Static task
static1
Behavioral task
behavioral1
Sample
564b681f2a1368f625113784d60287ef27cfac2538c46e94213335324590170b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
564b681f2a1368f625113784d60287ef27cfac2538c46e94213335324590170b.exe
Resource
win10v2004-20220812-en
General
-
Target
564b681f2a1368f625113784d60287ef27cfac2538c46e94213335324590170b
-
Size
864KB
-
MD5
32db1d3156361b3ed05829bae8e3e49b
-
SHA1
53e10d299475d3b3ceb84ba793f8619909c329b5
-
SHA256
564b681f2a1368f625113784d60287ef27cfac2538c46e94213335324590170b
-
SHA512
7c62bd80b3455d6447534066e8ff818508b2c091cc37b80b386bfa240309f4fa1785a25ea7811a847a3d2092f2509f24bf29502a895b1b2cf76b79881e9c09c4
-
SSDEEP
12288:lRrehj4LhIZcP8OsJKAUfBFn6RBMnyVq6iPkSKO8liM2YKXqQ8X4UuVi5:lRrOcELJhmsRBMyVri8SKO73XtuGA
Malware Config
Signatures
Files
-
564b681f2a1368f625113784d60287ef27cfac2538c46e94213335324590170b.exe windows x86
0cf63d55868cbb82a566ced8a377b2c5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RemoveDirectoryW
GlobalWire
VirtualFreeEx
WriteConsoleOutputAttribute
WriteProfileStringA
GetDiskFreeSpaceExA
EnterCriticalSection
Process32Next
VirtualAlloc
WriteTapemark
DebugBreak
SetHandleCount
GetNamedPipeHandleStateA
lstrcpynW
CreateFileMappingW
GetDiskFreeSpaceW
SetTapeParameters
lstrcmp
DeleteVolumeMountPointA
GetNumberFormatW
GetPrivateProfileStructA
GetConsoleAliasExesLengthW
LeaveCriticalSection
IsBadReadPtr
GetConsoleHardwareState
SetComputerNameExA
GlobalFindAtomW
GlobalFindAtomA
SetConsoleMode
GetDefaultCommConfigA
LCMapStringW
GetProcAddress
SetProcessAffinityMask
GetStringTypeExW
GlobalGetAtomNameA
FindVolumeMountPointClose
FindActCtxSectionStringW
VerLanguageNameA
LoadLibraryA
WritePrivateProfileSectionA
DeleteCriticalSection
GetConsoleCommandHistoryLengthA
SetProcessPriorityBoost
BuildCommDCBAndTimeoutsA
lstrlenW
FindNextChangeNotification
ExpungeConsoleCommandHistoryW
msvcp60
?min@?$numeric_limits@F@std@@SAFXZ
?get@?$messages@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@HHHABV32@@Z
??_8?$basic_istream@GU?$char_traits@G@std@@@std@@7B@
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?setbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAEPAV12@PAGH@Z
??0?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@I@Z
??4range_error@std@@QAEAAV01@ABV01@@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@AAV?$complex@N@0@@Z
??4?$numeric_limits@D@std@@QAEAAV01@ABV01@@Z
??Hstd@@YA?AV?$complex@O@0@ABV10@0@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$numpunct@G@std@@QAE@I@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIID@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?denorm_min@?$numeric_limits@I@std@@SAIXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0length_error@std@@QAE@ABV01@@Z
??4?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?getline@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@PAGHG@Z
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$complex@M@0@@Z
??Pstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?denorm_min@?$numeric_limits@K@std@@SAKXZ
?sin@?$_Ctr@N@std@@SANN@Z
??Xstd@@YAAAV?$complex@M@0@AAV10@ABV10@@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?do_date_order@?$time_get@GV?$istreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@MBEHXZ
?real@?$_Complex_base@M@std@@QAEMABM@Z
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?do_grouping@?$_Mpunct@D@std@@MBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?signaling_NaN@?$numeric_limits@I@std@@SAIXZ
_LExp
?_Mode@?$basic_stringbuf@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEHH@Z
??0?$_Mpunct@D@std@@QAE@ABV_Locinfo@1@I_N@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAE@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z
?_Psum@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPADPADI@Z
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SAIXZ
??0__non_rtti_object@std@@QAE@PBD@Z
??_0?$_Complex_base@M@std@@QAEAAV01@ABM@Z
??_7?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@6B@
??_F?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QAEXXZ
?osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@H@Z
??Dstd@@YA?AV?$complex@O@0@ABOABV10@@Z
?narrow@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDDD@Z
??8std@@YA_NABV?$complex@N@0@0@Z
?infinity@?$numeric_limits@E@std@@SAEXZ
??4?$numeric_limits@I@std@@QAEAAV01@ABV01@@Z
??Hstd@@YA?AV?$complex@N@0@ABNABV10@@Z
??9std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?_Doraise@out_of_range@std@@MBEXXZ
??1?$basic_ofstream@DU?$char_traits@D@std@@@std@@UAE@XZ
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIG@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?imag@?$_Complex_base@M@std@@QAEMABM@Z
?pos_format@?$_Mpunct@D@std@@QBE?AUpattern@money_base@2@XZ
?pubsetbuf@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEPAV12@PAGH@Z
?thousands_sep@?$_Mpunct@G@std@@QBEGXZ
??0range_error@std@@QAE@ABV01@@Z
?in_avail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?do_decimal_point@?$_Mpunct@D@std@@MBEDXZ
??1?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAK@Z
??1?$money_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?round_error@?$numeric_limits@H@std@@SAHXZ
??_7?$basic_ostringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@6B@
?imbue@ios_base@std@@QAE?AVlocale@2@ABV32@@Z
??_F?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
ntdll
NtCreateMailslotFile
_i64toa
NtQuerySystemEnvironmentValueEx
NtReplyWaitReceivePortEx
NtDisplayString
RtlAddAtomToAtomTable
RtlAbsoluteToSelfRelativeSD
_memccpy
VerSetConditionMask
_atoi64
RtlIpv6AddressToStringA
NtStopProfile
NtDeleteFile
CsrCaptureTimeout
ZwImpersonateAnonymousToken
isprint
ZwCreatePort
RtlLargeIntegerSubtract
NtSetDebugFilterState
ZwAccessCheckByTypeResultList
KiUserApcDispatcher
ZwGetContextThread
RtlCreateSecurityDescriptor
ZwDeleteObjectAuditAlarm
RtlCreateRegistryKey
RtlCreateUserSecurityObject
NtSetSystemTime
NtSetVolumeInformationFile
ZwOpenProcess
NtListenPort
RtlApplicationVerifierStop
RtlCaptureStackBackTrace
vDbgPrintEx
RtlFreeSid
RtlMultiByteToUnicodeN
ZwCreateThread
RtlEnableEarlyCriticalSectionEventCreation
NtCreateProcessEx
ZwOpenEventPair
_wcsnicmp
rtm
RtmGetListEnumRoutes
RtmDeregisterClient
RtmGetInstanceInfo
RtmGetDestInfo
RtmGetOpaqueInformationPointer
RtmCloseEnumerationHandle
RtmDeleteRoute
MgmDeRegisterMProtocol
MgmGetNextMfe
RtmCreateRouteList
RtmReleaseRouteInfo
RtmRegisterClient
RtmBlockMethods
RtmGetEnumNextHops
RtmIsBestRoute
RtmGetExactMatchRoute
RtmReleaseNextHopInfo
RtmGetLessSpecificDestination
RtmDeregisterEntity
RtmBlockDeleteRoutes
RtmBlockSetRouteEnable
RtmUpdateAndUnlockRoute
RtmAddNextHop
BestMatchInTable
DumpTable
crypt32
CryptStringToBinaryA
CertStrToNameA
CertEnumCertificatesInStore
CertFindCTLInStore
CryptMsgVerifyCountersignatureEncodedEx
CertOIDToAlgId
CertFindSubjectInCTL
I_CryptFreeTls
CertNameToStrA
CertEnumPhysicalStore
CertCreateCertificateChainEngine
CertVerifyRevocation
CryptVerifyDetachedMessageHash
RegSetValueExU
CertEnumCTLsInStore
CryptSIPGetSignedDataMsg
CryptGetMessageCertificates
CertCompareCertificate
CryptSIPCreateIndirectData
I_CryptAllocTls
CryptGetDefaultOIDDllList
CryptMsgClose
I_CryptGetAsn1Decoder
CertSerializeCertificateStoreElement
I_CryptCreateLruCache
CertComparePublicKeyInfo
CryptImportPublicKeyInfo
CertAddEnhancedKeyUsageIdentifier
CertFindRDNAttr
CertSerializeCTLStoreElement
CryptGetOIDFunctionAddress
CryptSIPRetrieveSubjectGuid
CryptDecryptAndVerifyMessageSignature
I_CryptGetTls
CertAddEncodedCTLToStore
CryptDecodeObject
CertSerializeCRLStoreElement
CryptDecryptMessage
msoert2
GetDllMajorVersion
FreeTempFileList
PszEscapeMenuStringA
CreateStreamOnHFile
IUnknownList_CreateInstance
ShellUtil_GetSpecialFolderPath
HrCopyStream
PszFromANSIStreamA
_MSG
CenterDialog
PszDupA
PszAllocW
PszToUnicode
FMissingCert
IVoidPtrList_CreateInstance
HrGetStreamSize
CleanupFileNameInPlaceA
CchFileTimeToDateTimeSz
fGetBrowserUrlEncoding
PszDupW
BrowseForFolder
HrGetStreamPos
HrSetDirtyFlagImpl
HrDecodeObject
UpdateRebarBandColors
HrGetElementImpl
netapi32
NetEnumerateTrustedDomains
I_NetLogonSamLogon
DsEnumerateDomainTrustsW
NetDfsAdd
DsRoleDemoteDc
NetFileEnum
NetDfsGetInfo
DsRoleGetDcOperationProgress
NlBindingAddServerToCache
NetapipBufferAllocate
I_NetServerGetTrustInfo
NetRemoteTOD
NetGroupGetInfo
NetpGetConfigDword
NetGetAnyDCName
NetpGetFileSecurity
NetReplExportDirAdd
NetpNetBiosReset
I_NetLogonSendToSam
NetUserGetLocalGroups
I_NetLogonControl2
NetLocalGroupGetInfo
NetDfsEnum
DsGetDcSiteCoverageA
NetLogonSetServiceBits
I_NetServerSetServiceBits
NetQueryDisplayInformation
I_NetDatabaseSync
NetUserChangePassword
NetpCleanFtinfoContext
NetUserGetGroups
RxNetServerEnum
NetApiBufferSize
NetStatisticsGet
RxNetAccessEnum
deskmon
DllGetClassObject
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 301KB - Virtual size: 301KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 438KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 980B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ