Static task
static1
Behavioral task
behavioral1
Sample
eb6a70381c2a98584466a37f65d6509ec9935d6c89ce328ab904d6c5c06ea9db.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
eb6a70381c2a98584466a37f65d6509ec9935d6c89ce328ab904d6c5c06ea9db.exe
Resource
win10v2004-20220812-en
General
-
Target
eb6a70381c2a98584466a37f65d6509ec9935d6c89ce328ab904d6c5c06ea9db
-
Size
815KB
-
MD5
749f7078c69da40444e795be0b30fec2
-
SHA1
74a9760a0147060effb4aa1fc88c5db4b96cdc56
-
SHA256
eb6a70381c2a98584466a37f65d6509ec9935d6c89ce328ab904d6c5c06ea9db
-
SHA512
cc2e6625539180aa732e098b1c724c8788c75536f4bece7a184029f4edfd076bd8ee4e3126634b54520632e9227b81417a135ba4675feb0da427e8d7f0208da0
-
SSDEEP
24576:D7JR5Ykv2CTNIFNw6mRgdW8YefQKSIBHRgzXwb:BR5hvkFNw6qgI/49Rgzg
Malware Config
Signatures
Files
-
eb6a70381c2a98584466a37f65d6509ec9935d6c89ce328ab904d6c5c06ea9db.exe windows x86
c613ebe9e1564257f282097709845218
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
odbctrac
TraceSQLForeignKeysW
TraceSQLColAttributes
TraceSQLSetConnectAttr
TraceSQLPrimaryKeysW
TraceSQLSetStmtAttr
TraceSQLDescribeParam
TraceSQLNumParams
TraceSQLColumns
TraceSQLGetConnectAttrW
TraceSQLGetDiagRec
TraceSQLColAttributeW
TraceSQLSetConnectAttrW
TraceSQLSetStmtOption
TraceSQLGetDescField
TraceSQLGetTypeInfoW
TraceSQLExtendedFetch
TraceSQLDescribeColW
TraceSQLSetCursorName
TraceSQLProcedureColumnsW
TraceSQLProcedureColumns
TraceSQLDriversW
TraceSQLDescribeCol
TraceSQLError
TraceSQLGetDiagField
TraceSQLPrimaryKeys
TraceSQLAllocHandleStdW
TraceSQLSetPos
TraceSQLBindCol
TraceSQLAllocHandle
untfs
?QuerySegmentReference@NTFS_MFT_INFO@@SG?AU_MFT_SEGMENT_REFERENCE@@PAX@Z
??1NTFS_ATTRIBUTE@@UAE@XZ
??0NTFS_BOOT_FILE@@QAE@XZ
?Initialize@NTFS_CLUSTER_RUN@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@VBIG_INT@@KK@Z
??0NTFS_REFLECTED_MASTER_FILE_TABLE@@QAE@XZ
?Write@NTFS_BITMAP@@QAEEPAVNTFS_ATTRIBUTE@@PAV1@@Z
?ComputeFileNameSignature@NTFS_MFT_INFO@@CGXKPAU_FILE_NAME@@QAE@Z
??0NTFS_MFT_INFO@@QAE@XZ
??1NTFS_BITMAP@@UAE@XZ
?Initialize@NTFS_EXTENT_LIST@@QAEEVBIG_INT@@0@Z
?QueryExtentList@NTFS_ATTRIBUTE_RECORD@@QBEEPAVNTFS_EXTENT_LIST@@@Z
??1NTFS_UPCASE_TABLE@@UAE@XZ
?QueryFileSizes@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVBIG_INT@@0PAE@Z
?Initialize@NTFS_BITMAP_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?Initialize@NTFS_BITMAP@@QAEEVBIG_INT@@EPAVLOG_IO_DP_DRIVE@@K@Z
?AddSecurityDescriptor@NTFS_FILE_RECORD_SEGMENT@@QAEEW4_CANNED_SECURITY_TYPE@@PAVNTFS_BITMAP@@@Z
??1NTFS_BITMAP_FILE@@UAE@XZ
??0NTFS_ATTRIBUTE_RECORD@@QAE@XZ
??0NTFS_BITMAP@@QAE@XZ
Recover
??0NTFS_EXTENT_LIST@@QAE@XZ
??1NTFS_ATTRIBUTE_LIST@@UAE@XZ
?ReadNext@NTFS_FRS_STRUCTURE@@QAEEVBIG_INT@@@Z
??1NTFS_REFLECTED_MASTER_FILE_TABLE@@UAE@XZ
?Initialize@NTFS_LOG_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?NtfsUpcaseCompare@@YGJPBGK0KPBVNTFS_UPCASE_TABLE@@E@Z
?Write@NTFS_ATTRIBUTE@@UAEEPBXVBIG_INT@@KPAKPAVNTFS_BITMAP@@@Z
??0NTFS_INDEX_TREE@@QAE@XZ
?Resize@NTFS_ATTRIBUTE@@UAEEVBIG_INT@@PAVNTFS_BITMAP@@@Z
?Relocate@NTFS_CLUSTER_RUN@@QAEXVBIG_INT@@@Z
?IsAttributePresent@NTFS_FILE_RECORD_SEGMENT@@QAEEKPBVWSTRING@@E@Z
??1NTFS_ATTRIBUTE_DEFINITION_TABLE@@UAE@XZ
??0NTFS_FILE_RECORD_SEGMENT@@QAE@XZ
??1NTFS_MFT_INFO@@UAE@XZ
msdart
?MpHeapCompact@@YAKPAX@Z
MPCSInitialize
?GetDefaultSpinCount@CFakeLock@@SGGXZ
?IsWriteLocked@CReaderWriterLock2@@QBE_NXZ
?IsReadLocked@CFakeLock@@QBE_NXZ
?ConvertExclusiveToShared@CFakeLock@@QAEXXZ
?IsUsable@CLKRLinearHashTable@@QBE_NXZ
mpMalloc
?TryWriteLock@CSpinLock@@QAE_NXZ
?Lock@CLockedDoubleList@@QAEXXZ
?GetDefaultSpinAdjustmentFactor@CReaderWriterLock@@SGNXZ
??0CSmallSpinLock@@QAE@XZ
?IsWriteLocked@CReaderWriterLock3@@QBE_NXZ
?Clear@CLKRLinearHashTable@@QAEXXZ
?GetStatistics@CLKRLinearHashTable@@QBE?AVCLKRHashTableStats@@XZ
?IsReadUnlocked@CFakeLock@@QBE_NXZ
?_ReadOrWriteUnlock@CLKRLinearHashTable@@ABEX_N@Z
?TryReadLock@CReaderWriterLock@@QAE_NXZ
?Size@CLKRLinearHashTable@@QBEKXZ
MPInitializeCriticalSectionAndSpinCount
??4CFakeLock@@QAEAAV0@ABV0@@Z
?_IsLocked@CSpinLock@@ABE_NXZ
?ReadUnlock@CLKRHashTable@@QBEXXZ
?InsertTail@CDoubleList@@QAEXQAVCListEntry@@@Z
?MaxSize@CLKRLinearHashTable@@QBEKXZ
?sm_dblDfltSpinAdjFctr@CSmallSpinLock@@1NA
?TryWriteLock@CReaderWriterLock@@QAE_NXZ
??1CLKRHashTable@@QAE@XZ
?IsReadLocked@CLKRHashTable@@QBE_NXZ
SetMemHook
?IsEmpty@CSingleList@@QBE_NXZ
MpHeapReAlloc
_DllMain@12
?SetDefaultSpinCount@CSmallSpinLock@@SGXG@Z
?TryReadLock@CSpinLock@@QAE_NXZ
kernel32
VirtualAlloc
CreatePipe
FindFirstFileA
lstrcatW
FindActCtxSectionStringA
UnregisterConsoleIME
DeleteAtom
GlobalFix
GetStartupInfoA
LZCreateFileW
GetUserDefaultLCID
BackupSeek
GetTempPathW
GetThreadLocale
GetNumberOfConsoleFonts
InitializeCriticalSectionAndSpinCount
TryEnterCriticalSection
UnlockFileEx
GetSystemTimeAsFileTime
GetPrivateProfileStructA
GetProcessPriorityBoost
lstrcpynW
CreateFileMappingA
SetupComm
LoadLibraryA
GetDriveTypeW
CreateMutexA
lstrlenA
ExpandEnvironmentStringsA
GetModuleHandleA
ExitProcess
ReadFileScatter
OpenJobObjectA
EnumDateFormatsExA
GetCPInfoExA
GetThreadSelectorEntry
QueryMemoryResourceNotification
GetPrivateProfileSectionNamesW
GetSystemDefaultLCID
user32
ChangeDisplaySettingsA
GetKeyboardLayoutList
GetDesktopWindow
User32InitializeImmEntryTable
GrayStringW
DefDlgProcA
MapVirtualKeyW
ExitWindowsEx
GetMenuState
WindowFromDC
LoadImageW
PostThreadMessageA
MessageBoxExW
GetKeyboardType
SetInternalWindowPos
GetClassInfoW
SetWindowContextHelpId
ReleaseCapture
SetWindowStationUser
ChangeMenuW
OpenWindowStationA
FreeDDElParam
DdeGetLastError
wvsprintfA
SetRectEmpty
GetWindowInfo
MessageBoxTimeoutW
CallMsgFilter
SetCaretPos
DeregisterShellHookWindow
GetMenuStringA
Sections
.text Size: 380KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 185KB - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 132KB - Virtual size: 132KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ