Static task
static1
Behavioral task
behavioral1
Sample
a3494e51183fa4e8ccf16d8c3498fe5ae5cf08d30e492cfb4ef4325b408048f4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a3494e51183fa4e8ccf16d8c3498fe5ae5cf08d30e492cfb4ef4325b408048f4.exe
Resource
win10v2004-20220812-en
General
-
Target
a3494e51183fa4e8ccf16d8c3498fe5ae5cf08d30e492cfb4ef4325b408048f4
-
Size
209KB
-
MD5
6c8c5ad53426f68896aa3ddb823074d9
-
SHA1
a9ba967a7b2405b959382b3cc6920a3c1b7ed90a
-
SHA256
a3494e51183fa4e8ccf16d8c3498fe5ae5cf08d30e492cfb4ef4325b408048f4
-
SHA512
a91a7eec17b0c6912cb7b2ff4219e7cb3393e48426de85601a99ccba75426b5acbebf1b40f46301e846a2a917bc94748fe85ba45d06775763f5b12814feb693c
-
SSDEEP
6144:nbGkiQtx3LElsprIheR9vyQP/FeTU2KbIGS1iQK:nBiQj3LamrIkZP/FTbIlw
Malware Config
Signatures
Files
-
a3494e51183fa4e8ccf16d8c3498fe5ae5cf08d30e492cfb4ef4325b408048f4.exe windows x86
b883f6826c7061527b6a1edb6442fb9a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
nailog
_naimcomn_SetSystem@4
_naimcomn_InitTracer@0
_naimcomn_SetLogToStdout@4
_naimcomn_StartFileLogging@4
naimcomn_LogInfoW
_naimcomn_EndFileLogging@0
comctl32
ord17
nacmnlib71
?cmnlib_QueryRegValue@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAVCRegKey@ATL@@PBGPAJ@Z
?cmnlib_GetAgentID@@YAJAAV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
??0CCmdLine@@QAE@XZ
?cmnlib_CreateLocalObjectName@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV12@@Z
?FindSwitch@CCmdLine@@QAEPAVCSwitch@@PBG@Z
?GetValue@CSwitch@@QAEPBGXZ
?cmnlib_CreateGlobalSecurityAttrib@@YAXPAU_SECURITY_DESCRIPTOR@@PAU_SECURITY_ATTRIBUTES@@@Z
?cmnlib_CreateGlobalObjectName@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV12@@Z
?cmnlib_MonitorRegistryLogLevel@@YAXXZ
?GetFirstSwitch@CCmdLine@@QAEPAVCSwitch@@XZ
?GetName@CSwitch@@QAEPBGXZ
?GetNextSwitch@CCmdLine@@QAEPAVCSwitch@@XZ
?IsWinNT@@YAHXZ
?cmnlib_NormalExit@@YAXXZ
??1CCmdLine@@UAE@XZ
??0CnaCriticalSection@@QAE@XZ
??1CnaCriticalSection@@UAE@XZ
??0CnaAutoCriticalSection@@QAE@AAVCnaCriticalSection@@@Z
??1CnaAutoCriticalSection@@UAE@XZ
?GetAddress@CSEException@@QAEPAXXZ
?GetCode@CSEException@@QAEIXZ
?AddMessageW@CnaLogger@@SAJW4ESUBSYSTEM@@W4_naimcomn_LogLevel@@PBGZZ
GetResString
?cmnlib_GetFrameworkDataDir@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
?install@CSEException@@SAXXZ
?cmnlib_StopService@@YAJABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?cmnlib_StartService@@YAJABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@Z
?cmnlib_GetFrameworkInstallDir@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@XZ
??0CnaProcessKiller@@QAE@XZ
?IsProcessRunning@CnaProcessKiller@@QAEHPBGPAK@Z
?Kill@CnaProcessKiller@@QAEHPBG@Z
??1CnaProcessKiller@@UAE@XZ
LoadResourceDLLW
?cmnlib_AppendFilePath@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@ABV12@0@Z
?cmnlib_StopMonitoringRegistryLogLevel@@YAXXZ
applib
?get@ARegKey@@AAE_N_NPBGPAK@Z
??1AProcess@@QAE@XZ
??0ARegKey@@QAE@XZ
?open@ARegKey@@AAE_N_NPAUHKEY__@@PBGK@Z
?create@AProcess@@AAE_N_NPBG1@Z
??0AString@@QAE@XZ
?get@ARegKey@@AAE_N_NPBGPAVAString@@@Z
??1AString@@QAE@XZ
??1ARegKey@@QAE@XZ
??0AString@@QAE@PBG@Z
??0APath@@QAE@ABVAString@@0@Z
??0AProcess@@QAE@XZ
??BAString@@QBEPBGXZ
??1APath@@QAE@XZ
kernel32
LoadResource
SetLastError
LoadLibraryA
GetSystemDirectoryA
GetWindowsDirectoryA
GetModuleFileNameA
GetModuleHandleA
CompareStringA
GetCurrentProcessId
GetVersionExA
LocalFree
ExitProcess
QueryPerformanceCounter
SetProcessWorkingSetSize
GetTickCount
GetSystemTimeAsFileTime
HeapFree
SizeofResource
InterlockedIncrement
GetLastError
WaitForMultipleObjects
SetEvent
MulDiv
WriteFile
Sleep
CloseHandle
GetLocalTime
ReadFile
GetCurrentThreadId
LeaveCriticalSection
EnterCriticalSection
FreeLibrary
GetUserDefaultLangID
IsValidLocale
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
RaiseException
InitializeCriticalSection
DeleteCriticalSection
FlushInstructionCache
GetCurrentProcess
HeapAlloc
GetProcessHeap
InterlockedDecrement
lstrlenA
GetTimeFormatA
GetDateFormatA
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
user32
GetWindowRect
GetParent
GetForegroundWindow
PostQuitMessage
EndPaint
BeginPaint
FillRect
OffsetRect
GetDlgCtrlID
GetSysColor
SetCursor
GetDC
ReleaseDC
UpdateWindow
CreateCursor
DestroyCursor
SetDlgItemInt
GetDlgItemInt
SetFocus
EndDialog
GetDesktopWindow
DestroyIcon
GetCursorPos
SetForegroundWindow
SetActiveWindow
TrackPopupMenu
GetAsyncKeyState
DestroyMenu
GetSubMenu
KillTimer
InvalidateRect
RedrawWindow
GetActiveWindow
PtInRect
IsWindow
SetTimer
IsWindowVisible
ShowWindow
ScreenToClient
IsIconic
DestroyWindow
MsgWaitForMultipleObjects
TranslateMessage
GetWindow
GetDlgItem
GetClientRect
MapWindowPoints
SetWindowPos
gdi32
CreateBrushIndirect
CreateSolidBrush
DPtoLP
SetTextColor
SetBkColor
DeleteObject
GetDeviceCaps
GetViewportOrgEx
SetTextAlign
SetBkMode
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC
Rectangle
GetStockObject
DeleteDC
BitBlt
SetViewportOrgEx
advapi32
CloseServiceHandle
RegCloseKey
OpenSCManagerW
ole32
CreateStreamOnHGlobal
CoMarshalInterface
CoInitializeEx
CoInitializeSecurity
CoResumeClassObjects
CoTaskMemRealloc
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
StringFromGUID2
CoCreateInstance
CoInitialize
CoUninitialize
CoTaskMemAlloc
oleaut32
SysFreeString
SysStringLen
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
VariantCopy
VariantClear
VariantInit
SysAllocString
cmalib
?IsTerminalServiceClientSession@@YAHXZ
shlwapi
PathFindExtensionW
msvcp71
?_Nomemory@std@@YAXXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
msvcr71
_except_handler3
__CxxFrameHandler
??_V@YAXPAX@Z
memcpy
free
??3@YAXPAX@Z
wcsncpy
wcslen
swscanf
wcsncmp
swprintf
__p__commode
wcscat
wcscpy
_purecall
_CxxThrowException
memmove
realloc
_beginthreadex
wcsrchr
_wtoi
malloc
_wtol
_controlfp
__set_app_type
__p__fmode
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
??0exception@@QAE@XZ
__RTDynamicCast
_snwprintf
_itow
abs
wcsstr
memcmp
_resetstkoflw
setlocale
_endthreadex
_callnewh
??1type_info@@UAE@XZ
__security_error_handler
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_cexit
exit
_wcmdln
_amsg_exit
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
memset
Sections
.text Size: 76KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE