Static task
static1
Behavioral task
behavioral1
Sample
4b8870a24aa46f9f480c74ec1ef7c1a1643aae8b6378745db1dea4d61cc89380.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4b8870a24aa46f9f480c74ec1ef7c1a1643aae8b6378745db1dea4d61cc89380.exe
Resource
win10v2004-20220901-en
General
-
Target
4b8870a24aa46f9f480c74ec1ef7c1a1643aae8b6378745db1dea4d61cc89380
-
Size
28.7MB
-
MD5
158ca0ee7d13e649f7dc1768fd56ddfa
-
SHA1
0dfcc7895dc9848d0e45fdb77fd47561b8ef30fe
-
SHA256
4b8870a24aa46f9f480c74ec1ef7c1a1643aae8b6378745db1dea4d61cc89380
-
SHA512
6a4c1d758b7ac1b09732c16eb88dc51fae4528b39459e12a85b3a682fb273316f706af2dabc11ddcbcff9b72670754d9d6b49a3ffba533eadee7323534c8f6a4
-
SSDEEP
786432:NNsI+NNN/R2lDJ6MPgqDZw0GOYXnyca74pB9TKKn8d5OV1:yNb2hLAXyvsPuK8m
Malware Config
Signatures
Files
-
4b8870a24aa46f9f480c74ec1ef7c1a1643aae8b6378745db1dea4d61cc89380.exe windows x86
981a275bce22f656f306ebaaaa886c29
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MultiByteToWideChar
lstrcmpW
MulDiv
SetFilePointerEx
GetFileSizeEx
SetFileAttributesW
DeleteFileW
SetFileTime
SetEndOfFile
WriteFile
GetVersion
lstrlenW
GetFullPathNameW
lstrcatW
WaitForSingleObject
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateEventW
SetEvent
ResetEvent
lstrcpyW
CreateDirectoryW
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateHardLinkW
RemoveDirectoryW
CreateSymbolicLinkW
VirtualAlloc
VirtualFree
GetModuleFileNameW
GetFileAttributesW
GetCurrentThread
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
Sleep
IsNormalizedString
NormalizeString
GlobalMemoryStatusEx
CompareStringW
CreateFileA
GetDriveTypeW
FlushFileBuffers
GetTickCount
FindClose
GlobalFree
LocalFree
WideCharToMultiByte
GetModuleHandleW
lstrcmpiW
RaiseException
InitializeCriticalSectionEx
SetLastError
GetCurrentThreadId
GetUserDefaultLangID
DecodePointer
GetConsoleOutputCP
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
GetConsoleMode
LCMapStringW
GetStdHandle
GetCommandLineW
GetCommandLineA
ExitProcess
GetFileType
GetModuleHandleExW
FreeLibraryAndExitThread
WriteConsoleW
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
LoadLibraryExA
IsProcessorFeaturePresent
GetLastError
GetProcAddress
CloseHandle
CreateFileW
lstrcpynW
ReadFile
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetSystemDirectoryW
FreeLibrary
LoadLibraryExW
LoadLibraryW
FlushInstructionCache
GetCurrentProcess
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
OutputDebugStringW
IsDebuggerPresent
user32
GetDlgItem
CreateWindowExW
GetWindowRect
SendMessageW
SystemParametersInfoW
ScreenToClient
SetFocus
EndDialog
KillTimer
EnableWindow
SetTimer
SetDlgItemTextW
PostMessageW
MessageBoxW
GetWindow
MonitorFromWindow
GetMonitorInfoW
GetClientRect
LoadIconW
GetWindowTextW
DialogBoxParamW
UnregisterClassW
GetActiveWindow
CharNextW
PeekMessageW
DispatchMessageW
TranslateMessage
RegisterWindowMessageW
MoveWindow
EnumChildWindows
SetWindowLongW
GetWindowLongW
FindWindowExW
GetClassNameW
MapWindowPoints
GetDlgCtrlID
GetParent
SetWindowPos
MonitorFromPoint
SetProcessDPIAware
ReleaseDC
GetDC
SetWindowTextW
InvalidateRect
GetWindowTextLengthW
gdi32
GetDeviceCaps
CreateFontIndirectW
GetObjectW
GetStockObject
DeleteObject
CreateFontW
advapi32
RegDeleteValueW
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegDeleteKeyW
AreAllAccessesGranted
AccessCheck
OpenThreadToken
RevertToSelf
ImpersonateSelf
GetFileSecurityW
shell32
SHBrowseForFolderW
CommandLineToArgvW
SHGetPathFromIDListW
ole32
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitialize
CoUninitialize
CoCreateInstance
oleaut32
VarUI4FromStr
shlwapi
PathIsDirectoryW
PathCanonicalizeW
Sections
.text Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 11KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ