Static task
static1
Behavioral task
behavioral1
Sample
35928044a282f6f0e7768e5bf2fc452cace60f7f9352c58ffa2fd345e73743af.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
35928044a282f6f0e7768e5bf2fc452cace60f7f9352c58ffa2fd345e73743af.exe
Resource
win10v2004-20220812-en
General
-
Target
35928044a282f6f0e7768e5bf2fc452cace60f7f9352c58ffa2fd345e73743af
-
Size
559KB
-
MD5
6b61ab90a2a6432aebb7cd0c0ce7ead0
-
SHA1
c500e3a6abf8410b39d6fde700c04487c2ea7e8d
-
SHA256
35928044a282f6f0e7768e5bf2fc452cace60f7f9352c58ffa2fd345e73743af
-
SHA512
f432720f3d32f3ff004a10d96ca30fdac380e5637fdd9a38dca9536c3d4956b0c93d8027dbd81f4403979af11316a4185ed6bde4e5586f2b9ba5a87cd0f85a67
-
SSDEEP
12288:DSU//njTpqxy509pgQ+wsE9aNlyHyhx/6klAY0fWJs3QJkaxacD3XE7JXIy7Dxwn:D7//jTpq1y4ffIP9Q4zbb
Malware Config
Signatures
Files
-
35928044a282f6f0e7768e5bf2fc452cace60f7f9352c58ffa2fd345e73743af.exe windows x86
a3e35d124750766a204a87db2a02210a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc90u
ord1219
ord5767
ord291
ord287
ord324
ord2084
ord608
ord1276
ord6811
ord814
ord290
ord2478
ord899
ord1354
ord3537
ord2106
ord1183
ord3543
ord2458
ord1243
ord2523
ord1250
ord1254
ord404
ord5535
ord265
ord4211
ord938
ord794
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord2251
ord2206
ord6035
ord4179
ord1272
ord1048
ord5548
ord6741
ord5830
ord4213
ord2087
ord3217
ord5674
ord5676
ord933
ord4347
ord4996
ord5680
ord5663
ord6018
ord2771
ord2983
ord3112
ord4728
ord2966
ord3115
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4905
ord4681
ord3670
ord589
ord4043
ord5979
ord4518
ord403
ord1552
ord4519
ord813
ord663
ord2537
ord935
ord4405
ord266
ord6630
ord3220
ord285
ord1607
ord6687
ord5939
ord1603
ord296
ord286
ord4324
ord4490
ord3185
ord6013
ord2676
ord280
ord811
ord799
ord1599
ord909
ord2479
ord600
ord939
ord6698
ord4494
ord2081
ord3729
ord293
ord2145
ord452
ord1542
ord5867
ord1356
ord801
ord453
ord2447
ord1137
msvcr90
_wfopen
wcsftime
_gmtime64_s
_time64
__wargv
__argc
strstr
_purecall
??0bad_cast@std@@QAE@PBD@Z
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
strncpy
memcpy
malloc
qsort
sprintf
atoi
memset
__RTtypeid
??0exception@std@@QAE@ABQBDH@Z
wcsrchr
wcsstr
_CIlog10
_CIexp
swscanf
_wtoi
rand
wcstok
_wcsdup
sscanf
??8type_info@@QBE_NABV0@@Z
memmove_s
_swprintf
_wcsicmp
_mktime64
_strdup
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
_except_handler4_common
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_fstat64i32
fclose
free
_CxxThrowException
__CxxFrameHandler3
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_fileno
abort
??0exception@std@@QAE@ABV01@@Z
kernel32
Sleep
InterlockedExchange
InterlockedCompareExchange
MultiByteToWideChar
WideCharToMultiByte
GetTickCount
FindFirstFileW
FindNextFileW
FindClose
CreateDirectoryW
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
user32
MessageBoxW
gdi32
CreateFontIndirectW
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
comctl32
ord17
msvcp90
?_Decref@facet@locale@std@@QAEPAV123@XZ
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@H@Z
?getline@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADHD@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
??1locale@std@@QAE@XZ
?widen@?$ctype@_W@std@@QBE_WD@Z
??0_Lockit@std@@QAE@H@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
?_Id_cnt@id@locale@std@@0HA
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PBX@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?uncaught_exception@std@@YA_NXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
vc9.0_xerces-c_2_8
??1XercesDOMParser@xercesc_2_8@@UAE@XZ
?handleAttributesPSVI@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0PAVPSVIAttributeList@2@@Z
?handlePartialElementPSVI@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0PAVPSVIElement@2@@Z
?handleElementPSVI@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0PAVPSVIElement@2@@Z
?TextDecl@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0@Z
?startExtSubset@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?startIntSubset@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?startAttList@AbstractDOMParser@xercesc_2_8@@UAEXABVDTDElementDecl@2@@Z
?notationDecl@AbstractDOMParser@xercesc_2_8@@UAEXABVXMLNotationDecl@2@_N@Z
?resetDocType@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?entityDecl@AbstractDOMParser@xercesc_2_8@@UAEXABVDTDEntityDecl@2@_N1@Z
?endExtSubset@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?endIntSubset@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?endAttList@AbstractDOMParser@xercesc_2_8@@UAEXABVDTDElementDecl@2@@Z
?elementDecl@AbstractDOMParser@xercesc_2_8@@UAEXABVDTDElementDecl@2@_N@Z
?doctypeWhitespace@AbstractDOMParser@xercesc_2_8@@UAEXQB_WI@Z
?doctypePI@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0@Z
?doctypeDecl@AbstractDOMParser@xercesc_2_8@@UAEXABVDTDElementDecl@2@QB_W1_N2@Z
?doctypeComment@AbstractDOMParser@xercesc_2_8@@UAEXQB_W@Z
?attDef@AbstractDOMParser@xercesc_2_8@@UAEXABVDTDElementDecl@2@ABVDTDAttDef@2@_N@Z
?startInputSource@XercesDOMParser@xercesc_2_8@@UAEXABVInputSource@2@@Z
?resolveEntity@XercesDOMParser@xercesc_2_8@@UAEPAVInputSource@2@QB_W00@Z
?resolveEntity@XercesDOMParser@xercesc_2_8@@UAEPAVInputSource@2@PAVXMLResourceIdentifier@2@@Z
?resetEntities@XercesDOMParser@xercesc_2_8@@UAEXXZ
?expandSystemId@XercesDOMParser@xercesc_2_8@@UAE_NQB_WAAVXMLBuffer@2@@Z
?endInputSource@XercesDOMParser@xercesc_2_8@@UAEXABVInputSource@2@@Z
?resetErrors@XercesDOMParser@xercesc_2_8@@UAEXXZ
?error@XercesDOMParser@xercesc_2_8@@UAEXIQB_WW4ErrTypes@XMLErrorReporter@2@000JJ@Z
?createElementNSNode@AbstractDOMParser@xercesc_2_8@@MAEPAVDOMElement@2@PB_W0@Z
?setPSVIHandler@AbstractDOMParser@xercesc_2_8@@UAEXQAVPSVIHandler@2@@Z
?elementTypeInfo@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0@Z
?XMLDecl@AbstractDOMParser@xercesc_2_8@@UAEXQB_W000@Z
?startEntityReference@AbstractDOMParser@xercesc_2_8@@UAEXABVXMLEntityDecl@2@@Z
?startElement@AbstractDOMParser@xercesc_2_8@@UAEXABVXMLElementDecl@2@IQB_WABV?$RefVectorOf@VXMLAttr@xercesc_2_8@@@2@I_N3@Z
?startDocument@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?resetDocument@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?ignorableWhitespace@AbstractDOMParser@xercesc_2_8@@UAEXQB_WI_N@Z
?endEntityReference@AbstractDOMParser@xercesc_2_8@@UAEXABVXMLEntityDecl@2@@Z
?endElement@AbstractDOMParser@xercesc_2_8@@UAEXABVXMLElementDecl@2@I_NQB_W@Z
?endDocument@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?docPI@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0@Z
?docComment@AbstractDOMParser@xercesc_2_8@@UAEXQB_W@Z
?docCharacters@AbstractDOMParser@xercesc_2_8@@UAEXQB_WI_N@Z
??0XercesDOMParser@xercesc_2_8@@QAE@QAVXMLValidator@1@QAVMemoryManager@1@QAVXMLGrammarPool@1@@Z
??0MemBufInputSource@xercesc_2_8@@QAE@QBEIQBD_NQAVMemoryManager@1@@Z
?setLoadExternalDTD@AbstractDOMParser@xercesc_2_8@@QAEX_N@Z
?setErrorHandler@XercesDOMParser@xercesc_2_8@@QAEXQAVErrorHandler@2@@Z
?parse@AbstractDOMParser@xercesc_2_8@@QAEXABVInputSource@2@@Z
?adoptDocument@AbstractDOMParser@xercesc_2_8@@QAEPAVDOMDocument@2@XZ
??1MemBufInputSource@xercesc_2_8@@UAE@XZ
?getColumnNumber@SAXParseException@xercesc_2_8@@QBEJXZ
?getLineNumber@SAXParseException@xercesc_2_8@@QBEJXZ
??1MemBufFormatTarget@xercesc_2_8@@UAE@XZ
?flush@XMLFormatTarget@xercesc_2_8@@UAEXXZ
?writeChars@MemBufFormatTarget@xercesc_2_8@@UAEXQBEIQAVXMLFormatter@2@@Z
?getDOMImplementation@DOMImplementationRegistry@xercesc_2_8@@SAPAVDOMImplementation@2@PB_W@Z
?fgMemoryManager@XMLPlatformUtils@xercesc_2_8@@2PAVMemoryManager@2@A
?fgDOMWRTSplitCdataSections@XMLUni@xercesc_2_8@@2QB_WB
?fgDOMWRTDiscardDefaultContent@XMLUni@xercesc_2_8@@2QB_WB
?fgDOMWRTFormatPrettyPrint@XMLUni@xercesc_2_8@@2QB_WB
?fgDOMWRTBOM@XMLUni@xercesc_2_8@@2QB_WB
??2XMemory@xercesc_2_8@@SAPAXI@Z
??0MemBufFormatTarget@xercesc_2_8@@QAE@HQAVMemoryManager@1@@Z
?getRawBuffer@MemBufFormatTarget@xercesc_2_8@@QBEPBEXZ
??3XMemory@xercesc_2_8@@SAXPAX@Z
?Terminate@XMLPlatformUtils@xercesc_2_8@@SAXXZ
?fgXercescDefaultLocale@XMLUni@xercesc_2_8@@2QBDB
?Initialize@XMLPlatformUtils@xercesc_2_8@@SAXQBD0QAVPanicHandler@2@QAVMemoryManager@2@_N@Z
??_7ErrorHandler@xercesc_2_8@@6B@
hugin
h_domain_delete
h_domain_get_attribute
h_node_retract_findings
h_node_enter_finding
h_node_get_entered_finding
h_domain_compile
h_net_parse_from_string
h_domain_get_node_by_name
h_error_description
h_domain_initialize
h_domain_get_first_node
h_node_get_next
h_node_evidence_is_entered
h_node_get_number_of_states
h_node_get_children
h_node_get_parents
h_node_get_name
h_node_get_label
h_node_get_state_label
h_node_get_attribute
h_node_get_belief
h_node_select_state
h_node_set_user_data
h_error_code
h_domain_propagate
Sections
.text Size: 376KB - Virtual size: 376KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 73KB - Virtual size: 78KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ