??4_Init_locks@std@@QAEAAV01@ABV01@@Z
Behavioral task
behavioral1
Sample
a1fce093d4f405a50884fb959e682162aa12bc2bed99b83bf8618d2a94f6af6f.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a1fce093d4f405a50884fb959e682162aa12bc2bed99b83bf8618d2a94f6af6f.exe
Resource
win10v2004-20220812-en
General
-
Target
a1fce093d4f405a50884fb959e682162aa12bc2bed99b83bf8618d2a94f6af6f
-
Size
836KB
-
MD5
08cffd80887dcf4720762d571fd55cd0
-
SHA1
7857b0373bf4cd3ca8e1ba8a788cae48dc4fd142
-
SHA256
a1fce093d4f405a50884fb959e682162aa12bc2bed99b83bf8618d2a94f6af6f
-
SHA512
85ceadc465f797a99982d5b76e13075cc890493b9992d9350f08bbdc502f1be7fe76b0b2d4e5cad28977e04fe23e1003c826d6e24a52bd8c421542f7d5e3b4f3
-
SSDEEP
12288:9e2npoiskW+o2Uesjc69ByMkTbLzInalJRdgHZoEXRs/4v+o:ciskW+D4c6sTHzqKP6vhs/I+
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
a1fce093d4f405a50884fb959e682162aa12bc2bed99b83bf8618d2a94f6af6f.exe windows x86
d91f590b0c5ec068f48074e5921a593f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
imm32
ImmReleaseContext
ImmGetDefaultIMEWnd
ImmDisableIME
ws2_32
htons
htonl
common
?ValidateBugReport@TXBugReport@@YAXXZ
?SetBugReportUin@TXBugReport@@YAXKPB_W@Z
?InitBugReport@TXBugReport@@YAXPB_W000GGKHHKKP6GHPAUtagBugReportInfo@1@PBD200PAPAXPAKPAX@Z@Z
kernel32
GetLocalTime
GetCurrentProcess
ExpandEnvironmentStringsW
SwitchToThread
InterlockedCompareExchange
SetEvent
LeaveCriticalSection
OpenFileMappingW
OpenEventW
InterlockedExchange
DeleteCriticalSection
ReadFile
GetTickCount
CreateDirectoryW
GetFileAttributesW
Sleep
GetSystemInfo
GetSystemDefaultLangID
TerminateProcess
GetShortPathNameW
OpenProcess
lstrcmpiW
InterlockedIncrement
InterlockedDecrement
VirtualQuery
LoadLibraryA
UnhandledExceptionFilter
GetStartupInfoW
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
RaiseException
WideCharToMultiByte
GetCurrentProcessId
EnterCriticalSection
GetSystemTimeAsFileTime
QueryPerformanceCounter
InitializeCriticalSection
IsDebuggerPresent
SetUnhandledExceptionFilter
GetModuleHandleW
lstrcpynW
lstrlenW
lstrcatW
SetDllDirectoryW
CreateMutexW
GetLastError
GetModuleFileNameW
GetCommandLineW
CloseHandle
FreeLibrary
FindResourceW
FindFirstFileW
SizeofResource
LockResource
LoadResource
GetVersionExW
GetLongPathNameW
FindResourceExW
FindNextFileW
FindClose
DeleteFileW
CopyFileW
GetUserDefaultUILanguage
GetLocaleInfoW
LoadLibraryW
GetDiskFreeSpaceExW
SetEndOfFile
GetCurrentThreadId
GetProcAddress
MulDiv
GlobalAlloc
GlobalLock
GlobalUnlock
FreeResource
GlobalReAlloc
GlobalFree
CreateFileW
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetFilePointer
WriteFile
SetLastError
user32
IsWindow
CallNextHookEx
GetClassInfoW
SetWindowsHookExW
UnhookWindowsHookEx
SetWindowLongW
InflateRect
FillRect
DrawTextW
GetClassNameW
GetClassInfoExW
GetSystemMetrics
DrawIconEx
UnionRect
GetMenuState
InvalidateRect
GetSystemMenu
IsRectEmpty
GetWindowTextW
BeginPaint
UpdateLayeredWindow
FindWindowExW
IsWindowVisible
GetWindowRect
GetActiveWindow
EndPaint
CreateCaret
SetWindowRgn
HideCaret
CallWindowProcW
ShowCaret
SystemParametersInfoW
GetWindowLongW
SetCursor
SendMessageTimeoutW
SetFocus
ClientToScreen
WindowFromPoint
ScreenToClient
GetCursorPos
GetParent
GetWindow
MapWindowPoints
GetSysColor
GetCaretPos
FindWindowA
MessageBoxW
RegisterClassExW
DefWindowProcW
GetKeyState
GetCapture
ReleaseCapture
SetCapture
IntersectRect
ReleaseDC
GetDC
OffsetRect
PtInRect
EqualRect
LoadCursorW
RegisterWindowMessageW
CopyRect
GetClientRect
CreateWindowExW
IsZoomed
LoadStringW
UnregisterClassA
GetMessageW
TranslateMessage
DispatchMessageW
DestroyIcon
SendMessageW
LoadImageW
FindWindowW
PostMessageW
SetWindowPos
SetForegroundWindow
DestroyWindow
ShowWindow
UpdateWindow
SetRect
SetTimer
SetCaretPos
KillTimer
PostQuitMessage
gdi32
GetTextExtentPoint32W
SetBkMode
CreateSolidBrush
GetObjectA
CombineRgn
ExtCreateRegion
GetDeviceCaps
GetObjectW
GetTextMetricsW
Rectangle
BitBlt
CreateCompatibleBitmap
CreateRectRgn
ExcludeClipRect
CreateFontIndirectW
GetStockObject
DeleteDC
SelectObject
CreateDIBSection
DeleteObject
CreateCompatibleDC
CreatePen
SetTextColor
advapi32
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegEnumKeyExW
RegFlushKey
RegQueryInfoKeyW
RegSetKeySecurity
RegGetKeySecurity
RegNotifyChangeKeyValue
RegEnumValueW
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyExW
RegDeleteValueW
shell32
ShellExecuteExW
SHGetPathFromIDListW
SHGetMalloc
SHGetFolderPathW
SHCreateDirectoryExW
ShellExecuteW
SHChangeNotify
SHGetSpecialFolderPathW
SHBrowseForFolderW
ole32
CoCreateInstance
CoUninitialize
CreateStreamOnHGlobal
CoInitialize
oleaut32
SysFreeString
SysAllocString
VariantClear
msvcp80
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_WI@Z
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?rbegin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?empty@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE_NXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
shlwapi
PathAppendW
StrStrIW
PathFileExistsW
PathRemoveFileSpecW
PathAddBackslashW
msvcr80
strchr
memcpy
_except_handler3
_i64toa_s
atoi
_atoi64
__CxxFrameHandler3
_controlfp_s
_invoke_watson
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
?terminate@@YAXXZ
memset
_time64
_vscwprintf_p
_vswprintf_p
wcsncmp
sprintf_s
_snwprintf_s
_wtoi64
_wtol
swprintf_s
isalpha
swscanf_s
_CxxThrowException
wcsncat_s
_memicmp
strrchr
fwrite
_vsnprintf_s
_snprintf_s
strncpy_s
fclose
fflush
tolower
_wcsdup
wcschr
_vsnwprintf_s
wcsncpy
_wsplitpath_s
memcpy_s
wcsrchr
malloc
wcsncpy_s
wcscpy_s
memmove_s
wcsstr
_wcsicmp
wcscat_s
free
realloc
__argc
__wargv
??_V@YAXPAX@Z
??0exception@std@@QAE@XZ
__RTDynamicCast
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??2@YAPAXI@Z
_purecall
??3@YAXPAX@Z
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
gdiplus
GdipCreateMatrix
GdipCreateHBITMAPFromBitmap
GdipDeleteMatrix
GdipCloneBitmapAreaI
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipTranslateMatrix
GdipRotateMatrix
GdipSetWorldTransform
GdipDrawImageRectRectI
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetTextRenderingHint
GdipSetStringFormatFlags
GdipCreateFontFromDC
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipCreateFontFromLogfontA
GdipDrawString
GdipMeasureString
GdipDeleteFont
GdipSetStringFormatTrimming
GdipDeleteBrush
GdipCreateSolidFill
GdipGraphicsClear
GdipCreateBitmapFromStream
GdipCreateBitmapFromFile
GdipGetImagePixelFormat
GdipDrawImageRectI
GdipDeleteGraphics
GdipFree
GdipAlloc
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipGetImageWidth
msimg32
AlphaBlend
psapi
GetModuleFileNameExW
GetProcessMemoryInfo
GetModuleBaseNameW
EnumProcesses
EnumProcessModules
comctl32
_TrackMouseEvent
InitCommonControlsEx
Exports
Exports
Sections
.text Size: 196KB - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 13B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 288KB - Virtual size: 285KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX Size: 244KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE