Behavioral task
behavioral1
Sample
7fafa64e2e6340f79e811dad5c7ac63edab64ae473b3930a47d122383fa858ff.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
7fafa64e2e6340f79e811dad5c7ac63edab64ae473b3930a47d122383fa858ff.exe
Resource
win10v2004-20220812-en
General
-
Target
7fafa64e2e6340f79e811dad5c7ac63edab64ae473b3930a47d122383fa858ff
-
Size
494KB
-
MD5
6277696edd215d0e3f16b770158d1baa
-
SHA1
9e1ec8a1c4795a040572c9ce0fe9a3a3536de869
-
SHA256
7fafa64e2e6340f79e811dad5c7ac63edab64ae473b3930a47d122383fa858ff
-
SHA512
cc9bf88847ba716e20da3f901f8faa24f4de916325d1b76b64f2c8c92615b61ea5d2c7a6550d7864b2632d5998f2abc6ddc23a65f2c64cd090a33e2b3b74a046
-
SSDEEP
6144:dsxm+QHH9FSgaEx18L3X4BuLHlNdpSKMaLDYwVPBXt34Sm4sdy4GV9Th+1sIUagJ:dsw+QH+gR0LFxTS4H6UtR
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
7fafa64e2e6340f79e811dad5c7ac63edab64ae473b3930a47d122383fa858ff.exe windows x86
9568be97a635354a409e5b38875082fa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
?terminate@@YAXXZ
_controlfp
??2@YAPAXI@Z
__CxxFrameHandler
swprintf
_ltow
_CxxThrowException
_wcsicmp
wcstok
??1type_info@@UAE@XZ
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
exit
_cexit
_XcptFilter
_exit
_c_exit
_wfreopen
_wtoi64
_i64tow
_kbhit
_filelength
_wremove
fputws
fprintf
fflush
fwprintf
wcsncpy
wcsncmp
fread
fseek
towlower
swscanf
wctomb
wcsstr
fgets
wcscmp
wcstoul
_wfopen
fwrite
fclose
_ftol
_getch
ceil
_wsystem
_wtoi
_itow
wcslen
??0exception@@QAE@ABV0@@Z
_iob
fgetws
sprintf
_wcsnicmp
wcscpy
_wtol
??3@YAXPAX@Z
msvcp60
??0out_of_range@std@@QAE@ABV01@@Z
??1out_of_range@std@@UAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0out_of_range@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIPBG@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?data@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0logic_error@std@@QAE@ABV01@@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEPAGXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
advapi32
RegCloseKey
RegOpenKeyExW
GetTokenInformation
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
kernel32
CompareFileTime
CreateEventW
CreateThread
SetEvent
WaitForSingleObject
DeleteFileW
GetCommandLineW
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
LocalAlloc
LoadLibraryW
FreeLibrary
GetProcAddress
GetWindowsDirectoryW
GetSystemDirectoryW
GetCurrentProcess
SetConsoleScreenBufferSize
GetConsoleMode
SetConsoleMode
ReadConsoleW
SetConsoleCursorPosition
WriteConsoleW
WideCharToMultiByte
GetFileTime
MultiByteToWideChar
GetComputerNameW
GetSystemDefaultUILanguage
GetConsoleScreenBufferInfo
FormatMessageW
GetStdHandle
GetFileType
lstrcatW
GetLocalTime
GetFileSizeEx
GetLastError
WriteFile
CreateFileW
SetFilePointer
SetLastError
CloseHandle
LocalFree
lstrcpynW
lstrcpyW
lstrlenW
GetCurrentThreadId
InterlockedDecrement
InterlockedIncrement
GetUserDefaultUILanguage
SetConsoleCtrlHandler
QueryPerformanceCounter
GetTickCount
GetModuleHandleA
lstrlenA
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
CompareStringW
CopyFileW
SetUnhandledExceptionFilter
ole32
CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstanceEx
CoCreateInstance
CoInitializeSecurity
oleaut32
SysStringLen
SysFreeString
SysAllocStringByteLen
VariantClear
SafeArrayGetElement
SafeArrayGetUBound
SafeArrayGetLBound
VariantInit
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
VariantChangeType
VariantCopy
SysStringByteLen
SafeArrayGetVartype
SysAllocString
user32
SetClipboardData
EmptyClipboard
OpenClipboard
LoadStringW
CloseClipboard
wsprintfW
CharUpperW
framedyn
?FindOneOf@CHString@@QBEHPBG@Z
?GetBuffer@CHString@@QAEPAGH@Z
?TrimRight@CHString@@QAEXXZ
?TrimLeft@CHString@@QAEXXZ
??0CHString@@QAE@PBG@Z
?Mid@CHString@@QBE?AV1@H@Z
??YCHString@@QAEABV0@ABV0@@Z
?GetData@CHString@@IBEPAUCHStringData@@XZ
?Left@CHString@@QBE?AV1@H@Z
?Find@CHString@@QBEHPBG@Z
??0CHString@@QAE@ABV0@@Z
??4CHString@@QAEABV0@PBG@Z
??0CHString@@QAE@XZ
??1CHString@@QAE@XZ
?Empty@CHString@@QAEXXZ
??YCHString@@QAEABV0@PBG@Z
??0CHString@@QAE@PBD@Z
??H@YG?AVCHString@@ABV0@PBG@Z
?Right@CHString@@QBE?AV1@H@Z
??4CHString@@QAEABV0@ABV0@@Z
?Format@CHString@@QAAXPBGZZ
shlwapi
StrStrIW
ws2_32
gethostbyname
WSACleanup
WSAStartup
inet_addr
secur32
GetUserNameExW
iphlpapi
IcmpSendEcho
IcmpCreateFile
IcmpCloseHandle
Sections
.text Size: 289KB - Virtual size: 289KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE