Behavioral task
behavioral1
Sample
2d6177dbd955b9dba02ac1181be55eae69ddfb8d1e7f1aafff7fa727aa3d2d85.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2d6177dbd955b9dba02ac1181be55eae69ddfb8d1e7f1aafff7fa727aa3d2d85.exe
Resource
win10v2004-20220812-en
General
-
Target
2d6177dbd955b9dba02ac1181be55eae69ddfb8d1e7f1aafff7fa727aa3d2d85
-
Size
180KB
-
MD5
6346bd3270ab8467cec0df845826bf30
-
SHA1
d9679676a233481dd9cb22411620d1655c2df247
-
SHA256
2d6177dbd955b9dba02ac1181be55eae69ddfb8d1e7f1aafff7fa727aa3d2d85
-
SHA512
512a0535d936f177ab0465417257a74fd4b6196db306c7967a9558a0af3a7be8efb2ef6255ded36a27b1293aa5c55271696ddf6c11925a69ee95dfb85a5916be
-
SSDEEP
3072:fokifUJV1Kdeb4PVb95QMwhux8djIQ/MVqmkP2ES1QCu86oX3dRoyrjaT4V+EU0U:fofG1Kdeb4PVb95QXhux8djIQ/MVqmkT
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
2d6177dbd955b9dba02ac1181be55eae69ddfb8d1e7f1aafff7fa727aa3d2d85.exe windows x86
22a412379959b9308e7fbe9ed3638dde
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
MoveFileExA
LocalAlloc
GetCurrentThread
SetLastError
CreateFileA
SetEnvironmentVariableA
GetModuleHandleA
GetFileSize
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
SetFilePointer
SetEndOfFile
GetFileAttributesA
RemoveDirectoryA
GetCurrentProcess
CopyFileA
FindFirstFileA
FindNextFileA
FindClose
CreateProcessA
GetExitCodeProcess
Sleep
CloseHandle
WinExec
OpenFile
_lclose
SetFileAttributesA
DeleteFileA
GetFullPathNameA
SetCurrentDirectoryA
GetLastError
FormatMessageA
GetVersionExA
LocalFree
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
GetCurrentDirectoryA
GetComputerNameA
GetPrivateProfileStringA
GetStartupInfoA
user32
LoadStringA
wsprintfA
ExitWindowsEx
MessageBoxA
advapi32
InitializeSecurityDescriptor
OpenSCManagerA
OpenServiceA
CloseServiceHandle
ImpersonateSelf
OpenThreadToken
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
IsValidSecurityDescriptor
AccessCheck
RevertToSelf
FreeSid
RegDeleteValueA
RegEnumKeyExA
RegOpenKeyExA
RegQueryInfoKeyA
RegCloseKey
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
GetUserNameA
QueryServiceStatus
ControlService
RegQueryValueExA
DeleteService
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
setupapi
SetupDiGetDeviceInstanceIdA
SetupDiSetSelectedDevice
SetupDiGetClassDevsA
SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiRemoveDevice
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
sprintf
_mbsicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
_mbschr
_mbsrchr
toupper
_mbsstr
fprintf
sscanf
_mbsnbcpy
fgetc
vsprintf
rewind
fclose
tmpfile
fopen
_access
__CxxFrameHandler
strtoul
memmove
strchr
strstr
_except_handler3
_itoa
Sections
.text Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 104KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE