Static task
static1
Behavioral task
behavioral1
Sample
d69a20a56a436b607bc69ad095669e69146753f7dcb0883969a3bcec27cd55a1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d69a20a56a436b607bc69ad095669e69146753f7dcb0883969a3bcec27cd55a1.exe
Resource
win10v2004-20220901-en
General
-
Target
d69a20a56a436b607bc69ad095669e69146753f7dcb0883969a3bcec27cd55a1
-
Size
432KB
-
MD5
63cedef7a67bf0a021f90ba3874f5979
-
SHA1
2df641eb69335425304d3170d039281e1ac29ab4
-
SHA256
d69a20a56a436b607bc69ad095669e69146753f7dcb0883969a3bcec27cd55a1
-
SHA512
c254d22605388eb965836c73411f8765c004561dd023c52f2b043694d316146f1252e8447aaa2aceeb3199153b901e5718d5d371e721d2786b31dd8b07ff70da
-
SSDEEP
6144:bi83kQ6J8h0H4j10hA6npLK3C45nLX4Y/OUvYZO2oCzo0naGY:bi83kQ6J20H4j10hA6ncZ5nLPOWuPaGY
Malware Config
Signatures
Files
-
d69a20a56a436b607bc69ad095669e69146753f7dcb0883969a3bcec27cd55a1.exe windows x86
cd993dd0ab9a8241c0d339ba74ae09bd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
oracore10
ss_mem_alc
slzprintf
sltrusleep
ss_mem_fre
sltsini
sltsmxi
sltsmna
sltsmnr
sltsmxd
lficls
lfiwr
lfilsek
lfiopn
lfifini
lficr
lfifex
lfimknam
lfimkpth
Slfpfn
lpminit
lsttokr
slmtnatol
sltspin
SlfAccess
Slfgfn
lstprintf
slosDep2String
lfird
ss_mem_ral
ss_mem_cal
lstclo
lcv42b
lcvb24
slzgetevar
orahasgen10
scls_scr_create
scls_scr_setval
clscdisc
clsclisten
clssnsprivatebynum
clssnsqlnum
scls_idq_get_user_id
clssnsqvnodes
clssnsqname
scls_idq_get_user_name
scls_idq_get_primary_privgrp_name
clssscheck
clscrs_ctxsize
clsssattrib
scls_iddb_has_ha_privs
clsdgetcompid
clsdprintft
clsdterm
clsdget_regcomp
clsdget_complist
clsdset_loglvl
clsdcompreg
cls_thrInitid
cls_thrGetid
cls_thrFormatId
clscrs_init_api
cls_thrIMxlock
cls_thrIMxunlock
clscparse_dbgcmd
clsgGet
clsgSet
clscconquiesce
clsutcpbase
clscwaitconnectcompl
clscselect
clscreceive
clscsend
clsz_getnodenm
clscconnect
clscanswer
clscgetaddr
clsh_mkUserID
clsh_freeUserID
clsh_freePrivGrpID
cls_thrMxinit
cls_thrCvtinit
scls_pid_get_self
cls_thrMxlock
cls_thrCvtwait
cls_thrMxunlock
cls_thrCvtsignal
clse_init
clse_set_oracle_home
cls_thrCvtdestroy
cls_thrMxd
scls_pid_get_parent
scls_iddb_compare_user_id
clscrs_reslist_create
clscrs_get_fixed_attrlist
clscrs_stat
clshinit
cls_thrInitctx
clsz_Init
clssshutdown
clsuhost
clsssdebug
clsdmc_init
clsdmc_msgfab
clsdmc_send
clsdmc_term
clsp_addToPath
clsp_getFile
scls_process_spawn
scls_process_join
clsssvotedisk
scls_meta_ctx_init
scls_meta_query_size
scls_meta_init
clsssinit
clsuslmfree
clsuslmmalloc
clscugblmini
clscinit
clsuslztrace
scls_meta_ctx_destroy
clscterm
clscugblmterm
clsssterm
clsvswversion
clsvactversion
clssnsqclname
clssgsqgrp
clssnsqanum
cls_thrDestroyid
oraocr10
procr_create_key
procr_get_key_security
procr_set_value
procr_get_last_error
procr_terminate
procr_init_ext
procr_open_key
procr_get_value
procr_close_key
procr_create_n_set_key
procr_delete_key
procr_enum_subkey
orauts
GetModuleHandleA
GetLastError
Sleep
kernel32
GetTickCount
advapi32
QueryServiceStatus
OpenServiceA
OpenSCManagerA
CloseServiceHandle
StartServiceA
msvcr71
exit
__p___initenv
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
?terminate@@YAXXZ
_controlfp
_cexit
_XcptFilter
_exit
_c_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
memcmp
memcpy
??3@YAXPAX@Z
??1bad_cast@@UAE@XZ
??0exception@@QAE@ABV0@@Z
??0bad_cast@@QAE@ABV0@@Z
strncpy
isspace
strtol
strncat
strlen
strcmp
_CxxThrowException
??0bad_cast@@QAE@PBD@Z
__CxxFrameHandler
_vsnprintf
strcpy
printf
??0exception@@QAE@XZ
??1exception@@UAE@XZ
toupper
_assert
strcat
memmove
strncmp
atoi
_purecall
_errno
strerror
strchr
strtok
sprintf
fgetc
strstr
isalnum
isdigit
fprintf
_iob
localtime
_setmode
_write
_read
_unlink
_open
mktime
perror
fclose
fgets
fopen
sscanf
time
strftime
fflush
vsprintf
isprint
malloc
_callnewh
_strdup
_lseek
_fdopen
memset
msvcp71
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?to_int_type@?$char_traits@D@std@@SAHABD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?width@ios_base@std@@QBEHXZ
?is@?$ctype@D@std@@QBE_NFD@Z
??1locale@std@@QAE@XZ
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?eof@?$char_traits@D@std@@SAHXZ
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
?to_char_type@?$char_traits@D@std@@SADABH@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@IG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?id@?$ctype@G@std@@2V0locale@2@A
?_Nomemory@std@@YAXXZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@V312@0@Z
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?flags@ios_base@std@@QBEHXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AVconst_iterator@12@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@Vconst_iterator@12@0@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBE@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?6U?$char_traits@D@std@@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?fill@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGXZ
?sputc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGG@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
?sbumpc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?to_int_type@?$char_traits@G@std@@SAGABG@Z
?widen@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEGD@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?setstate@?$basic_ios@GU?$char_traits@G@std@@@std@@QAEXH_N@Z
?snextc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?sgetc@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEGXZ
?is@?$ctype@G@std@@QBE_NFG@Z
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?to_char_type@?$char_traits@G@std@@SAGABG@Z
?eq_int_type@?$char_traits@G@std@@SA_NABG0@Z
?eof@?$char_traits@G@std@@SAGXZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AVconst_iterator@12@XZ
?width@ios_base@std@@QAEHH@Z
?_Getcat@?$ctype@G@std@@SAIPAPBVfacet@locale@2@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Register@facet@locale@std@@QAEXXZ
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@@Z
?_Incref@facet@locale@std@@QAEXXZ
??Bid@locale@std@@QAEIXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Ipfx@?$basic_istream@GU?$char_traits@G@std@@@std@@QAE_N_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEXXZ
?flush@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@XZ
?tie@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_ostream@GU?$char_traits@G@std@@@2@XZ
?good@ios_base@std@@QBE_NXZ
?_Unlock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
?rdbuf@?$basic_ios@GU?$char_traits@G@std@@@std@@QBEPAV?$basic_streambuf@GU?$char_traits@G@std@@@2@XZ
?_Lock@?$basic_streambuf@GU?$char_traits@G@std@@@std@@QAEXXZ
orageneric10
slgtd
oranls10
lxldini
lxdobl
lxlinit
lmsagbcmt
lmsacbn
lmsacin
lmsatrm
lmsaicmt
lxldfcb
lxlterm
lxhLangEnv
lxinitc
ws2_32
gethostbyname
htonl
gethostbyaddr
htons
ntohl
inet_ntoa
inet_addr
oran10
nlstdgg
Sections
.text Size: 324KB - Virtual size: 321KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data1 Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE