Static task
static1
Behavioral task
behavioral1
Sample
f1d5e99465d30a49df0df1855fc8982c893829b895d767120abab24f2642c58e.exe
Resource
win7-20220812-en
General
-
Target
f1d5e99465d30a49df0df1855fc8982c893829b895d767120abab24f2642c58e
-
Size
760KB
-
MD5
65feaf516852831a2e0cd62930e4d890
-
SHA1
93ee37e6d04c6c1dc34cf24b8101bae904d07d2d
-
SHA256
f1d5e99465d30a49df0df1855fc8982c893829b895d767120abab24f2642c58e
-
SHA512
74ea6edfb414f79e249ef023e6a0d7b775747390ca1042b9f3e0bcecccfa4a7802f20f14c5ee188db2b3d61c452cc033cb9fc284ab0f29aa2693dd8b653a76cf
-
SSDEEP
6144:/aKFVip6wM4AfNrUq76cLdAfgfb3TlwFEoSpWaK+lIZNVh42xrYGIWT:6MwMx2qKgjDlc6p1viDBd
Malware Config
Signatures
Files
-
f1d5e99465d30a49df0df1855fc8982c893829b895d767120abab24f2642c58e.exe windows x86
f29cb0dee4537d17daa7ff48c8c88b3b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
DebugBreak
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeviceIoControl
EnterCriticalSection
ExitProcess
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindResourceW
FlushFileBuffers
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDriveTypeA
GetExitCodeThread
GetFileAttributesA
GetFileAttributesW
GetFileSize
GetFileType
GetFullPathNameA
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoA
GetLongPathNameA
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleW
GetProcessHeap
GetStartupInfoW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempFileNameA
GetTempFileNameW
GetThreadLocale
GetTickCount
GetUserDefaultLCID
GetVersion
GetVersionExA
GetVersionExW
CreateFileMappingW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
HeapAlloc
HeapDestroy
CreateMutexW
InitializeCriticalSection
InterlockedCompareExchange
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
IsValidLocale
LCMapStringA
LCMapStringW
LeaveCriticalSection
LoadLibraryW
LoadResource
LockResource
MapViewOfFile
MultiByteToWideChar
QueryDosDeviceW
QueryPerformanceCounter
ReadFile
ReleaseMutex
RtlUnwind
SetEndOfFile
SetErrorMode
SetEvent
SetFileAttributesW
SetFilePointer
SetLastError
SetThreadPriority
SetUnhandledExceptionFilter
SystemTimeToFileTime
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteFile
lstrlenA
lstrlenW
CreateFileMappingA
CreateFileA
CreateEventW
CreateDirectoryW
CopyFileW
CompareStringW
CompareFileTime
CloseHandle
GetDriveTypeW
LoadLibraryA
GetProcAddress
Sleep
GetModuleHandleA
CreateMutexA
HeapFree
CreateFileW
GetVolumeInformationW
VirtualAllocEx
user32
LoadIconA
CharNextA
DispatchMessageW
GetMessageA
KillTimer
MessageBoxW
MsgWaitForMultipleObjects
PeekMessageW
PostThreadMessageA
SetTimer
TranslateMessage
LoadIconW
gdi32
DeleteMetaFile
DeleteEnhMetaFile
advapi32
RegQueryValueExA
GetFileSecurityW
GetSecurityDescriptorControl
GetSecurityDescriptorLength
IsValidSecurityDescriptor
RegCloseKey
RegCreateKeyExW
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SetFileSecurityW
TraceMessage
RegOpenKeyExA
shell32
SHGetPathFromIDListW
SHGetMalloc
SHGetFolderPathW
SHFileOperationW
SHGetSpecialFolderLocation
ole32
CLSIDFromString
CoCreateFreeThreadedMarshaler
CoCreateGuid
CoCreateInstance
CoGetInterfaceAndReleaseStream
CoGetMalloc
StringFromCLSID
PropVariantCopy
PropVariantClear
CreateStreamOnHGlobal
CoUnmarshalInterface
CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoReleaseMarshalData
CoMarshalInterface
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
shlwapi
PathUndecorateW
PathRemoveFileSpecW
PathRemoveBackslashW
PathGetCharTypeA
PathGetCharTypeW
msvcrt
_snwprintf
wcstoul
wcstombs
wcsstr
wcsrchr
wcspbrk
wcsncpy
wcsncmp
wcslen
wcscpy
wcschr
towupper
towlower
swscanf
rand
qsort
memset
memmove
memcpy
_CIpow
_CIsqrt
_XcptFilter
__dllonexit
__p__commode
__p__fmode
__set_app_type
__setusermatherr
__wgetmainargs
_adjust_fdiv
_amsg_exit
_beginthreadex
_cexit
_controlfp
_exit
_initterm
_lock
_onexit
_purecall
_unlock
_vsnwprintf
_wcmdln
_wcsicmp
_wcsnicmp
_wtoi
_wtoi64
_wtol
abs
atoi
bsearch
exit
floor
free
iswalnum
iswdigit
iswspace
malloc
memcmp
Sections
.text Size: 731KB - Virtual size: 731KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text2 Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 376B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ