Static task
static1
Behavioral task
behavioral1
Sample
794cfe8d43fd669b8b92656a55e952a90255aec163fbfed949c12013d379c7d3.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
794cfe8d43fd669b8b92656a55e952a90255aec163fbfed949c12013d379c7d3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
794cfe8d43fd669b8b92656a55e952a90255aec163fbfed949c12013d379c7d3
-
Size
920KB
-
MD5
44418ea305707c31dcec89299fac2fe0
-
SHA1
6371b5b2f436069991115dfdd476045a19f921f9
-
SHA256
794cfe8d43fd669b8b92656a55e952a90255aec163fbfed949c12013d379c7d3
-
SHA512
e1353f10f36d83be5c58e7617a5018ab4f8ddc9c727bdea4e4decc4034fade4d53dfd57d8b1afc709c3b1fb4b97e5853341e51e91a06cc2a0ac8bb55791c95d6
-
SSDEEP
12288:gYRs1eFHUKbCyHstzvLJQOb7ciEJNVCN1tuT:gkKKbCyMtzvqOb7jEJnCN1
Malware Config
Signatures
Files
-
794cfe8d43fd669b8b92656a55e952a90255aec163fbfed949c12013d379c7d3.exe windows x86
d5e7669326de6b6454bf498faaefccf8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc71d
ord8676
ord5288
ord8674
ord4663
ord6738
ord1875
ord6976
ord2591
ord2233
ord2232
ord2163
ord7004
ord4007
ord6187
ord5949
ord2795
ord1680
ord4495
ord386
ord714
ord2645
ord694
ord929
ord5641
ord1423
ord347
ord316
ord674
ord855
ord8343
ord8394
ord8430
ord8395
ord1120
ord2330
ord621
ord1836
ord5792
ord2333
ord1438
ord7997
ord6720
ord832
ord711
ord693
ord745
ord2548
ord2558
ord1832
ord2766
ord8329
ord3200
ord7648
ord4114
ord2235
ord426
ord7793
ord7643
ord2176
ord2177
ord340
ord379
ord573
ord5997
ord1100
ord6011
ord1095
ord8653
ord5406
ord310
ord1363
ord926
ord6733
ord4853
ord893
ord901
ord6941
ord704
ord368
ord2530
ord5518
ord4914
ord326
ord5668
ord1579
ord4568
ord499
ord1563
ord1364
ord794
ord270
ord7220
ord8694
ord5563
ord3668
ord1034
ord1046
ord2847
ord1475
ord1724
ord267
ord269
ord7209
ord8683
ord5477
ord1157
ord303
ord5594
ord3124
ord5765
ord4077
ord1070
ord8562
ord8556
ord3411
ord1153
ord5712
ord2529
ord7520
ord7466
ord2041
ord305
ord4124
ord8472
ord272
ord2038
ord2075
ord739
ord1985
ord4872
ord7212
ord4078
ord7623
ord6867
ord419
ord8685
ord8288
ord7459
ord8057
ord7366
ord1154
ord1151
ord3123
ord5342
ord2034
ord3234
ord7407
ord4724
ord1214
ord5766
ord1213
ord910
ord646
ord900
ord7418
ord3359
ord874
ord1640
ord7630
ord7909
ord7053
ord6375
ord7680
ord7257
ord2048
ord5934
ord5977
ord5843
ord6486
ord6621
ord6565
ord7660
ord7253
ord1997
ord1181
ord2891
ord1758
ord4626
ord635
ord866
ord2042
ord2152
ord4060
ord7252
ord5096
ord4842
ord2550
ord2035
ord5755
ord2745
ord2107
ord8126
ord1928
ord5920
ord7018
ord2905
ord1771
ord358
ord699
ord3116
ord3477
ord6351
ord7270
ord6354
ord6386
ord7606
ord4835
ord2105
ord5918
ord695
ord348
ord5226
ord2236
ord3251
ord5793
ord7607
ord5222
ord4340
ord5775
ord5590
ord4654
ord2945
ord2992
ord7954
ord1918
ord2996
ord5716
ord4772
ord873
ord1999
ord3191
ord8707
ord6875
ord645
ord3350
ord8550
ord1634
ord1644
ord742
ord1986
ord7465
ord3830
ord3834
ord5473
ord5461
ord3142
ord3132
ord7554
ord422
ord3412
ord1589
ord3003
ord3013
ord3294
ord3276
ord3274
ord3292
ord3304
ord3281
ord3297
ord3302
ord3285
ord3287
ord3289
ord3283
ord3299
ord3279
ord1189
ord1185
ord1442
ord1187
ord1183
ord1178
ord7056
ord7058
ord8200
ord2164
ord1165
ord5969
ord6463
ord4783
ord1813
ord3005
ord7007
ord5864
ord8672
ord6849
ord2519
ord6952
ord5930
ord1927
ord5507
ord2187
ord2190
ord8123
ord2111
ord2112
ord2255
ord2256
ord6286
ord6646
ord6476
ord5892
ord6983
ord5053
ord3091
ord3671
ord5200
ord4656
ord5510
ord3179
ord7963
ord4059
ord5319
ord1403
ord8233
ord1493
ord2657
ord888
ord908
ord662
ord4646
ord7691
ord1768
ord2902
ord5948
ord6182
ord5514
ord3690
ord5150
ord5160
ord5159
ord3511
ord3692
ord3519
ord3983
ord3788
ord5998
ord3980
ord3811
ord3516
ord7559
ord7017
ord7052
ord6274
ord5511
ord7042
ord7040
ord4122
ord2533
ord5321
ord7282
ord8607
ord6881
ord1346
ord5295
ord7576
ord2655
ord2700
ord6017
ord8673
ord5287
ord8675
ord5621
ord5663
ord5095
ord6245
ord1565
ord4757
ord1569
msvcr71d
_stricmp
_vsnwprintf
_snwprintf
realloc
memmove
_time64
ceil
floor
_mktime64
_gmtime64
memcmp
wcscmp
wcslen
wcsncpy
_setmbcp
printf
strrchr
strchr
strtok
strncpy
_access
strlen
fclose
fwrite
fseek
atoi
??0exception@@QAE@XZ
??1exception@@UAE@XZ
memcpy
fopen
fread
_mkdir
_vsnprintf
strcat
strncat
strftime
strcpy
_purecall
memset
_CxxThrowException
??0bad_cast@@QAE@PBD@Z
??1bad_cast@@UAE@XZ
??0bad_cast@@QAE@ABV0@@Z
??0exception@@QAE@ABV0@@Z
_controlfp
free
malloc
wcscpy
_except_handler3
_resetstkoflw
__CxxFrameHandler
_CrtDbgReport
_localtime64
isdigit
sprintf
_snprintf
rand
strtol
??0exception@@QAE@ABQBD@Z
calloc
strcmp
_mbsstr
_mbsnbcpy
_assert
_CRT_RTC_INIT
??1type_info@@UAE@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_cexit
exit
_ismbblead
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
__security_error_handler
time
strstr
kernel32
FindClose
GetFileAttributesA
SetEvent
WaitForMultipleObjects
SetFileAttributesA
DeleteFileA
CreateThread
CreateEventA
WaitForSingleObject
GetTickCount
RaiseException
DeleteCriticalSection
CreateMutexA
CloseHandle
GetLastError
lstrlenA
lstrcmpiA
lstrcmpiW
GetStringTypeExA
GetStringTypeExW
WideCharToMultiByte
lstrlenW
CompareStringA
CompareStringW
GetEnvironmentVariableA
MultiByteToWideChar
GetVersion
GetEnvironmentVariableW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
FindNextFileA
SystemTimeToFileTime
GetCurrentDirectoryA
LocalFree
CreateDirectoryA
SetFileTime
WriteFile
Process32Next
TerminateProcess
OpenProcess
Process32First
RemoveDirectoryA
GetModuleFileNameA
CopyFileExA
CreateProcessA
SetCurrentDirectoryA
InterlockedDecrement
GetPrivateProfileStringA
GetPrivateProfileIntA
GetModuleHandleA
GetStartupInfoA
ExitProcess
DebugBreak
GetProcAddress
LoadLibraryA
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
HeapAlloc
GetProcessHeap
GetCurrentProcess
FreeLibrary
ReadFile
FindFirstFileA
TerminateThread
FreeResource
SizeofResource
LockResource
LoadResource
FormatMessageA
LocalFileTimeToFileTime
GetFileAttributesExA
OpenEventA
lstrcpyA
lstrcpyW
OutputDebugStringA
OutputDebugStringW
lstrcpynW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
MulDiv
FileTimeToSystemTime
FileTimeToLocalFileTime
VirtualAlloc
UnmapViewOfFile
IsBadReadPtr
GetSystemInfo
MapViewOfFile
CreateFileMappingA
GetCurrentThread
OpenFileMappingA
InterlockedIncrement
GetModuleFileNameW
FindResourceA
CreateToolhelp32Snapshot
CreateFileA
SetFilePointer
user32
CharUpperW
CharUpperA
SubtractRect
UnionRect
IntersectRect
OffsetRect
InflateRect
EqualRect
SetRectEmpty
CharLowerA
PtInRect
IsRectEmpty
CopyRect
MsgWaitForMultipleObjects
PeekMessageA
IsWindowUnicode
GetMessageW
GetMessageA
TranslateMessage
DispatchMessageW
DispatchMessageA
CharLowerW
SetRect
RemovePropA
GetPropA
UnregisterClassA
SetPropA
PostMessageA
wsprintfA
DrawTextA
GetCursorPos
IsWindow
PostQuitMessage
gdi32
GetStockObject
advapi32
OpenThreadToken
SetThreadToken
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
RevertToSelf
shell32
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetMalloc
comctl32
ord17
_TrackMouseEvent
shlwapi
StrTrimA
ole32
CoRegisterClassObject
CoUnmarshalInterface
CoMarshalInterface
CoReleaseMarshalData
CoCreateInstance
OleRun
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoRevokeClassObject
oleaut32
CreateErrorInfo
SetErrorInfo
GetErrorInfo
VarDateFromUdate
SystemTimeToVariantTime
VarUdateFromDate
VariantTimeToSystemTime
DosDateTimeToVariantTime
SysAllocString
SysStringByteLen
SysAllocStringByteLen
VariantInit
VariantChangeType
VariantClear
SysFreeString
VariantCopy
gdiplus
GdipCloneImage
GdipLoadImageFromFile
GdipDrawImageRectRect
GdipSetInterpolationMode
GdipDisposeImage
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromStream
GdipLoadImageFromFileICM
GdipFree
GdipGetImageHeight
GdipGetImageWidth
GdipDrawImageRectRectI
GdipDeleteGraphics
GdiplusStartup
GdiplusShutdown
GdipCreateImageAttributes
GdipDisposeImageAttributes
GdipSetImageAttributesColorMatrix
GdipCreateFromHDC
GdipAlloc
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipBitmapUnlockBits
GdipBitmapLockBits
ws2_32
WSAStartup
WSACleanup
msvcp71d
?_Register@facet@locale@std@@QAEXXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
?to_int_type@?$char_traits@_W@std@@SAGAB_W@Z
?sbumpc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WD@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@@Z
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Ipfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAE_N_N@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?max_size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?sgetc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?snextc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEGXZ
?eof@?$char_traits@_W@std@@SAGXZ
?eq_int_type@?$char_traits@_W@std@@SA_NABG0@Z
?to_char_type@?$char_traits@_W@std@@SA_WABG@Z
?is@?$ctype@_W@std@@QBE_NF_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?good@ios_base@std@@QBE_NXZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?flags@ios_base@std@@QBEHXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?to_int_type@?$char_traits@D@std@@SAHABD@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0_Lockit@std@@QAE@H@Z
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@@Z
?_Incref@facet@locale@std@@QAEXXZ
??1_Lockit@std@@QAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1locale@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?width@ios_base@std@@QBEHXZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?eof@?$char_traits@D@std@@SAHXZ
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?to_char_type@?$char_traits@D@std@@SADABH@Z
?is@?$ctype@D@std@@QBE_NFD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?width@ios_base@std@@QAEHH@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?fill@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBE_WXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??7ios_base@std@@QBE_NXZ
?eof@ios_base@std@@QBE_NXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?gcount@?$basic_istream@DU?$char_traits@D@std@@@std@@QBEHXZ
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
sensapi
IsNetworkAlive
wininet
InternetGetConnectedState
Sections
.textbss Size: - Virtual size: 246KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 532KB - Virtual size: 531KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 68KB - Virtual size: 66KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 196KB - Virtual size: 193KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
4R� Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE