Static task
static1
Behavioral task
behavioral1
Sample
aa893119d1b92ae62c9b3ecc854a841e69088f476831a75ec2bd10b308e44a3c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
aa893119d1b92ae62c9b3ecc854a841e69088f476831a75ec2bd10b308e44a3c.exe
Resource
win10v2004-20220812-en
General
-
Target
aa893119d1b92ae62c9b3ecc854a841e69088f476831a75ec2bd10b308e44a3c
-
Size
3.0MB
-
MD5
739dc38e53298e0bc1f21a29422c2d74
-
SHA1
5c7950d46c233ae1c180b0f8f82ca99787e2d8fe
-
SHA256
aa893119d1b92ae62c9b3ecc854a841e69088f476831a75ec2bd10b308e44a3c
-
SHA512
19e99c27e90bf298cf6155c21689ad9a6ff3bec3487a59e2060d4af0250407d817a2582becabec1a5df722bf2575f90a2ab011559f04a5a7f6a06f37c5d11633
-
SSDEEP
12288:cdfdugvIhQXi5LtFUi43we17gfyvzWOdZXP47G4Ln:qdBDi1tFUiuwcKyviOdt4C4Ln
Malware Config
Signatures
Files
-
aa893119d1b92ae62c9b3ecc854a841e69088f476831a75ec2bd10b308e44a3c.exe windows x86
33003ceed945d2e0dbe88d163d666180
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
common
?IsEmpty@CTXStringW@@QBE_NXZ
?Replace@CTXStringW@@QAEH_W0@Z
??0CTXStringW@@QAE@PB_W@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
??0CTXStringW@@QAE@XZ
??4CTXStringW@@QAEAAV0@PA_W@Z
??1CTXStringW@@QAE@XZ
??4CTXStringW@@QAEAAV0@ABV0@@Z
?Format@CTXStringW@@QAAXPB_WZZ
?GetBuffer@CTXStringW@@QAEPA_WXZ
?ReleaseBuffer@CTXStringW@@QAEXH@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?GetLength@CTXStringW@@QBEHXZ
?CompareNoCase@CTXStringW@@QBEHPB_W@Z
??BCTXStringW@@QBEPB_WXZ
??0CTXStringW@@QAE@ABV0@@Z
?Empty@CTXStringW@@QAEXXZ
mfc80u
ord1006
ord4558
ord2867
ord326
ord774
ord3395
ord2876
ord3869
ord2254
ord760
ord572
ord3157
ord1939
ord776
ord642
ord3208
ord3678
ord1549
ord1628
ord4230
ord1906
ord896
ord772
ord741
ord3311
ord860
ord4234
ord1582
ord2086
ord2121
ord3756
ord3990
ord4101
ord2260
ord5638
ord587
ord6251
ord3158
ord6033
ord4226
ord1536
ord4103
ord2263
ord907
ord784
ord304
ord310
ord384
ord3331
ord629
ord5083
ord6284
ord1430
ord1156
ord284
ord781
ord2463
ord5220
ord2925
ord566
ord1911
ord757
ord3826
ord5378
ord6215
ord5096
ord1007
ord3800
ord5579
ord2009
ord2054
ord4320
ord1472
ord6274
ord3795
ord3824
ord6272
ord4008
ord4032
ord5971
ord762
ord1542
ord6086
ord2407
ord2390
ord2392
ord2394
ord2388
ord2404
ord1058
ord2384
ord1894
ord931
ord927
ord929
ord265
ord925
ord920
ord5229
ord5231
ord5956
ord1591
ord4276
ord4716
ord3397
ord3635
ord2460
ord6700
ord4574
ord5398
ord5222
ord2239
ord3942
ord3677
ord4562
ord5226
ord4535
ord2261
ord5209
ord5562
ord4100
ord2832
ord4475
ord3327
ord266
ord2531
ord2725
ord2829
ord4301
ord2708
ord2534
ord2640
ord2527
ord3712
ord3713
ord3703
ord2638
ord3943
ord4255
ord605
ord1248
ord577
ord283
ord764
ord1198
ord5558
ord4179
ord280
ord6271
ord282
ord899
ord5067
ord1899
ord1479
ord578
ord5148
ord300
ord3940
ord2255
ord3344
ord3995
ord4117
ord502
ord2366
ord5727
ord4109
ord3789
ord2651
ord1959
ord6116
ord5210
ord2579
ord6721
ord5911
ord1393
ord4232
ord3224
ord3645
ord753
ord563
ord4347
ord3198
ord658
ord1970
ord1476
ord2225
ord5637
ord1271
ord5633
ord3296
ord1925
ord3155
ord5609
ord3435
ord6063
ord1270
ord2648
ord1659
ord4314
ord1106
ord3281
ord2311
ord2361
ord6061
ord3204
ord1386
ord5829
ord2461
ord4119
ord1118
ord1785
ord1416
ord602
ord347
ord1920
ord5178
ord2402
ord354
ord4206
ord2386
ord1021
ord4729
ord2409
ord4743
ord4884
ord2397
ord2011
ord2379
ord1662
ord2381
ord1079
ord1661
ord2399
ord6720
ord2169
ord5908
ord2163
ord1392
ord1513
ord4238
ord6273
ord5199
ord3796
ord4256
ord6275
ord3339
ord3176
ord4961
ord1353
ord5171
ord2313
ord1955
ord1647
ord1646
ord1590
ord5196
ord2856
ord709
ord293
ord4480
ord501
ord1611
ord1608
msvcr80
wcsstr
_wcsicmp
wcschr
_wtol
sscanf
free
malloc
atoi
strncpy
strncat
_snprintf
memmove_s
memmove
_wtoi
iswdigit
wcsncmp
wcsncpy
_time32
_invalid_parameter_noinfo
wcsncat
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
wcstoul
_time64
wcsrchr
_mktime64
_snwprintf
_wcslwr_s
swscanf
memcpy_s
vswprintf_s
wcscat_s
wcscpy_s
_purecall
_wsplitpath
_wsplitpath_s
_wmkdir
_CxxThrowException
_wstat64
rand
isprint
isalnum
_vsnwprintf_s
isspace
tolower
strncmp
_vsnprintf_s
swscanf_s
_vswprintf
wcstol
realloc
putchar
putwchar
_beginthreadex
srand
_amsg_exit
__wgetmainargs
_cexit
_exit
memset
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
memcpy
__CxxFrameHandler3
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
kernel32
HeapReAlloc
HeapDestroy
GetVersionExA
GetThreadLocale
GetACP
HeapSize
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
InterlockedExchange
GetLocaleInfoA
GetTimeFormatW
GetDateFormatW
GetCurrencyFormatW
GetNumberFormatW
GetLocaleInfoW
FlushFileBuffers
SetEvent
ResetEvent
DeviceIoControl
ProcessIdToSessionId
GetCurrentProcessId
MultiByteToWideChar
RaiseException
CopyFileW
LoadLibraryA
DeleteCriticalSection
VirtualQuery
InitializeCriticalSection
GetSystemInfo
ReleaseMutex
CreateEventW
WaitForSingleObject
FindResourceExW
SizeofResource
GetFileSize
GetCurrentThreadId
OpenProcess
FindClose
HeapAlloc
GetDriveTypeW
FindFirstFileW
GetProcessHeap
lstrlenA
HeapFree
GetModuleHandleW
Thread32Next
Thread32First
CreateProcessW
SetFilePointer
OpenMutexW
FileTimeToLocalFileTime
GetSystemDirectoryW
GetVersionExW
ExpandEnvironmentStringsW
CreateDirectoryW
GetCurrentDirectoryW
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemDefaultLangID
IsBadWritePtr
IsBadReadPtr
lstrcmpW
lstrcpynW
lstrlenW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetCurrentProcess
CreateThread
TerminateThread
LockResource
LoadResource
VirtualProtect
FindResourceW
SleepEx
ResumeThread
LeaveCriticalSection
EnterCriticalSection
SetDllDirectoryW
CreateMutexW
SetLastError
GetTickCount
OutputDebugStringW
Sleep
GetCommandLineW
GetLastError
GetModuleFileNameW
FileTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
CloseHandle
WriteFile
ReadFile
CreateFileW
DeleteFileW
WideCharToMultiByte
user32
PostQuitMessage
EnableWindow
IsIconic
GetClassNameW
LoadIconW
UnregisterClassA
MessageBoxW
GetWindowTextW
WindowFromPoint
GetForegroundWindow
SetWindowLongW
EnumThreadWindows
FindWindowExW
GetWindowThreadProcessId
SetWindowTextW
EqualRect
IsWindowVisible
ClientToScreen
GetWindowLongW
CharNextW
GetDesktopWindow
CharPrevW
GetSysColor
DestroyIcon
CopyRect
KillTimer
SendMessageW
TranslateMessage
WaitMessage
SetTimer
GetParent
RedrawWindow
DrawIconEx
GetSystemMetrics
GetClientRect
DrawIcon
FindWindowW
PtInRect
SetWindowRgn
ShowScrollBar
PeekMessageW
DispatchMessageW
GetMessageW
SetWindowPos
InvalidateRect
SystemParametersInfoW
GetDC
GetClassInfoW
ReleaseDC
RegisterClassW
GetWindowRect
PostMessageW
LoadBitmapW
LoadCursorW
DestroyCursor
FillRect
IsWindow
GetCursorPos
ScreenToClient
SetCursor
OffsetRect
gdi32
CreateRoundRectRgn
CreateCompatibleDC
GetStockObject
CreateCompatibleBitmap
SelectObject
GetDeviceCaps
CreateDCW
DeleteDC
BitBlt
GetBkColor
GetTextColor
CreateFontIndirectW
StretchBlt
Rectangle
GetObjectW
CreatePen
advapi32
InitializeSecurityDescriptor
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegOpenKeyExW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
SetSecurityDescriptorDacl
shell32
SHFileOperationW
SHAppBarMessage
SHGetSpecialFolderPathW
CommandLineToArgvW
comctl32
InitCommonControlsEx
_TrackMouseEvent
shlwapi
StrCpyW
PathFileExistsW
StrFormatByteSizeW
StrFormatKBSizeW
StrFromTimeIntervalW
StrCmpW
ole32
CoInitialize
CoUninitialize
StgOpenStorage
CoCreateInstance
CoFreeUnusedLibrariesEx
StgCreateDocfile
StgIsStorageFile
CoCreateGuid
oleaut32
SysAllocString
VariantInit
VariantClear
msvcp80
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V32@@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1strstreambuf@std@@UAE@XZ
?freeze@strstreambuf@std@@QAEX_N@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?ends@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0strstreambuf@std@@QAE@H@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
winmm
timeEndPeriod
timeBeginPeriod
timeGetDevCaps
iphlpapi
GetIpForwardTable
atl80
ord30
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
netapi32
NetApiBufferFree
NetWkstaTransportEnum
Netbios
ws2_32
ioctlsocket
socket
getprotobyname
setsockopt
closesocket
recv
send
htons
gethostbyname
connect
WSAStartup
WSACleanup
recvfrom
getpeername
bind
select
WSAGetLastError
__WSAFDIsSet
sendto
psapi
GetModuleFileNameExW
Sections
.text Size: 216KB - Virtual size: 214KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 276KB - Virtual size: 281KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 440KB - Virtual size: 440KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE