Static task
static1
Behavioral task
behavioral1
Sample
3f66a9e90fd3dbe8d425e9a9a63fda14ff815fbadc65c8ea199a3c7c83440433.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3f66a9e90fd3dbe8d425e9a9a63fda14ff815fbadc65c8ea199a3c7c83440433.exe
Resource
win10v2004-20220901-en
General
-
Target
3f66a9e90fd3dbe8d425e9a9a63fda14ff815fbadc65c8ea199a3c7c83440433
-
Size
628KB
-
MD5
5b6d912622045282061fbf1d84b0b900
-
SHA1
c041a3f9e1e1acaaffa74928d9bae826518576a1
-
SHA256
3f66a9e90fd3dbe8d425e9a9a63fda14ff815fbadc65c8ea199a3c7c83440433
-
SHA512
9ccca3cf15e35cb7e4aa4ad59ed4e94729e09000174f600fc39c9237805fa2dfda9173896f8489c3ee7f0aca6f55ae825d7356ca89c19c331046e2a6e31fdd8e
-
SSDEEP
12288:bYlZN096VS6tNhSAfHyFeH92pt1ZwmbxrIQcXr2E:bz9JP11rIQcXr
Malware Config
Signatures
Files
-
3f66a9e90fd3dbe8d425e9a9a63fda14ff815fbadc65c8ea199a3c7c83440433.exe windows x64
2c849afccdd42fc5dc118826c4e87587
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
GetSidIdentifierAuthority
OpenProcessToken
GetSidSubAuthority
OpenThreadToken
GetSidSubAuthorityCount
GetTokenInformation
CopySid
ConvertStringSidToSidW
RegDeleteTreeW
RegEnumValueW
IsValidSid
RegOpenKeyExW
GetLengthSid
RegEnumKeyExW
ConvertSidToStringSidW
RegCloseKey
kernel32
GetCurrentProcess
GetCurrentThread
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
CompareStringOrdinal
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LocalFree
CloseHandle
LocalAlloc
GetLastError
GetCommandLineW
user32
MessageBoxW
LoadStringW
LoadIconW
PostMessageW
msvcrt
?terminate@@YAXXZ
__set_app_type
_fmode
__setusermatherr
_amsg_exit
_initterm
_acmdln
exit
_cexit
_ismbblead
_exit
_XcptFilter
__C_specific_handler
__getmainargs
??2@YAPEAX_K@Z
wcsncmp
??3@YAXPEAX@Z
_commode
memset
crypt32
CryptUpdateProtectedState
ole32
CoInitialize
CoUninitialize
comctl32
ord345
PropertySheetW
shell32
CommandLineToArgvW
netapi32
NetApiBufferFree
NetUserModalsGet
dui70
StrToID
?Click@Button@DirectUI@@SA?AVUID@@XZ
InitProcessPriv
UnInitProcessPriv
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?GetEncodedContentString@Element@DirectUI@@QEAAJPEAG_K@Z
UnInitThread
??0TaskPage@DirectUI@@QEAA@XZ
??1TaskPage@DirectUI@@UEAA@XZ
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QEAAJPEAUHINSTANCE__@@@Z
?PropSheet_SendMessage@TaskPage@DirectUI@@IEAA_JI_K_J@Z
?CreateDUICP@TaskPage@DirectUI@@EEAAJPEAVHWNDElement@2@PEAUHWND__@@1PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z
?CreateParserCP@TaskPage@DirectUI@@EEAAJPEAPEAVDUIXmlParser@2@@Z
?DestroyCP@TaskPage@DirectUI@@EEAAXXZ
InitThread
?OnListenedInput@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEAUInputEvent@2@@Z
?OnListenerDetach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z
?OnListenerAttach@TaskPage@DirectUI@@MEAAXPEAVElement@2@@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetLayoutPos@Element@DirectUI@@QEAAJH@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?SetMaxLength@Edit@DirectUI@@QEAAJH@Z
?LoadPage@TaskPage@DirectUI@@MEAAJPEAVHWNDElement@2@PEAUHINSTANCE__@@PEAPEAVElement@2@PEAPEAVDUIXmlParser@2@@Z
?InitPropSheetPage@TaskPage@DirectUI@@MEAAXPEAU_PROPSHEETPAGEW@@@Z
?OnQueryCancel@TaskPage@DirectUI@@MEAA_JXZ
?OnReset@TaskPage@DirectUI@@MEAA_JXZ
?OnListenedPropertyChanging@TaskPage@DirectUI@@MEAA_NPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
?LoadParser@TaskPage@DirectUI@@MEAAJPEAPEAVDUIXmlParser@2@@Z
?OnWizBack@TaskPage@DirectUI@@MEAA_JXZ
?OnWizFinish@TaskPage@DirectUI@@MEAA_JXZ
?OnWizNext@TaskPage@DirectUI@@MEAA_JXZ
?OnMessage@TaskPage@DirectUI@@MEAA_NI_K_JPEA_J@Z
?OnQueryInitialFocus@TaskPage@DirectUI@@MEAAPEAVElement@2@XZ
?OnListenedPropertyChanged@TaskPage@DirectUI@@MEAAXPEAVElement@2@PEBUPropertyInfo@2@HPEAVValue@2@2@Z
Sections
.text Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 55KB - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 556KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE