Static task
static1
Behavioral task
behavioral1
Sample
c18fd891c48c98473e4d0eba886b8c553991939a6df0ee681c94121194dff92f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c18fd891c48c98473e4d0eba886b8c553991939a6df0ee681c94121194dff92f.exe
Resource
win10v2004-20220812-en
General
-
Target
c18fd891c48c98473e4d0eba886b8c553991939a6df0ee681c94121194dff92f
-
Size
82KB
-
MD5
dce6618ce729208b9ee46f768c64e7cc
-
SHA1
6e44ebb966a0e8862dd5b47f37ebd526541f4449
-
SHA256
c18fd891c48c98473e4d0eba886b8c553991939a6df0ee681c94121194dff92f
-
SHA512
f526e100fdbf6fbf4f71aad7b5cafe7a9831251835bec35fd916b7a29ba51ae2667604a7a03dbd31cc411b6aeefd1269c3aff9294e1e6beaadfe0d79190167be
-
SSDEEP
1536:uszeryUqp2T/DTuWvtn8Dky61kv8DPL6GqdP27jsGbTm/SGHiFNrr0jGyIbG:uszmyh2TJvtnxVDPtmP2kGbi/SGE0Cf
Malware Config
Signatures
Files
-
c18fd891c48c98473e4d0eba886b8c553991939a6df0ee681c94121194dff92f.exe windows x86
528d6fa8889d5c6f1cdac2dd965a803c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFindFileNameA
PathRemoveFileSpecA
StrTrimA
PathIsFileSpecW
IntlStrEqWorkerA
StrToIntExA
SHStrDupA
StrRetToBufA
PathUndecorateA
SHQueryValueExW
StrCSpnW
PathIsUNCServerA
UrlCreateFromPathW
SHSkipJunction
PathFindNextComponentA
SHOpenRegStreamW
SHRegEnumUSValueA
SHEnumKeyExW
UrlCanonicalizeA
PathFindNextComponentW
PathIsRootW
AssocQueryStringW
PathCommonPrefixA
SHDeleteValueA
StrIsIntlEqualA
SHQueryValueExA
PathIsSameRootA
PathRemoveFileSpecW
UrlHashA
StrCpyW
PathQuoteSpacesW
SHSetThreadRef
SHDeleteKeyW
PathStripToRootA
SHCopyKeyW
ChrCmpIA
SHRegQueryUSValueW
PathParseIconLocationW
PathCommonPrefixW
UrlGetPartW
PathCombineA
SHRegQueryInfoUSKeyW
AssocQueryStringByKeyW
StrFormatKBSizeA
PathUnquoteSpacesW
PathIsDirectoryA
SHGetInverseCMAP
PathIsNetworkPathA
StrCSpnIA
PathCreateFromUrlW
StrStrIW
SHDeleteEmptyKeyW
PathUndecorateW
StrCmpW
SHRegDeleteEmptyUSKeyA
StrChrW
PathIsRelativeW
PathSkipRootW
PathIsContentTypeW
HashData
StrSpnW
PathCanonicalizeA
PathQuoteSpacesA
StrCmpNIA
SHCreateStreamOnFileW
SHRegOpenUSKeyA
PathRemoveBlanksA
AssocQueryKeyA
PathGetDriveNumberW
SHAutoComplete
SHRegWriteUSValueA
PathSearchAndQualifyA
PathGetDriveNumberA
PathMatchSpecW
StrCpyNW
PathCompactPathA
UrlIsA
ColorHLSToRGB
PathCompactPathExA
UrlCreateFromPathA
SHCopyKeyA
UrlIsOpaqueW
SHRegSetUSValueA
UrlIsNoHistoryA
PathFindSuffixArrayW
SHGetValueW
UrlIsW
StrCSpnA
SHEnumValueA
PathRemoveBackslashA
PathSkipRootA
UrlCompareW
PathGetArgsA
StrFormatByteSize64A
PathRelativePathToA
PathFindExtensionA
SHOpenRegStreamA
UrlCanonicalizeW
SHIsLowMemoryMachine
PathRemoveExtensionW
StrRStrIA
UrlHashW
UrlCompareA
PathFindSuffixArrayA
UrlIsOpaqueA
PathIsPrefixW
StrNCatA
user32
DefMDIChildProcW
GrayStringA
CreateDialogParamW
CreateIconIndirect
CopyAcceleratorTableW
PeekMessageW
GetThreadDesktop
DlgDirListW
GetWindowTextLengthA
OemToCharW
GetSystemMenu
ReleaseCapture
LoadMenuIndirectA
InsertMenuW
WaitMessage
DrawFrameControl
DestroyCursor
GetWindow
SetWindowRgn
DrawFrame
GetWindowRect
GetQueueStatus
GetWindowWord
CloseWindow
DrawEdge
SetWindowsHookExW
GetMessageA
EnumDisplaySettingsExA
CreateDialogParamA
CheckDlgButton
EnableScrollBar
EndTask
FreeDDElParam
SetDlgItemTextW
AppendMenuW
ClipCursor
TranslateMessage
GetMenuItemID
GetMenuStringA
GrayStringW
ReplyMessage
WINNLSGetIMEHotkey
SendMessageW
KillTimer
EnumDisplayMonitors
CharToOemW
GetMenuBarInfo
SetDeskWallpaper
RegisterClassExA
GetPropA
IsZoomed
GetSubMenu
DdeCmpStringHandles
WinHelpW
GetMenuContextHelpId
DlgDirSelectExA
CharUpperBuffA
GetCapture
TabbedTextOutW
CreateWindowStationW
CreateCaret
ShowWindowAsync
GetCursor
LoadAcceleratorsA
AdjustWindowRectEx
ShowScrollBar
IntersectRect
CreateCursor
LoadCursorA
SendNotifyMessageA
DdeAccessData
DestroyAcceleratorTable
GetClassLongW
UnhookWindowsHookEx
SetUserObjectSecurity
GetUserObjectInformationA
GetScrollRange
FlashWindowEx
GetAsyncKeyState
GetMonitorInfoA
DestroyMenu
OemToCharBuffA
EqualRect
LoadCursorFromFileA
GetProcessWindowStation
GetWindowLongW
LoadBitmapW
GetKBCodePage
DdeGetLastError
CascadeWindows
GetTabbedTextExtentW
PostThreadMessageA
DialogBoxParamW
CallWindowProcA
CascadeChildWindows
DefWindowProcW
CreateMDIWindowA
DrawIcon
DrawStateA
ShowCaret
OpenDesktopA
DdeCreateStringHandleA
CallMsgFilterW
DrawMenuBar
MessageBoxW
GetDlgItemInt
ClientToScreen
RegisterClipboardFormatW
BroadcastSystemMessageW
CharLowerW
MessageBoxIndirectA
GetDialogBaseUnits
CheckMenuItem
InvalidateRect
OemKeyScan
WINNLSGetEnableStatus
CallMsgFilterA
EndDialog
DdeImpersonateClient
IsClipboardFormatAvailable
CharNextW
EndPaint
GetDoubleClickTime
GetTabbedTextExtentA
DlgDirSelectExW
DdePostAdvise
LoadStringW
LoadMenuW
DialogBoxParamA
SetProcessWindowStation
CharNextA
SendIMEMessageExW
IsDlgButtonChecked
MessageBoxExW
CharUpperBuffW
CharUpperW
BroadcastSystemMessage
ExitWindowsEx
SendNotifyMessageW
GetForegroundWindow
ole32
SetConvertStg
CoCopyProxy
CoRegisterMallocSpy
ReadFmtUserTypeStg
CoRevokeClassObject
OleCreateLinkFromDataEx
GetDocumentBitStg
CoFileTimeToDosDateTime
OleSetMenuDescriptor
CoResumeClassObjects
CoUnmarshalInterface
CoMarshalInterThreadInterfaceInStream
CoCreateInstance
OleGetAutoConvert
CoMarshalInterface
StgCreateDocfile
OleCreateDefaultHandler
CoIsHandlerConnected
CoDisconnectObject
CoGetInstanceFromFile
OleCreateLinkToFile
CoCreateInstanceEx
OleCreateFromFileEx
StgGetIFillLockBytesOnFile
CreateOleAdviseHolder
CoRevertToSelf
CoCreateFreeThreadedMarshaler
OleTranslateAccelerator
OleFlushClipboard
OleConvertOLESTREAMToIStorageEx
OleDestroyMenuDescriptor
ReadClassStg
CreateAntiMoniker
GetHookInterface
StgGetIFillLockBytesOnILockBytes
CoGetPSClsid
CreateGenericComposite
OleLockRunning
StgSetTimes
CoInitializeSecurity
CoUnmarshalHresult
MonikerRelativePathTo
RegisterDragDrop
StgCreateDocfileOnILockBytes
StgOpenStorage
CreateDataCache
UtGetDvtd32Info
OleCreateMenuDescriptor
OleIsRunning
OleSave
CreateStreamOnHGlobal
OleSetContainedObject
OleRegEnumVerbs
OleCreateLink
ReleaseStgMedium
CoRevokeMallocSpy
CoRegisterChannelHook
OleGetIconOfClass
OpenOrCreateStream
WriteFmtUserTypeStg
WriteClassStg
CoFreeAllLibraries
WriteStringStream
CoGetCurrentProcess
SetDocumentBitStg
OleCreate
ReadOleStg
OleGetIconOfFile
IsAccelerator
CoImpersonateClient
OleRun
OleLoadFromStream
EnableHookObject
StringFromCLSID
CreateDataAdviseHolder
CoGetObject
CoGetMalloc
CoGetCallerTID
CoTaskMemAlloc
IIDFromString
CoRegisterClassObject
UtConvertDvtd32toDvtd16
OleMetafilePictFromIconAndLabel
CoReleaseMarshalData
CoGetCurrentLogicalThreadId
StringFromGUID2
UpdateDCOMSettings
MonikerCommonPrefixWith
MkParseDisplayName
OleGetClipboard
CoGetInterfaceAndReleaseStream
OleDuplicateData
CoReleaseServerProcess
GetHGlobalFromILockBytes
OleCreateEmbeddingHelper
CoTaskMemRealloc
StringFromIID
OleQueryCreateFromData
CoRegisterMessageFilter
OleInitialize
OleSaveToStream
OleCreateEx
CoQueryAuthenticationServices
CreateObjrefMoniker
CreateFileMoniker
CoGetInstanceFromIStorage
OleQueryLinkFromData
PropVariantClear
WriteOleStg
CreateBindCtx
StgIsStorageILockBytes
OleRegGetUserType
CoGetCallContext
DllDebugObjectRPCHook
advapi32
RegSetValueW
CryptEnumProviderTypesW
RegisterEventSourceA
GetTrusteeTypeW
GetAce
RegCreateKeyW
MakeSelfRelativeSD
CreateServiceA
ReadEventLogA
BuildImpersonateTrusteeA
OpenBackupEventLogW
DeleteService
RegSetValueA
CryptAcquireContextA
GetNamedSecurityInfoA
InitiateSystemShutdownW
BuildSecurityDescriptorA
CryptDecrypt
ConvertSecurityDescriptorToAccessNamedA
AddAccessDeniedAce
SetKernelObjectSecurity
OpenSCManagerW
DuplicateToken
GetAuditedPermissionsFromAclW
GetSecurityDescriptorLength
ObjectDeleteAuditAlarmA
SetFileSecurityA
RegEnumKeyExA
OpenServiceW
RegisterEventSourceW
RegCreateKeyExW
SetSecurityInfoExA
SetSecurityInfo
SetSecurityInfoExW
LockServiceDatabase
CryptHashSessionKey
EqualSid
GetSecurityInfoExA
OpenProcessToken
RegReplaceKeyA
BuildImpersonateTrusteeW
RegLoadKeyW
AreAllAccessesGranted
GetTrusteeNameA
RegCreateKeyA
CryptGenKey
CryptEnumProvidersW
InitializeAcl
GetSecurityDescriptorOwner
BuildImpersonateExplicitAccessWithNameW
LookupPrivilegeDisplayNameW
QueryServiceLockStatusW
GetSecurityInfoExW
LookupPrivilegeDisplayNameA
GetAccessPermissionsForObjectW
RegLoadKeyA
LookupAccountNameA
GetFileSecurityW
IsValidSecurityDescriptor
RegQueryValueW
AllocateLocallyUniqueId
RegQueryValueA
AccessCheckAndAuditAlarmA
GetTrusteeTypeA
RegConnectRegistryA
BuildSecurityDescriptorW
GetKernelObjectSecurity
SetNamedSecurityInfoA
RegGetKeySecurity
BackupEventLogA
RegConnectRegistryW
RegEnumKeyA
GetMultipleTrusteeOperationA
GetMultipleTrusteeOperationW
PrivilegedServiceAuditAlarmW
ClearEventLogW
RegSetValueExA
GetEffectiveRightsFromAclA
RegUnLoadKeyA
CryptGetUserKey
SetSecurityDescriptorSacl
AllocateAndInitializeSid
AdjustTokenGroups
CryptVerifySignatureW
CryptSetProviderExW
ConvertSecurityDescriptorToAccessNamedW
RegOpenKeyW
PrivilegedServiceAuditAlarmA
AddAuditAccessAce
ObjectOpenAuditAlarmW
RegNotifyChangeKeyValue
SetFileSecurityW
ObjectCloseAuditAlarmA
RegCreateKeyExA
AreAnyAccessesGranted
GetCurrentHwProfileA
TrusteeAccessToObjectA
PrivilegeCheck
GetNamedSecurityInfoExA
LookupAccountSidW
RegEnumKeyExW
LookupPrivilegeValueW
EnumServicesStatusA
GetSidSubAuthority
SetEntriesInAccessListW
RegQueryInfoKeyA
RegSetKeySecurity
LookupAccountNameW
OpenThreadToken
BuildTrusteeWithNameA
EqualPrefixSid
InitializeSecurityDescriptor
StartServiceCtrlDispatcherA
DeregisterEventSource
RegQueryValueExW
DuplicateTokenEx
kernel32
LocalShrink
CreateNamedPipeW
SetTimeZoneInformation
SwitchToThread
GetProfileIntW
GetFileAttributesExW
GetAtomNameW
CreateMailslotW
GetWriteWatch
SetConsoleTextAttribute
GetFileSize
FindResourceA
SetCommMask
GetTempFileNameA
TerminateProcess
DisableThreadLibraryCalls
SetMessageWaitingIndicator
EnumDateFormatsExW
SetMailslotInfo
CreateProcessW
EnumSystemLocalesW
GetModuleHandleW
GetAtomNameA
GetComputerNameW
GetCommandLineW
DebugActiveProcess
LCMapStringA
EnumTimeFormatsA
FindResourceExW
lstrcpynW
PeekConsoleInputW
CreateMutexA
FindFirstChangeNotificationA
ReadConsoleInputA
GlobalAlloc
VirtualAlloc
WriteFileGather
CreateProcessA
TlsGetValue
SetFilePointer
FindCloseChangeNotification
GetDiskFreeSpaceW
GetStringTypeW
GetEnvironmentStrings
OutputDebugStringW
SystemTimeToFileTime
LCMapStringW
FileTimeToLocalFileTime
SetSystemTimeAdjustment
HeapWalk
GetLargestConsoleWindowSize
GetSystemInfo
BuildCommDCBAndTimeoutsW
FlushFileBuffers
SetCalendarInfoW
GetFileInformationByHandle
GetTimeFormatA
SetConsoleActiveScreenBuffer
BackupRead
GetCurrentThread
GetPrivateProfileSectionW
SetPriorityClass
GetCommMask
FindFirstFileExA
GetProfileSectionW
FindClose
Heap32ListNext
WriteConsoleInputA
FindNextFileW
LockFile
RequestWakeupLatency
lstrcmpiW
lstrcatW
SearchPathA
GlobalUnlock
GetCompressedFileSizeW
FindNextChangeNotification
CreateDirectoryA
CreateFiber
DeleteAtom
SetProcessAffinityMask
ReadConsoleInputW
SetFileAttributesW
GetVersionExW
GlobalDeleteAtom
CreateTapePartition
CreateMailslotA
SetLocalTime
GetEnvironmentVariableW
CreateFileA
AllocConsole
SetCurrentDirectoryA
SetThreadLocale
GlobalGetAtomNameW
GetCalendarInfoA
ConvertDefaultLocale
lstrcmp
GetCurrentThreadId
GetPrivateProfileStringA
BuildCommDCBAndTimeoutsA
LoadResource
GetStartupInfoW
VirtualFreeEx
FoldStringW
TerminateThread
VirtualQueryEx
GetFileAttributesA
TransactNamedPipe
GetThreadLocale
SetCommTimeouts
WriteConsoleOutputAttribute
Module32First
RequestDeviceWakeup
DeleteFileW
EnumResourceLanguagesA
IsDBCSLeadByte
GetEnvironmentStringsW
SetThreadPriorityBoost
PrepareTape
ReadConsoleA
VirtualProtect
Sections
.text Size: 63KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 349B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE