Static task
static1
Behavioral task
behavioral1
Sample
5a6890ef30b30011b76e10397ed515bc792bf858e306e1b7efeb8e2ac42fa481.exe
Resource
win7-20220901-en
General
-
Target
5a6890ef30b30011b76e10397ed515bc792bf858e306e1b7efeb8e2ac42fa481
-
Size
524KB
-
MD5
44ffcfc0c87ecef3fcf0b677f164e160
-
SHA1
24e6c5eb0cd23336c069703ceb40060332afef34
-
SHA256
5a6890ef30b30011b76e10397ed515bc792bf858e306e1b7efeb8e2ac42fa481
-
SHA512
519676c3801e0bc6f82acf20602e8ae9047e93c94b0f4c7d446206b67f164ef4073cd7105119a3384f5d801547ff687d3401de0afd384e9e1cdc9283e102e5f7
-
SSDEEP
12288:RZy7PC3lLlSZKi/EImNcswHEMTl2WAi5cyQvf/N:XEPC1xSZuImN3w34sJQvH
Malware Config
Signatures
Files
-
5a6890ef30b30011b76e10397ed515bc792bf858e306e1b7efeb8e2ac42fa481.exe windows x86
3a9ccdc0afbfe271de9f96a0987c9075
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetConsoleCtrlHandler
GetLastError
LocalFree
FormatMessageW
CreateFileW
CloseHandle
BackupRead
GetCurrentProcess
BackupSeek
CreateHardLinkW
SetFileTime
DeviceIoControl
FindClose
FindFirstFileW
DeleteFileW
RemoveDirectoryW
CreateDirectoryW
MoveFileW
GetShortPathNameW
GetLongPathNameW
SetFilePointer
SetEndOfFile
GetFileTime
ReadFile
FlushFileBuffers
GetDriveTypeW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetFileAttributesW
SetFileAttributesW
ExpandEnvironmentStringsW
FindNextFileW
GetVersionExW
GetModuleFileNameW
GetCurrentDirectoryW
GetFullPathNameW
SetErrorMode
FreeLibrary
LoadLibraryW
LoadLibraryExW
GetCurrentProcessId
Sleep
SetThreadPriority
GetCurrentThread
SetPriorityClass
SetCurrentDirectoryW
GetFullPathNameA
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
CreateThread
WaitForSingleObject
GetProcessAffinityMask
CreateEventW
CreateSemaphoreW
ReleaseSemaphore
ResetEvent
SetEvent
SystemTimeToFileTime
GetSystemTime
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
TzSpecificLocalTimeToSystemTime
WideCharToMultiByte
MultiByteToWideChar
CompareStringW
IsDBCSLeadByte
GetCPInfo
GetConsoleOutputCP
CreateFileA
WriteConsoleA
SetEnvironmentVariableA
GetLocaleInfoA
GetStringTypeW
WriteFile
WriteConsoleW
SetConsoleMode
ReadConsoleW
GetStdHandle
GetFileType
GetConsoleMode
GetCommandLineW
GetModuleHandleW
GetProcAddress
SetLastError
CompareStringA
GetFileInformationByHandle
GetStringTypeA
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapFree
HeapReAlloc
HeapAlloc
RtlUnwind
RaiseException
GetSystemTimeAsFileTime
ExitProcess
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapCreate
VirtualFree
VirtualAlloc
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
GetCurrentThreadId
InterlockedDecrement
GetModuleFileNameA
GetACP
GetOEMCP
IsValidCodePage
SetHandleCount
GetStartupInfoA
SetStdHandle
GetConsoleCP
HeapSize
LoadLibraryA
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
FreeEnvironmentStringsA
GetEnvironmentStrings
user32
CharUpperW
CharLowerW
MessageBeep
ExitWindowsEx
CharLowerA
LoadStringW
CharToOemBuffW
CharToOemA
OemToCharBuffA
OemToCharA
CharToOemBuffA
advapi32
RegQueryValueExW
RegCloseKey
SetFileSecurityW
GetFileSecurityW
GetSecurityDescriptorLength
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
RegOpenKeyExW
shell32
SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHFileOperationW
Sections
.text Size: 399KB - Virtual size: 399KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rmnet Size: 56KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE