Behavioral task
behavioral1
Sample
9eb1b0b62fc6d457f759f1f94fa2c2dd78a31ae26cfa6ab454a13e81bef725af.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9eb1b0b62fc6d457f759f1f94fa2c2dd78a31ae26cfa6ab454a13e81bef725af.exe
Resource
win10v2004-20220901-en
General
-
Target
9eb1b0b62fc6d457f759f1f94fa2c2dd78a31ae26cfa6ab454a13e81bef725af
-
Size
408KB
-
MD5
473a8255183286b03fb847b700664b10
-
SHA1
fec3ddbe9963d23bf8f2452e59d135d11f10b80f
-
SHA256
9eb1b0b62fc6d457f759f1f94fa2c2dd78a31ae26cfa6ab454a13e81bef725af
-
SHA512
eb4b689acdb65f1bd033497dac87718c8a16e9a30b4713c5af73c7fab41fa833bcfcbd0b8595810ae24846df9248f3f340120a136d3821518e7b2cf8872aab97
-
SSDEEP
6144:KeayjMblgdMdXANkXhCaVbJRdgHgnuoE681zPHM/4/3S7o:2hgK5GnalJRdgHZoEXRs/4v+o
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
9eb1b0b62fc6d457f759f1f94fa2c2dd78a31ae26cfa6ab454a13e81bef725af.exe windows x86
ab2df1d37d0bbc9eddb8d60683e57358
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
MultiByteToWideChar
GetCurrentProcess
GetCPInfo
DeleteFileW
InterlockedIncrement
InterlockedDecrement
InitializeCriticalSection
DeleteCriticalSection
FlushInstructionCache
SetLastError
RaiseException
GetCommandLineW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetConsoleMode
GetConsoleCP
GetStringTypeW
GetStringTypeA
RtlUnwind
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
SetFilePointer
FreeLibrary
FindClose
FindFirstFileW
FindResourceW
LoadLibraryW
GetModuleFileNameW
GetProcAddress
FindResourceExW
LoadResource
LockResource
WriteFile
SizeofResource
CreateFileW
ReadFile
GetLastError
GetFileSize
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleFileNameA
GetStdHandle
CloseHandle
LCMapStringW
LCMapStringA
IsValidCodePage
GetVersionExA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
Sleep
ExitProcess
HeapCreate
GetOEMCP
user32
SetWindowLongW
GetParent
ScreenToClient
GetDlgItem
TranslateMessage
GetWindowRect
PostQuitMessage
LoadImageW
LoadIconW
DestroyIcon
DestroyWindow
DispatchMessageW
UnregisterClassA
IsDialogMessageW
CreateDialogParamW
GetMessageW
EnableWindow
SetFocus
SetWindowTextW
IsWindow
SendMessageW
PostMessageW
MessageBoxW
SetForegroundWindow
ShowWindow
MoveWindow
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
shell32
SHGetSpecialFolderPathW
ole32
CoCreateInstance
CreateBindCtx
oleaut32
SysFreeString
SysAllocString
shlwapi
PathFileExistsW
comctl32
ord17
urlmon
RegisterBindStatusCallback
CreateURLMoniker
Sections
.text Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX Size: 244KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE