Static task
static1
Behavioral task
behavioral1
Sample
9d5964296cdc967a9e2adf43451102b6b84d71c2393d4815fb91c78cd5bad2d8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9d5964296cdc967a9e2adf43451102b6b84d71c2393d4815fb91c78cd5bad2d8.exe
Resource
win10v2004-20220812-en
General
-
Target
9d5964296cdc967a9e2adf43451102b6b84d71c2393d4815fb91c78cd5bad2d8
-
Size
2.5MB
-
MD5
6f7a34058d16519913ce9cca880de0ff
-
SHA1
825f8bb6877544b194b96f8cb8e5837e6e12bbe7
-
SHA256
9d5964296cdc967a9e2adf43451102b6b84d71c2393d4815fb91c78cd5bad2d8
-
SHA512
1071617e732a9ad5a5f3bb91db43efc43f354aa143744fb44ffad8613334c37addb91b3b985b479ed4e0faf191e4c7db7e4de8d7aa2b5d8b66b9c1f5d29d62d3
-
SSDEEP
768:PF4vvlbWt/kwr0u06OUj34GVDHP8YRD1widvD39d4MscJWWjd56K:PFKlbWt5r0ULHPbXpD39eMst
Malware Config
Signatures
Files
-
9d5964296cdc967a9e2adf43451102b6b84d71c2393d4815fb91c78cd5bad2d8.exe windows x86
5ded618612757132417be3630adf1a03
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
ws2_32
htons
inet_addr
recv
send
socket
gethostname
WSAAsyncSelect
closesocket
WSAStartup
WSACleanup
connect
kernel32
FillConsoleOutputAttribute
FillConsoleOutputCharacterA
FlushConsoleInputBuffer
FlushFileBuffers
GetCommandLineA
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetDiskFreeSpaceA
GetDriveTypeA
GetLastError
GetModuleFileNameA
GetModuleHandleA
CloseHandle
GetProcAddress
GetProcessHeap
GetStdHandle
GetTickCount
GetVolumeInformationA
GlobalMemoryStatus
HeapAlloc
LoadLibraryA
LocalAlloc
OpenProcess
Process32First
Process32Next
ReadConsoleA
CreateFileA
ReadConsoleOutputA
ReadConsoleOutputW
ReadConsoleW
ReadFile
RtlUnwind
ScrollConsoleScreenBufferA
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsoleTextAttribute
TerminateProcess
TerminateThread
CreatePipe
CreateProcessA
WriteConsoleA
WriteConsoleOutputA
WriteConsoleOutputW
WriteConsoleW
WriteFile
lstrlenA
lstrlenW
CreateThread
CreateToolhelp32Snapshot
user32
GetWindowTextA
GetParent
GetWindowThreadProcessId
LoadCursorA
LoadIconA
RegisterClassA
GetMessageA
TranslateMessage
DispatchMessageA
PostQuitMessage
EnumWindows
CreateWindowExA
DefWindowProcA
advapi32
LookupAccountSidA
LookupPrivilegeValueA
ChangeServiceConfigA
CloseServiceHandle
ControlService
CreateServiceA
DeleteService
EnumServicesStatusExA
LockServiceDatabase
OpenSCManagerA
OpenServiceA
QueryServiceConfigA
QueryServiceConfig2A
QueryServiceStatus
QueryServiceStatusEx
StartServiceA
UnlockServiceDatabase
OpenProcessToken
GetTokenInformation
AdjustTokenPrivileges
GetLengthSid
CopySid
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
GetCurrentHwProfileA
crtdll
__GetMainArgs
atoi
exit
free
malloc
memset
printf
raise
signal
sprintf
sscanf
strchr
strcmp
strcpy
strlen
strncmp
strrchr
strstr
Sections
.text Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.bss Size: - Virtual size: 3KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE