Behavioral task
behavioral1
Sample
bd17b4ed9cbee7f867a3aa371a1172c64be8afa4fa03b91c2aa6f1addf5ede8f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
bd17b4ed9cbee7f867a3aa371a1172c64be8afa4fa03b91c2aa6f1addf5ede8f.exe
Resource
win10v2004-20220812-en
General
-
Target
bd17b4ed9cbee7f867a3aa371a1172c64be8afa4fa03b91c2aa6f1addf5ede8f
-
Size
147KB
-
MD5
599cd33f865fc50d927365ab3134fb9a
-
SHA1
9bcd0425e4fcbabdf66782fc5aaf998ee4adb68d
-
SHA256
bd17b4ed9cbee7f867a3aa371a1172c64be8afa4fa03b91c2aa6f1addf5ede8f
-
SHA512
f2a1e50a45872e47ed64a9cbf5f674b8102c81bedc083f59d1f23d362799f6fbbed5a28fa724bb7c0911050988ad06c4a448e16d9422220be89efe5bfd9288d2
-
SSDEEP
3072:07esW1TAC3y2suAVcyN5J1nhx4YTniXt1QJtmjOdIrvA:07e3A0RqfN5bMSiXt1QujOdIr4
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
bd17b4ed9cbee7f867a3aa371a1172c64be8afa4fa03b91c2aa6f1addf5ede8f.exe windows x86
bcf0cc7568c82b0ea05b09c85a51b745
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
IsTextUnicode
TraceEvent
kernel32
GetProcessHeap
InterlockedIncrement
GetLastError
HeapDestroy
FreeLibrary
CloseHandle
SetEvent
WaitForSingleObject
DuplicateHandle
GetCurrentProcess
LocalFree
LocalAlloc
GetProcAddress
LoadLibraryW
GetCommandLineW
WriteFile
WideCharToMultiByte
GetConsoleOutputCP
WriteConsoleW
GetFileType
GetStdHandle
CreateEventW
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
GetModuleHandleW
SetLastError
FormatMessageW
WaitForMultipleObjects
ReadFile
GetConsoleCP
ReadConsoleW
CreateThread
ExitProcess
LoadLibraryExW
CancelIoEx
SetStdHandle
WriteConsoleInputA
SetConsoleMode
GetConsoleMode
InterlockedExchange
InterlockedCompareExchange
DeleteCriticalSection
SetConsoleCtrlHandler
InitializeCriticalSection
HeapSetInformation
SetThreadPreferredUILanguages
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
Sleep
msvcrt
_controlfp
_except_handler4_common
?terminate@@YAXXZ
_onexit
_lock
_wcsnicmp
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
free
isdigit
_snwscanf_s
memset
_wcsicmp
_purecall
__CxxFrameHandler3
_strnicmp
malloc
memcpy
_vsnwprintf
user32
LoadStringA
LoadStringW
credui
CredUICmdLinePromptForCredentialsW
wsmsvc
WSManSetSessionOption
WSManCreateShell
WSManRunShellCommand
WSManReceiveShellOutput
WSManSignalShell
WSManSendShellInput
WSManCreateSession
WSManCloseCommand
WSManCloseShell
WSManCloseSession
WSManDeinitialize
?Free@WSManMemory@@SGXPAXABVCallSite@TestSystem@@@Z
?Alloc@WSManMemory@@SGPAXIABVCallSite@TestSystem@@W4Mode@3@@Z
WSManInitialize
WSManCloseOperation
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE