Static task
static1
Behavioral task
behavioral1
Sample
8665e1a967eac92d02126753ded5c9c9c3a7cfeb19af4d8c009cbaf4889f9694.exe
Resource
win7-20220812-en
General
-
Target
8665e1a967eac92d02126753ded5c9c9c3a7cfeb19af4d8c009cbaf4889f9694
-
Size
461KB
-
MD5
4bfe5b1835eb3f76bf7b5e736908a750
-
SHA1
85216c1ff202059d3d1a9ac9e4afc8b481a9bbf2
-
SHA256
8665e1a967eac92d02126753ded5c9c9c3a7cfeb19af4d8c009cbaf4889f9694
-
SHA512
8e219996dbe177435bfe2a00b89be8ad010155116f961895d985b118ea4aa83d009cf5898b6d475f478d4e86dd1eea7ed9d9dd5500ad927c6b088cb2bc726dec
-
SSDEEP
6144:Unq6/ZvH02rc62UDRPkZeUeVvcyp2FpVLIb5W44k63AihhYB9br2V:URvH0+9ZUeqyp2F7LiS/YB9bCV
Malware Config
Signatures
Files
-
8665e1a967eac92d02126753ded5c9c9c3a7cfeb19af4d8c009cbaf4889f9694.exe windows x86
11047359a4d857b4889340fd91e59f64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetQueryOptionA
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
kernel32
EnterCriticalSection
LeaveCriticalSection
GetLastError
WideCharToMultiByte
lstrlenA
MultiByteToWideChar
GetTickCount
WaitForSingleObject
CreateThread
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
ReleaseMutex
LoadLibraryW
GetProcAddress
GetStdHandle
WriteConsoleW
GetLocalTime
SystemTimeToFileTime
CreateFileMappingW
VirtualQueryEx
GetThreadSelectorEntry
CreateFileA
SetFilePointer
WriteFile
DeleteFileW
SetUnhandledExceptionFilter
GetCurrentProcessId
ReadProcessMemory
ReadFile
GetModuleFileNameA
CreateFileW
GetCurrentThread
GetVersionExW
VirtualQuery
FreeLibrary
lstrlenW
lstrcpynW
DeviceIoControl
CopyFileW
GetFileSize
GetLogicalDrives
GetDriveTypeW
LocalFree
ProcessIdToSessionId
FindResourceExW
OutputDebugStringW
MapViewOfFileEx
GetFullPathNameW
GetCPInfo
IsDBCSLeadByte
RtlUnwind
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetStartupInfoA
GetCommandLineA
CreateDirectoryW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileType
ExitProcess
GetModuleHandleA
GetSystemTimeAsFileTime
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
TlsGetValue
Sleep
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
VirtualAlloc
VirtualFree
DeleteCriticalSection
GetPrivateProfileIntW
FlushInstructionCache
LoadResource
WritePrivateProfileStringW
GetCurrentProcess
InitializeCriticalSection
LockResource
IsProcessorFeaturePresent
SizeofResource
CreateMutexW
InterlockedDecrement
OpenMutexW
FindResourceW
GetCommandLineW
GetModuleFileNameW
SetLastError
RaiseException
InterlockedIncrement
CloseHandle
FindClose
FindFirstFileW
GetCurrentThreadId
CompareStringA
CompareStringW
LoadLibraryA
InterlockedCompareExchange
GetProcessHeap
HeapSize
GetDriveTypeA
GetConsoleOutputCP
WriteConsoleA
GetLocaleInfoW
IsValidLocale
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
SetEnvironmentVariableA
EnumSystemLocalesA
GetUserDefaultLCID
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetCurrentDirectoryA
SetStdHandle
GetDateFormatA
GetTimeFormatA
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
SetHandleCount
IsValidCodePage
GetOEMCP
HeapCreate
TlsFree
TlsSetValue
TlsAlloc
user32
UnregisterClassA
CallWindowProcW
DefWindowProcW
DestroyWindow
PostQuitMessage
GetMonitorInfoW
GetCursorPos
MonitorFromPoint
PostMessageW
IsWindow
SetTimer
KillTimer
LoadCursorW
GetClassInfoExW
RegisterClassExW
SetWindowLongW
DispatchMessageW
TranslateMessage
GetMessageW
CreateWindowExW
GetWindowLongW
advapi32
RegOpenKeyExW
IsTextUnicode
GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityInfo
SetEntriesInAclW
BuildExplicitAccessWithNameW
GetSecurityInfo
RegSetValueExW
ConvertSidToStringSidW
LookupAccountNameW
RegOpenKeyExA
RegQueryValueExA
RegQueryValueExW
RegCloseKey
RegCreateKeyExW
shell32
SHGetFolderPathW
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ole32
CoInitialize
CoCreateGuid
CoUninitialize
CoCreateInstance
shlwapi
PathFileExistsW
comctl32
ord17
ws2_32
setsockopt
shutdown
gethostbyname
sendto
WSACleanup
ntohs
recv
send
WSAAsyncGetHostByName
connect
WSAAsyncSelect
socket
inet_addr
inet_ntoa
htonl
closesocket
WSACancelAsyncRequest
WSAGetLastError
WSAStartup
htons
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
netapi32
NetApiBufferFree
Netbios
NetWkstaTransportEnum
Sections
.text Size: 292KB - Virtual size: 289KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE