Static task
static1
Behavioral task
behavioral1
Sample
c7340047d44aab6e778f216547b9b00e564fa408.exe
Resource
win10v2004-20220812-en
General
-
Target
c7340047d44aab6e778f216547b9b00e564fa408
-
Size
5.3MB
-
MD5
8948282798dd10fdd46063955715fd0d
-
SHA1
c7340047d44aab6e778f216547b9b00e564fa408
-
SHA256
485c044ad5f6ed033667b6064cd942fecf04c90f51245a8e8f8b3102126231b4
-
SHA512
404c08f3500bebfda7d22932c74e4f16b3ecadce015befb12904ad8d2dba09374bcd9bba545f174884be76f2b4553f962c37e26b1b479402fd53bf43f1e30516
-
SSDEEP
24576:cBYlL7raX1jxT7o2/2rPGwxncpJJJzbNZ4u+2YI4O8HkbyFa52yCmGyDsy5zIfOV:d9XyQGrRFrEVV/dx65q3TXborcU9
Malware Config
Signatures
Files
-
c7340047d44aab6e778f216547b9b00e564fa408.exe windows x86
fd147563eeac8e69af5082108533f974
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlCreateUnicodeString
ZwReadFile
RtlFreeHeap
RtlInitUnicodeString
ZwSetInformationFile
ZwCreateFile
isalpha
RtlNtStatusToDosError
ZwClose
NtAllocateLocallyUniqueId
ZwQueryInformationFile
ZwWriteFile
RtlDosPathNameToNtPathName_U
ceil
_stricmp
sprintf
strncmp
strstr
swprintf
memchr
_snprintf
strtol
_memicmp
strtoul
wcschr
RtlDosSearchPath_U
RtlExpandEnvironmentStrings_U
NtQueryAttributesFile
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtClose
RtlAllocateHeap
RtlSetEnvironmentVariable
wcsrchr
NtOpenKey
NtQueryValueKey
NtSetValueKey
NtResumeThread
NtWaitForMultipleObjects
RtlCreateUserProcess
RtlDestroyProcessParameters
NtCreateEvent
NtOpenProcess
RtlCreateProcessParameters
NtDeviceIoControlFile
NtUnloadDriver
NtCreateKey
NtLoadDriver
NtOpenFile
NtProtectVirtualMemory
RtlInitAnsiString
LdrGetProcedureAddress
LdrGetDllHandle
NtQuerySecurityObject
NtWriteFile
RtlCreateAcl
RtlFreeSid
RtlSetDaclSecurityDescriptor
NtFsControlFile
NtSetInformationFile
NtQueryInformationFile
NtQueryDirectoryFile
RtlAddAccessAllowedAce
NtWaitForSingleObject
RtlFreeUnicodeString
NtCreateFile
NtOpenDirectoryObject
RtlGetDaclSecurityDescriptor
RtlCompareUnicodeString
NtOpenProcessToken
NtQueryInformationToken
NtSetSecurityObject
RtlAllocateAndInitializeSid
RtlGetOwnerSecurityDescriptor
RtlGetCurrentDirectory_U
NtReadFile
RtlLengthSid
RtlCreateSecurityDescriptor
RtlSetOwnerSecurityDescriptor
NtQueryInformationProcess
NtSetInformationProcess
NtAdjustPrivilegesToken
LdrFindResource_U
LdrAccessResource
NtDelayExecution
_allmul
_chkstk
NtEnumerateValueKey
NtFlushKey
NtEnumerateKey
NtCreateSymbolicLinkObject
NtDeleteValueKey
RtlAppendUnicodeToString
RtlReAllocateHeap
RtlAppendUnicodeStringToString
NtDeleteKey
RtlFormatCurrentUserKeyPath
NtQuerySystemInformation
wcsncpy
vsprintf
wcsstr
NtQueryKey
NtQueryVolumeInformationFile
wcsncmp
RtlValidateHeap
sin
cos
tan
atan
_ftol
floor
sqrt
RtlFillMemory
RtlMoveMemory
RtlCreateUnicodeStringFromAsciiz
DbgPrint
NtDisplayString
_vsnprintf
RtlLeaveCriticalSection
RtlEnterCriticalSection
NtCancelIoFile
NtResetEvent
RtlInitializeCriticalSection
RtlDeleteCriticalSection
_aulldiv
_aullrem
RtlUnwind
NtQueryVirtualMemory
_CIpow
_alldiv
_allrem
_allshl
_allshr
_aullshr
Sections
.text Size: 995KB - Virtual size: 995KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.reloc Size: 65KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ