Static task
static1
Behavioral task
behavioral1
Sample
AVKWCtl.exe
Resource
win7-20220812-it
General
-
Target
AVKWCtl.EXE
-
Size
3.0MB
-
MD5
8ea797eb1796df20d4bdcadf0264ad6c
-
SHA1
782205f9bb0c0504243fb3251f9f8880e3ccf407
-
SHA256
3ed0cd277bc278432fd6f49b58fe25e87e7e9053c714216ebd7f5308206793b2
-
SHA512
37d556c260e7981e9a220d1db8b76ebd31699c66292b89250f51284077b7804b2587c2fa55d83fb863aef3d8f28c37d3207ac115d02dc88e5e6940d0fe094420
-
SSDEEP
49152:EFXf5AlXW0ztezw6wazxaprnbIkNiRDfxAcBmnEnBzq0RNnolJuyaK6qaK6qz:EFXf5Azw0RbytAc+OPKlJ
Malware Config
Signatures
Files
-
AVKWCtl.EXE.exe windows x86
228cfcc5e1207b2bb58d8f194b5b0a7b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
MoveFileA
IsBadWritePtr
FindFirstFileA
SetHandleCount
VirtualProtect
GetCurrentProcess
lstrlenW
GetStdHandle
ReleaseSemaphore
LeaveCriticalSection
GetFullPathNameA
FindResourceA
LocalAlloc
ReleaseMutex
IsBadCodePtr
GetModuleHandleA
GetVersion
OpenMutexA
GetFileAttributesA
CreateFileA
GetCurrentThread
LoadLibraryA
TlsAlloc
FindResourceExA
GlobalAlloc
GetSystemInfo
LoadResource
SetFileAttributesA
SetStdHandle
CreateFileMappingA
DebugBreak
FlushInstructionCache
TlsGetValue
TlsFree
CreateDirectoryA
QueryPerformanceCounter
GetTickCount
MapViewOfFileEx
GetComputerNameA
SetUnhandledExceptionFilter
GetLastError
GetProcAddress
LocalFree
FreeLibrary
WriteConsoleW
HeapSize
CreateFileW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
lstrlenA
VirtualAlloc
ExitProcess
GetModuleHandleW
lstrcmpA
ReadFile
SetEndOfFile
CloseHandle
WideCharToMultiByte
EnterCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
IsDebuggerPresent
UnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwind
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsSetValue
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameW
WriteFile
GetCommandLineA
GetCommandLineW
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
MoveFileExW
GetFileSizeEx
SetFilePointerEx
GetFileType
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
user32
GetSystemMetrics
ole32
CoInitializeEx
CoCreateGuid
wsock32
socket
connect
recv
send
WSAGetLastError
WSACleanup
WSAStartup
htons
gethostbyname
setsockopt
crypt32
CertFreeCertificateContext
CertOpenSystemStoreA
CertFindChainInStore
shlwapi
PathFileExistsA
Sections
.text Size: 580KB - Virtual size: 579KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
CODE Size: - Virtual size: 584B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1.5MB - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.fdata Size: 512B - Virtual size: 1B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 92B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 870KB - Virtual size: 869KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ