Static task
static1
Behavioral task
behavioral1
Sample
5528817b2a2690206812a4186510c45746db2154c7d3ada3618345807b290f27.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5528817b2a2690206812a4186510c45746db2154c7d3ada3618345807b290f27.exe
Resource
win10v2004-20220812-en
General
-
Target
5528817b2a2690206812a4186510c45746db2154c7d3ada3618345807b290f27
-
Size
987KB
-
MD5
63605c997a4af5925b9c132cd0947160
-
SHA1
499b2383f920ecc4b0fffe6f1a21035f5f1c6e35
-
SHA256
5528817b2a2690206812a4186510c45746db2154c7d3ada3618345807b290f27
-
SHA512
00d15aa585dfd33bd7877827650642740057b39cd1a67a5e9fc5c030954d2cf3acf5d5c9fd7847ae5112e464cab6b55d523dbc83b2c4e6d388de9e1021df9423
-
SSDEEP
24576:nrs7EM2kMltkIVxdT9twVGQ26XH4qvIReK1odddGdBnyEj6kKZnBF:rySqNK7jyRB
Malware Config
Signatures
Files
-
5528817b2a2690206812a4186510c45746db2154c7d3ada3618345807b290f27.exe windows x86
2759e4feb225a01f456b1150752aa6c7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
EventRegister
EventUnregister
EventWrite
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
CheckTokenMembership
CreateWellKnownSid
ConvertSidToStringSidW
GetTokenInformation
OpenProcessToken
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegLoadMUIStringW
kernel32
CreateEventW
GetModuleFileNameW
ReadFile
WriteFile
CreateThread
GetFullPathNameW
FindClose
SetCurrentDirectoryW
FindFirstFileW
GetCurrentDirectoryW
CloseHandle
CreateFileW
HeapSetInformation
LocalFree
GetFileAttributesW
GetCommandLineW
FreeLibrary
GetProcAddress
ExpandEnvironmentStringsW
GetUserPreferredUILanguages
FindNextFileW
DeleteFileW
GetCurrentProcess
GetCurrentThread
GetTempPathW
RemoveDirectoryW
SetFileAttributesW
CreateDirectoryW
CopyFileW
GetTempFileNameW
LoadLibraryExW
GetSystemTime
MoveFileW
ConnectNamedPipe
CreateNamedPipeW
OpenEventW
HeapReAlloc
SetDllDirectoryW
CreateTimerQueueTimer
SetEvent
DeleteTimerQueueTimer
ResetEvent
GetTickCount64
InterlockedDecrement
TlsAlloc
GetLastError
TlsFree
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
GetFileInformationByHandle
FileTimeToLocalFileTime
FileTimeToDosDateTime
MultiByteToWideChar
WideCharToMultiByte
GetFileSizeEx
FindResourceW
LoadResource
LockResource
SizeofResource
GlobalAlloc
GlobalLock
FreeResource
GlobalUnlock
GlobalFree
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
InterlockedExchange
GetExitCodeProcess
WaitForSingleObject
WaitForMultipleObjects
HeapAlloc
GetProcessHeap
HeapFree
LoadLibraryW
InterlockedIncrement
InterlockedCompareExchange
TlsGetValue
GetCurrentThreadId
TlsSetValue
user32
UnhookWindowsHookEx
SetWindowsHookExW
GetFocus
EnableWindow
GetKeyState
CallNextHookEx
PostMessageW
CreateWindowExW
IsChild
GetSystemMetrics
SendMessageW
LoadImageW
IsWindow
ShowScrollBar
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
MessageBoxW
LoadStringW
SetForegroundWindow
GetWindowLongW
AllowSetForegroundWindow
SetWindowLongW
GetClientRect
msvcrt
__CxxFrameHandler3
_purecall
_vsnwprintf
memset
memcpy
towlower
_wcsicmp
_vsnprintf
_CxxThrowException
memcpy_s
memmove_s
_wcslwr_s
wcsncmp
_wcsnicmp
wcstol
iswdigit
free
calloc
wcstombs_s
malloc
_wtol
wcschr
wcstok
mbstowcs_s
_callnewh
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler4_common
_controlfp
time
srand
_get_osfhandle
rand
_wremove
_lseek
_close
_write
_read
_errno
_wopen
memmove
ntdll
RtlInitUnicodeStringEx
RtlSetEnvironmentVariable
RtlExpandEnvironmentStrings
RtlDestroyEnvironment
RtlInitializeSid
RtlNtStatusToDosError
RtlSubAuthoritySid
DbgPrintEx
NtQueryInformationToken
NtClose
NtOpenProcessToken
NtOpenThreadToken
WinSqmAddToStream
WinSqmAddToStreamEx
RtlCreateEnvironment
shell32
SHGetKnownFolderIDList
SHBrowseForFolderW
ShellExecuteExW
ShellExecuteW
CommandLineToArgvW
SHGetPathFromIDListW
comctl32
ImageList_Destroy
PropertySheetW
ImageList_Create
ImageList_ReplaceIcon
oleaut32
SysAllocString
SysStringLen
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreate
SafeArrayGetElement
SafeArrayUnaccessData
SafeArrayAccessData
SysAllocStringLen
SysFreeString
VariantClear
VariantInit
uxtheme
SetWindowTheme
atl
ord42
ord40
ole32
CoTaskMemFree
StringFromCLSID
CoCreateInstance
CoUninitialize
OleInitialize
StringFromGUID2
GetHGlobalFromStream
CreateStreamOnHGlobal
CoInitializeEx
comdlg32
GetOpenFileNameW
CommDlgExtendedError
rpcrt4
UuidCreate
duser
ForwardGadgetMessage
GetGadgetFocus
wer
WerReportSubmit
WerReportAddFile
WerReportCreate
WerReportCloseHandle
WerReportSetParameter
secur32
GetUserNameExW
wintrust
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
crypt32
CertGetCertificateContextProperty
CryptHashCertificate
CertFreeCertificateContext
CertDuplicateCertificateContext
dui70
?Destroy@DUIXmlParser@DirectUI@@QAEXXZ
?RemoveAll@Element@DirectUI@@QAEJXZ
?GetSelected@Element@DirectUI@@QAE_NXZ
?SetSelected@Element@DirectUI@@QAEJ_N@Z
?GetVisible@Element@DirectUI@@QAE_NXZ
?CreateElement@DUIXmlParser@DirectUI@@QAEJPBGPAVElement@2@1PAKPAPAV32@@Z
?Add@Element@DirectUI@@QAEJPAV12@@Z
?Click@Button@DirectUI@@SG?AVUID@@XZ
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z
?OnMessage@TaskPage@DirectUI@@MAE_NIIJPAJ@Z
??1TaskPage@DirectUI@@UAE@XZ
?EndDefer@Element@DirectUI@@QAEXK@Z
?StartDefer@Element@DirectUI@@QAEXPAK@Z
?SetTooltip@Element@DirectUI@@QAEJ_N@Z
?SetTooltipMaxWidth@Element@DirectUI@@QAEJH@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?SetAccValue@Element@DirectUI@@QAEJPBG@Z
?SetAccDesc@Element@DirectUI@@QAEJPBG@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?SetLayoutPos@Element@DirectUI@@QAEJH@Z
StrToID
?GetElement@TaskPage@DirectUI@@IAEPAVElement@2@XZ
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
?GetParentHWND@TaskPage@DirectUI@@QAEPAUHWND__@@XZ
?PropSheet_SendMessage@TaskPage@DirectUI@@IAEJIIJ@Z
?DestroyCP@TaskPage@DirectUI@@EAEXXZ
?CreateParserCP@TaskPage@DirectUI@@EAEJPAPAVDUIXmlParser@2@@Z
?CreateDUICP@TaskPage@DirectUI@@EAEJPAVHWNDElement@2@PAUHWND__@@1PAPAVElement@2@PAPAVDUIXmlParser@2@@Z
?OnQueryInitialFocus@TaskPage@DirectUI@@MAEPAVElement@2@XZ
?OnWizFinish@TaskPage@DirectUI@@MAEJXZ
?OnReset@TaskPage@DirectUI@@MAEJXZ
?OnKillActive@TaskPage@DirectUI@@MAEJXZ
?InitPropSheetPage@TaskPage@DirectUI@@MAEXPAU_PROPSHEETPAGEW@@@Z
?LoadPage@TaskPage@DirectUI@@MAEJPAVHWNDElement@2@PAUHINSTANCE__@@PAPAVElement@2@PAPAVDUIXmlParser@2@@Z
?LoadParser@TaskPage@DirectUI@@MAEJPAPAVDUIXmlParser@2@@Z
?OnListenedEvent@TaskPage@DirectUI@@MAEXPAVElement@2@PAUEvent@2@@Z
?OnListenedInput@TaskPage@DirectUI@@MAEXPAVElement@2@PAUInputEvent@2@@Z
?OnListenedPropertyChanged@TaskPage@DirectUI@@MAEXPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenedPropertyChanging@TaskPage@DirectUI@@MAE_NPAVElement@2@PBUPropertyInfo@2@HPAVValue@2@2@Z
?OnListenerDetach@TaskPage@DirectUI@@MAEXPAVElement@2@@Z
?OnListenerAttach@TaskPage@DirectUI@@MAEXPAVElement@2@@Z
??0TaskPage@DirectUI@@QAE@XZ
??1HWNDHost@DirectUI@@UAE@XZ
?Register@HWNDHost@DirectUI@@SGJXZ
?OnPropertyChanged@HWNDHost@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?KeyFocusedProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?GetBool@Value@DirectUI@@QAE_NXZ
?Initialize@HWNDHost@DirectUI@@QAEJIIPAVElement@2@PAK@Z
?GetDisplayNode@Element@DirectUI@@QAEPAUHGADGET__@@XZ
?GetClassInfoPtr@HWNDHost@DirectUI@@SGPAUIClassInfo@2@XZ
?OnNotify@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?GetClassInfoW@HWNDHost@DirectUI@@UAEPAUIClassInfo@2@XZ
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?OnInput@HWNDHost@DirectUI@@UAEXPAUInputEvent@2@@Z
??0HWNDHost@DirectUI@@QAE@XZ
?Register@Edit@DirectUI@@SGJXZ
?Register@HWNDElement@DirectUI@@SGJXZ
?Register@CCBase@DirectUI@@SGJXZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
??1CritSecLock@DirectUI@@QAE@XZ
?Initialize@CCBase@DirectUI@@QAEJIPAVElement@2@PAK@Z
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?Initialize@CCListView@DirectUI@@QAEJIPAVElement@2@PAK@Z
?SetWinStyle@CCBase@DirectUI@@QAEJH@Z
?Initialize@Edit@DirectUI@@QAEJIPAVElement@2@PAK@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?DirectionProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetNotifyHandler@CCBase@DirectUI@@QAEXP6GHIIJPAJPAX@Z1@Z
?OnNotify@Edit@DirectUI@@UAE_NIIJPAJ@Z
?CreateHWND@Edit@DirectUI@@MAEPAUHWND__@@PAU3@_N@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?MessageCallback@Edit@DirectUI@@UAEIPAUtagGMSG@@@Z
?GetContentSize@Edit@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?OnInput@Edit@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnPropertyChanged@Edit@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Edit@DirectUI@@UAEPBGPAPAVValue@2@@Z
?IsContentProtected@Edit@DirectUI@@UAE_NXZ
??0Edit@DirectUI@@QAE@XZ
??1ClassInfoBase@DirectUI@@UAE@XZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
??0ClassInfoBase@DirectUI@@QAE@XZ
?GetClassInfoW@CCListView@DirectUI@@UAEPAUIClassInfo@2@XZ
?OnPropertyChanged@CCBase@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
??0CCListView@DirectUI@@QAE@XZ
?GetClassInfoPtr@Edit@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@HWNDElement@DirectUI@@SGPAUIClassInfo@2@XZ
?GetClassInfoPtr@CCBase@DirectUI@@SGPAUIClassInfo@2@XZ
?GetMultiline@Edit@DirectUI@@QAE_NXZ
?GetThemedBorder@Edit@DirectUI@@QAE_NXZ
?AttachCtrlSubclassProc@HWNDHost@DirectUI@@KGXPAUHWND__@@@Z
?OnInput@Element@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnInput@CCBase@DirectUI@@UAEXPAUInputEvent@2@@Z
??1CCBase@DirectUI@@UAE@XZ
?PostCreate@CCBase@DirectUI@@MAEXPAUHWND__@@@Z
?OnReceivedDialogFocus@CCBase@DirectUI@@UAE_NPAVDialogElement@2@@Z
?OnLostDialogFocus@CCBase@DirectUI@@UAE_NPAVDialogElement@2@@Z
?OnCustomDraw@CCBase@DirectUI@@UAE_NPAUtagNMCUSTOMDRAWINFO@@PAJ@Z
?EraseBkgnd@HWNDHost@DirectUI@@MAE_NPAUHDC__@@PAJ@Z
?CreateHWND@CCBase@DirectUI@@UAEPAUHWND__@@PAU3@@Z
?SetWindowDirection@HWNDHost@DirectUI@@UAEXPAUHWND__@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UAEHHHI@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UAEXIPBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSysChar@HWNDHost@DirectUI@@UAE_NG@Z
?OnMessage@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnNotify@CCBase@DirectUI@@UAE_NIIJPAJ@Z
?GetHWND@HWNDHost@DirectUI@@UAEPAUHWND__@@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?Release@Value@DirectUI@@QAEXXZ
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetID@Element@DirectUI@@QAEJPBG@Z
?GetChildren@Element@DirectUI@@QAEPAV?$DynamicArray@PAVElement@DirectUI@@$0A@@2@PAPAVValue@2@@Z
?DefaultAction@CCBase@DirectUI@@UAEJXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetClassInfoW@CCBase@DirectUI@@UAEPAUIClassInfo@2@XZ
?GetKeyFocused@HWNDHost@DirectUI@@UAE_NXZ
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?OnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?QueryInterface@Element@DirectUI@@UAGJABU_GUID@@PAPAX@Z
?MessageCallback@HWNDHost@DirectUI@@UAEIPAUtagGMSG@@@Z
?SetKeyFocus@HWNDHost@DirectUI@@UAEXXZ
??BTaskPage@DirectUI@@QAEPAU_PSP@@XZ
?DUICreatePropertySheetPage@TaskPage@DirectUI@@QAEJPAUHINSTANCE__@@@Z
InitProcessPriv
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?Paint@HWNDHost@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UAEXXZ
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
UnInitProcessPriv
InitThread
UnInitThread
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
??0CCBase@DirectUI@@QAE@KPBG@Z
?GetString@Value@DirectUI@@QAEPBGXZ
?GetContentString@Element@DirectUI@@QAEPBGPAPAVValue@2@@Z
?SetNote@CCCommandLink@DirectUI@@QAEJPBG@Z
??1Edit@DirectUI@@UAE@XZ
shlwapi
SHCreateStreamOnFileEx
winhttp
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpOpen
WinHttpCrackUrl
WinHttpGetDefaultProxyConfiguration
WinHttpGetIEProxyConfigForCurrentUser
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpWriteData
WinHttpReadData
WinHttpSetOption
WinHttpGetProxyForUrl
Sections
.text Size: 306KB - Virtual size: 306KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 632KB - Virtual size: 632KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 46KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
faekgph Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE