Static task
static1
Behavioral task
behavioral1
Sample
35e3edd4bc806ef01824989d2218d098808b37fa25721ee4cdb50a7a68ef4f87.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
35e3edd4bc806ef01824989d2218d098808b37fa25721ee4cdb50a7a68ef4f87.exe
Resource
win10v2004-20220901-en
General
-
Target
35e3edd4bc806ef01824989d2218d098808b37fa25721ee4cdb50a7a68ef4f87
-
Size
310KB
-
MD5
448925a62e53971fb1bd1bf9e1de5dc0
-
SHA1
1b37c8f67491c09517d5e0dff0f8bfa93c807ac3
-
SHA256
35e3edd4bc806ef01824989d2218d098808b37fa25721ee4cdb50a7a68ef4f87
-
SHA512
c3b717999e6db1c19f8385387f30dfe03343b82433aad26411b94c7c89ca5327700615d83a3426ca32dc261e76eb9c45210d13d48718f5d29026e5081c242d90
-
SSDEEP
6144:MRgad2NBSZLdB/wASmGdsk4acyDpv7gE1T+PHnU:MGaGBMH/AmKJLT+vU
Malware Config
Signatures
Files
-
35e3edd4bc806ef01824989d2218d098808b37fa25721ee4cdb50a7a68ef4f87.exe windows x86
d32af0a7d32c38cd1672b809a5fae57e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
CreateEventW
GetPrivateProfileIntW
lstrlenA
TlsGetValue
GetCurrentThread
DeleteFileA
ResumeThread
CreateEventW
VirtualProtect
GetStringTypeW
GetDriveTypeA
CreateMailslotA
GetPrivateProfileSectionA
CreateEventW
FindAtomA
GetProcessVersion
SuspendThread
HeapFree
GetProcessHeap
LoadLibraryW
SetLastError
clbcatq
CheckMemoryGates
CheckMemoryGates
SetupOpen
ComPlusMigrate
ComPlusMigrate
SetupOpen
DllGetClassObject
ComPlusMigrate
CheckMemoryGates
CheckMemoryGates
SetupOpen
CheckMemoryGates
DllGetClassObject
d3dramp
g_RampOld_BeadTbl
RampOldTri
RampOldTri
g_RampOld_BeadTbl
Sections
.text Size: 1024B - Virtual size: 928B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 352B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 304KB - Virtual size: 304KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 70B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE