Static task
static1
Behavioral task
behavioral1
Sample
17194b76ef773636b965b9876906931a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
17194b76ef773636b965b9876906931a.exe
Resource
win10v2004-20220812-en
General
-
Target
17194b76ef773636b965b9876906931a.exe
-
Size
1.4MB
-
MD5
17194b76ef773636b965b9876906931a
-
SHA1
a6a2ff22a5efcb6491d64a85933f1402156e6913
-
SHA256
84f656d0d857689361ab10c723c25eddb4bb52509cecbe1aca855948e1ece438
-
SHA512
95819ef0bf0f4582301795ff7b008c6286045a5304bdd6fd7082f5f22bc7954bdd67ee76f969f653b9bed54a4169fbaf5f1ac29163a2fb3b411fab44d76cd294
-
SSDEEP
12288:EuOAjqBXgJjNzVnZiijuuv2tHShIRku7dBfzvCgwuKM2ZZycN0WYYHOd:+BwJVJB2QhIyunfzBqdYRd
Malware Config
Signatures
Files
-
17194b76ef773636b965b9876906931a.exe.exe windows x86
fb8e74be801e0f8f96931303950d4085
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
ExpandEnvironmentStringsW
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameExW
GetConsoleCP
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetDateFormatW
GetDriveTypeW
GetEnvironmentStringsW
GetExitCodeProcess
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLocalTime
GetLocaleInfoW
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHandleCount
GetProcessHeaps
GetProcessId
GetProcessTimes
GetQueuedCompletionStatus
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempPathW
GetThreadContext
GetThreadId
GetThreadLocale
GetThreadPriority
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetUserDefaultLocaleName
GetVersion
GetVersionExW
GetWindowsDirectoryW
HeapCreate
HeapSetInformation
InitOnceExecuteOnce
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32GetPerformanceInfo
K32GetProcessMemoryInfo
K32QueryWorkingSetEx
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
EnumSystemLocalesEx
LoadLibraryW
LocalFree
LockFileEx
MapViewOfFile
MoveFileW
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
PostQueuedCompletionStatus
ProcessIdToSessionId
QueryDosDeviceW
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
ReadConsoleW
ReadFile
ReadProcessMemory
RegisterWaitForSingleObject
ReleaseSRWLockExclusive
ReleaseSemaphore
RemoveDirectoryW
ReplaceFileW
ResetEvent
ResumeThread
RtlCaptureContext
RtlCaptureStackBackTrace
RtlUnwind
SearchPathW
SetConsoleCtrlHandler
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFileAttributesW
SetFilePointerEx
SetHandleInformation
SetInformationJobObject
SetNamedPipeHandleState
SetProcessShutdownParameters
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
SignalObjectAndWait
SleepConditionVariableSRW
SleepEx
SuspendThread
SwitchToThread
SystemTimeToTzSpecificLocalTime
TlsSetValue
TransactNamedPipe
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UnlockFileEx
UnmapViewOfFile
UnregisterWaitEx
VirtualAllocEx
VirtualFree
VirtualFreeEx
VirtualProtectEx
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeW
WakeAllConditionVariable
Wow64GetThreadContext
WriteConsoleW
WriteFile
WriteProcessMemory
lstrlenW
CreateEventA
GetModuleFileNameA
HeapQueryInformation
HeapValidate
TlsFree
TlsGetValue
TlsAlloc
InterlockedFlushSList
TerminateProcess
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
EnumSystemLocalesW
EnterCriticalSection
EncodePointer
DuplicateHandle
DisconnectNamedPipe
DeleteFileW
DebugBreak
CreateSemaphoreW
CreateRemoteThread
CreateProcessW
CreateNamedPipeW
CreateMutexW
CreateJobObjectW
CreateIoCompletionPort
CreateFileW
CreateFileMappingW
CreateEventW
CreateDirectoryW
ConnectNamedPipe
CompareStringW
AssignProcessToJobObject
AcquireSRWLockExclusive
FreeConsole
GetSystemDefaultLCID
WideCharToMultiByte
MultiByteToWideChar
VirtualProtect
VirtualAlloc
GetTickCount
GetExitCodeThread
GetCurrentThreadId
CreateThread
WaitForMultipleObjects
Sleep
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
SetLastError
GetLastError
RaiseException
CloseHandle
LoadLibraryExW
DecodePointer
GetConsoleOutputCP
user32
GetProcessWindowStation
GetMessageW
FindWindowExW
DispatchMessageW
DestroyWindow
DefWindowProcW
CreateWindowStationW
CreateWindowExW
CreateDesktopW
CloseWindowStation
CloseDesktop
AllowSetForegroundWindow
GetMonitorInfoA
GetUserObjectInformationW
GetWindow
GetParent
SetWindowLongA
GetWindowThreadProcessId
PostMessageW
RegisterClassW
SendMessageTimeoutW
SetProcessDPIAware
UnregisterClassA
GetActiveWindow
IsWindow
SetWindowPos
EndDialog
GetClientRect
GetWindowRect
MessageBoxA
MapWindowPoints
GetWindowLongA
GetThreadDesktop
SetProcessWindowStation
TranslateMessage
UnregisterClassW
GetMessageA
DispatchMessageA
PostThreadMessageA
DialogBoxParamA
CharUpperA
CharNextA
CharNextW
MonitorFromWindow
advapi32
EventRegister
DuplicateTokenEx
DuplicateToken
CreateWellKnownSid
CreateRestrictedToken
CreateProcessAsUserW
CopySid
ConvertStringSidToSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
AccessCheck
EventUnregister
EventWrite
FreeSid
GetAce
GetKernelObjectSecurity
GetLengthSid
GetNamedSecurityInfoW
GetSecurityDescriptorSacl
GetSecurityInfo
GetSidSubAuthority
GetTokenInformation
ImpersonateLoggedOnUser
ImpersonateNamedPipeClient
InitializeSid
IsValidSid
LookupPrivilegeValueW
MapGenericMask
OpenProcessToken
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegDisablePredefinedCache
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RevertToSelf
SetEntriesInAclW
SetKernelObjectSecurity
SetSecurityInfo
SetThreadToken
SetTokenInformation
SystemFunction036
RegDeleteKeyA
RegOpenKeyExA
RegQueryInfoKeyA
EqualSid
shell32
SHGetKnownFolderPath
SHGetFolderPathW
CommandLineToArgvW
ole32
CoReleaseServerProcess
CoTaskMemRealloc
CoAddRefServerProcess
CoResumeClassObjects
CoRevokeClassObject
CoRegisterClassObject
CoInitializeEx
CoUninitialize
CoTaskMemFree
StringFromGUID2
CoCreateInstance
oleaut32
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
SysStringLen
SysAllocString
GetErrorInfo
VariantClear
VariantInit
SafeArrayDestroy
SysFreeString
shlwapi
PathMatchSpecW
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
winmm
timeGetTime
Sections
.text Size: 802KB - Virtual size: 802KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 357KB - Virtual size: 373KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 1024B - Virtual size: 777B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.00cfg Size: 512B - Virtual size: 270B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ