Static task
static1
Behavioral task
behavioral1
Sample
871eeea951fee03cbf364edc0b096a2152e24d6f55f15b1833acd7ca6affe227.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
871eeea951fee03cbf364edc0b096a2152e24d6f55f15b1833acd7ca6affe227.exe
Resource
win10v2004-20220812-en
General
-
Target
871eeea951fee03cbf364edc0b096a2152e24d6f55f15b1833acd7ca6affe227
-
Size
913KB
-
MD5
4ea90df531f14f42f3ba9621825b36d0
-
SHA1
1efad47b083ff41d0c1084ef955ab77fb09363cf
-
SHA256
871eeea951fee03cbf364edc0b096a2152e24d6f55f15b1833acd7ca6affe227
-
SHA512
8aa1491775caac81fd374c88fb05de534759258cca0891b8f7076ed0edd5a1c1b0436b7c0954c9938c3c118015ba9d2057a6d0a217036db54b050803da8d4dd4
-
SSDEEP
24576:VQh4Dl9Zv/mCIuFWd8V7pWg6QyKipE4S0coInb:VLBvO3uFOWpj6QyKQfze
Malware Config
Signatures
Files
-
871eeea951fee03cbf364edc0b096a2152e24d6f55f15b1833acd7ca6affe227.exe windows x86
e1d3dd753c24812a6bd234e1f2a39979
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
OpenFileMappingW
CreateMutexW
GetLastError
SetLastError
GetFileAttributesW
FreeLibrary
TerminateProcess
WaitForMultipleObjects
ResumeThread
CreateEventW
SetFileAttributesW
CopyFileW
GetPrivateProfileIntW
DeleteFileW
GetCurrentProcessId
GetCurrentThreadId
WritePrivateProfileStringW
WideCharToMultiByte
CreateFileMappingA
OpenFileMappingA
GetFileTime
CreateFileA
OpenMutexW
Process32NextW
OpenProcess
Process32FirstW
CreateToolhelp32Snapshot
QueryDosDeviceW
GetLogicalDriveStringsW
WriteFile
CreateFileW
FindClose
FindNextFileW
FindFirstFileW
Sleep
GetTickCount
lstrlenW
CreateProcessW
GetExitCodeProcess
SearchPathW
GetLongPathNameW
MoveFileExW
Module32NextW
Module32FirstW
SleepEx
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
FlushFileBuffers
WaitForSingleObject
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
GetPrivateProfileStringW
OutputDebugStringW
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
lstrlenA
SetEvent
MultiByteToWideChar
GetProcessHeap
SetEndOfFile
SetStdHandle
GetConsoleMode
GetConsoleCP
HeapReAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetFilePointer
SetHandleCount
ReadFile
InterlockedIncrement
InterlockedDecrement
GetStringTypeW
InterlockedCompareExchange
InterlockedExchange
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
RtlUnwind
RaiseException
HeapFree
HeapAlloc
GetSystemTimeAsFileTime
GetLocalTime
GetTimeZoneInformation
CreateDirectoryW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
FindFirstFileExW
GetCommandLineW
HeapSetInformation
GetStartupInfoW
GetCPInfo
LCMapStringW
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetACP
GetOEMCP
IsValidCodePage
GetStdHandle
GetLocaleInfoW
HeapSize
ExitProcess
HeapCreate
InitializeCriticalSectionAndSpinCount
GetFullPathNameW
GetFileInformationByHandle
PeekNamedPipe
GetFileType
GetCurrentDirectoryW
user32
CreateWindowExW
PeekMessageW
DefWindowProcW
SetWindowLongW
DestroyWindow
FindWindowW
SendMessageW
PostQuitMessage
IsWindow
PostMessageW
MessageBoxW
KillTimer
SetCursor
GetWindowLongW
UpdateWindow
ShowWindow
DispatchMessageW
TranslateMessage
TranslateAcceleratorW
GetMessageW
LoadAcceleratorsW
RegisterClassExW
LoadCursorW
LoadIconW
DialogBoxParamW
SetTimer
EndDialog
ClipCursor
shell32
SHGetFolderPathW
SHFileOperationW
advapi32
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
bugrpt
BR_SetUin
BR_SetVersion
BR_SetLogSession
BR_Init
BR_SetSender
BR_SetSenderExtCmd
BR_SetLogFileMd5Dir
BR_pfPostBugReport
BR_SetLcid
BR_pfPreBugReport
psapi
GetModuleFileNameExA
GetProcessImageFileNameW
GetModuleFileNameExW
rpcrt4
UuidCreate
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
ws2_32
socket
htons
__WSAFDIsSet
connect
WSAGetLastError
recv
send
closesocket
select
inet_addr
htonl
ntohl
WSACleanup
WSAStartup
inet_ntoa
gethostbyname
ioctlsocket
Sections
.text Size: 466KB - Virtual size: 465KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 123KB - Virtual size: 122KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 54KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 262KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE