Static task
static1
Behavioral task
behavioral1
Sample
e42e3c29bc7d329321a94fc33ad41621042337a066c1f24a7a6811d2dccde467.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e42e3c29bc7d329321a94fc33ad41621042337a066c1f24a7a6811d2dccde467.exe
Resource
win10v2004-20220812-en
General
-
Target
e42e3c29bc7d329321a94fc33ad41621042337a066c1f24a7a6811d2dccde467
-
Size
312KB
-
MD5
6f3f010a06cfeb597a2b63427b3c08fc
-
SHA1
d0f140f4721ed55be96fec8c169781b9bc3e4b88
-
SHA256
e42e3c29bc7d329321a94fc33ad41621042337a066c1f24a7a6811d2dccde467
-
SHA512
453627db0b641aaa4953523a755a3ea91f814e31a27b7f3f0d57b790ed34f946d9ebf10a5d1930b220aff76727c280ad065a11942ddb29765d4e022a6c2500c7
-
SSDEEP
6144:gBPRhcuenmNHXiC6wlpETCJPWdmEQAUdiclxmcnZyrCSsg:OhctmBXialpGg2yiclVArjsg
Malware Config
Signatures
Files
-
e42e3c29bc7d329321a94fc33ad41621042337a066c1f24a7a6811d2dccde467.exe windows x86
f586e3ad14cc4ad2ae58be3271b31ac0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
HeapFree
GetVolumePathNameA
GetDriveTypeA
CreateEventW
GetStringTypeW
SuspendThread
CreateEventW
LoadLibraryW
ResumeThread
GetStartupInfoA
GetProcessVersion
TlsGetValue
GetCurrentThread
CreateEventW
VirtualProtect
FindAtomW
GetPrivateProfileSectionA
GetProcessHeap
DeleteFileA
SetLastError
lstrlenA
clbcatq
DllGetClassObject
ComPlusMigrate
CheckMemoryGates
ComPlusMigrate
CheckMemoryGates
ComPlusMigrate
CheckMemoryGates
DllGetClassObject
SetupOpen
CheckMemoryGates
CheckMemoryGates
SetupOpen
SetupOpen
gpedit
DllCanUnloadNow
ExportRSoPData
BrowseForGPO
DllGetClassObject
Sections
.text Size: 1024B - Virtual size: 612B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 11KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 352B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 305KB - Virtual size: 305KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.import Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ