Static task
static1
Behavioral task
behavioral1
Sample
04a6dfb9e7249d45cc4129e6df4e511320dddb62212627a51113f70670156457.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
04a6dfb9e7249d45cc4129e6df4e511320dddb62212627a51113f70670156457.exe
Resource
win10v2004-20220901-en
General
-
Target
04a6dfb9e7249d45cc4129e6df4e511320dddb62212627a51113f70670156457
-
Size
5.4MB
-
MD5
e3937e54a1eba9f9c946959e1588ec83
-
SHA1
9ca8f169e3af48839b1f2fbc3bdce50ff5196b96
-
SHA256
04a6dfb9e7249d45cc4129e6df4e511320dddb62212627a51113f70670156457
-
SHA512
1bf907d9893fc0b6d44c6ab5a7319ed8931d4c5b1b55cb80019d3c8cf6cd0baf7aa08bd8e0917e1ac6574aba1093f931c2547b2c3d2749181929aa21845d91c6
-
SSDEEP
98304:+a6Kf6tDRDh4m1WPQ/esqPWc5tFLYLvBcwz+f9q:iKE1DSmcPGqYLv6Pfg
Malware Config
Signatures
Files
-
04a6dfb9e7249d45cc4129e6df4e511320dddb62212627a51113f70670156457.exe windows x86
c614d9c2b9821a68d2fac780fe873127
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
kernel32
WaitForMultipleObjects
PostQueuedCompletionStatus
DeleteCriticalSection
GetQueuedCompletionStatus
SetWaitableTimer
LeaveCriticalSection
EnterCriticalSection
InterlockedCompareExchange
TlsFree
TlsAlloc
TlsGetValue
TlsSetValue
SleepEx
SetEvent
CreateEventW
CreateIoCompletionPort
VerifyVersionInfoW
VerSetConditionMask
CreateWaitableTimerW
GetProcessHandleCount
GlobalMemoryStatusEx
GetCurrentThreadId
MapViewOfFile
OpenMutexW
LoadLibraryA
GlobalAlloc
GlobalFree
SetConsoleCtrlHandler
FindFirstFileW
FindNextFileW
GetModuleFileNameW
FindClose
GetSystemDirectoryW
GetACP
QueryDosDeviceW
lstrlenW
GetFileAttributesW
InterlockedExchangeAdd
SetFileAttributesW
GetLogicalDriveStringsW
OutputDebugStringA
CreateMutexW
HeapReAlloc
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
FlushFileBuffers
GetConsoleCP
TerminateThread
QueueUserAPC
InterlockedExchange
GetDiskFreeSpaceExW
FormatMessageW
WideCharToMultiByte
OpenProcess
GetTickCount
SetFilePointer
SetEndOfFile
MapViewOfFileEx
UnmapViewOfFile
GetCurrentProcess
DuplicateHandle
GetCurrentProcessId
Sleep
SwitchToThread
LocalFree
FormatMessageA
SetLastError
GetTimeZoneInformation
HeapAlloc
HeapFree
GetModuleHandleW
OpenFileMappingA
CreateFileMappingA
GetFileSizeEx
WriteFile
CreateFileW
QueryPerformanceFrequency
QueryPerformanceCounter
SetEnvironmentVariableA
ExitProcess
GetCommandLineA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetSystemInfo
MultiByteToWideChar
GetVersionExW
FreeLibrary
InterlockedDecrement
InterlockedIncrement
CloseHandle
GetExitCodeThread
WaitForSingleObject
CreateThread
LoadLibraryW
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetLastError
GetSystemTime
IsValidCodePage
PeekNamedPipe
GetDriveTypeW
HeapSize
ExitThread
WriteConsoleW
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
ReadFile
RtlUnwind
UnregisterWaitEx
QueryDepthSList
GetOEMCP
GetModuleHandleA
SystemTimeToFileTime
InterlockedFlushSList
InterlockedPushEntrySList
GetCurrentDirectoryW
CreateDirectoryW
DeleteFileW
FindFirstFileExW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
RemoveDirectoryW
AreFileApisANSI
CopyFileW
TryEnterCriticalSection
EncodePointer
DecodePointer
RaiseException
WaitForSingleObjectEx
GetCurrentThread
SetFilePointerEx
IsProcessorFeaturePresent
QueueUserWorkItem
GetModuleHandleExW
GetSystemTimeAsFileTime
GetCPInfo
GetStringTypeW
CompareStringW
LCMapStringW
GetLocaleInfoW
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
GetFileType
GetStdHandle
GetEnvironmentVariableW
CreateFiber
DeleteFiber
SwitchToFiber
ConvertThreadToFiber
ConvertFiberToThread
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSection
ExpandEnvironmentStringsA
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
VirtualAlloc
VirtualProtect
VirtualFree
ReleaseSemaphore
InterlockedPopEntrySList
user32
GetUserObjectInformationW
GetProcessWindowStation
GetMessageW
wsprintfW
PostThreadMessageW
DispatchMessageW
TranslateMessage
MessageBoxW
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptGenRandom
SetNamedSecurityInfoA
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
shell32
SHGetFolderPathW
SHGetSpecialFolderPathW
ole32
CoUninitialize
CoCreateInstance
CoInitializeEx
ws2_32
WSAAddressToStringA
WSAIoctl
__WSAFDIsSet
WSASendTo
WSARecvFrom
getpeername
shutdown
connect
select
getsockopt
bind
listen
WSASocketW
htons
WSARecv
getsockname
WSASend
setsockopt
ioctlsocket
closesocket
accept
getaddrinfo
ntohs
htonl
ntohl
WSAAddressToStringW
WSAStartup
WSACleanup
getnameinfo
recv
send
socket
WSAStringToAddressW
WSASetLastError
WSAGetLastError
freeaddrinfo
mswsock
GetAcceptExSockaddrs
AcceptEx
shlwapi
ord219
iphlpapi
GetAdaptersInfo
GetAdaptersAddresses
psapi
GetProcessImageFileNameW
crypt32
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
Sections
.text Size: 4.1MB - Virtual size: 4.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 934KB - Virtual size: 933KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 154KB - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 190KB - Virtual size: 189KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ