Behavioral task
behavioral1
Sample
2e213b8801b48d22b3cceeb80e8a7942472dc8a29a6502b10044ec1d89375627.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2e213b8801b48d22b3cceeb80e8a7942472dc8a29a6502b10044ec1d89375627.exe
Resource
win10v2004-20220901-en
General
-
Target
2e213b8801b48d22b3cceeb80e8a7942472dc8a29a6502b10044ec1d89375627
-
Size
140KB
-
MD5
6b2688e1a7a2e0f1662452e1fcf43e3e
-
SHA1
520eb1379e63e41f2296130ec94e84acc422a0a1
-
SHA256
2e213b8801b48d22b3cceeb80e8a7942472dc8a29a6502b10044ec1d89375627
-
SHA512
7d742310f57771a196522a353902f03413c642c8518d3df152c2abba5ce9c7853a722f26101148722b11ff5b9da33636c55d8f9f13ec4c3043e37cc560a2ba87
-
SSDEEP
3072:/GAZ8PtukAWIRfDs6c2xNh86hzSlghAD0EiEhe1Cqb:cwtLs6c2xNG6hzS2hDEhe1H
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
2e213b8801b48d22b3cceeb80e8a7942472dc8a29a6502b10044ec1d89375627.exe windows x86
7172e7e2a39bfaae14d18705016e63a1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetThreadPreferredUILanguages
DeleteFileW
MoveFileW
GetThreadLocale
GetStdHandle
CompareStringW
CreateDirectoryW
SetEndOfFile
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
GetFileSize
WriteFile
GetFileAttributesW
SetFilePointer
FlushFileBuffers
GetProcessHeap
HeapFree
GetModuleHandleW
FindFirstFileW
FindNextFileW
FindClose
GetSystemInfo
GetFullPathNameW
FormatMessageW
LocalFree
GetLastError
lstrlenW
WriteConsoleW
InterlockedExchange
Sleep
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetLastError
CloseHandle
CreateEventW
SetEvent
CreateFileW
WaitForSingleObject
InterlockedIncrement
GetSystemWindowsDirectoryW
RaiseException
HeapAlloc
GetCurrentThread
msvcrt
_vsnwprintf
_resetstkoflw
memcpy
wcsrchr
wcschr
_wcsicmp
__wgetmainargs
_cexit
_exit
_XcptFilter
_except_handler4_common
_controlfp
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
?terminate@@YAXXZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
user32
LoadStringW
CharPrevW
CharNextW
CharLowerW
setupapi
SetupUninstallOEMInfW
SetupDiGetClassDescriptionExW
SetupGetStringFieldW
SetupEnumPublishedInfW
SetupOpenInfFileW
SetupVerifyInfFileW
SetupCloseInfFile
SetupFindFirstLineW
SetupCopyOEMInfW
ole32
CLSIDFromString
newdev
DiInstallDriverW
advapi32
IsValidSecurityDescriptor
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetNamedSecurityInfoW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetKernelObjectSecurity
DuplicateTokenEx
SetThreadToken
AdjustTokenPrivileges
OpenThreadToken
OpenProcessToken
ntdll
RtlNtStatusToDosError
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE