Static task
static1
Behavioral task
behavioral1
Sample
AppInstallerFullTrustAppServiceClient.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
AppInstallerFullTrustAppServiceClient.exe
Resource
win10v2004-20220812-en
General
-
Target
c1426d62b4023121477b0d9972c2128b-sample.zip
-
Size
96KB
-
MD5
d20296706f806c863b5ddb66dc146ee4
-
SHA1
9cd871e9003e1e3d7733aa316917d2d77f6e1f21
-
SHA256
826814568fbf0e1414e9f31ec4c538a95cea0382d109a56013dbadf1924ded32
-
SHA512
152b5d24593f22c34edbe36dc188e76dd00010f94c150517860fac63126fcf2e5b09a5c0a5bfb6ba8632c7797484ba04d206176aecd41a64c9116a9069f3b430
-
SSDEEP
3072:SMuvLtBCXKRb+N9Eq/4z/180vyBDlGG8+ZZy:IZ8aRbELuN80KBDlGG8+Py
Malware Config
Signatures
Files
-
c1426d62b4023121477b0d9972c2128b-sample.zip.zip
Password: infected
-
AppInstallerFullTrustAppServiceClient.exe.exe windows x64
Password: infected
b023db32734eabd0c6b5a7d3ea65c2ad
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
api-ms-win-core-errorhandling-l1-1-0
SetLastError
GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
api-ms-win-core-string-l1-1-0
MultiByteToWideChar
api-ms-win-core-debug-l1-1-0
DebugBreak
OutputDebugStringW
IsDebuggerPresent
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
TerminateProcess
GetStartupInfoW
GetCurrentThreadId
GetCurrentProcessId
api-ms-win-core-localization-l1-2-0
FormatMessageW
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-synch-l1-1-0
CreateMutexExW
OpenSemaphoreW
CreateEventW
EnterCriticalSection
ReleaseMutex
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
WaitForSingleObject
WaitForSingleObjectEx
SetEvent
CreateEventExW
ReleaseSemaphore
ResetEvent
CreateSemaphoreExW
LeaveCriticalSection
api-ms-win-security-base-l1-1-0
CheckTokenMembership
api-ms-win-core-libraryloader-l1-2-0
GetModuleFileNameW
GetModuleHandleExW
FreeLibrary
GetModuleFileNameA
GetProcAddress
GetModuleHandleW
api-ms-win-core-registry-l1-1-0
RegGetValueW
api-ms-win-core-heap-l1-1-0
HeapAlloc
HeapFree
GetProcessHeap
shell32
ShellExecuteW
msvcp140
??Bid@locale@std@@QEAA_KXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
_Xtime_get_ticks
_Cnd_do_broadcast_at_thread_exit
_Thrd_sleep
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_frequency
_Query_perf_counter
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAPEA_WXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_unlock
_Mtx_lock
?_Throw_C_error@std@@YAXH@Z
_Mtx_destroy_in_situ
_Mtx_init_in_situ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
_CxxThrowException
memset
__C_specific_handler
_purecall
__std_exception_destroy
__std_exception_copy
__std_terminate
memmove
memcpy
__current_exception_context
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
abort
_get_wide_winmain_command_line
_invalid_parameter_noinfo
_exit
_errno
_invalid_parameter_noinfo_noreturn
_initterm_e
_configure_wide_argv
exit
terminate
_set_app_type
_c_exit
_initialize_wide_environment
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_beginthreadex
_initterm
api-ms-win-crt-string-l1-1-0
iswspace
api-ms-win-crt-heap-l1-1-0
_callnewh
malloc
free
_set_new_mode
api-ms-win-crt-convert-l1-1-0
wcstol
wcstoull
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
__stdio_common_vswprintf
fclose
fwrite
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
__stdio_common_vsnprintf_s
fgetc
fgetwc
ungetwc
ungetc
fputwc
api-ms-win-crt-time-l1-1-0
_localtime64_s
_time64
asctime_s
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedPushEntrySList
oleaut32
SetErrorInfo
GetErrorInfo
SysStringLen
SysAllocString
SysFreeString
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryW
Sections
.text Size: 118KB - Virtual size: 117KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 53KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 31KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 73KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ