Static task
static1
Behavioral task
behavioral1
Sample
2883a4be85002d827614b1ed948229d171e64c155708b44fa2e9483c59098550.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2883a4be85002d827614b1ed948229d171e64c155708b44fa2e9483c59098550.exe
Resource
win10v2004-20220812-en
General
-
Target
2883a4be85002d827614b1ed948229d171e64c155708b44fa2e9483c59098550
-
Size
210KB
-
MD5
6f947d78f5114cdba86e005c36da9a45
-
SHA1
4191f006038f320f01949a027245cadd40af9c04
-
SHA256
2883a4be85002d827614b1ed948229d171e64c155708b44fa2e9483c59098550
-
SHA512
2bc77def36a6eca250486f797a55ffa4371551a4d342efd1283966a5d91a99732d9a2c35a27ce0a4ed38aa96e06363e6f013f5a5a4e5ecefd1733c9fbc199e57
-
SSDEEP
3072:HoQ/V+lMTH2c30P8XMdsOD0nfBIXQdqirEJCi0EvF9SUF7uLWYjKlX1B:J/F2MvMdsOD0n5gbCiBvuWoKd
Malware Config
Signatures
Files
-
2883a4be85002d827614b1ed948229d171e64c155708b44fa2e9483c59098550.exe windows x86
ecd1d06a0cfb16dd06db5d2ffc8a07ed
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc90
ord2208
ord5309
ord5152
ord4617
ord5615
ord3480
ord4667
ord5647
ord4638
ord1497
ord6391
ord3346
ord1668
ord611
ord601
ord6257
ord817
ord945
ord2610
ord2630
ord2614
ord2620
ord2618
ord2616
ord2633
ord2628
ord2612
ord2635
ord2623
ord2605
ord2607
ord2625
ord2375
ord1810
ord1644
ord6784
ord4160
ord6782
ord3671
ord1809
ord1678
ord5389
ord6356
ord798
ord265
ord266
ord310
ord3178
ord300
ord3726
ord2899
ord6559
ord2069
ord2591
ord524
ord744
ord5167
ord4311
ord4197
ord3218
ord1446
ord3344
ord6388
ord800
ord1755
ord1752
ord4331
ord1496
ord4650
ord5585
ord2074
ord5497
ord6780
ord969
ord4589
ord5636
ord3732
ord5139
ord4688
ord1729
ord6446
ord5668
ord5666
ord958
ord963
ord967
ord965
ord2368
ord5997
ord2672
ord4392
ord5963
ord820
ord2327
ord1098
ord6462
ord793
ord4434
ord4409
ord6783
ord4159
ord6781
ord4733
ord2251
ord2206
ord6018
ord4165
ord5608
ord2139
ord1792
ord1791
ord1728
ord5633
ord2766
ord2978
ord3107
ord4714
ord2961
ord3135
ord2769
ord2888
ord2759
ord4066
ord4067
ord1046
ord5533
ord6721
ord5813
ord4199
ord2087
ord3209
ord4057
ord2886
ord4334
ord4895
ord4668
ord3506
ord374
ord639
ord3987
ord5657
ord5659
ord2447
ord4333
ord4981
ord5663
ord5646
ord6001
ord3110
ord4890
ord3659
ord589
ord4029
ord1108
ord2274
ord3277
ord595
ord6074
ord1357
ord1358
ord3477
ord3479
ord2106
ord2539
ord1183
ord3534
ord3612
ord1137
ord2587
ord367
ord636
ord6078
ord6557
ord4801
ord4030
ord1490
ord4993
ord6615
ord316
ord4431
ord910
ord2691
ord5835
ord1276
msvcr90
_splitpath
fread
fseek
sprintf
_vsnprintf
malloc
ftell
memcpy
_setmbcp
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
?terminate@@YAXXZ
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_controlfp_s
_initterm
_acmdln
exit
_invoke_watson
__set_app_type
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
_decode_pointer
__CxxFrameHandler3
_getdiskfree
_getdrive
memset
free
_purecall
_stricmp
_mbstok
_mbscmp
_time64
sprintf_s
_snprintf
_invalid_parameter_noinfo
strcpy_s
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
fclose
fgets
fopen
rand
srand
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
kernel32
lstrlenA
HeapFree
GetProcessHeap
GetCurrentDirectoryA
GetModuleFileNameA
WideCharToMultiByte
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
InterlockedExchange
GetVolumeInformationA
GetSystemInfo
InterlockedDecrement
CreatePipe
GetStartupInfoA
CreateProcessA
WaitForSingleObject
ReadFile
CloseHandle
QueryPerformanceCounter
GetLastError
Sleep
MultiByteToWideChar
GetModuleHandleA
GetProcAddress
GetVersionExA
GlobalMemoryStatus
user32
MessageBoxA
wsprintfA
SetRect
FillRect
DrawIcon
GetClientRect
EnableWindow
LoadIconA
AppendMenuA
SendMessageA
GetSystemMenu
IsIconic
GetSystemMetrics
gdi32
CreateCompatibleBitmap
StretchBlt
Rectangle
CreateCompatibleDC
GetStockObject
advapi32
GetCurrentHwProfileA
comctl32
ord17
ole32
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
oleaut32
VariantClear
SysAllocString
SysFreeString
msvcp90
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??7ios_base@std@@QBE_NXZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?close@?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?close@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_ifstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?bad@ios_base@std@@QBE_NXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?eof@ios_base@std@@QBE_NXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
iphlpapi
GetAdaptersInfo
Sections
.text Size: 61KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ