Static task
static1
Behavioral task
behavioral1
Sample
cf39742a5db5659aa6235161dc05194479e0116a01d63f7fd722b28465fb8e31.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cf39742a5db5659aa6235161dc05194479e0116a01d63f7fd722b28465fb8e31.exe
Resource
win10v2004-20220812-en
General
-
Target
cf39742a5db5659aa6235161dc05194479e0116a01d63f7fd722b28465fb8e31
-
Size
47KB
-
MD5
dab7b5189e4ad94917003b5c4025648a
-
SHA1
f6ebdb64090c1de0c8f1ad4f956a20307fa6ac70
-
SHA256
cf39742a5db5659aa6235161dc05194479e0116a01d63f7fd722b28465fb8e31
-
SHA512
ca26fbd4dc0645effcfac77561909ff10cd195dcd795b21ed8b29377775b96144c62fe80ffb68cd6907485072c78de0e0d938e486bac592dadce2d5c3540dfd8
-
SSDEEP
768:CXhIihb1jc30mXILlorIPq63k3qq3dnt/fbNjZoduMekrQ:CXh7zQplIiv3qoV9fpSnLrQ
Malware Config
Signatures
Files
-
cf39742a5db5659aa6235161dc05194479e0116a01d63f7fd722b28465fb8e31.exe windows x86
a93e609a5ead390877946785b4b4ff4e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
WinExec
LoadLibraryA
GetCurrentProcessId
ExitThread
GetProcAddress
GetModuleFileNameA
Sleep
SetEnvironmentVariableA
CompareStringW
CompareStringA
FlushFileBuffers
LCMapStringW
LCMapStringA
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
SetFilePointer
GetLastError
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
HeapAlloc
ExitProcess
TerminateProcess
GetCurrentProcess
GetTimeZoneInformation
GetSystemTime
GetLocalTime
HeapFree
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
CloseHandle
advapi32
RegSetValueExA
RegOpenKeyExA
wsock32
WSAStartup
inet_addr
sendto
closesocket
recv
send
accept
listen
socket
inet_ntoa
connect
WSAGetLastError
htons
bind
select
__WSAFDIsSet
ioctlsocket
gethostbyname
Sections
.avp Size: 32KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 11KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE