Behavioral task
behavioral1
Sample
42de4f761e2dbd9cfd4c7e0fe72d518c96df1b96070d1941d6d99c0d1fb293f8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
42de4f761e2dbd9cfd4c7e0fe72d518c96df1b96070d1941d6d99c0d1fb293f8.exe
Resource
win10v2004-20220901-en
General
-
Target
42de4f761e2dbd9cfd4c7e0fe72d518c96df1b96070d1941d6d99c0d1fb293f8
-
Size
223KB
-
MD5
10e84fdd9727c7418d21e901e0317936
-
SHA1
3323a77388e9751a3dc62a7c0894a451717225cc
-
SHA256
42de4f761e2dbd9cfd4c7e0fe72d518c96df1b96070d1941d6d99c0d1fb293f8
-
SHA512
8040b44ffd946ee9d1c7ee7993b64ed368c9f9855ffe08b731338e38918a195a34273ed683d04d89ddf4a39e9fb779bf5234021c44cdeffa123d5cefd5395035
-
SSDEEP
6144:akk1I34X9th32HMgPuNfa6xdue5cRCxFk+h0SjQSbb:akk1I34tthvfawduwcMxFmyb
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
42de4f761e2dbd9cfd4c7e0fe72d518c96df1b96070d1941d6d99c0d1fb293f8.exe windows x86
74d2ccb3e108701dd2f13b16a6cd48af
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegQueryValueExW
RegCloseKey
RegConnectRegistryW
LookupAccountSidW
CloseServiceHandle
EnumServicesStatusExW
OpenSCManagerW
kernel32
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetLocaleInfoW
SetLastError
GetNumberFormatW
OpenProcess
InterlockedDecrement
GetLastError
GetCurrentThreadId
HeapSetInformation
InterlockedIncrement
LocalAlloc
lstrlenW
FormatMessageW
WriteConsoleW
GetStdHandle
GetTimeFormatW
GetModuleFileNameW
FileTimeToSystemTime
ExitProcess
GetCurrentProcess
SetConsoleMode
ReadFile
ReadConsoleW
HeapReAlloc
HeapFree
HeapSize
HeapAlloc
GetProcessHeap
HeapValidate
WideCharToMultiByte
MultiByteToWideChar
CompareStringA
GetThreadLocale
CompareStringW
lstrlenA
GetFileType
GetConsoleMode
VerSetConditionMask
VerifyVersionInfoW
SetThreadUILanguage
GetComputerNameExW
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
InterlockedCompareExchange
Sleep
InterlockedExchange
LocalFree
CloseHandle
FreeLibrary
GetConsoleOutputCP
msvcrt
wcstoul
wcstod
_vsnwprintf
fflush
fprintf
wcsstr
wcstol
_controlfp
_except_handler4_common
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_CxxThrowException
_wtoi64
_wcsicmp
free
_wcsdup
wcscpy_s
??2@YAPAXI@Z
??3@YAXPAX@Z
wcsrchr
__iob_func
wcschr
memset
memcpy
__CxxFrameHandler3
wcstok
_memicmp
_get_osfhandle
_errno
_fileno
user32
GetWindowThreadProcessId
EnumWindows
CloseDesktop
GetWindowTextW
CharUpperW
FindWindowExW
LoadStringW
GetWindowLongW
wsprintfW
EnumWindowStationsW
GetProcessWindowStation
OpenWindowStationW
SetProcessWindowStation
CloseWindowStation
EnumDesktopsW
GetWindow
IsHungAppWindow
SetThreadDesktop
OpenDesktopW
GetThreadDesktop
ntdll
RtlTimeToElapsedTimeFields
RtlLargeIntegerToChar
ole32
CoUninitialize
CoInitializeSecurity
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
CoInitializeEx
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
mpr
WNetGetLastErrorW
WNetAddConnection2W
WNetCancelConnection2W
oleaut32
SysAllocStringByteLen
VariantChangeType
VariantCopy
VariantInit
SysStringLen
SysFreeString
SysAllocString
VariantClear
secur32
GetUserNameExW
ws2_32
WSACleanup
FreeAddrInfoW
GetNameInfoW
GetAddrInfoW
WSAGetLastError
WSAStartup
framedynos
?Find@CHString@@QBEHPBG@Z
??4CHString@@QAEABV0@PBG@Z
??YCHString@@QAEABV0@ABV0@@Z
?GetBuffer@CHString@@QAEPAGH@Z
??4CHString@@QAEABV0@PBD@Z
?Left@CHString@@QBE?AV1@H@Z
?Mid@CHString@@QBE?AV1@H@Z
?Find@CHString@@QBEHG@Z
?Format@CHString@@QAAXPBGZZ
?Empty@CHString@@QAEXXZ
?GetBufferSetLength@CHString@@QAEPAGH@Z
?Mid@CHString@@QBE?AV1@HH@Z
??4CHString@@QAEABV0@ABV0@@Z
?Compare@CHString@@QBEHPBG@Z
?ReleaseBuffer@CHString@@QAEXH@Z
??1CHString@@QAE@XZ
??0CHString@@QAE@XZ
?GetData@CHString@@IBEPAUCHStringData@@XZ
?FindOneOf@CHString@@QBEHPBG@Z
netapi32
NetApiBufferFree
NetServerGetInfo
dbghelp
EnumerateLoadedModulesW64
shlwapi
StrStrIW
StrChrIW
StrStrW
StrChrW
Sections
.text Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE