Static task
static1
Behavioral task
behavioral1
Sample
f41c0b8f2fa453c67bef7a442f0630bdab87bd7549c4fcde522ee0bd7b8a3d97.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f41c0b8f2fa453c67bef7a442f0630bdab87bd7549c4fcde522ee0bd7b8a3d97.exe
Resource
win10v2004-20220901-en
General
-
Target
f41c0b8f2fa453c67bef7a442f0630bdab87bd7549c4fcde522ee0bd7b8a3d97
-
Size
345KB
-
MD5
70c4df880aaf77d01e5339d5ca2c4c98
-
SHA1
46f58e13a91ad16691f38ea4737a05f81847b6a3
-
SHA256
f41c0b8f2fa453c67bef7a442f0630bdab87bd7549c4fcde522ee0bd7b8a3d97
-
SHA512
1ea9c80dd960f9fa2f79e5882c096ecf0ed9c5ed91ef360cb34f3833205747bdceea87e982950cd07d72e920532f134cb9882e78853287cf32f0f9f6ad6d6d80
-
SSDEEP
3072:d95Frmy2Gsd3bGUU8b9YYkA8gLk5bpIeWfF609E9oLiOiikwOISdnKQSbmJ3ZDiP:T5/EcRD5bKuwFkwOgbmFZDi0uzctS
Malware Config
Signatures
Files
-
f41c0b8f2fa453c67bef7a442f0630bdab87bd7549c4fcde522ee0bd7b8a3d97.exe windows x86
4ed89c91db4c92d23dd176225fedc9b7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetLastError
GetLastError
FreeLibrary
GetWindowsDirectoryA
WinExec
FileTimeToSystemTime
FileTimeToDosDateTime
SetFilePointer
GetFileInformationByHandle
GetFileType
MapViewOfFile
CreateFileMappingA
DuplicateHandle
GetCurrentProcess
SystemTimeToFileTime
GetLocalTime
UnmapViewOfFile
GetProcAddress
GetFileAttributesA
GetTempPathA
CreateDirectoryA
GetModuleHandleA
LoadLibraryA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
DeleteFileA
WriteFile
MultiByteToWideChar
WideCharToMultiByte
lstrcpynA
GetPrivateProfileSectionA
GetPrivateProfileStructA
GetPrivateProfileSectionNamesA
WritePrivateProfileStructA
WritePrivateProfileSectionA
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
GetModuleFileNameA
GetVersionExA
GetNumberFormatA
lstrcpyA
GetLocaleInfoA
MulDiv
CreateFileA
GetFileSize
ReadFile
CloseHandle
SetFileAttributesA
CopyFileA
user32
GetAsyncKeyState
FillRect
DrawIcon
GetClientRect
RedrawWindow
GetSysColor
GetSystemMetrics
InflateRect
InvalidateRect
TabbedTextOutA
DrawTextA
DrawTextExA
GrayStringA
PtInRect
ScreenToClient
GetDC
ReleaseDC
wsprintfA
KillTimer
GetParent
LoadCursorA
DestroyCursor
GetMessagePos
SetCursor
IsWindow
CopyIcon
MessageBeep
SetWindowLongA
RegisterWindowMessageA
DrawEdge
UpdateWindow
GetFocus
AppendMenuA
GetSystemMenu
IsIconic
LoadIconA
SendMessageA
EnableWindow
SetTimer
GetWindowRect
LockWindowUpdate
gdi32
GetBkColor
BitBlt
GetTextExtentPoint32A
GetCurrentObject
PtVisible
CreateCompatibleDC
TextOutA
ExtTextOutA
Escape
CreateSolidBrush
CreateRectRgn
CreateCompatibleBitmap
GetStockObject
GetObjectA
CreateFontIndirectA
CreateDCA
RectVisible
DeleteDC
GetDeviceCaps
advapi32
RegOpenKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegEnumKeyExA
RegCloseKey
RegQueryValueA
shell32
ExtractIconA
ShellExecuteA
SHGetFolderPathA
mfc90
ord4392
ord6682
ord6676
ord300
ord4506
ord2480
ord1611
ord305
ord3213
ord1603
ord4477
ord5997
ord5963
ord3519
ord654
ord4030
ord967
ord2588
ord1358
ord333
ord744
ord5957
ord3730
ord4116
ord6079
ord6077
ord6170
ord6166
ord6527
ord6023
ord524
ord1087
ord1061
ord3612
ord3477
ord1357
ord6074
ord3538
ord4642
ord1685
ord1771
ord2278
ord677
ord636
ord6554
ord367
ord3504
ord6157
ord6398
ord5833
ord5846
ord6084
ord6352
ord6549
ord4565
ord6546
ord6043
ord6552
ord6046
ord2753
ord3815
ord2263
ord4396
ord4527
ord6078
ord2896
ord525
ord2470
ord2271
ord2069
ord5372
ord3479
ord2587
ord2592
ord789
ord586
ord6557
ord6048
ord1536
ord5835
ord2691
ord6760
ord1045
ord1258
ord1254
ord3627
ord3554
ord3244
ord4644
ord2280
ord693
ord6327
ord4252
ord436
ord686
ord6616
ord3056
ord6071
ord3157
ord3140
ord3148
ord6333
ord2815
ord3731
ord4760
ord6335
ord3997
ord1607
ord4029
ord589
ord652
ord4890
ord3110
ord6001
ord5646
ord5663
ord4981
ord4333
ord2447
ord5659
ord5657
ord3209
ord2087
ord4199
ord5813
ord6721
ord404
ord1046
ord4165
ord6018
ord2206
ord2251
ord4733
ord6781
ord4159
ord6783
ord4409
ord4434
ord793
ord1098
ord2591
ord1108
ord5167
ord2364
ord781
ord580
ord2698
ord2327
ord5851
ord2525
ord6793
ord403
ord4502
ord5753
ord965
ord969
ord2610
ord2630
ord2614
ord2620
ord2618
ord2616
ord2633
ord2628
ord2612
ord2635
ord2623
ord2605
ord2607
ord2625
ord2375
ord2368
ord1644
ord6784
ord4160
ord6782
ord3671
ord5389
ord6356
ord3218
ord1446
ord5608
ord2139
ord1792
ord1791
ord1728
ord5633
ord2766
ord2978
ord3107
ord4714
ord2961
ord3135
ord2769
ord2888
ord2759
ord3277
ord4066
ord4067
ord4057
ord2886
ord4334
ord4895
ord4667
ord3643
ord595
ord3528
ord2106
ord316
ord1183
ord3534
ord1137
ord6150
ord1252
ord6491
ord310
ord2539
ord817
ord941
ord601
ord800
ord2356
ord1692
ord1938
ord5615
ord4617
ord5309
ord2208
ord1810
ord1809
ord1678
ord3344
ord6388
ord1496
ord4650
ord5636
ord4668
ord3506
ord374
ord639
ord2590
ord2372
ord1387
ord777
ord2283
ord1720
ord3346
ord6391
ord1755
ord1752
ord4331
ord1497
ord5520
ord663
ord1555
ord6153
ord6494
ord3987
ord265
ord266
ord4993
ord4431
ord6559
ord945
ord942
ord820
ord5152
ord5533
ord390
ord4646
ord5585
ord2074
ord5497
ord6780
ord4589
ord5647
ord3732
ord5139
ord4688
ord1729
ord6446
ord5668
ord5666
ord958
ord3659
ord963
ord798
ord1276
msvcr90
_stricmp
_tzset
_controlfp_s
_invoke_watson
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
_amsg_exit
?terminate@@YAXXZ
_except_handler4_common
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
remove
sprintf_s
_mbstok
isspace
strcat_s
strcpy_s
strncpy
memcpy
_mktime64
_mbsstr
malloc
_snprintf
_ismbcprint
_mbsnbcmp
_mbsnbcpy
_mbschr
memmove_s
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
strftime
_splitpath
_purecall
fopen_s
fseek
ftell
rewind
fread
fclose
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_time64
_localtime64
memcpy_s
_mbsrchr
memset
_invalid_parameter_noinfo
__CxxFrameHandler3
_access
_setmbcp
msvcp90
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?rbegin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
?rend@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
ws2_32
WSAStartup
shutdown
WSACleanup
closesocket
gethostname
gethostbyname
socket
htons
connect
send
recv
inet_ntoa
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
oleaut32
SysFreeString
Sections
.text Size: 197KB - Virtual size: 196KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 91KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE