Static task
static1
Behavioral task
behavioral1
Sample
0b6aa798221aa67e73b946d9a23df3ece982b260557d2499679180f037bb71a6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0b6aa798221aa67e73b946d9a23df3ece982b260557d2499679180f037bb71a6.exe
Resource
win10v2004-20220812-en
General
-
Target
0b6aa798221aa67e73b946d9a23df3ece982b260557d2499679180f037bb71a6
-
Size
343KB
-
MD5
497138986bd407477d997c994a1f37a0
-
SHA1
6de109b15767fa4dba2cf2ac1386e6002a372b39
-
SHA256
0b6aa798221aa67e73b946d9a23df3ece982b260557d2499679180f037bb71a6
-
SHA512
c376403c83ac4c50da2fbd1a31ec8dc4bb67ac3c222da2876e2f4d57126ef83d55645f540da02fc4f45842a5f6d4050063088821b0b3b35aab80c3047b156fbe
-
SSDEEP
6144:nhVsM2AshkSE80JoDYfACChTBqdU9vyJOGLaMcDN7Y7t7qP0QIdgiuIwn:nhVD2r0mco1hTsd/WMcp7YJeP0/d16
Malware Config
Signatures
Files
-
0b6aa798221aa67e73b946d9a23df3ece982b260557d2499679180f037bb71a6.exe windows x86
ab3094c549d81e92dfcaaadd8615cc50
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
dbghelp
SymSetOptions
SymCleanup
SymGetModuleInfoW
SymLoadModule
SymInitialize
wininet
InternetConnectA
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetOpenA
psapi
GetModuleFileNameExW
GetModuleFileNameExA
comctl32
ImageList_ReplaceIcon
ImageList_Create
InitCommonControlsEx
tinyxml
?ToElement@TiXmlNode@@UBEPBVTiXmlElement@@XZ
?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ
?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ
?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ
?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ
?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ
?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ
?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ
?Clone@TiXmlDocument@@MBEPAVTiXmlNode@@XZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?Accept@TiXmlDocument@@UBE_NPAVTiXmlVisitor@@@Z
?Value@TiXmlNode@@QBEPBDXZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?GetText@TiXmlElement@@QBEPBDXZ
??1TiXmlDocument@@UAE@XZ
?Print@TiXmlDocument@@UBEXPAU_iobuf@@H@Z
?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z
?ToDocument@TiXmlDocument@@UAEPAV1@XZ
?ToDocument@TiXmlDocument@@UBEPBV1@XZ
?ToElement@TiXmlNode@@UAEPAVTiXmlElement@@XZ
?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z
?Attribute@TiXmlElement@@QBEPBDPBD@Z
??0TiXmlDocument@@QAE@XZ
kernel32
HeapDestroy
HeapReAlloc
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
DeviceIoControl
MoveFileW
VirtualQuery
SetFileAttributesW
GetCurrentProcess
GetProcessTimes
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
InitializeCriticalSection
GetCurrentThreadId
GetCurrentProcessId
GetModuleHandleW
HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
HeapFree
GetTickCount
SetCurrentDirectoryW
OpenThread
SizeofResource
LockResource
LoadResource
ReadProcessMemory
WriteProcessMemory
FindResourceExW
CreateThread
FindResourceW
OpenProcess
GetLastError
lstrlenW
lstrcatW
DeleteFileW
CopyFileW
LoadLibraryW
FindFirstFileW
GetExitCodeProcess
FindNextFileW
VirtualQueryEx
TerminateProcess
FindClose
CreateFileA
SetEvent
lstrcpyW
MultiByteToWideChar
WaitForSingleObject
CreateProcessW
FreeLibrary
GlobalUnlock
GlobalFree
InterlockedIncrement
InterlockedDecrement
GlobalAlloc
IsDBCSLeadByte
GlobalLock
WideCharToMultiByte
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
FreeResource
CreateEventW
ResumeThread
Process32NextW
CreateToolhelp32Snapshot
Process32FirstW
Sleep
CreateFileW
WriteFile
DeleteCriticalSection
RaiseException
GetVersionExW
ReadFile
SetFilePointer
GetProcAddress
GetFileSize
GetModuleFileNameW
GetPrivateProfileSectionW
GetSystemDefaultLCID
GetPrivateProfileIntW
GetTempPathW
WritePrivateProfileStringW
CreateDirectoryW
GetThreadSelectorEntry
GetFileAttributesW
GetSystemTimeAsFileTime
user32
GetClassInfoExW
DefWindowProcW
IsWindow
DestroyMenu
TrackPopupMenu
GetWindowThreadProcessId
GetMenuItemCount
CreatePopupMenu
ReleaseDC
DrawTextW
SetWindowLongW
GetDC
ClientToScreen
EndPaint
GetSysColorBrush
RegisterClassExW
GetKeyState
DialogBoxParamW
SetDlgItemTextW
GetWindow
CloseClipboard
EnableWindow
SetClipboardData
GetWindowTextW
SendDlgItemMessageW
EmptyClipboard
GetWindowTextLengthW
SetTimer
OpenClipboard
RegisterClipboardFormatW
CallWindowProcW
InvalidateRect
MapDialogRect
GetWindowRect
MapWindowPoints
GetDesktopWindow
PostMessageW
EndDialog
DrawIconEx
GetDlgItem
GetClientRect
ShowWindow
LoadImageW
SetWindowPos
SetWindowTextW
SendMessageW
LoadIconW
CreateWindowExW
DestroyWindow
UnregisterClassA
BeginPaint
KillTimer
gdi32
GetStockObject
SetTextColor
DeleteObject
SetBkMode
CreateFontW
SelectObject
advapi32
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
shell32
ord155
SHBindToParent
SHGetDesktopFolder
ShellExecuteW
SHGetFileInfoW
SHGetSpecialFolderPathW
ShellExecuteExW
ole32
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
DoDragDrop
oleaut32
SysStringLen
SysAllocString
SysFreeString
SysAllocStringByteLen
SysStringByteLen
gdiplus
GdipLoadImageFromStreamICM
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipCreateFromHDC
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDeleteGraphics
GdipDisposeImage
GdipCloneImage
GdipDrawImageRectI
GdipGetImageHeight
GdipGetImageWidth
shlwapi
PathFileExistsW
msvcp80
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
msvcr80
_time32
memcpy
_invalid_parameter_noinfo
malloc
swscanf
strchr
vsprintf_s
wcsncmp
_vscprintf
__wargv
__argc
vswprintf_s
_mbscmp
free
_vscwprintf
srand
wcslen
memcpy_s
_purecall
memmove_s
??3@YAXPAX@Z
strlen
_snprintf
_mbsstr
_mbslwr_s
??2@YAPAXI@Z
??0exception@std@@QAE@XZ
??_V@YAXPAX@Z
wcscmp
??0exception@std@@QAE@ABQBD@Z
memset
??0exception@std@@QAE@ABV01@@Z
wcsrchr
_wcslwr_s
wcschr
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
memcmp
iswspace
_wcsicmp
strcmp
strtoul
ftell
fwrite
fclose
fprintf
wcscpy
_lock
_encode_pointer
wcscat
__dllonexit
_unlock
_wfopen
fseek
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
strncpy_s
tolower
isalnum
sprintf_s
_wtoi
memmove
wcsncpy
_time64
iswalnum
iswalpha
iswdigit
wcscat_s
wcscpy_s
_gmtime32
_snwprintf
fread
atoi
strrchr
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_beginthreadex
wcsstr
towlower
isspace
__CxxFrameHandler3
_mbsicmp
_mbschr
strncmp
_CxxThrowException
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
crypt32
CertGetNameStringW
wintrust
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain
iphlpapi
GetAdaptersAddresses
GetAdaptersInfo
netapi32
Netbios
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE