Behavioral task
behavioral1
Sample
591b1095f254edeee1cda90d37d1a80a44aa1448d2e6424088d52cf9d8430984.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
591b1095f254edeee1cda90d37d1a80a44aa1448d2e6424088d52cf9d8430984.exe
Resource
win10v2004-20220901-en
General
-
Target
591b1095f254edeee1cda90d37d1a80a44aa1448d2e6424088d52cf9d8430984
-
Size
952KB
-
MD5
1b36a567142b892f3dc5f48b6ad0c1f5
-
SHA1
9b20290488bb805c5061899c39b48c41bf34fc56
-
SHA256
591b1095f254edeee1cda90d37d1a80a44aa1448d2e6424088d52cf9d8430984
-
SHA512
53643d1b1d16d39c244f994685be55ecab7faed1a5cf84951ce2557c143316e746007d639ee3ed7a199c08f6273ab3481efd8edec695e23ef94b2de07ed8ef40
-
SSDEEP
24576:fGYiJh0lNU5NYR2VuK9R1plaBRjn7s8XYK5aXsro:fGY2h0lNaNYAVv9HGnfs8L8X
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
591b1095f254edeee1cda90d37d1a80a44aa1448d2e6424088d52cf9d8430984.exe windows x86
0e494a1507adac9022a7a40c5bb6986f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedIncrement
lstrcmpiA
GetCurrentThreadId
GetCommandLineA
InitializeCriticalSection
HeapDestroy
DeleteCriticalSection
lstrlenW
LeaveCriticalSection
EnterCriticalSection
MultiByteToWideChar
lstrlenA
GetShortPathNameA
GetModuleHandleA
SetCurrentDirectoryA
GetTickCount
ResetEvent
MapViewOfFileEx
OpenFileMappingA
CreateFileMappingA
UnmapViewOfFile
GetModuleFileNameA
ReadProcessMemory
GetThreadSelectorEntry
GetLastError
LoadLibraryA
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateEventA
CreateThread
WaitForSingleObject
GetCurrentProcessId
GetProcAddress
FreeLibrary
VirtualQueryEx
GetCurrentProcess
GetCurrentThread
CreateFileA
ReadFile
SetFilePointer
VirtualQuery
TlsSetValue
TlsFree
TlsAlloc
TlsGetValue
DeleteFileA
WritePrivateProfileStringA
SetErrorMode
SetUnhandledExceptionFilter
OpenProcess
Sleep
TerminateProcess
CloseHandle
InterlockedDecrement
GetStartupInfoA
SetEvent
user32
CharNextA
PostThreadMessageA
DispatchMessageA
GetMessageA
advapi32
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegDeleteKeyA
ole32
CoRevokeClassObject
StringFromCLSID
CoRegisterClassObject
CoInitialize
CoTaskMemFree
CoCreateInstance
CoUninitialize
oleaut32
SafeArrayUnaccessData
SysFreeString
LoadRegTypeLi
SafeArrayAccessData
SysStringLen
ws2_32
closesocket
htons
WSACleanup
recv
WSAGetLastError
__WSAFDIsSet
inet_ntoa
accept
listen
getpeername
ntohs
bind
socket
inet_addr
WSAStartup
gethostbyname
gethostname
htonl
ntohl
select
ioctlsocket
setsockopt
sendto
recvfrom
connect
send
msvcp60
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??0Init@ios_base@std@@QAE@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UAE@XZ
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??1Init@ios_base@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
msvcrt
memset
strlen
strrchr
__CxxFrameHandler
strncat
memcpy
_purecall
??2@YAPAXI@Z
memcmp
_CxxThrowException
strncpy
_beginthreadex
fclose
fwrite
fopen
fread
isdigit
_mbsnbcpy
_mbsrchr
_snprintf
_mbsnbcat
strftime
localtime
time
printf
fputc
_iob
srand
rand
strstr
atoi
memmove
_ftol
_mbslwr
calloc
free
_except_handler3
fgetc
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_strlwr
strcmp
wcstombs
imagehlp
StackWalk
SymGetModuleInfo
SymLoadModule
SymInitialize
SymSetOptions
SymFunctionTableAccess
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
iphlpapi
GetIfEntry
GetAdaptersInfo
wininet
InternetGetConnectedState
Sections
.text Size: 612KB - Virtual size: 608KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX Size: 240KB - Virtual size: 240KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE