Static task
static1
Behavioral task
behavioral1
Sample
P1474.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
P1474.exe
Resource
win10v2004-20220812-en
General
-
Target
P1474
-
Size
419KB
-
MD5
c852af9998100878200f5faa8780864f
-
SHA1
72e2bd5aec024fc0956c824537849e250081f7ab
-
SHA256
962e4986ca64c9f703da86af833b18e0df32db625a450be7a3270904c2db5401
-
SHA512
d9db89e633921bb3d2849ffb6f485624c1ae87623672350ffe2057f9f3313fbd586f91da5ff7ee25f4d1023ab6b92a83493d99ddcc61f2ca24f0467f3f179e7e
-
SSDEEP
12288:ABAEPOQDKmzpCz4ZvMFriibVgT66thxrfT+cnb:ABAMOQLCcZEFriibVp6tjfT1b
Malware Config
Signatures
Files
-
P1474.exe windows x86
8ff635ff310efa3e1c3591f5fc836d54
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
GetComputerNameW
GetLogicalDrives
GetModuleHandleW
WriteFile
WideCharToMultiByte
LoadLibraryW
Sleep
SizeofResource
GetVersionExW
GetFileAttributesW
ReadFile
GetModuleFileNameW
lstrcmpW
MultiByteToWideChar
GetTempPathW
OpenMutexW
GetLastError
GetProcAddress
SetFileAttributesA
FindClose
CreatePipe
lstrcmpiW
FindNextFileW
CloseHandle
GetWindowsDirectoryW
CreateThread
SetHandleInformation
DeviceIoControl
GetVolumeInformationW
lstrcpyA
HeapCreate
IsProcessorFeaturePresent
GetFileType
SetEndOfFile
VirtualQuery
GetProcessHeap
CreateFileA
WriteConsoleW
SetStdHandle
CompareStringW
GetStringTypeW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
FreeLibrary
GetCurrentProcess
InterlockedDecrement
GetCommandLineW
SetErrorMode
PeekNamedPipe
FindFirstFileW
CreateMutexW
CreateFileW
GetLocaleInfoW
HeapSize
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
IsDebuggerPresent
SetUnhandledExceptionFilter
GetOEMCP
GetACP
FlushFileBuffers
GetConsoleMode
GetConsoleCP
SetFilePointer
InterlockedIncrement
EncodePointer
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
lstrlenA
LocalFree
HeapFree
HeapAlloc
GetCurrentProcessId
CreateDirectoryA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
HeapReAlloc
GetSystemTimeAsFileTime
ExitProcess
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
LCMapStringW
GetCPInfo
TerminateProcess
UnhandledExceptionFilter
user32
DialogBoxParamW
DispatchMessageW
DefWindowProcW
UpdateWindow
CreateWindowExW
ShowWindow
wsprintfA
EndPaint
LoadStringW
TranslateAcceleratorW
GetMessageW
PostQuitMessage
LoadStringA
DestroyWindow
LoadCursorW
BeginPaint
TranslateMessage
LoadAcceleratorsW
RegisterClassExW
GetWindowLongW
EndDialog
advapi32
GetUserNameW
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
shell32
CommandLineToArgvW
SHCreateDirectoryExW
ole32
CoInitializeEx
CoInitialize
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoUninitialize
oleaut32
SysFreeString
VariantClear
SysAllocString
shlwapi
PathFileExistsW
setupapi
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
Sections
.text Size: 322KB - Virtual size: 321KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 67KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 17KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ