Static task
static1
Behavioral task
behavioral1
Sample
f5ea73ddf9c661f81590c301547c2bff62c60c4c62e8c437752fe94e60a247f6.exe
Resource
win7-20220812-en
General
-
Target
f5ea73ddf9c661f81590c301547c2bff62c60c4c62e8c437752fe94e60a247f6
-
Size
181KB
-
MD5
69527878b04ddd9e51e8a6c4ead041a0
-
SHA1
6dafcbaf0b9266633b06e77ca5b830e3477829e7
-
SHA256
f5ea73ddf9c661f81590c301547c2bff62c60c4c62e8c437752fe94e60a247f6
-
SHA512
f6aca7d387ed2c149c1e8919d3d21478058bd34c7dd96be68f658da032177a78377213ac9237499c813b4d4306100103162ec941e7e8a49193b972f16337f86a
-
SSDEEP
3072:tmVpLjjdQWgEGJN+BNORT4zCIS+VliTvCFjFyzKIC2O46GJSpIKUXB:ExjjdQW0f+BYRT4zY+VYTvQUKIC9xG4y
Malware Config
Signatures
Files
-
f5ea73ddf9c661f81590c301547c2bff62c60c4c62e8c437752fe94e60a247f6.exe windows x86
35b8b55412f09fbe3d6457fbaac83ce1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42u
ord860
ord2822
ord927
ord2606
ord925
ord535
ord940
ord942
ord858
ord823
ord861
ord825
ord538
ord540
ord2810
ord800
msvcrt
wcsspn
_except_handler3
memcpy
wcscspn
__set_app_type
__p__fmode
__p__commode
_wcsicmp
wcstoul
wcscpy
_wtoi
wcscmp
_ftol
memcmp
_wtol
isspace
isalnum
_wcsdup
rand
iswdigit
strlen
malloc
free
__CxxFrameHandler
memset
wcsncpy
wcslen
_wcsnicmp
_controlfp
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
strcpy
sprintf
strcat
strrchr
strncpy
_acmdln
exit
_XcptFilter
__dllonexit
_onexit
_exit
kernel32
CreateFileMappingW
GetEnvironmentVariableW
OpenEventW
CreateEventW
WaitForSingleObject
CloseHandle
GetLastError
SetEvent
MapViewOfFile
UnmapViewOfFile
ResetEvent
OpenFileMappingW
lstrlenA
CreateMutexW
SetLastError
CreateProcessW
GetModuleHandleW
GetStartupInfoA
GetModuleHandleA
GetTempPathW
GetModuleFileNameA
GetVersionExW
CreateFileA
DeviceIoControl
CreateFileW
GetFileSize
DebugBreak
InterlockedDecrement
GetModuleFileNameW
OutputDebugStringW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CopyFileW
GetCurrentProcess
FlushInstructionCache
EnterCriticalSection
LeaveCriticalSection
DeleteFileW
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
GetTickCount
Sleep
LoadLibraryW
GetProcAddress
FreeLibrary
GetTempFileNameW
CreateThread
user32
PostQuitMessage
CharNextW
RegisterClassExW
LoadCursorW
UpdateWindow
CreateWindowExW
DispatchMessageW
TranslateMessage
GetMessageW
FindWindowW
wvsprintfW
IsWindow
PostMessageW
GetClassInfoExW
wsprintfW
KillTimer
SetTimer
CallWindowProcW
GetWindowLongW
SetWindowLongW
SendMessageW
DestroyWindow
DefWindowProcW
ShowWindow
advapi32
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
shell32
ShellExecuteExW
SHGetFolderPathW
ole32
CoTaskMemFree
CoInitialize
CreateBindCtx
CoTaskMemAlloc
CoUninitialize
oleaut32
SysFreeString
SysAllocString
urlmon
RevokeBindStatusCallback
RegisterBindStatusCallback
CreateURLMoniker
URLDownloadToFileW
msvcp60
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
wintrust
WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
crypt32
CertGetNameStringW
wininet
InternetOpenW
InternetOpenUrlW
InternetCloseHandle
HttpQueryInfoW
InternetCrackUrlW
shlwapi
PathRemoveFileSpecW
StrStrIW
PathFileExistsW
PathAppendW
PathFindFileNameW
StrCmpW
Sections
.text Size: 64KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rrdata Size: 68KB - Virtual size: 68KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE