Static task
static1
Behavioral task
behavioral1
Sample
ec34dc6b4b7c52db6f93da0468f61db937ad657abe454c996677444cc400b9bd.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ec34dc6b4b7c52db6f93da0468f61db937ad657abe454c996677444cc400b9bd.exe
Resource
win10v2004-20220812-en
General
-
Target
ec34dc6b4b7c52db6f93da0468f61db937ad657abe454c996677444cc400b9bd
-
Size
481KB
-
MD5
6ab5dcd5175df5b7360d1c4107f502a0
-
SHA1
b6f883c328afd45440929958f74092454ce54c55
-
SHA256
ec34dc6b4b7c52db6f93da0468f61db937ad657abe454c996677444cc400b9bd
-
SHA512
442296c39a7930451f145bbeb1b120fcd2836ff53bb5dfcb6553e6cdda632ecf6c977d18e34e2577a1a9483cd6d13126283f638ec0d1b36f1110fb871e77348f
-
SSDEEP
6144:uGBBhu6HA6gs5Rv09ek/oVXCjb3/VrMjIb1tHHZ4VRsF8evSsQLH5Av:uGBi4auvmek/bbv5Mjy1tn+VRsPvSsPv
Malware Config
Signatures
Files
-
ec34dc6b4b7c52db6f93da0468f61db937ad657abe454c996677444cc400b9bd.exe windows x86
f121a10f1686cb44311aea2d0a39ef60
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
awesomium
?AwesomiumMain@@YAHPAUHINSTANCE__@@PATSandboxInterfaceInfo@sandbox@@PA_W@Z
kernel32
InterlockedExchange
SignalObjectAndWait
FreeLibrary
LoadLibraryW
WriteProcessMemory
MapViewOfFile
CreateFileMappingW
GetExitCodeProcess
GetThreadContext
AssignProcessToJobObject
InterlockedIncrement
InterlockedDecrement
UnregisterWaitEx
RegisterWaitForSingleObject
GetVersionExW
CreateJobObjectW
CreateMutexW
GetCurrentProcessId
GetModuleHandleW
VirtualFreeEx
VirtualAllocEx
VirtualProtectEx
CreateNamedPipeW
CreateProcessW
OpenEventW
SearchPathW
DebugBreak
lstrlenW
WideCharToMultiByte
VirtualQuery
GetProcAddress
GetCurrentDirectoryW
ReadProcessMemory
SuspendThread
GetModuleFileNameW
GetLongPathNameW
GetFileAttributesW
QueryDosDeviceW
InterlockedCompareExchange
SetFilePointer
CreateFileW
ReleaseMutex
WriteFile
OutputDebugStringA
GetModuleHandleA
Sleep
RaiseException
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
GetUserDefaultLCID
GetStringTypeA
GetLocaleInfoA
IsValidCodePage
GetOEMCP
GetACP
FlushFileBuffers
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
GetTimeZoneInformation
SetEnvironmentVariableA
HeapReAlloc
VirtualAlloc
HeapSize
QueryPerformanceCounter
VirtualFree
ResumeThread
LocalFree
PostQueuedCompletionStatus
DeleteCriticalSection
CreateIoCompletionPort
CreateEventW
CreateThread
GetCurrentThreadId
DuplicateHandle
ResetEvent
GetQueuedCompletionStatus
SetEvent
TerminateJobObject
CloseHandle
InitializeCriticalSection
GetLastError
SetLastError
WaitForSingleObject
SetInformationJobObject
LeaveCriticalSection
EnterCriticalSection
GetTickCount
TerminateProcess
GetCurrentProcess
EnumSystemLocalesA
IsValidLocale
ReadFile
LoadLibraryA
GetLocaleInfoW
CreateFileA
CompareStringA
CompareStringW
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetFileType
MultiByteToWideChar
GetCommandLineA
GetStartupInfoA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
RtlUnwind
GetSystemTimeAsFileTime
GetConsoleCP
GetConsoleMode
HeapAlloc
LCMapStringA
LCMapStringW
GetCPInfo
GetStringTypeW
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
user32
CloseWindowStation
MessageBoxW
GetUserObjectInformationW
GetThreadDesktop
SetProcessWindowStation
CreateDesktopW
GetProcessWindowStation
CreateWindowStationW
CloseDesktop
advapi32
RegOpenKeyExW
RegCreateKeyExW
SetEntriesInAclW
GetSecurityInfo
CreateWellKnownSid
CopySid
LookupPrivilegeValueW
GetTokenInformation
EqualSid
DuplicateToken
DuplicateTokenEx
CreateRestrictedToken
CreateProcessAsUserW
SetThreadToken
OpenProcessToken
ConvertStringSidToSidW
GetLengthSid
SetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetSecurityDescriptorSacl
SetSecurityInfo
RevertToSelf
RegDisablePredefinedCache
RegCloseKey
Sections
.text Size: 235KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 98KB - Virtual size: 98KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ