Static task
static1
Behavioral task
behavioral1
Sample
8c5d0c71e13e7488446aa78be9a9833fb0d17e4ea7f79777c7541f5cf9067b95.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8c5d0c71e13e7488446aa78be9a9833fb0d17e4ea7f79777c7541f5cf9067b95.exe
Resource
win10v2004-20220901-en
General
-
Target
8c5d0c71e13e7488446aa78be9a9833fb0d17e4ea7f79777c7541f5cf9067b95
-
Size
867KB
-
MD5
8930a3711509137221459e5296d57f52
-
SHA1
4f8ca713badf74faebeae34627f00fe57efb0630
-
SHA256
8c5d0c71e13e7488446aa78be9a9833fb0d17e4ea7f79777c7541f5cf9067b95
-
SHA512
6e7af82c84dcb85eed19eff1d5efa716b34c7000cd852f379d5ff0eba9074f9368d79b6a5e3836a2e81aa93767ecb2223294920522a22e635792942931fc604d
-
SSDEEP
24576:gqzhAIoeV0jZ89LEzFlloVSK4FDf9D5XQjR0Jxqp:gihAIoeCZMgJMVSfRfV6jQxqp
Malware Config
Signatures
Files
-
8c5d0c71e13e7488446aa78be9a9833fb0d17e4ea7f79777c7541f5cf9067b95.exe windows x86
01c1f3633d763f006f9973a2704446d7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
query
?OpenRecord@CPropStoreManager@@QAEPAVCCompositePropRecord@@KPAE@Z
??1CWorkQueue@@QAE@XZ
?IsValid@COccRestriction@@QBEHXZ
??0CSynRestriction@@QAE@ABVCKey@@KKKH@Z
?ChangeCurrentDepth@CCatState@@QAEXH@Z
?TransferNode@CDbCmdTreeNode@@QAEXPAV1@@Z
?Clone@CRestriction@@QBEPAV1@XZ
?ciDelete@@YGXPAX@Z
?RequiresFlush@CPhysStorage@@QAEHK@Z
?SetAlias@CScopeAdmin@@QAEXPBG@Z
?UnMarshall@CDbByGuid@@QAEHAAVPDeSerStream@@@Z
?ParseOneLine@CPropertyList@@SGXAAVCQueryScanner@@HAAV?$XPtr@VCPropEntry@@@@@Z
?Next@CStaticPropertyList@@UAEPBVCPropEntry@@XZ
??0CPhysStorage@@IAE@AAVPStorage@@AAVPStorageObject@@KPAVPMmStream@@W4EOpenMode@1@HIH@Z
?QueryCatalogEnum@CMachineAdmin@@QAEPAVCCatalogEnum@@XZ
?Lookup@CPropStoreInfo@@AAEIK@Z
?GetAllEntries@CPropertyList@@UAEJPAPAVCPropEntry@@K@Z
??0CRcovStrmMDTrans@@QAE@AAVPRcovStorageObj@@W4MDOp@0@K@Z
?UpdateContentIndex@@YGKPBG00H@Z
??0CNormalizer@@QAE@AAVPNoiseList@@@Z
?Refresh@CCiRegParams@@QAEXPAUICiAdminParams@@H@Z
?TreeCount@CRestriction@@QBEKXZ
?BorrowBuffer@CPhysStorage@@QAEPAKKHH@Z
??0CGetDbProps@@QAE@XZ
?SetValue@CPropertyRestriction@@QAEXPAU_GUID@@@Z
?Load@CLocalGlobalPropertyList@@QAEXQBG@Z
?GetBrowserCodepage@@YGKAAVCWebServer@@K@Z
?StopFiltering@CFilterDaemon@@QAEXXZ
?FetchProperty@COLEPropManager@@QAEXABU_GUID@@ABUtagPROPSPEC@@PAUtagPROPVARIANT@@PAI@Z
?PutValue@CValueNormalizer@@QAEXKAAKABVCStorageVariant@@@Z
?SetMappedCacheSize@CPropStoreManager@@QAEXKK@Z
?SetScopePropertiesNoThrow@@YGJPAUICommand@@IPBQBGPBK11@Z
?GetOleError@@YGJAAVCException@@@Z
??1CDynStream@@QAE@XZ
?Find@CEmptyPropertyList@@QAEPBVCPropEntry@@ABVCDbColId@@@Z
?EnumVPaths@CMetaDataMgr@@QAEXAAVCMetaDataCallBack@@@Z
?GetDATE@CAllocStorageVariant@@QBENI@Z
?GetPropertyInfo@CDbProperties@@UAGJKQBUtagDBPROPIDSET@@PAKPAPAUtagDBPROPINFOSET@@PAPAG@Z
?VT_VARIANT_LT@@YGHABUtagPROPVARIANT@@0@Z
?SetUI4@CStorageVariant@@QAEXKI@Z
?ParseExpression@CParseCommandTree@@QAEPAVCRestriction@@PAVCDbCmdTreeNode@@@Z
?SetValue@CPropertyRestriction@@QAEXAAUtagBLOB@@@Z
??0CImpersonateRemoteAccess@@QAE@PAVCImpersonationTokenCache@@@Z
??0CIndexTable@@QAE@AAVCiStorage@@AAVCTransaction@@@Z
?QuerySdidLookupTable@CiStorage@@QAEPAVPRcovStorageObj@@K@Z
?IsDirectoryWritable@@YGHPBG@Z
?DisableNotification@CRegNotify@@QAEXXZ
??0CColumns@@QAE@ABV0@@Z
?MakeLocalICommand@@YGJPAPAUIUnknown@@PAUICiCDocStore@@PAU1@@Z
?UnMarshall@CDbPropSet@@QAEHAAVPDeSerStream@@@Z
?SetUI1@CStorageVariant@@QAEXEI@Z
?OpenExclusive@CMmStream@@QAEXPAGH@Z
?DisableVPathNotify@CMetaDataMgr@@QAEXXZ
??1CImpersonateClient@@QAE@XZ
??1CEventLog@@QAE@XZ
?StrLen@CKeyBuf@@QBEIXZ
_AbortMerges@16
??1COccRestriction@@QAE@XZ
?DoIt@CCopyRcovObject@@QAEJXZ
?Init@CSdidLookupTable@@QAEHPAVCiStorage@@@Z
?ValidateScopeRestriction@@YGHPAVCRestriction@@@Z
?GetDWORDParam@CCatalogAdmin@@QAEHPBGAAK@Z
?GetNumber@CQueryScanner@@QAEHAAJAAH@Z
??0CPerfMon@@QAE@PBG@Z
?SetProperty@CFullPropSpec@@QAEXK@Z
?GetCategory@CCatState@@QBEPBGI@Z
??3CDbContent@@SGXPAX@Z
?GetGUID@CMemDeSerStream@@UAEXAAU_GUID@@@Z
?CiNtOpenNoThrow@@YGJAAPAXPBGKKK@Z
?SaCreateAndCopy@@YGHAAVPMemoryAllocator@@PAUtagSAFEARRAY@@PAPAU2@@Z
?IsValid@CNodeRestriction@@QBEHXZ
?Release@CEnumWorkid@@UAGKXZ
?GetWeight@CDbCmdTreeNode@@QBEJXZ
?Read@CRegAccess@@QAEKPBGK@Z
kernel32
LZSeek
GetModuleHandleExW
CommConfigDialogA
AddAtomA
OpenSemaphoreA
SetClientTimeZoneInformation
GetLogicalDriveStringsA
VirtualAlloc
CreateProcessInternalW
WriteFileGather
VirtualAllocEx
GetShortPathNameA
SetThreadExecutionState
HeapCompact
SetConsoleActiveScreenBuffer
Module32First
GetNamedPipeHandleStateA
InvalidateConsoleDIBits
SetNamedPipeHandleState
LZOpenFileW
IsDBCSLeadByte
SetFileAttributesW
GlobalFindAtomA
InterlockedIncrement
OpenFile
GetFileTime
GetCurrentDirectoryA
OpenMutexA
GetSystemDirectoryA
GetCommState
WriteFile
SetComputerNameA
EnumSystemCodePagesA
LZCreateFileW
WriteConsoleInputVDMW
HeapSize
LocalUnlock
LZRead
InterlockedPopEntrySList
CreateTimerQueue
SetConsoleCP
LockFile
InitializeCriticalSection
LCMapStringA
SetDefaultCommConfigW
MoveFileExA
EscapeCommFunction
CreateWaitableTimerA
Process32FirstW
GetLogicalDrives
DeviceIoControl
IsProcessInJob
GlobalFindAtomW
SetEnvironmentVariableW
LZDone
GetTimeFormatW
EnumSystemGeoID
GetModuleFileNameW
IsValidLocale
WriteConsoleOutputW
GetEnvironmentVariableA
SetThreadLocale
CreateMutexW
LZClose
LoadLibraryA
GetCurrentActCtx
CancelDeviceWakeupRequest
FreeLibrary
ReadConsoleInputExW
EnumCalendarInfoExA
SetCalendarInfoA
FoldStringW
SetupComm
DeleteTimerQueueTimer
DefineDosDeviceA
FindResourceA
SetConsoleKeyShortcuts
ntdll
NtImpersonateClientOfPort
RtlTraceDatabaseFind
RtlxOemStringToUnicodeSize
RtlLookupAtomInAtomTable
_splitpath
ZwAccessCheckAndAuditAlarm
NtSetDebugFilterState
NtQueryKey
RtlNewSecurityObjectWithMultipleInheritance
isgraph
RtlGetElementGenericTableAvl
RtlGetFullPathName_U
ZwClose
ZwSetSystemPowerState
NtQueryFullAttributesFile
NtAllocateLocallyUniqueId
NtDeviceIoControlFile
RtlInterlockedPushListSList
RtlpNtOpenKey
NtOpenDirectoryObject
RtlRunEncodeUnicodeString
ZwSaveKeyEx
NtTraceEvent
NtQueryInformationProcess
RtlSetUserFlagsHeap
RtlLockBootStatusData
bsearch
CsrClientCallServer
ZwSetLowWaitHighEventPair
ZwAllocateVirtualMemory
ZwCreateDirectoryObject
NtQuerySystemInformation
ZwAreMappedFilesTheSame
NtCompactKeys
ZwQueryInformationProcess
NtDeleteValueKey
_ui64tow
RtlGetLastWin32Error
ZwCompressKey
_CIcos
KiUserExceptionDispatcher
NtImpersonateThread
NtSaveKey
DbgPrintEx
advapi32
SaferiPopulateDefaultsInRegistry
CredMarshalCredentialA
IsTokenUntrusted
QueryTraceA
SystemFunction020
GetSidIdentifierAuthority
CredDeleteW
SystemFunction023
GetWindowsAccountDomainSid
A_SHAInit
StopTraceA
FreeInheritedFromArray
CryptHashSessionKey
LsaGetQuotasForAccount
GetServiceDisplayNameW
MD5Final
IdentifyCodeAuthzLevelW
GetSidSubAuthorityCount
LsaSetInformationTrustedDomain
LsaICLookupSidsWithCreds
SetTraceCallback
RegOverridePredefKey
BuildTrusteeWithObjectsAndNameW
SystemFunction018
SystemFunction017
SystemFunction008
FreeSid
LsaQuerySecurityObject
SetSecurityDescriptorRMControl
iasnap
DllGetClassObject
Sections
.text Size: 335KB - Virtual size: 335KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 330KB - Virtual size: 330KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 198KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ