Static task
static1
Behavioral task
behavioral1
Sample
05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe
Resource
win10v2004-20220901-en
General
-
Target
05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0
-
Size
536KB
-
MD5
4ab05f44a4ee4aeef3fffd08cf3897d0
-
SHA1
51b28c7b2f16458ef3a86e50014902c02a9e5001
-
SHA256
05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0
-
SHA512
fb5a8399c8275a1ab1c355e6daf1a3ae5c565bcf44d52a02ea1f4e2cf66db59249942acc49a2a84368fee685e793a334c00b7fe63cdc974d23f36cab9c8641c0
-
SSDEEP
12288:YqXg1EBXgR86OJqW3o8p8BS0TPt9yJLFk6A/sJJeio:YqFBwODYW3Vp8MA0
Malware Config
Signatures
Files
-
05c3352049b6200b125229a07e514b859c6898f71f91f4dc8489c8641616ffd0.exe windows x86
e8bb6525b4452cb3b27c71ff8b320fa8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comdlg32
GetOpenFileNameW
GetSaveFileNameW
shell32
Shell_NotifyIconA
SHGetSpecialFolderLocation
SHGetPathFromIDListA
SHGetMalloc
SHGetSpecialFolderPathA
gdi32
SelectObject
CreateCompatibleDC
CreateDIBSection
CreatePen
TextOutA
StretchDIBits
SetTextColor
SetROP2
SetBkMode
Rectangle
GetStockObject
DeleteObject
DeleteDC
ws2_32
closesocket
connect
gethostbyname
gethostname
getservbyname
getsockname
htonl
htons
inet_addr
bind
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket
accept
WSAStartup
WSASetLastError
WSAGetLastError
ioctlsocket
WSACleanup
getsockopt
opengl32
glPopName
glColor3dv
glTexCoord3iv
glNormal3b
glLightModelf
glTexGenfv
glEvalCoord2d
glNormal3d
comctl32
ord17
kernel32
SetStdHandle
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CloseHandle
HeapSize
FlushFileBuffers
GetConsoleMode
RaiseException
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
RtlUnwind
GetCurrentProcessId
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetModuleHandleA
GetModuleFileNameA
GetStdHandle
ExitProcess
HeapCreate
HeapReAlloc
GetConsoleCP
SetDefaultCommConfigW
CancelDeviceWakeupRequest
CreateHardLinkA
SetComputerNameExW
GetNumberFormatW
GlobalReAlloc
GenerateConsoleCtrlEvent
WriteProcessMemory
WriteFile
WideCharToMultiByte
WaitForSingleObject
WaitForMultipleObjects
VirtualQuery
VirtualProtect
VirtualFreeEx
VirtualFree
VirtualAllocEx
VirtualAlloc
UnmapViewOfFile
TryEnterCriticalSection
TerminateThread
TerminateProcess
SuspendThread
Sleep
SetUnhandledExceptionFilter
SetThreadPriority
SetLastError
SetFilePointer
SetCurrentDirectoryW
ResumeThread
RemoveDirectoryW
ReleaseSemaphore
ReadProcessMemory
ReadFile
QueryPerformanceCounter
PostQueuedCompletionStatus
OpenProcess
OpenMutexA
MultiByteToWideChar
MoveFileW
MapViewOfFile
LocalUnlock
LocalSize
LocalLock
LocalFree
LocalFlags
LocalAlloc
LoadLibraryW
LoadLibraryExW
LoadLibraryA
LeaveCriticalSection
IsDBCSLeadByteEx
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
GlobalMemoryStatus
GlobalFree
GlobalAlloc
GetVersionExA
GetVersion
GetTickCount
GetTempPathA
GetSystemTimeAsFileTime
GetLastError
HeapAlloc
GetCommandLineA
GetStartupInfoA
EnterCriticalSection
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetCurrentThreadId
DeleteCriticalSection
HeapFree
Sections
.text Size: 115KB - Virtual size: 115KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 388KB - Virtual size: 387KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ