Behavioral task
behavioral1
Sample
11b71024992eaf3e768307f311ad7182942ad6cd9b13077666c0060f8262e1db.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
11b71024992eaf3e768307f311ad7182942ad6cd9b13077666c0060f8262e1db.exe
Resource
win10v2004-20220812-en
General
-
Target
11b71024992eaf3e768307f311ad7182942ad6cd9b13077666c0060f8262e1db
-
Size
202KB
-
MD5
665707ab61857499639dd74455742e70
-
SHA1
47d58bb307c3b061fc630675ac837ec35d85e7fb
-
SHA256
11b71024992eaf3e768307f311ad7182942ad6cd9b13077666c0060f8262e1db
-
SHA512
ae7b9cb28a26357ff938f058f20b92ff13f535e350244652758405a7728053baddccecac1be56faf28d77d79b029140ccd1210a0877ed69a88b5e7f7bbd1fa60
-
SSDEEP
3072:1Ofhy9mA1kUTWTMHjtUZAUapPp4Ofhy9mA1kUTWTMHjtUZAUapP:1Ahy1/4MHaAXPp4Ahy1/4MHaAXP
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
11b71024992eaf3e768307f311ad7182942ad6cd9b13077666c0060f8262e1db.exe windows x86
45a28b729ac8dbc7ccfad6cee9749945
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strstr
strrchr
srand
rand
??2@YAPAXI@Z
??3@YAXPAX@Z
memset
memcpy
_except_handler3
shlwapi
SHDeleteKeyA
PathFileExistsA
SHSetValueA
SHGetValueA
ws2_32
WSAResetEvent
connect
htonl
htons
setsockopt
sendto
socket
WSACreateEvent
send
WSAStartup
WSACleanup
gethostbyname
inet_addr
inet_ntoa
gethostname
closesocket
WSARecvFrom
bind
WSAGetLastError
iphlpapi
GetAdaptersInfo
wintrust
WinVerifyTrust
mpr
WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum
WNetAddConnection2A
WNetCancelConnection2A
rpcrt4
UuidFromStringA
UuidToStringA
kernel32
GlobalFree
GetLocalTime
MoveFileExA
GlobalAlloc
TransactNamedPipe
GetExitCodeThread
GetLogicalDrives
GetFileAttributesA
FlushViewOfFile
SetFileAttributesA
FindNextFileA
FindClose
GetLogicalDriveStringsA
FindFirstFileA
LockResource
RemoveDirectoryA
ExitProcess
CreateFileA
GetFileSize
SetFilePointer
lstrlenA
VirtualQuery
SetEndOfFile
FreeLibrary
WaitForSingleObject
SetEvent
WriteFile
OpenProcess
Sleep
CreateEventA
ReadFile
GetSystemDirectoryA
MultiByteToWideChar
GetLastError
lstrcmpiA
GetProcAddress
LoadLibraryA
OpenEventA
GetModuleFileNameA
GetModuleHandleA
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
GetTempPathA
DeleteFileA
FindResourceA
FreeResource
LoadResource
Process32First
GetTickCount
GetSystemTimeAsFileTime
SetFileTime
GetDriveTypeA
SizeofResource
CreateProcessA
lstrcatA
Process32Next
lstrcpynA
DeviceIoControl
SetNamedPipeHandleState
LoadLibraryExA
CreateToolhelp32Snapshot
GetFileTime
GetVersionExA
LocalFree
lstrcpyA
ConnectNamedPipe
TerminateThread
Thread32Next
ExitThread
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeA
OpenThread
GetCurrentProcess
lstrlenW
VirtualProtect
CreateThread
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
WinExec
CreateDirectoryA
user32
SetThreadDesktop
OpenWindowStationA
UnloadKeyboardLayout
SetProcessWindowStation
LoadKeyboardLayoutA
GetMessageA
PostThreadMessageA
wsprintfA
wsprintfW
GetInputState
OpenDesktopA
FindWindowA
PostMessageA
advapi32
RegOpenKeyA
CloseServiceHandle
OpenProcessToken
GetTokenInformation
RegSetValueExA
RegQueryValueExA
CreateServiceA
StartServiceA
RegCreateKeyExA
CreateProcessAsUserA
AdjustTokenPrivileges
RegFlushKey
RegSaveKeyA
LookupPrivilegeValueA
RegRestoreKeyA
DeleteService
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
SetNamedSecurityInfoA
SetEntriesInAclA
RegCloseKey
OpenServiceA
ControlService
OpenSCManagerA
RegDeleteValueA
QueryServiceStatus
RegOpenKeyExA
shell32
ShellExecuteA
Sections
.text Size: 37KB - Virtual size: 36KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.UPX1 Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
�H� Size: 101KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE