Static task
static1
Behavioral task
behavioral1
Sample
2dd72e062f7a4f385c5cccf00921f87e001b54c1bd8a2aa9f02b2f111e002d5e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2dd72e062f7a4f385c5cccf00921f87e001b54c1bd8a2aa9f02b2f111e002d5e.exe
Resource
win10v2004-20220901-en
General
-
Target
2dd72e062f7a4f385c5cccf00921f87e001b54c1bd8a2aa9f02b2f111e002d5e
-
Size
355KB
-
MD5
4c7421b2b5475f51cad70f601aa18a30
-
SHA1
1130ed5c318804a42cada44c3bbeecece8f426ff
-
SHA256
2dd72e062f7a4f385c5cccf00921f87e001b54c1bd8a2aa9f02b2f111e002d5e
-
SHA512
9abbb1d2e0ed087694d0303c6b78ac3f9de09bcf46ab63d03650a85062e0c29b56524a34956b9280c33c18a2db001606c762b06a8d12e42b66991f3de55e3997
-
SSDEEP
6144:muosMeBXlv6+bFXXuzFCTBqFzMDJO00q4McDN7I7t56joJRdi7E:muNMeBXlywnuZCTsFOb4Mcp7IJ56j46E
Malware Config
Signatures
Files
-
2dd72e062f7a4f385c5cccf00921f87e001b54c1bd8a2aa9f02b2f111e002d5e.exe windows x86
df9656b071d73c5b0e20baa8d6f5ca83
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
dbghelp
SymGetModuleInfoW
SymLoadModule
SymInitialize
SymSetOptions
SymCleanup
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenUrlA
psapi
GetModuleFileNameExW
GetModuleFileNameExA
comctl32
ImageList_Create
ImageList_ReplaceIcon
InitCommonControlsEx
tinyxml
?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z
?ToDocument@TiXmlDocument@@UAEPAV1@XZ
?ToDocument@TiXmlDocument@@UBEPBV1@XZ
?ToElement@TiXmlNode@@UAEPAVTiXmlElement@@XZ
?ToElement@TiXmlNode@@UBEPBVTiXmlElement@@XZ
?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ
?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ
?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ
?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ
??0TiXmlDocument@@QAE@XZ
?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ
?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ
?Clone@TiXmlDocument@@MBEPAVTiXmlNode@@XZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?Accept@TiXmlDocument@@UBE_NPAVTiXmlVisitor@@@Z
?Value@TiXmlNode@@QBEPBDXZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?GetText@TiXmlElement@@QBEPBDXZ
??1TiXmlDocument@@UAE@XZ
?Print@TiXmlDocument@@UBEXPAU_iobuf@@H@Z
?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z
?Attribute@TiXmlElement@@QBEPBDPBD@Z
?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ
kernel32
HeapDestroy
HeapReAlloc
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
DeviceIoControl
SetFileAttributesW
GetSystemTimeAsFileTime
GetCurrentProcess
GetProcessTimes
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
InitializeCriticalSection
MoveFileW
VirtualQuery
VirtualFree
VirtualAlloc
GetModuleHandleW
HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
HeapFree
GetTickCount
SetCurrentDirectoryW
lstrlenW
GetLastError
lstrcatW
DeleteFileW
CopyFileW
LoadLibraryW
FindFirstFileW
GetExitCodeProcess
FindNextFileW
VirtualQueryEx
TerminateProcess
FindClose
SetEvent
lstrcpyW
CreateFileA
WaitForSingleObject
CreateProcessW
SizeofResource
LockResource
LoadResource
FreeLibrary
FindResourceExW
OpenThread
ReadProcessMemory
FindResourceW
WriteProcessMemory
CreateThread
OpenProcess
MultiByteToWideChar
GlobalAlloc
GlobalLock
IsDBCSLeadByte
GlobalUnlock
GlobalFree
InterlockedIncrement
InterlockedDecrement
Sleep
WideCharToMultiByte
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
ResumeThread
FreeResource
CreateEventW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
WriteFile
DeleteCriticalSection
RaiseException
CreateDirectoryW
GetVersionExW
ReadFile
SetFilePointer
GetProcAddress
GetFileSize
GetModuleFileNameW
GetPrivateProfileSectionW
GetSystemDefaultLCID
GetPrivateProfileIntW
GetTempPathW
WritePrivateProfileStringW
GetThreadSelectorEntry
GetFileAttributesW
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
user32
GetClassInfoExW
DefWindowProcW
IsWindow
DestroyMenu
TrackPopupMenu
GetWindowThreadProcessId
GetMenuItemCount
CreatePopupMenu
ReleaseDC
BeginPaint
GetSysColorBrush
GetKeyState
DialogBoxParamW
SetDlgItemTextW
RegisterClassExW
EnableWindow
SetClipboardData
GetWindowTextW
SendDlgItemMessageW
EmptyClipboard
GetWindowTextLengthW
SetTimer
OpenClipboard
RegisterClipboardFormatW
CallWindowProcW
InvalidateRect
MapDialogRect
GetWindowRect
MapWindowPoints
DrawTextW
GetDC
SetWindowLongW
EndPaint
ClientToScreen
KillTimer
GetDesktopWindow
PostMessageW
EndDialog
DrawIconEx
GetDlgItem
GetClientRect
ShowWindow
LoadImageW
SetWindowPos
SetWindowTextW
SendMessageW
LoadIconW
CreateWindowExW
DestroyWindow
UnregisterClassA
CloseClipboard
GetWindow
gdi32
SetBkMode
DeleteObject
SelectObject
CreateFontW
GetStockObject
SetTextColor
advapi32
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
shell32
ord155
SHBindToParent
SHGetDesktopFolder
ShellExecuteW
SHGetFileInfoW
SHGetSpecialFolderPathW
ShellExecuteExW
ole32
CreateStreamOnHGlobal
DoDragDrop
OleUninitialize
OleInitialize
oleaut32
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SysAllocString
SysStringLen
gdiplus
GdipLoadImageFromStreamICM
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipCreateFromHDC
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDeleteGraphics
GdipDisposeImage
GdipCloneImage
GdipDrawImageRectI
GdipGetImageHeight
GdipGetImageWidth
shlwapi
PathFileExistsW
msvcp80
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
msvcr80
_wcslwr_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
wcsrchr
strchr
??_V@YAXPAX@Z
wcscmp
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??2@YAPAXI@Z
_mbslwr_s
_snprintf
_mbsstr
_time32
memcpy
srand
wcslen
memcpy_s
_purecall
memmove_s
??3@YAXPAX@Z
wcschr
_vscwprintf
_mbscmp
vswprintf_s
_vscprintf
vsprintf_s
free
__argc
__wargv
wcsncmp
swscanf
_invalid_parameter_noinfo
malloc
??0exception@std@@QAE@XZ
memset
strlen
_wcsicmp
memcmp
iswspace
strcmp
strtoul
_wfopen
fseek
ftell
fwrite
fclose
_lock
fprintf
_encode_pointer
__dllonexit
_unlock
wcscpy
wcscat
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
strncpy_s
tolower
isalnum
sprintf_s
_wtoi
wcsncpy
_time64
memmove
iswalnum
iswalpha
iswdigit
wcscat_s
wcscpy_s
_gmtime32
_snwprintf
fread
atoi
strrchr
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_beginthreadex
wcsstr
towlower
isspace
__CxxFrameHandler3
_mbsicmp
_mbschr
strncmp
_CxxThrowException
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
crypt32
CertGetNameStringW
wintrust
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain
iphlpapi
GetAdaptersAddresses
GetAdaptersInfo
netapi32
Netbios
Sections
.text Size: 136KB - Virtual size: 132KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 64KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE