Static task
static1
Behavioral task
behavioral1
Sample
9c0aff83f76d680967bdd8b2d4e1551a2763db77a110b4dd9d6844db6bb8e48f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9c0aff83f76d680967bdd8b2d4e1551a2763db77a110b4dd9d6844db6bb8e48f.exe
Resource
win10v2004-20220812-en
General
-
Target
9c0aff83f76d680967bdd8b2d4e1551a2763db77a110b4dd9d6844db6bb8e48f
-
Size
448KB
-
MD5
f56b8d831020585c05a246fb976ef726
-
SHA1
0938abd5c301d1be8ccab2dccba92c2f51d27c15
-
SHA256
9c0aff83f76d680967bdd8b2d4e1551a2763db77a110b4dd9d6844db6bb8e48f
-
SHA512
7fe8883e751a989752eae6a1a28367097d6b1455337b2783d81cbfb1cc1d8405b178418ad7667fd0e99a5d00e3afd2ec7ec5bcde0375008071d054717f658e00
-
SSDEEP
3072:ibkBUee9TIqKOeOcPmJOeu1MAMkSTEiVc1VLVWJkudG9/cXAeIdV6j9u1/V:ibkO0OaIuGBkSTEIcPck/tc60huj
Malware Config
Signatures
Files
-
9c0aff83f76d680967bdd8b2d4e1551a2763db77a110b4dd9d6844db6bb8e48f.exe windows x86
818226c448894ba1c916a7cad44ba677
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RevertToSelf
SaferRecordEventLogEntry
ImpersonateLoggedOnUser
SaferCloseLevel
SaferComputeTokenFromLevel
SaferIdentifyLevel
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyW
RegDeleteValueW
RegOpenKeyW
RegDeleteKeyW
RegSetValueW
CreateProcessAsUserW
RegSetValueExW
RegCreateKeyExW
LookupAccountSidW
GetSecurityDescriptorOwner
GetFileSecurityW
kernel32
SetFilePointer
lstrcmpW
lstrcmpiW
HeapFree
GetProcessHeap
MultiByteToWideChar
ReadFile
SetThreadLocale
GetProcAddress
GetModuleHandleW
VirtualQuery
HeapAlloc
CloseHandle
WriteConsoleW
FillConsoleOutputCharacterW
SetConsoleCursorPosition
ReadConsoleW
GetConsoleScreenBufferInfo
GetStdHandle
GetFileType
GetLastError
WideCharToMultiByte
GetFileSize
FlushConsoleInputBuffer
GetCPInfo
GetConsoleOutputCP
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
GetFullPathNameW
GetUserDefaultLCID
SetLocalTime
SystemTimeToFileTime
GetSystemTime
FileTimeToSystemTime
GetLocaleInfoW
GetDateFormatW
FileTimeToLocalFileTime
GetTimeFormatW
GetLocalTime
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableW
SetEnvironmentStringsW
SetConsoleMode
GetConsoleMode
GetCommandLineW
GetEnvironmentVariableW
SetErrorMode
SetLastError
ReadProcessMemory
LoadLibraryW
GetConsoleWindow
CreateProcessW
GetStartupInfoW
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
GetBinaryTypeW
NeedCurrentDirectoryForExePathW
GetFileAttributesW
GetConsoleTitleW
MoveFileExW
LocalFree
SetConsoleTitleW
MoveFileW
SetFilePointerEx
WriteFile
SearchPathW
GetVolumeInformationW
LeaveCriticalSection
EnterCriticalSection
CancelSynchronousIo
ExpandEnvironmentStringsW
GetModuleFileNameW
GetVersion
GetWindowsDirectoryW
SetConsoleCtrlHandler
InitializeCriticalSection
GetDriveTypeW
GetFileAttributesExW
HeapSetInformation
OpenThread
GetCurrentThreadId
VirtualFree
VirtualAlloc
HeapSize
HeapReAlloc
FlushFileBuffers
DuplicateHandle
FormatMessageW
ScrollConsoleScreenBufferW
SetConsoleTextAttribute
FillConsoleOutputAttribute
CreateDirectoryW
SetFileTime
DeleteFileW
SetEndOfFile
SetFileAttributesW
CopyFileW
GetExitCodeProcess
WaitForSingleObject
TerminateProcess
SetCurrentDirectoryW
GetCurrentDirectoryW
RemoveDirectoryW
CompareFileTime
GetDiskFreeSpaceExW
FindNextStreamW
FindFirstStreamW
DeviceIoControl
ResumeThread
SetProcessAffinityMask
GetSystemInfo
GetThreadLocale
GetVolumePathNameW
CreateSymbolicLinkW
CreateHardLinkW
RaiseException
LoadLibraryA
FreeLibrary
LocalAlloc
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
GetVDMCurrentDirectories
CmdBatNotification
msvcrt
_wpopen
_wcsupr
setlocale
realloc
towlower
fprintf
_iob
printf
memcpy
wcsrchr
rand
iswalpha
wcstoul
_errno
_local_unwind4
wcsstr
_setjmp3
exit
fflush
srand
time
_wtol
iswxdigit
wcsncmp
_setmode
_pipe
_ultoa
swscanf
_close
_open_osfhandle
_dup
_dup2
qsort
_wcslwr
free
ferror
__getmainargs
_cexit
_exit
_XcptFilter
_initterm
_amsg_exit
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
?terminate@@YAXXZ
_controlfp
feof
_pclose
memmove
wcschr
_tell
iswspace
memset
wcsspn
towupper
longjmp
_wcsnicmp
_wcsicmp
_vsnwprintf
_get_osfhandle
_getch
iswdigit
wcstol
calloc
fgets
ntdll
RtlDosPathNameToNtPathName_U
NtFsControlFile
RtlFreeHeap
RtlNtStatusToDosError
NtQueryInformationToken
NtClose
NtOpenProcessToken
NtOpenThreadToken
Sections
.text Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 188KB - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ