11943M | Triage

Resubmissions

06/09/2022, 13:58

220906-q92ftabbdm 1

06/09/2022, 13:56

220906-q85f3sdhe5 1

Sharing

Copy URL

Twitter E-mail

General

Target

11943M
Size

508KB
MD5

9816cdf199e07a7021cd5ccd881ab461
SHA1

178d8fd1ea6f0ee3580868fa93de7d950d633639
SHA256

d06b8d920adc2312032a4746fb8a381e2277880c5a1faf367a648bb57a435d1b
SHA512

7b2fa39bbdc386d31ffe7d482a3e1a3453362666eb4f812424916d828f19306f97576aa24ca32eda6ce9e49a97ef574292e97faaef8ba5e88137f2cd2a124ab5
SSDEEP

12288:6Hq1NlqUOowcM7OsuRqgUSuw2NNQnanGdrTrboOsJ:6Hq58oLqFS5HcOTrUOM

Score

N/A

Malware Config

Signatures

Files

11943M
.exe windows

548d9f5f1e74f34b85612667335d41f2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
Sleep
lstrcmpiW
GetStdHandle
MultiByteToWideChar
SetHandleInformation
CreatePipe
WideCharToMultiByte
GetWindowsDirectoryW
GetFileAttributesW
SetFileAttributesW
SetFileAttributesA
FindClose
FindFirstFileW
WriteFile
CreateFileW
GetVersionExW
DeleteFileW
GetTempPathW
GetComputerNameW
InterlockedDecrement
GetCurrentProcess
GetModuleHandleW
GetProcAddress
FindNextFileW
lstrcmpW
GetLogicalDrives
SetErrorMode
TerminateProcess
CopyFileW
LoadLibraryW
FindResourceW
LoadResource
LockResource
SizeofResource
OpenMutexW
CreateMutexW
GetCommandLineW
HeapAlloc
GetProcessHeap
CreateThread
TlsAlloc
HeapCreate
IsProcessorFeaturePresent
SetEndOfFile
CreateFileA
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
GetTimeZoneInformation
HeapSize
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTickCount
ReadFile
PeekNamedPipe
OpenProcess
CloseHandle
WaitForSingleObject
FormatMessageA
GetLastError
GetModuleFileNameW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentDirectoryW
IsValidCodePage
GetOEMCP
GetACP
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CompareStringW
SetFilePointer
GetDateFormatA
FlushFileBuffers
GetFileType
SetHandleCount
GetConsoleMode
GetConsoleCP
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
InterlockedCompareExchange
InterlockedExchange
InterlockedIncrement
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
GetLocaleInfoW
GetStringTypeW
lstrlenA
LocalFree
HeapReAlloc
HeapFree
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
ExitProcess
CreateDirectoryA
GetDriveTypeW
GetFullPathNameA
HeapSetInformation
GetStartupInfoW
RaiseException
RtlUnwind
LCMapStringW
GetTimeFormatA
TlsGetValue

user32

DispatchMessageW
BeginPaint
PostQuitMessage
GetWindowLongW
SetWindowLongW
CreateWindowExW
ShowWindow
LoadStringA
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DefWindowProcW
LoadCursorW
RegisterClassExW

advapi32

CryptGetHashParam
CryptAcquireContextW
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptReleaseContext
GetUserNameW

shell32

CommandLineToArgvW
SHCreateDirectoryExW

ole32

CoUninitialize
CoSetProxyBlanket
CoCreateInstance
CoInitializeEx
CoInitialize
CoInitializeSecurity

oleaut32

SysAllocString
SysFreeString
VariantClear

wininet

InternetCloseHandle
InternetSetOptionW
InternetQueryDataAvailable
InternetReadFile
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetCrackUrlW

urlmon

ObtainUserAgentString

sensapi

IsNetworkAlive

Exports

Exports

adler32
adler32_combine
adler32_z
crc32
crc32_combine
crc32_z
deflate
deflateBound
deflateCopy
deflateEnd
deflateGetDictionary
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
inflate
inflateCodesUsed
inflateCopy
inflateEnd
inflateGetDictionary
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
inflateValidate
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 386KB - Virtual size: 385KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

548d9f5f1e74f34b85612667335d41f2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

wininet

urlmon

sensapi

Exports

Exports

Sections

.text Size: 386KB - Virtual size: 385KB

.rdata Size: 82KB - Virtual size: 82KB

.data Size: 11KB - Virtual size: 19KB

.rsrc Size: 2KB - Virtual size: 4KB

.reloc Size: 25KB - Virtual size: 25KB

.text
Size: 386KB - Virtual size: 385KB

.rdata
Size: 82KB - Virtual size: 82KB

.data
Size: 11KB - Virtual size: 19KB

.rsrc
Size: 2KB - Virtual size: 4KB

.reloc
Size: 25KB - Virtual size: 25KB