Static task
static1
Behavioral task
behavioral1
Sample
91c1822ab5adef85c77aa222d89537f21e257766152db1a7706fd6ea421cb2d2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
91c1822ab5adef85c77aa222d89537f21e257766152db1a7706fd6ea421cb2d2.exe
Resource
win10v2004-20220812-en
General
-
Target
91c1822ab5adef85c77aa222d89537f21e257766152db1a7706fd6ea421cb2d2
-
Size
639KB
-
MD5
41796a5cc17ad136dcb1b5a90a2024e0
-
SHA1
f3f085e95100fdf0f1b8dd3f9d994bdfb6bfc892
-
SHA256
91c1822ab5adef85c77aa222d89537f21e257766152db1a7706fd6ea421cb2d2
-
SHA512
3492a5a4153f18bab7c5ee5b69c85a6399549e246edef65db58322c454565fd7c098f033c78cbb53225807b52668288c177f31b0b3280d0856ed0d9f689a9479
-
SSDEEP
12288:uuxtrfGeQdaTUPruFI3PEjso7lJr8/RPx60sTs5+dwmXKDtng:FnQg6um3PEjPXY/xx60sTqtRg
Malware Config
Signatures
Files
-
91c1822ab5adef85c77aa222d89537f21e257766152db1a7706fd6ea421cb2d2.exe windows x86
e01b8f98a733ba813c83ad3308aff221
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetGetCookieExW
InternetSetCookieExW
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
kernel32
GetFileSize
SetFilePointer
GetFileAttributesW
FindNextFileW
CopyFileW
GetPrivateProfileStringW
GetSystemDirectoryA
DeleteFileA
HeapAlloc
HeapFree
GetProcessHeap
CreateMutexW
OpenMutexW
ReadFile
DeviceIoControl
GetFullPathNameW
GetFullPathNameA
CreateFileA
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
QueryPerformanceCounter
InterlockedCompareExchange
UnlockFile
LockFile
GetTickCount
UnlockFileEx
GetSystemTimeAsFileTime
FormatMessageA
InitializeCriticalSection
LeaveCriticalSection
GetFileAttributesA
FlushFileBuffers
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingW
GetDiskFreeSpaceA
GetFileAttributesExW
DeleteCriticalSection
GetTempPathA
GetSystemTime
AreFileApisANSI
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
InitializeCriticalSectionAndSpinCount
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
GetConsoleMode
GetConsoleCP
GetDateFormatA
GetTimeFormatA
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
CreateToolhelp32Snapshot
GetModuleHandleA
Process32NextW
GetSystemInfo
Process32FirstW
GetTempPathW
GetEnvironmentVariableA
CreateFileW
RaiseException
TerminateProcess
GetExitCodeProcess
GetVersionExW
Sleep
WideCharToMultiByte
WriteFile
CreateProcessW
ExpandEnvironmentStringsW
LockResource
SetLastError
SizeofResource
GetModuleHandleW
LoadResource
FindResourceW
FindResourceExW
LocalSize
lstrlenW
LocalAlloc
FormatMessageW
GetProcAddress
FindClose
FindFirstFileW
LocalFree
DeleteFileW
GetEnvironmentVariableW
WaitForSingleObject
GetModuleFileNameW
InterlockedDecrement
CloseHandle
GetLastError
MultiByteToWideChar
lstrlenA
FreeLibrary
LoadLibraryW
GetCurrentProcess
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
GetLocaleInfoW
SetEnvironmentVariableA
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetTimeZoneInformation
VirtualAlloc
VirtualFree
HeapCreate
LCMapStringW
LCMapStringA
CompareStringW
GetCPInfo
CompareStringA
InterlockedIncrement
InterlockedExchange
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
HeapReAlloc
GetCurrentProcessId
ExitProcess
RtlUnwind
HeapDestroy
user32
IsWindow
GetClassNameW
EnumWindows
PostMessageW
wsprintfW
advapi32
RegCreateKeyExW
OpenProcessToken
DuplicateTokenEx
AddAccessAllowedAce
InitializeAcl
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
CryptHashData
CryptDestroyHash
CryptCreateHash
CryptReleaseContext
CryptAcquireContextW
CryptGetHashParam
RegSetValueExW
RegCloseKey
RegEnumKeyExW
RegFlushKey
RegOpenKeyExW
RegDeleteKeyW
RegQueryValueExW
GetTokenInformation
CreateProcessAsUserW
SetTokenInformation
ConvertStringSidToSidW
GetLengthSid
shell32
ShellExecuteExW
SHGetSpecialFolderPathW
ole32
CoCreateInstance
oleaut32
VariantClear
SysAllocStringByteLen
SysAllocString
SysStringLen
SysFreeString
shlwapi
UrlUnescapeW
PathFileExistsW
crypt32
CryptProtectData
Sections
.text Size: 474KB - Virtual size: 474KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 117KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ