Static task
static1
Behavioral task
behavioral1
Sample
559a5233d8258082bd4775073c7d639e790ab53882144adb604dbd305433a498.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
559a5233d8258082bd4775073c7d639e790ab53882144adb604dbd305433a498.exe
Resource
win10v2004-20220812-en
General
-
Target
559a5233d8258082bd4775073c7d639e790ab53882144adb604dbd305433a498
-
Size
136KB
-
MD5
426f3f4edd85cb380f68bc7b10951ce0
-
SHA1
ef53c10c42a3290baa6ca0d2620029e4957ad788
-
SHA256
559a5233d8258082bd4775073c7d639e790ab53882144adb604dbd305433a498
-
SHA512
be1c298866df36e1cb4f6667cb05e6151f86e291e61cf49497d1239da222f931bd7a53464fccfb35af970851840d344b81bf90de7c5be461a667d9f74f994a18
-
SSDEEP
3072:e/qg7ulUJzPxzkmYFoKaN8MVAn94kRwfh3XF:elalQPxQWKaNcn9XwVF
Malware Config
Signatures
Files
-
559a5233d8258082bd4775073c7d639e790ab53882144adb604dbd305433a498.exe windows x86
ebaf1cfc04ac44ab33484de4262fcd56
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileInformationByHandle
FatalAppExitA
CreateEventW
GetPrivateProfileStringA
EnterCriticalSection
GetDateFormatA
CreateProcessA
IsValidCodePage
InitializeCriticalSection
InterlockedExchange
HeapDestroy
VirtualFree
DeleteFileW
TlsSetValue
LCMapStringA
GetDriveTypeA
Thread32First
CopyFileW
FileTimeToLocalFileTime
GetModuleHandleA
MoveFileExW
FormatMessageA
Thread32Next
GetCurrentProcessId
FreeEnvironmentStringsA
SystemTimeToFileTime
GlobalUnlock
SetEnvironmentVariableA
ReadFileEx
Sleep
InterlockedDecrement
GetLocaleInfoW
RemoveDirectoryW
CreateNamedPipeA
SetConsoleCtrlHandler
PeekNamedPipe
DisconnectNamedPipe
FileTimeToSystemTime
ExitThread
WaitForSingleObjectEx
CompareStringW
SetEndOfFile
VirtualAllocEx
TlsGetValue
SetCurrentDirectoryW
Process32FirstW
SetHandleCount
GetLocaleInfoA
DeviceIoControl
GetThreadContext
FlushInstructionCache
FlushFileBuffers
SetEvent
WideCharToMultiByte
RaiseException
GetSystemInfo
CreateThread
VirtualAlloc
GetFileType
IsDebuggerPresent
HeapSize
OpenThread
QueryPerformanceCounter
ResumeThread
LeaveCriticalSection
FindClose
GetVersionExA
GetLastError
TlsAlloc
GetModuleHandleW
SetUnhandledExceptionFilter
ResetEvent
OpenFileMappingA
WriteConsoleW
FindFirstFileW
WaitForSingleObject
GetACP
GetStringTypeA
WriteFileEx
CloseHandle
CreateProcessW
GetCPInfo
UnhandledExceptionFilter
InterlockedCompareExchange
GetTimeFormatA
CreateFileMappingA
GetConsoleOutputCP
GetFullPathNameA
SetLastError
DuplicateHandle
FreeLibrary
CompareStringA
MultiByteToWideChar
TryEnterCriticalSection
SleepEx
GlobalLock
MapViewOfFileEx
GetCurrentDirectoryW
GetStartupInfoA
VirtualQuery
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
GetFileSizeEx
DeleteCriticalSection
SetThreadContext
LoadLibraryA
RtlUnwind
IsValidLocale
CreateToolhelp32Snapshot
EnumSystemLocalesA
GlobalAlloc
GetUserDefaultLCID
LCMapStringW
FindNextFileW
VirtualFreeEx
SetEnvironmentVariableW
TerminateProcess
CreateFileA
ReadFile
CreateDirectoryW
FindFirstFileA
GetCurrentThread
GetEnvironmentStringsW
VirtualProtect
GetTimeZoneInformation
GetStringTypeW
GetConsoleCP
GetFileAttributesW
GetSystemTimeAsFileTime
OpenProcess
GetFullPathNameW
CreateEventA
CreateFileW
GetCurrentThreadId
lstrlenA
SetStdHandle
ConnectNamedPipe
GlobalFree
WriteConsoleA
GetStdHandle
SetFileAttributesW
GetModuleFileNameA
GetEnvironmentStrings
WriteFile
GetExitCodeProcess
UnmapViewOfFile
ExpandEnvironmentStringsA
SetCurrentDirectoryA
HeapCreate
InterlockedIncrement
GetTickCount
SetFilePointer
HeapReAlloc
GetConsoleMode
GetOEMCP
FreeEnvironmentStringsW
SuspendThread
GetCurrentDirectoryA
CreateMutexW
LocalFree
LocalAlloc
VirtualProtectEx
GetProcAddress
MulDiv
LoadLibraryW
GetCommandLineA
GetProcessHeap
HeapFree
GetCurrentProcess
HeapAlloc
GetCommandLineW
TlsFree
ExitProcess
user32
GetWindowLongA
DispatchMessageW
RegisterClassExA
GetSystemMetrics
OpenClipboard
CreateWindowExA
CloseClipboard
GetDC
ScreenToClient
InflateRect
SetWindowLongW
UnregisterClassW
IsZoomed
InvalidateRect
SetWindowLongA
BringWindowToTop
TranslateMessage
UnhookWindowsHookEx
GetClientRect
SetFocus
LoadIconA
MoveWindow
CreateWindowExW
ReleaseDC
ScrollDC
GetMessageW
SendMessageW
SetForegroundWindow
GetWindowLongW
LoadIconW
ShowWindow
RegisterClassExW
TrackMouseEvent
SetClipboardData
BeginPaint
MessageBoxW
PtInRect
EndPaint
LoadCursorW
LoadImageW
PostMessageW
LoadCursorA
EmptyClipboard
SetWindowRgn
DefWindowProcW
DestroyWindow
SetWindowsHookExA
DefWindowProcA
GetWindowRect
PostQuitMessage
SetWindowsHookExW
FindWindowW
MessageBoxA
GetWindowThreadProcessId
CallNextHookEx
gdi32
DeleteObject
SetTextColor
TextOutA
StretchBlt
DeleteDC
SelectObject
SelectClipRgn
GetStockObject
StretchDIBits
GetObjectA
GetDeviceCaps
BitBlt
CreateRectRgn
Polygon
CreateDIBSection
SetBkMode
CreateCompatibleBitmap
CreatePen
CreateCompatibleDC
advapi32
RegCloseKey
CryptHashData
RegOpenKeyExW
RegQueryValueExA
CryptCreateHash
CryptDestroyKey
SetSecurityDescriptorDacl
CryptDestroyHash
CryptReleaseContext
LookupPrivilegeValueA
InitializeSecurityDescriptor
RegQueryValueExW
CryptDecrypt
CryptAcquireContextW
OpenProcessToken
AdjustTokenPrivileges
CryptDeriveKey
RegOpenKeyExA
shell32
ShellExecuteA
ShellExecuteExW
ShellExecuteW
SHGetFolderPathW
CommandLineToArgvW
winmm
PlaySoundW
rpcrt4
RpcStringFreeA
UuidCreate
UuidToStringA
secur32
InitializeSecurityContextW
QueryContextAttributesW
DeleteSecurityContext
AcceptSecurityContext
FreeCredentialsHandle
InitializeSecurityContextA
DecryptMessage
EncryptMessage
QueryContextAttributesA
AcquireCredentialsHandleW
avifil32
AVISaveVW
msvcrt
sprintf
fputs
fclose
tmpfile
Sections
.text Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ