Static task
static1
Behavioral task
behavioral1
Sample
d57cd6b5ce93e14a44012f29f85ad1fbfa5705d6ae9d3a7506efe077604b2402.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d57cd6b5ce93e14a44012f29f85ad1fbfa5705d6ae9d3a7506efe077604b2402.exe
Resource
win10v2004-20220812-en
General
-
Target
d57cd6b5ce93e14a44012f29f85ad1fbfa5705d6ae9d3a7506efe077604b2402
-
Size
648KB
-
MD5
39d1977dced8389e4d89de1f26115d14
-
SHA1
ed9dfd0ad62567b62d61d009920e1b0aea80dd62
-
SHA256
d57cd6b5ce93e14a44012f29f85ad1fbfa5705d6ae9d3a7506efe077604b2402
-
SHA512
b376c93a1e4b6e2d10b00c338fc6b40c0df3633d4fb9d6fce26b27ab719244c13993fdfc7d1c40e195894e60540f8553ecd02b8ad9d90fd9e56dda7386c198df
-
SSDEEP
12288:whB5XNPIEZOAZ3YXQxYLSz3GQ0lKHH7AckRRyRNM:whB5zfYXIYL5QTEpE
Malware Config
Signatures
Files
-
d57cd6b5ce93e14a44012f29f85ad1fbfa5705d6ae9d3a7506efe077604b2402.exe windows x86
1f6a9b7f13125f130ed39be37481cfbd
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetStartupInfoA
GetHandleInformation
GetACP
VerLanguageNameW
Heap32ListNext
DuplicateConsoleHandle
GetSystemTime
IsValidLocale
GetLocalTime
GetProcAddress
VerLanguageNameA
DisableThreadLibraryCalls
LoadLibraryA
SetVolumeLabelA
GetVersion
GetModuleHandleA
VirtualAlloc
user32
GetDoubleClickTime
CreateIconIndirect
AnyPopup
UnregisterHotKey
EnumDesktopsW
GetInputDesktop
LookupIconIdFromDirectory
SetProcessDefaultLayout
CharLowerBuffA
ReplyMessage
CharToOemBuffA
EnumPropsW
SetWindowsHookExW
SendInput
SendMessageTimeoutA
GetMenuState
GetKBCodePage
SendDlgItemMessageW
CountClipboardFormats
CopyRect
GetClassNameA
PostThreadMessageW
GetMenuItemInfoW
SystemParametersInfoW
SetRectEmpty
GetClassInfoExW
EnumDisplaySettingsExA
GetWindowPlacement
GetWindow
IsCharUpperA
ChangeDisplaySettingsW
EndMenu
VkKeyScanExW
SendMessageCallbackW
ChangeMenuW
EnumDisplaySettingsW
RealChildWindowFromPoint
SetCapture
FlashWindowEx
ClientToScreen
EnumClipboardFormats
IntersectRect
EnumWindows
IsWindow
RegisterDeviceNotificationW
PostQuitMessage
GetActiveWindow
SetScrollRange
UnionRect
DefMDIChildProcW
SetProcessWindowStation
DlgDirListComboBoxA
SetCaretPos
GetDlgItemInt
ToAsciiEx
RegisterWindowMessageW
CreateAcceleratorTableA
CheckMenuRadioItem
CreateDialogIndirectParamA
OpenWindowStationA
DefWindowProcA
RegisterClipboardFormatA
OemToCharBuffA
GetUpdateRgn
advapi32
RemoveUsersFromEncryptedFile
LsaDeleteTrustedDomain
SystemFunction015
ConvertAccessToSecurityDescriptorW
GetTrusteeNameW
AbortSystemShutdownA
SystemFunction032
SystemFunction003
LsaCreateTrustedDomain
ImpersonateLoggedOnUser
LsaFreeMemory
GetCurrentHwProfileW
AccessCheckByTypeResultList
LsaQuerySecurityObject
LookupAccountSidA
ElfReadEventLogA
LookupPrivilegeValueW
LookupPrivilegeDisplayNameW
LsaQueryTrustedDomainInfoByName
DecryptFileW
ReadEventLogW
ClearEventLogW
GetAccessPermissionsForObjectW
CryptDeriveKey
LookupPrivilegeValueA
AccessCheckByTypeAndAuditAlarmW
GetSidLengthRequired
CancelOverlappedAccess
CryptAcquireContextA
AddAccessAllowedAceEx
RegisterEventSourceA
BuildImpersonateTrusteeW
GetExplicitEntriesFromAclW
CryptDecrypt
GetFileSecurityA
RegOpenKeyExW
SystemFunction002
CreateProcessAsUserW
InitializeAcl
CryptGetHashParam
InitiateSystemShutdownA
LsaLookupSids
IsValidSecurityDescriptor
OpenServiceW
MakeSelfRelativeSD
ConvertStringSidToSidW
SetNamedSecurityInfoExA
SetServiceStatus
AreAnyAccessesGranted
GetTrusteeTypeA
SetSecurityInfoExW
ElfBackupEventLogFileA
LsaRemoveAccountRights
RegSaveKeyA
RegSetValueW
ChangeServiceConfig2W
LookupSecurityDescriptorPartsW
ElfCloseEventLog
SystemFunction006
CryptSignHashA
QueryServiceLockStatusW
LsaICLookupNames
AllocateLocallyUniqueId
LsaClearAuditLog
SetFileSecurityA
OpenBackupEventLogA
ConvertSecurityDescriptorToAccessW
OpenSCManagerW
ElfClearEventLogFileW
CryptDuplicateKey
SystemFunction018
SystemFunction028
GetNamedSecurityInfoA
StartServiceW
SetSecurityDescriptorSacl
GetSidIdentifierAuthority
I_ScSetServiceBitsW
GetSecurityDescriptorGroup
DuplicateToken
GetEffectiveRightsFromAclW
CryptVerifySignatureA
ElfOpenBackupEventLogA
RegSetKeySecurity
RegQueryMultipleValuesA
SystemFunction031
QueryServiceConfig2W
GetPrivateObjectSecurity
CryptGetProvParam
PrivilegeCheck
LsaSetDomainInformationPolicy
BuildTrusteeWithSidW
LsaEnumeratePrivilegesOfAccount
LsaQueryTrustedDomainInfo
comctl32
ImageList_GetIconSize
ord15
CreatePropertySheetPageA
ImageList_LoadImageA
gdi32
CreateFontW
GetTextExtentPoint32A
GetROP2
GetCurrentPositionEx
SetColorAdjustment
GetCharacterPlacementA
LineDDA
SetBrushOrgEx
FillPath
SelectClipRgn
SetMiterLimit
CloseMetaFile
GetTextCharacterExtra
GetDCPenColor
ScaleWindowExtEx
SetDIBitsToDevice
EnumFontsA
CreateScalableFontResourceW
WidenPath
CreatePolygonRgn
PtVisible
PolyTextOutW
Escape
ChoosePixelFormat
GdiPlayPrivatePageEMF
EnableEUDC
GetEnhMetaFileW
CreateDIBSection
GetCharABCWidthsA
SetPixel
ExtFloodFill
GetPolyFillMode
GetFontAssocStatus
CreateBitmap
GetBkColor
GetMetaRgn
PatBlt
StrokeAndFillPath
GetCharWidthFloatA
SetRelAbs
GetBrushOrgEx
GetColorSpace
PaintRgn
GetColorAdjustment
InvertRgn
SetViewportExtEx
GdiStartDocEMF
SetWindowOrgEx
SetBkMode
GetRegionData
GetSystemPaletteUse
GetStockObject
Polygon
SwapBuffers
GetFontResourceInfoW
GetCharacterPlacementW
SelectBrushLocal
PolyPolygon
GetPixelFormat
GetCharWidth32W
SetPolyFillMode
GetStretchBltMode
FrameRgn
ColorCorrectPalette
GetClipRgn
GetDCOrgEx
PolyBezier
OffsetWindowOrgEx
GdiSetBatchLimit
opengl32
wglUseFontBitmapsA
wglCreateContext
glBitmap
glGetLightfv
glIndexsv
glIndexd
glTexCoord1sv
glRenderMode
glGetIntegerv
glColor4us
GlmfInitPlayback
glNormal3b
glGenLists
glMapGrid1d
glEnable
glCopyPixels
glLightModelfv
glNormal3i
glGetFloatv
glNormal3bv
glLoadName
glGetTexParameterfv
glGenTextures
glStencilOp
glHint
glCopyTexSubImage2D
glTexGenfv
glLineStipple
glRasterPos4fv
glTexCoord4i
glColor3usv
glLightfv
glRectsv
wglGetCurrentDC
glVertex3f
glIndexfv
glIndexf
glDrawBuffer
glPushClientAttrib
glClipPlane
glFogf
glPopName
glCopyTexImage2D
glVertex2d
glColor3uiv
glColor3ub
glDeleteLists
glNewList
glEvalCoord1f
glMap1f
glColorPointer
glRasterPos2i
glColor3sv
glVertex3i
glTexCoord2f
glMaterialf
glTexCoord4d
glPopClientAttrib
glTexCoord4dv
glColor3us
glTexGend
glTranslated
glTexEnvf
glMapGrid2d
glTexCoord3iv
glRasterPos3f
glIndexub
glColor3f
glIndexs
glGetLightiv
glTexEnviv
glTexCoord4iv
glRasterPos2f
glInitNames
glGetTexGendv
shell32
StrNCmpW
RegenerateUserEnvironment
StrRChrA
ShellExecuteExA
SheGetDirA
FindExecutableA
InternalExtractIconListW
DragQueryFileA
RealShellExecuteExA
StrNCmpA
SHGetFileInfoA
ExtractAssociatedIconExW
StrStrIA
SHGetSettings
StrCmpNW
ExtractAssociatedIconW
SHQueryRecycleBinA
DoEnvironmentSubstA
ShellHookProc
StrRStrIA
SheChangeDirExW
StrCmpNA
StrChrW
CheckEscapesW
DragQueryFileAorW
SHGetDesktopFolder
ExtractAssociatedIconExA
InternalExtractIconListA
SHBrowseForFolderA
SHFileOperationA
DragFinish
SHEmptyRecycleBinA
SHFreeNameMappings
SHBrowseForFolderW
SHAppBarMessage
DragAcceptFiles
StrRChrW
ShellExecuteW
ShellAboutA
ExtractIconW
SHFileOperationW
SheSetCurDrive
StrChrA
SHGetSpecialFolderPathA
SHUpdateRecycleBinIcon
SHGetSpecialFolderPathW
SHGetFileInfoW
Shell_NotifyIconW
ord180
StrNCmpIA
SHGetPathFromIDListA
Shell_NotifyIconA
SHGetMalloc
ShellAboutW
SHGetSpecialFolderLocation
SHFormatDrive
SHGetDiskFreeSpaceA
FreeIconList
SHGetDataFromIDListW
StrChrIW
SHInvokePrinterCommandA
SHGetInstanceExplorer
CommandLineToArgvW
DuplicateIcon
StrCmpNIA
ExtractAssociatedIconA
SHAddToRecentDocs
StrRStrW
ord179
ExtractIconExA
StrRChrIW
SHGetPathFromIDListW
ShellExecuteExW
SHChangeNotify
StrNCmpIW
StrStrW
WOWShellExecute
SHQueryRecycleBinW
FindExecutableW
StrStrIW
ExtractIconExW
SHInvokePrinterCommandW
StrStrA
RealShellExecuteExW
StrChrIA
SHLoadInProc
StrCmpNIW
StrRChrIA
DoEnvironmentSubstW
SHEmptyRecycleBinW
shlwapi
SHQueryValueExA
PathIsPrefixW
PathIsRootW
PathCompactPathA
PathCanonicalizeW
PathSkipRootA
UrlCombineA
SHSetValueW
PathRemoveExtensionA
PathCanonicalizeA
UrlUnescapeA
PathMakePrettyW
PathRemoveFileSpecA
SHDeleteEmptyKeyA
PathCombineW
SHRegEnumUSValueA
SHRegQueryInfoUSKeyW
PathRemoveBackslashW
StrCSpnA
PathCompactPathW
PathStripToRootA
PathRemoveBlanksA
UrlApplySchemeA
PathIsContentTypeA
SHRegGetUSValueA
UrlEscapeA
StrToIntW
SHRegGetBoolUSValueW
UrlIsW
SHRegWriteUSValueA
PathStripPathA
UrlCreateFromPathA
PathRemoveBlanksW
PathGetDriveNumberA
SHRegDeleteUSValueW
SHRegSetUSValueW
PathCreateFromUrlA
PathCombineA
PathSkipRootW
PathAppendW
PathSearchAndQualifyW
UrlIsOpaqueA
PathGetArgsW
PathMakeSystemFolderA
UrlGetLocationW
SHRegCreateUSKeyW
SHRegEnumUSKeyA
SHEnumKeyExA
PathFindFileNameW
StrDupA
SHRegQueryUSValueA
UrlGetPartA
SHOpenRegStreamA
PathIsSameRootA
UrlUnescapeW
PathParseIconLocationW
SHEnumValueA
PathAddExtensionA
PathRemoveArgsA
PathQuoteSpacesA
StrNCatW
SHEnumKeyExW
PathGetArgsA
PathGetCharTypeW
StrCSpnIA
StrTrimA
PathIsUNCA
SHRegCreateUSKeyA
SHRegEnumUSKeyW
version
GetFileVersionInfoW
VerInstallFileA
GetFileVersionInfoA
VerQueryValueW
VerQueryValueA
GetFileVersionInfoSizeW
VerFindFileA
GetFileVersionInfoSizeA
VerFindFileW
VerInstallFileW
winspool.drv
AddPrintProvidorA
PrinterMessageBoxW
DeletePrinterConnectionW
AddPrintProvidorW
ConvertUnicodeDevModeToAnsiDevmode
ClosePrinter
QueryRemoteFonts
EnumPrinterDataA
FindClosePrinterChangeNotification
PrinterProperties
DevQueryPrintEx
CommitSpoolData
AddPrinterDriverExA
EnumFormsW
SetJobW
EnumPrintProcessorsA
WaitForPrinterChange
DeletePrinter
ord205
AddPrinterConnectionA
SetPrinterDataExW
StartDocDlgW
DeletePrintProcessorW
GetPrinterW
msvcrt
tolower
_onexit
__dllonexit
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
_mbsncpy
_mbsrchr
_wcsrev
printf
_strrev
_getmaxstdio
strtok
fprintf
getenv
__p__pgmptr
fputc
wcspbrk
ldexp
_i64toa
wctomb
__p__acmdln
_wenviron
_ismbbkana
localtime
_wcsdup
_sopen
fsetpos
_spawnl
sprintf
_mbsncoll
_fgetwchar
_mbctohira
_wcslwr
_CIexp
iswdigit
_ismbslead
rewind
fopen
_control87
frexp
strtol
memset
_CIpow
ferror
_wspawnlpe
_wctime
_wfindfirst
fclose
_fdopen
_getws
fwprintf
localeconv
getwchar
_itow
asctime
_execl
_wtempnam
_getsystime
__fpecode
_ismbcalnum
feof
_execvp
_mbcjmstojis
_getdcwd
fread
_mbsncat
_wsearchenv
mblen
vfwprintf
__p__dstbias
fputs
_wpgmptr
_findfirst
_wfullpath
_unlink
wcstol
_findnext
fseek
ftell
fwrite
__threadhandle
fgetc
Sections
.text Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 568KB - Virtual size: 564KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE