_GetInterface@8
Static task
static1
Behavioral task
behavioral1
Sample
2c38c409d6ee33da0b5e3b16e0b4e4f1f2fbcabfae45742730d3b258c7ce8059.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2c38c409d6ee33da0b5e3b16e0b4e4f1f2fbcabfae45742730d3b258c7ce8059.exe
Resource
win10v2004-20220812-en
General
-
Target
2c38c409d6ee33da0b5e3b16e0b4e4f1f2fbcabfae45742730d3b258c7ce8059
-
Size
720KB
-
MD5
80776d062361f1ebb003cd7397825488
-
SHA1
3588f8c1aa864c40329340bd60be4b9424dcadbb
-
SHA256
2c38c409d6ee33da0b5e3b16e0b4e4f1f2fbcabfae45742730d3b258c7ce8059
-
SHA512
07c49cd77eae148831face6331ae8f4fa4105ccde04c3ffae22e95b4a1a23b108f74de7fa921d01bb6e2984385b0c49b2519c838194c890becd6c2428e202125
-
SSDEEP
12288:ZTea6LmnGnWjsxshyNEu6cQXqQYIkP65KXu9e2HuiDg7kP65KXf:ZYykWjONqLXAG9VgC3
Malware Config
Signatures
Files
-
2c38c409d6ee33da0b5e3b16e0b4e4f1f2fbcabfae45742730d3b258c7ce8059.exe windows x86
0f326c84272eb0fabc1a5a2c97bbae71
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessW
GetSystemDirectoryW
GetCommandLineA
LocalFree
SetEvent
CreateEventW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
GetACP
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetFileAttributesW
CreateDirectoryW
WaitForSingleObject
GetLocalTime
FindResourceW
GlobalUnlock
InterlockedIncrement
GetFileSize
GetCurrentProcess
DeleteCriticalSection
SetLastError
GetPrivateProfileStringW
GetModuleHandleW
GlobalAlloc
InitializeCriticalSection
GlobalLock
InterlockedExchange
GetPrivateProfileIntW
FreeResource
RaiseException
InterlockedDecrement
OutputDebugStringW
GetWindowsDirectoryW
GetCurrentThreadId
FlushInstructionCache
CreateFileW
LeaveCriticalSection
ReadFile
GetVersionExW
GlobalFree
EnterCriticalSection
WideCharToMultiByte
lstrlenW
GetTickCount
GlobalAddAtomW
Sleep
CloseHandle
GetModuleFileNameW
OpenProcess
GetCommandLineW
GetLastError
lstrlenA
MultiByteToWideChar
LoadLibraryW
SizeofResource
LockResource
FindResourceExW
GetProcAddress
FreeLibrary
LoadResource
UnhandledExceptionFilter
user32
DestroyWindow
ReleaseDC
ShowWindow
PostMessageW
FindWindowExW
SetWindowTextW
IsWindow
DrawFrameControl
SetRectEmpty
IsChild
DefWindowProcW
SystemParametersInfoW
GetClientRect
GetWindowLongW
CallWindowProcW
GetClassInfoExW
CopyRect
GetMonitorInfoW
DestroyIcon
PtInRect
GetDlgItem
UpdateLayeredWindow
RegisterWindowMessageW
UnregisterClassA
SendMessageTimeoutW
SetForegroundWindow
BringWindowToTop
MessageBoxA
AttachThreadInput
GetForegroundWindow
PostQuitMessage
SetActiveWindow
GetWindowThreadProcessId
GetDesktopWindow
MapWindowPoints
DispatchMessageW
InflateRect
ReleaseCapture
DrawIconEx
SetCursor
ScreenToClient
SetCapture
GetWindowRect
IsDialogMessageW
MonitorFromWindow
SetRect
EndPaint
GetParent
LoadCursorW
DrawTextW
SendMessageW
KillTimer
RegisterClassExW
GetCursorPos
MoveWindow
SetTimer
SetFocus
GetMessageW
EqualRect
SetWindowLongW
GetWindow
OffsetRect
PeekMessageW
GetNextDlgTabItem
IsWindowVisible
InvalidateRect
LoadImageW
GetFocus
BeginPaint
SetWindowPos
GetDlgCtrlID
LoadIconW
LoadBitmapW
IsRectEmpty
CreateWindowExW
ClientToScreen
IntersectRect
TranslateMessage
GetDC
FindWindowW
gdi32
GetStockObject
Rectangle
GetClipRgn
GetObjectW
CombineRgn
TextOutW
LineTo
CreatePen
DeleteDC
CreateCompatibleBitmap
SetTextColor
RectInRegion
CreateBitmap
SetBkMode
GetCurrentObject
CreateCompatibleDC
GetViewportOrgEx
CreateRectRgn
SaveDC
BitBlt
CreateFontIndirectW
SelectClipRgn
CreateDIBSection
ExtSelectClipRgn
CreateRoundRectRgn
CreateSolidBrush
RestoreDC
SetBkColor
SelectObject
SetViewportOrgEx
MoveToEx
OffsetRgn
RoundRect
SetStretchBltMode
ExtTextOutW
GetTextColor
CreateRectRgnIndirect
GetTextExtentPoint32W
DeleteObject
StretchBlt
GetDeviceCaps
advapi32
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
GetUserNameW
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
GetSecurityDescriptorSacl
shell32
SHGetFolderPathW
ShellExecuteW
ole32
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
oleaut32
SysFreeString
msvcp80
??1locale@std@@QAE@XZ
??0locale@std@@QAE@XZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V32@0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEX_NI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@V?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@0ABV12@@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcat@?$numpunct@_W@std@@SAIPAPBVfacet@locale@2@@Z
?_Register@facet@locale@std@@QAEXXZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
??0?$allocator@_W@std@@QAE@XZ
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
??0?$_String_val@_WV?$allocator@_W@std@@@std@@IAE@V?$allocator@_W@1@@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?grouping@?$numpunct@_W@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@@Z
?thousands_sep@?$numpunct@_W@std@@QBE_WXZ
?_Incref@facet@locale@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
?is@?$ctype@_W@std@@QBE_NF_W@Z
?id@?$numpunct@_W@std@@2V0locale@2@A
??0_Lockit@std@@QAE@H@Z
??Bid@locale@std@@QAEIXZ
shlwapi
PathAppendW
StrToIntW
PathFileExistsW
PathFindFileNameW
StrToIntA
PathAddBackslashW
PathRemoveFileSpecW
comctl32
_TrackMouseEvent
msimg32
AlphaBlend
gdiplus
GdipSetTextRenderingHint
GdipFillPath
GdipImageRotateFlip
GdipCreateStringFormat
GdipFree
GdipDeleteFontFamily
GdipCreateBitmapFromScan0
GdipSetSmoothingMode
GdipCreateSolidFill
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipSetStringFormatLineAlign
GdipDeleteGraphics
GdipClosePathFigure
GdiplusShutdown
GdipResetWorldTransform
GdipDrawImagePointsRectI
GdipFillRectangle
GdipDrawRectangleI
GdipDeletePrivateFontCollection
GdipDrawImageI
GdipCreateHBITMAPFromBitmap
GdipDeletePath
GdipCreateFontFromLogfontW
GdipSetStringFormatFlags
GdipCreateBitmapFromStream
GdipCloneImage
GdipDrawLinesI
GdipCreateImageAttributes
GdipLoadImageFromStream
GdipDisposeImageAttributes
GdipDrawImageRectRect
GdipCreateFromHDC
GdipDeleteBrush
GdipCreateLineBrushFromRectWithAngleI
GdipGetImageGraphicsContext
GdipSetImageAttributesColorMatrix
GdipDrawImageRectI
GdipAlloc
GdipSetCompositingQuality
GdipGetFontCollectionFamilyList
GdipAddPathArcI
GdipAddPathPieI
GdipFillRectangleI
GdipGetFontSize
GdipMeasureString
GdipSetPenEndCap
GdipDeleteFont
GdipPrivateAddFontFile
GdipCloneFontFamily
GdipGetFamily
GdipDrawImageRectRectI
GdipDrawLine
GdipDeletePen
GdipGetImageHeight
GdipDrawPath
GdipSetPenDashStyle
GdipLoadImageFromFile
GdipSetClipPath
GdiplusStartup
GdipDeleteStringFormat
GdipAddPathRectangleI
GdipAddPathStringI
GdipDrawString
GdipGraphicsClear
GdipSetPenMode
GdipCreateFont
GdipCreatePen1
GdipSetPenStartCap
GdipGetImagePixelFormat
GdipCloneBrush
GdipSetPixelOffsetMode
GdipGetImageWidth
GdipCreatePath
GdipSetStringFormatTrimming
GdipSetInterpolationMode
GdipDisposeImage
GdipSetStringFormatAlign
GdipCloneBitmapArea
GdipGetFontCollectionFamilyCount
GdipNewPrivateFontCollection
msvcr80
_CxxThrowException
vswprintf_s
__CxxFrameHandler3
_stricmp
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
??8type_info@@QBE_NABV0@@Z
strchr
isspace
strncmp
isalpha
tolower
isalnum
fprintf
_vsnprintf_s
memmove
wcsncmp
_mktime64
_localtime64_s
iswspace
_wcslwr_s
strlen
memcpy
wcsspn
wcscspn
ceil
_waccess
_wtof
_mbscmp
atoi
vsprintf_s
wcscpy
strcmp
wcschr
_mbschr
_mbsicmp
labs
_vscprintf
abs
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
swprintf_s
??0bad_cast@std@@QAE@ABV01@@Z
wcsstr
floor
??0exception@std@@QAE@ABV01@@Z
wcscmp
wcsrchr
??0exception@std@@QAE@ABQBD@Z
_purecall
??2@YAPAXI@Z
_beginthreadex
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
_wtoi
calloc
_time64
_localtime64
_recalloc
strftime
memmove_s
memset
??_V@YAXPAX@Z
wcslen
malloc
memcpy_s
_vscwprintf
__RTDynamicCast
_wcsicmp
free
??3@YAXPAX@Z
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
Exports
Exports
Sections
.text Size: 288KB - Virtual size: 286KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 94KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 320KB - Virtual size: 319KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ