Static task
static1
Behavioral task
behavioral1
Sample
562b0c142ee8d8ca4cb45011b23f004b16deadc6b8ca5da15a4ef9e740016d28.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
562b0c142ee8d8ca4cb45011b23f004b16deadc6b8ca5da15a4ef9e740016d28.exe
Resource
win10v2004-20220812-en
General
-
Target
562b0c142ee8d8ca4cb45011b23f004b16deadc6b8ca5da15a4ef9e740016d28
-
Size
556KB
-
MD5
a202360b9629e0a2691ce96bf079dfaf
-
SHA1
8c091425820ed13b3618da405682ff28a03426e1
-
SHA256
562b0c142ee8d8ca4cb45011b23f004b16deadc6b8ca5da15a4ef9e740016d28
-
SHA512
fefccdfc2ad699ed63c5b3790e3e448976a485c03560fb63b9e1a58b1172443f79209df3679e945ce4dab1a24c227174e5c4c4819c4b27f30e5dcecfd5aca2c6
-
SSDEEP
12288:Ojg1P32NbH9J76wNCGWmbNhzoZLHcWnRw6ehY83u0NgpwsO:d1PCTywRYRw6ehY8TSp1O
Malware Config
Signatures
Files
-
562b0c142ee8d8ca4cb45011b23f004b16deadc6b8ca5da15a4ef9e740016d28.exe windows x86
2006521e8e4894d690c509a480ae6593
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateDirectoryA
CreateRemoteThread
VirtualAllocEx
GetProcAddress
LoadLibraryW
GetFileSizeEx
CreateFileA
VerifyVersionInfoW
VerSetConditionMask
WaitForMultipleObjects
CloseHandle
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
MoveFileExA
WideCharToMultiByte
MultiByteToWideChar
GetTickCount
FreeLibrary
GetSystemDirectoryA
QueryPerformanceFrequency
SleepEx
FormatMessageW
SetLastError
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
LocalFree
GetProcessHeap
DeleteCriticalSection
HeapDestroy
HeapAlloc
CreateThread
HeapReAlloc
LoadLibraryA
Sleep
CreateToolhelp32Snapshot
OpenProcess
GetFullPathNameA
Module32Next
SetConsoleTitleA
PeekNamedPipe
WriteProcessMemory
GetLastError
HeapSize
GetModuleHandleA
InitializeCriticalSectionEx
GetCurrentProcess
HeapFree
GetModuleFileNameA
user32
GetWindowThreadProcessId
MessageBoxA
FindWindowA
shell32
ShellExecuteA
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?id@?$ctype@D@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPBD@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??Bid@locale@std@@QAEIXZ
?_Xbad_function_call@std@@YAXXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
urlmon
URLDownloadToFileA
rpcrt4
UuidToStringA
UuidCreate
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140
__std_terminate
__std_exception_destroy
__CxxFrameHandler3
strchr
strrchr
memcpy
strstr
memchr
memmove
memset
__current_exception_context
__current_exception
_CxxThrowException
_except_handler4_common
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
abort
_controlfp_s
_register_thread_local_exe_atexit_callback
_errno
_beginthreadex
_getpid
_resetstkoflw
_invalid_parameter_noinfo
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_c_exit
system
__sys_nerr
exit
__p___argc
__p___argv
__sys_errlist
terminate
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
_callnewh
free
realloc
malloc
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64
_localtime64_s
strftime
api-ms-win-crt-convert-l1-1-0
strtol
wcstombs
strtoul
atoi
strtod
strtoull
strtoll
api-ms-win-crt-stdio-l1-1-0
_close
__acrt_iob_func
fread
fwrite
_set_fmode
fputs
__stdio_common_vsscanf
_read
_popen
fclose
_lseeki64
feof
fseek
ftell
__stdio_common_vsprintf
fgets
__p__commode
_pclose
fputc
fflush
fopen
_write
_open
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
__setusermatherr
_fdopen
advapi32
CopySid
ConvertSidToStringSidA
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
GetTokenInformation
GetLengthSid
OpenProcessToken
IsValidSid
CryptImportKey
CryptEncrypt
normaliz
IdnToAscii
wldap32
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord217
ord143
ord301
ord45
ord200
crypt32
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertFreeCertificateChain
CertGetCertificateChain
ws2_32
gethostname
ioctlsocket
sendto
WSASetLastError
recvfrom
freeaddrinfo
getaddrinfo
setsockopt
htonl
accept
select
__WSAFDIsSet
WSACleanup
WSAStartup
WSAIoctl
socket
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
bind
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
WSAGetLastError
listen
recv
api-ms-win-crt-string-l1-1-0
strncpy
tolower
strpbrk
strncmp
strcspn
strspn
isupper
_strdup
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_stat64
_unlink
_access
_fstat64
bcrypt
BCryptGenRandom
Sections
.text Size: 438KB - Virtual size: 438KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 77KB - Virtual size: 77KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ