Static task
static1
Behavioral task
behavioral1
Sample
c7aa2dfd51a187d786e2cc42bd51d24189197919cb74f3cc6475f20acf439bac.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c7aa2dfd51a187d786e2cc42bd51d24189197919cb74f3cc6475f20acf439bac.exe
Resource
win10v2004-20220812-en
General
-
Target
c7aa2dfd51a187d786e2cc42bd51d24189197919cb74f3cc6475f20acf439bac
-
Size
187KB
-
MD5
686d1243b23012c857d870fc553c93b9
-
SHA1
3b732ef6fce5813e9425fdd9024c079d068bd2aa
-
SHA256
c7aa2dfd51a187d786e2cc42bd51d24189197919cb74f3cc6475f20acf439bac
-
SHA512
8104b81ac3a4254cb57b9d61853518ef858a21ee0a33a9cf797aab305d92eeb4f6b27823ca83ee9f010313bbf4c725bc50e1d83cda52e1178988629c7bfb562d
-
SSDEEP
3072:pWtZgS3WdM/dxNSuVfbpFYDrOVBqI418VOQ+dqgs23Q7Me8Db5mz/e:wtZdmdUkuZpFYDrOVBqI418EMmqIf5m
Malware Config
Signatures
Files
-
c7aa2dfd51a187d786e2cc42bd51d24189197919cb74f3cc6475f20acf439bac.exe windows x86
01d4bb167deefbf0931ffeb64ebe8f46
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
common
??0CFmtString@@QAE@XZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
?InitPlatformFileSystem@Boot@Util@@YAHXZ
??1CTXBSTR@@QAE@XZ
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
??BCTXBSTR@@QBEPA_WXZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
??0CTXStringW@@QAE@ABV0@@Z
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
ord34
??9@YA_NABVCTXStringW@@PB_W@Z
??8@YA_NABVCTXStringW@@PB_W@Z
??0CTXStringW@@QAE@PA_W@Z
??1CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@PB_W@Z
?GetRegulatedTime@Time@Util@@YA_NAAJ@Z
?GetTime@CTXTime@@QBE_JXZ
?GetTickCount@CTXTime@@SA?AV1@XZ
??YCTXStringW@@QAEAAV0@_W@Z
??9@YA_NABVCTXStringW@@_W@Z
?Right@CTXStringW@@QBE?AV1@H@Z
?Replace@CTXStringW@@QAEH_W0@Z
??4CTXStringW@@QAEAAV0@PA_W@Z
??1CTXStringA@@QAE@XZ
??1CTXCommPack@@UAE@XZ
?GetBufferOut@CTXCommPack@@QAEHAAVCTXBuffer@@@Z
?AddWord@CTXCommPack@@QAEHGH@Z
??1CFmtString@@QAE@XZ
??0CTXCommPack@@QAE@XZ
?PropertyStr@CFmtString@@QAEHPB_W0@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
?DoFormat@CFmtString@@QAEPB_WPB_W@Z
??4CTXBSTR@@QAEAAV0@ABV0@@Z
??ICTXBSTR@@QAEPAPA_WXZ
?IsEmpty@CTXBSTR@@QAEHXZ
??0CTXBSTR@@QAE@PB_W@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
ord26
?AddTLV@CTXCommPack@@QAEHKABVCTXBuffer@@W4TXCommPackDataType@@@Z
?FlushLog@TXLog@@YAXXZ
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?PropertyDWord@CFmtString@@QAEHPB_WK0@Z
??0CTXBSTR@@QAE@XZ
?Format@CTXStringA@@QAAXPBDZZ
??0CTXStringA@@QAE@XZ
??M@YA_NABVCTXStringA@@0@Z
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?IsEmpty@CTXStringW@@QBE_NXZ
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
??1CTXThreadModel@@MAE@XZ
??0CTXThreadModel@@IAE@XZ
?WaitThread@CTXThreadModel@@QAEHK@Z
?GetAt@CTXStringW@@QBE_WH@Z
?GetLength@CTXStringW@@QBEHXZ
?Format@CTXStringW@@QAAXPB_WZZ
??M@YA_NABVCTXStringW@@0@Z
?StartThread@CTXThreadModel@@QAEHXZ
?Mid@CTXStringW@@QBE?AV1@HH@Z
?Left@CTXStringW@@QBE?AV1@H@Z
?Find@CTXStringW@@QBEHPB_WH@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
??ACTXStringW@@QBE_WH@Z
?ReleaseBuffer@CTXStringW@@QAEXH@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
?OnExitCoreCenter@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?ClearDeadQueue@Misc@Util@@YAXXZ
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
??0CTXBSTR@@QAE@ABV0@@Z
?AddFmtString@TXStringBundle@@YAXABVCFmtString@@@Z
??BCTXStringW@@QBEPB_WXZ
?AddByte@CTXCommPack@@QAEHE@Z
?OnUninitCom@Misc@Util@@YAXXZ
gf
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@0H@Z
?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z
afutil
?MessageBoxW@Misc@Util@@YAHPAUIGFFrame@@VCTXStringW@@1H@Z
comctl32
InitCommonControlsEx
kernel32
CreateMutexW
OpenMutexW
InitializeCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
SetEnvironmentVariableW
GetEnvironmentVariableW
GetModuleFileNameW
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
SetEvent
WriteFile
CreateFileW
lstrlenW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
GetLastError
WaitForSingleObject
Sleep
WritePrivateProfileStringW
DeleteFileW
CopyFileW
RemoveDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
GetCurrentProcessId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
EnterCriticalSection
RaiseException
CloseHandle
DeleteCriticalSection
MoveFileExW
LeaveCriticalSection
user32
PostMessageW
UnregisterClassA
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
MessageBoxW
shell32
SHGetSpecialFolderPathW
SHCreateDirectoryExW
ShellExecuteW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
oleaut32
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysFreeString
atl80
ord32
ord64
ord31
ord58
ord30
shlwapi
StrCmpIW
StrCmpW
msvcp80
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
msvcr80
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_initterm_e
_wtoi
??3@YAXPAX@Z
_CxxThrowException
free
??_V@YAXPAX@Z
memset
_time64
__CxxFrameHandler3
__wargv
__argc
_purecall
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
memcmp
__wgetmainargs
?terminate@@YAXXZ
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
_controlfp_s
Sections
.text Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE