Static task
static1
Behavioral task
behavioral1
Sample
b8098fe4ce415a4381ce045c1ebf58b53680f8ad8baed3dadf8ad303d45f2743.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b8098fe4ce415a4381ce045c1ebf58b53680f8ad8baed3dadf8ad303d45f2743.exe
Resource
win10v2004-20220812-en
General
-
Target
b8098fe4ce415a4381ce045c1ebf58b53680f8ad8baed3dadf8ad303d45f2743
-
Size
273KB
-
MD5
4dbac16f80b032efe354e53f0f192d10
-
SHA1
1fa4a0367a7f147ed24ff5a023f67f784bc9b29a
-
SHA256
b8098fe4ce415a4381ce045c1ebf58b53680f8ad8baed3dadf8ad303d45f2743
-
SHA512
bacef51fbe6fee70582386a7700c0db0026ac648608b161787ccf4bf173f95341008b23258a0042b922286405e2f8a534091e588203a78586551e6e1fda8dd46
-
SSDEEP
6144:tvL+JLQp7kOOiZ2D6YmxXdL+RsTeOhoyT:tv6JERr2eYmxXsRsTZhF
Malware Config
Signatures
Files
-
b8098fe4ce415a4381ce045c1ebf58b53680f8ad8baed3dadf8ad303d45f2743.exe windows x86
cf54d88e7a2b747e1fd1b4902470014f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
dbghelp
MiniDumpReadDumpStream
ws2_32
closesocket
setsockopt
socket
connect
htons
gethostbyname
inet_addr
send
recv
WSAStartup
WSACleanup
minizip
zipClose
zipOpen
zipCloseFileInZip
zipWriteInFileInZip
zipOpenNewFileInZip
kernel32
CopyFileW
FindClose
FindNextFileW
FindFirstFileW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetProcAddress
GetModuleHandleW
InitializeCriticalSection
FlushInstructionCache
GetCurrentProcess
GetCurrentThreadId
SetLastError
InterlockedIncrement
GlobalUnlock
GlobalLock
GlobalAlloc
OutputDebugStringW
SetErrorMode
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
FileTimeToLocalFileTime
ReadFile
FileTimeToDosDateTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetLastError
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
Sleep
InterlockedExchange
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
GetSystemTimeAsFileTime
InterlockedCompareExchange
WideCharToMultiByte
RaiseException
MultiByteToWideChar
lstrlenW
CloseHandle
MapViewOfFile
lstrlenA
InterlockedDecrement
CreateFileW
CreateFileMappingW
user32
LoadStringW
wsprintfW
UnregisterClassA
EndPaint
GetActiveWindow
MessageBeep
GetSystemMetrics
LoadImageW
LoadBitmapW
GetDlgItem
GetWindowTextW
EndDialog
EmptyClipboard
SetClipboardData
CloseClipboard
GetWindow
MonitorFromWindow
GetMonitorInfoW
OpenClipboard
MessageBoxW
SetDlgItemTextW
KillTimer
SetTimer
GetWindowTextLengthW
SetWindowTextW
SetCursor
ShowCursor
GetParent
MapWindowPoints
SendMessageW
IsWindowEnabled
GetCursorPos
SystemParametersInfoW
ShowWindow
GetWindowRect
SetWindowPos
GetDC
DrawTextW
ReleaseDC
CharNextW
BeginPaint
CallWindowProcW
GetClientRect
GetWindowLongW
InflateRect
GetSysColor
DestroyWindow
DefWindowProcW
DialogBoxParamW
IsWindow
InvalidateRect
SetWindowLongW
RegisterClassExW
RegisterClassExA
UnregisterClassW
LoadCursorW
GetClassInfoExW
LoadCursorA
GetClassInfoExA
gdi32
ExtSelectClipRgn
CreateRectRgnIndirect
GetWindowOrgEx
BitBlt
CreateCompatibleDC
OffsetWindowOrgEx
SetWindowOrgEx
SetTextColor
SetBkMode
GetStockObject
SelectObject
CreateFontIndirectW
DeleteObject
GetObjectW
ExtTextOutW
Rectangle
DeleteDC
SetBkColor
shell32
ShellExecuteW
SHCreateDirectoryExW
ole32
CoUninitialize
CoInitialize
CoCreateInstance
oleaut32
RegisterTypeLi
UnRegisterTypeLi
SysStringLen
SysAllocString
SysAllocStringLen
VariantClear
SysFreeString
atl90
ord64
ord56
ord61
ord23
ord68
ord44
ord43
ord49
comctl32
InitCommonControlsEx
_TrackMouseEvent
msvcp90
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
msvcr90
wcscpy
_invalid_parameter_noinfo
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
__CxxFrameHandler3
wcsftime
memset
??_V@YAXPAX@Z
strlen
tolower
fclose
_atoi64
wcslen
_snwprintf
_localtime64
free
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??3@YAXPAX@Z
fread
_wfopen
sprintf
atoi
strncmp
memcpy
_wstat64i32
memcmp
sprintf_s
swprintf_s
_recalloc
_purecall
_vswprintf
fwrite
_time64
wcsrchr
memmove_s
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
wcsncpy_s
_strupr
??0exception@std@@QAE@ABQBD@Z
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 169KB - Virtual size: 172KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE