Static task
static1
Behavioral task
behavioral1
Sample
59ac9fba1e9cef7e31624d748f4de009d2a62d101aff0e744b019ca81c01bda5.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
59ac9fba1e9cef7e31624d748f4de009d2a62d101aff0e744b019ca81c01bda5.exe
Resource
win10v2004-20220812-en
General
-
Target
59ac9fba1e9cef7e31624d748f4de009d2a62d101aff0e744b019ca81c01bda5
-
Size
391KB
-
MD5
aa31999669f4fe1046f51773c202eaa9
-
SHA1
62b47133c40366a75c953a61568d2eef07a6f880
-
SHA256
59ac9fba1e9cef7e31624d748f4de009d2a62d101aff0e744b019ca81c01bda5
-
SHA512
2edbcd71d1cd474615b03804aab22d22983315b4485d465b6c4551f791a233551af6edfa8f8401c51c050ac3788be5a305486ca44b34d81628fcc019a8390db2
-
SSDEEP
12288:16nB72Sf3+qWsnNmkjw6ZoEgkF1bpNivXl/V:IH8EN1dNivX1
Malware Config
Signatures
Files
-
59ac9fba1e9cef7e31624d748f4de009d2a62d101aff0e744b019ca81c01bda5.exe windows x86
15c0edd69546fcaf03ec0c62c372e473
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
WSAStartup
WSACleanup
closesocket
WSAGetLastError
select
inet_ntoa
__WSAFDIsSet
listen
accept
recvfrom
sendto
WSASetLastError
gethostbyname
socket
connect
setsockopt
getsockopt
htons
bind
ntohs
getsockname
send
recv
wldap32
ord46
ord27
ord301
ord33
ord200
ord79
ord35
ord32
ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord41
iphlpapi
GetAdaptersAddresses
libxvi010
OpenWiMAXDevice
SendWiMAXMessage
RegisterCallback
CloseWiMAXDevice
kernel32
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetCurrentDirectoryA
GetFullPathNameA
FlushFileBuffers
SetStdHandle
GetModuleHandleA
LCMapStringW
LCMapStringA
GetConsoleCP
VirtualAlloc
GetCurrentProcessId
QueryPerformanceCounter
VirtualFree
HeapCreate
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
WriteFile
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
InterlockedDecrement
Sleep
GetLastError
GetModuleFileNameA
GetSystemTime
WaitForSingleObject
SetEvent
CreateEventA
CreateMutexA
ReleaseMutex
CloseHandle
GetVersionExA
SetLastError
FormatMessageA
SleepEx
DuplicateHandle
GetCurrentProcess
WaitForMultipleObjects
GetExitCodeThread
TerminateThread
ReadFile
PeekNamedPipe
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
ExpandEnvironmentStringsA
GetLocaleInfoA
GetTimeZoneInformation
CompareStringA
CompareStringW
SetEnvironmentVariableA
HeapSize
SetEndOfFile
GetProcessHeap
GetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
EnterCriticalSection
LeaveCriticalSection
MoveFileA
DeleteFileA
GetSystemTimeAsFileTime
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
HeapReAlloc
HeapAlloc
HeapFree
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
SetFilePointer
FindClose
GetDriveTypeA
FindFirstFileA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
CreateFileA
DeleteCriticalSection
SetHandleCount
GetStartupInfoA
GetModuleHandleW
ExitProcess
RtlUnwind
MultiByteToWideChar
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
advapi32
ControlService
OpenSCManagerA
QueryServiceStatus
CreateServiceA
DeleteService
CloseServiceHandle
OpenServiceA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
Sections
.text Size: 308KB - Virtual size: 308KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 436B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ