Static task
static1
Behavioral task
behavioral1
Sample
8d284353d7821fd96eafb83d712c190fb28a0e06ed97d83c263ded7fc1a17c72.exe
Resource
win7-20220812-en
General
-
Target
8d284353d7821fd96eafb83d712c190fb28a0e06ed97d83c263ded7fc1a17c72
-
Size
185KB
-
MD5
38eeaf72b37f23ec43b17ccd12f65020
-
SHA1
f0023c30323ca544f498be80345d6cbde62a1c73
-
SHA256
8d284353d7821fd96eafb83d712c190fb28a0e06ed97d83c263ded7fc1a17c72
-
SHA512
956b62b3372157749deb8a49de5c9221d7839dda909e6d15b45b54fc840eb22ca641f06b1ec1de210d249409047525ac076fbfd877c4c572c48540244d4532e8
-
SSDEEP
3072:Qknv51+v1jjSBHi3EHCx+q5XmzgjrXe96BchEtv8nwbvuE/:5nv51+tjjSBHiIG+q8z1oBas8+Z/
Malware Config
Signatures
Files
-
8d284353d7821fd96eafb83d712c190fb28a0e06ed97d83c263ded7fc1a17c72.exe windows x86
35b8b55412f09fbe3d6457fbaac83ce1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42u
ord860
ord2822
ord927
ord2606
ord925
ord535
ord940
ord942
ord858
ord823
ord861
ord825
ord538
ord540
ord2810
ord800
msvcrt
wcsspn
_except_handler3
memcpy
wcscspn
__set_app_type
__p__fmode
__p__commode
_wcsicmp
wcstoul
wcscpy
_wtoi
wcscmp
_ftol
memcmp
_wtol
isspace
isalnum
_wcsdup
rand
iswdigit
strlen
malloc
free
__CxxFrameHandler
memset
wcsncpy
wcslen
_wcsnicmp
_controlfp
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
strcpy
sprintf
strcat
strrchr
strncpy
_acmdln
exit
_XcptFilter
__dllonexit
_onexit
_exit
kernel32
CreateFileMappingW
GetEnvironmentVariableW
OpenEventW
CreateEventW
WaitForSingleObject
CloseHandle
GetLastError
SetEvent
MapViewOfFile
UnmapViewOfFile
ResetEvent
OpenFileMappingW
lstrlenA
CreateMutexW
SetLastError
CreateProcessW
GetModuleHandleW
GetStartupInfoA
GetModuleHandleA
GetTempPathW
GetModuleFileNameA
GetVersionExW
CreateFileA
DeviceIoControl
CreateFileW
GetFileSize
DebugBreak
InterlockedDecrement
GetModuleFileNameW
OutputDebugStringW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CopyFileW
GetCurrentProcess
FlushInstructionCache
EnterCriticalSection
LeaveCriticalSection
DeleteFileW
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
GetTickCount
Sleep
LoadLibraryW
GetProcAddress
FreeLibrary
GetTempFileNameW
CreateThread
user32
PostQuitMessage
CharNextW
RegisterClassExW
LoadCursorW
UpdateWindow
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
FindWindowW
wvsprintfW
IsWindow
PostMessageW
GetClassInfoExW
wsprintfW
KillTimer
SetTimer
CallWindowProcW
GetWindowLongW
SetWindowLongW
SendMessageW
DestroyWindow
DefWindowProcW
ShowWindow
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
shell32
ShellExecuteExW
SHGetFolderPathW
ole32
CoTaskMemFree
CoInitialize
CreateBindCtx
CoTaskMemAlloc
CoUninitialize
oleaut32
SysFreeString
SysAllocString
urlmon
RevokeBindStatusCallback
RegisterBindStatusCallback
CreateURLMoniker
URLDownloadToFileW
msvcp60
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
wintrust
WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
crypt32
CertGetNameStringW
wininet
InternetOpenW
InternetOpenUrlW
InternetCloseHandle
HttpQueryInfoW
InternetCrackUrlW
shlwapi
PathRemoveFileSpecW
StrStrIW
PathFileExistsW
PathAppendW
PathFindFileNameW
StrCmpW
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE