Static task
static1
Behavioral task
behavioral1
Sample
beefbd4470d17c26cecb06db02c1cb8501bbb2aebc20ff1c48291046dc385792.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
beefbd4470d17c26cecb06db02c1cb8501bbb2aebc20ff1c48291046dc385792.exe
Resource
win10v2004-20220812-en
General
-
Target
beefbd4470d17c26cecb06db02c1cb8501bbb2aebc20ff1c48291046dc385792
-
Size
1.5MB
-
MD5
7425d865ccfa0ffd10a002e62d52040f
-
SHA1
b2f5d6efa12a4ec197b754ddc542ea23b515dfb3
-
SHA256
beefbd4470d17c26cecb06db02c1cb8501bbb2aebc20ff1c48291046dc385792
-
SHA512
bc92ae9ff86a0e31d12724f81b149eddef6a5b0bda231ed468bc5f2d967026c24e06ebf9111f74f4358305ebcea52573c9aff0f6c1b4a50bfe5f79f500dd77c8
-
SSDEEP
24576:0fXYb8uzntZjCypGSprgJlLGpDAfG8N0kHu61ErqCOZYYxAiUfwz3wsEztB:07uzPtPrgJJGpDAuqLH0OXaYxAwsV
Malware Config
Signatures
Files
-
beefbd4470d17c26cecb06db02c1cb8501bbb2aebc20ff1c48291046dc385792.exe windows x86
311cfbc92ec0c63fa08574e32fc18bb3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathIsDirectoryW
StrRetToBufW
PathRemoveFileSpecW
PathIsRootW
PathIsNetworkPathW
PathAddBackslashW
PathRemoveBackslashW
PathFindFileNameW
PathStripPathW
PathIsPrefixW
PathMatchSpecW
PathCombineW
PathFindNextComponentW
PathFileExistsW
ws2_32
WSACleanup
closesocket
send
connect
select
shutdown
gethostbyname
bind
inet_addr
inet_ntoa
htons
WSAGetLastError
recv
WSAStartup
socket
setsockopt
htonl
WSASetLastError
rpcrt4
RpcStringFreeW
UuidToStringW
libexpat
ord21
ord11
ord2
ord12
ord16
ord17
ord18
ord31
ord25
ord52
ord7
ord53
kernel32
InterlockedDecrement
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
ReleaseMutex
WaitForSingleObject
CloseHandle
CreateMutexW
GetLastError
CreateProcessW
GetStartupInfoW
WriteFile
CreateFileW
SetEvent
Sleep
SetThreadPriority
ReleaseSemaphore
CreateEventW
CreateSemaphoreW
GetTimeFormatW
GetDateFormatW
InterlockedIncrement
ExpandEnvironmentStringsW
GetProcessHeap
HeapAlloc
GetCurrentProcess
CompareStringW
WaitForMultipleObjects
ConnectNamedPipe
CreateNamedPipeW
SleepEx
GetComputerNameW
GetTempPathW
ReadFile
GetFileInformationByHandle
SetFilePointer
FlushFileBuffers
TerminateThread
CreateThread
OpenMutexW
GetTickCount
GetVersionExW
ResetEvent
ReadDirectoryChangesW
WaitForSingleObjectEx
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
WideCharToMultiByte
Process32NextW
CreateToolhelp32Snapshot
GetFileAttributesW
SystemTimeToFileTime
FileTimeToSystemTime
GetProcAddress
GetModuleHandleW
FormatMessageA
LoadLibraryA
FreeLibrary
GetTempFileNameW
SetLastError
FlushConsoleInputBuffer
TerminateProcess
GlobalMemoryStatus
GetStdHandle
GetFileType
GetVersion
CreateDirectoryW
DeleteFileW
lstrcpynW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
IsDebuggerPresent
HeapDestroy
SetUnhandledExceptionFilter
HeapReAlloc
HeapSize
RaiseException
GetVersionExA
lstrlenW
lstrcatW
lstrcpyW
lstrcmpiW
MultiByteToWideChar
GetLocalTime
lstrcmpW
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
HeapFree
InterlockedCompareExchange
UnhandledExceptionFilter
user32
MessageBoxA
GetDesktopWindow
GetProcessWindowStation
GetUserObjectInformationW
UnregisterClassA
wsprintfW
wsprintfA
advapi32
GetSecurityDescriptorControl
CryptDecrypt
CryptEncrypt
CryptDestroyKey
CryptDeriveKey
RegisterEventSourceA
ReportEventA
DeregisterEventSource
CryptAcquireContextW
CryptCreateHash
CryptReleaseContext
CryptHashData
CryptDestroyHash
RegSetValueExW
RegDeleteValueW
InitializeSecurityDescriptor
AllocateAndInitializeSid
SetSecurityDescriptorDacl
FreeSid
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
AddAccessAllowedAce
GetAce
AddAce
EqualSid
InitializeAcl
SetFileSecurityW
LookupAccountNameW
GetFileSecurityW
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
shell32
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetMalloc
SHGetDesktopFolder
ord28
ole32
CoTaskMemFree
CoUninitialize
CoInitialize
CoCreateGuid
CLSIDFromString
CoInitializeEx
CoCreateInstance
oleaut32
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VariantChangeType
SafeArrayCreate
SafeArrayPutElement
VariantInit
SysStringLen
VariantClear
SysAllocString
SysFreeString
msvcp80
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??0?$_String_val@DV?$allocator@D@std@@@std@@IAE@V?$allocator@D@1@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
??0?$allocator@D@std@@QAE@XZ
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
msvcr80
qsort
strtoul
fprintf
strtol
strrchr
fputs
signal
_lseeki64
_strtoui64
isxdigit
_ftol
_iob
vfprintf
getenv
_fstat64
isdigit
ferror
calloc
feof
_wassert
_snprintf
_time32
??3@YAXPAX@Z
__CxxFrameHandler3
??_V@YAXPAX@Z
_wtoi
memset
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
_atoi64
atoi
_wcsdup
wcsstr
memcpy_s
memmove_s
_vscwprintf
vswprintf_s
_i64tow
wcsrchr
_wcsicmp
wcscpy_s
_wtoi64
_i64tow_s
_vswprintf_c_l
sprintf_s
strstr
_mbsstr
atol
_mbsnbcpy_s
_mbslen
_beginthreadex
memcpy
_purecall
free
wcschr
_itow
__RTDynamicCast
_wstat64i32
_time64
sprintf
_wremove
_localtime64
_close
_filelengthi64
?_wopen@@YAHPB_WHH@Z
malloc
tolower
fclose
fwprintf
_wfopen
strncpy
memmove
memchr
strchr
iscntrl
isprint
strerror
_vsnprintf
strncmp
fopen
abort
realloc
strncat
sscanf
_strdup
_fsopen
fread
_write
_read
remove
strcpy
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
__winitenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
fgets
fseek
ftell
_setmode
fflush
_errno
_gmtime32
_fileno
_stat32
_getch
_strnicmp
fwrite
_pctype
_isctype
__mb_cur_max
strcmp
wininet
InternetGetConnectedState
Sections
.text Size: 720KB - Virtual size: 716KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 228KB - Virtual size: 224KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 68KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: 540KB - Virtual size: 1.6MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE