCreateUserThread
kernel32
GetTempFileNameA
GetTempPathA
GetProcessHeap
HeapValidate
CopyFileA
GlobalFindAtomA
GlobalAddAtomA
GetModuleFileNameW
WriteProcessMemory
VirtualAllocEx
CreateRemoteThread
VirtualQuery
MultiByteToWideChar
FlushInstructionCache
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
GetTickCount
GetVolumeInformationA
GetSystemWindowsDirectoryA
GetCurrentProcess
VirtualFree
VirtualAlloc
DeleteFileA
Process32First
OpenProcess
Process32Next
CreateToolhelp32Snapshot
CloseHandle
CreateFileA
MoveFileExA
lstrcpynA
SetEndOfFile
SetFileTime
WriteFile
IsBadWritePtr
ReadFile
GetFileSizeEx
GetFileTime
HeapAlloc
HeapFree
ExitProcess
Sleep
CreateProcessA
user32
CharUpperA
advapi32
RegCreateKeyExA
CreateProcessWithLogonW
GetUserNameA
RegCloseKey
RegFlushKey
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
oleaut32
SysFreeString
SysAllocString
Sections
.text Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 289KB - Virtual size: 355KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ