Static task
static1
Behavioral task
behavioral1
Sample
9df3a48313cf7f7d342f566d5636a67e32ea1d346b63ed9e9086a7a745adacdf.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9df3a48313cf7f7d342f566d5636a67e32ea1d346b63ed9e9086a7a745adacdf.exe
Resource
win10v2004-20220812-en
General
-
Target
9df3a48313cf7f7d342f566d5636a67e32ea1d346b63ed9e9086a7a745adacdf
-
Size
131KB
-
MD5
6cb08dec325c505c5af78c315b6e3f70
-
SHA1
5faddbb13381ef2efe4fc458c27396dbe1c2b4f5
-
SHA256
9df3a48313cf7f7d342f566d5636a67e32ea1d346b63ed9e9086a7a745adacdf
-
SHA512
f66c217f567a70060e7268a792c4d7dd6813506ba648859e4d084d43b4d86336ba87c9a4a69e541695d500a73a125dc26a4a46766d0140074d4643529c469b62
-
SSDEEP
3072:0xpdocP41kV66V+h3apRmP9i7vcffwIiXwd8vILyo8zNBIma9WIDEG:kp4huaoLnJRq99
Malware Config
Signatures
Files
-
9df3a48313cf7f7d342f566d5636a67e32ea1d346b63ed9e9086a7a745adacdf.exe windows x86
d39cf4a3c93bff6f150f2f9b078312e8
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
GetUserNameW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetSecurityDescriptorControl
ReadEncryptedFileRaw
DecryptFileW
EncryptFileW
RegCreateKeyExW
RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegSetValueExW
CloseEncryptedFileRaw
WriteEncryptedFileRaw
OpenEncryptedFileRawW
kernel32
GetFullPathNameW
GetDateFormatW
SystemTimeToFileTime
GetTimeFormatW
FileTimeToSystemTime
CompareStringW
lstrlenW
GetLastError
GetLocalTime
GetVersion
GetSystemTime
ExpandEnvironmentStringsW
LocalFileTimeToFileTime
CloseThreadpoolWork
FindFirstChangeNotificationW
TlsGetValue
SetErrorMode
CreateThreadpoolWork
SetWaitableTimer
QueryPerformanceCounter
FindCloseChangeNotification
SetEvent
ReleaseSRWLockExclusive
SleepEx
WaitForSingleObjectEx
GetModuleHandleW
SetThreadUILanguage
SetFileTime
AcquireSRWLockExclusive
InitializeCriticalSection
TlsSetValue
OpenProcess
CreateThreadpool
Sleep
SetThreadpoolThreadMaximum
LeaveCriticalSection
GetFileAttributesW
GetConsoleOutputCP
SetLastError
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroupMembers
EnterCriticalSection
InitializeSRWLock
OpenThread
CreateEventW
FindNextChangeNotification
WaitForMultipleObjects
SubmitThreadpoolWork
CreateWaitableTimerW
HeapSetInformation
QueryPerformanceFrequency
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
CloseHandle
GetCurrentProcessId
WideCharToMultiByte
FormatMessageW
LocalAlloc
LocalFree
FindFirstFileW
CompareFileTime
CreateDirectoryW
CreateFileW
lstrcmpW
GlobalFree
FindClose
RemoveDirectoryW
DeviceIoControl
GetFileInformationByHandle
SetFileAttributesW
GetVolumeInformationW
CopyFileExW
WaitForSingleObject
CompareStringOrdinal
BackupRead
BackupWrite
DeleteFileW
ExitThread
SetThreadPriority
GetExitCodeThread
ResumeThread
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleA
GetSystemTimeAsFileTime
GetTickCount
GetFileType
GetConsoleMode
GetStdHandle
WriteConsoleW
ExitProcess
GetProcessHeap
HeapFree
HeapValidate
HeapAlloc
HeapSize
PrivCopyFileExW
mfc42u
ord922
ord925
ord927
ord5601
ord3971
ord539
ord2606
ord2756
ord3658
ord1863
ord535
ord415
ord715
ord823
ord6928
ord1184
ord825
ord5616
ord1081
ord538
ord540
ord861
ord858
ord942
ord4124
ord5706
ord4199
ord2910
ord5568
ord800
ord996
msvcrt
_onexit
??1type_info@@UAE@XZ
_controlfp
_except_handler4_common
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_wcsnicmp
_wcsicmp
malloc
free
clock
time
ctime
_lock
fwprintf_s
__dllonexit
??_V@YAXPAX@Z
??_U@YAPAXI@Z
swprintf_s
fclose
_setmode
fputws
_fileno
_vsnwprintf
printf
fgetws
wprintf
_wfopen
__iob_func
fwprintf
__set_app_type
?terminate@@YAXXZ
_initterm
__setusermatherr
_wsetlocale
_unlock
__p__fmode
_cexit
_exit
exit
fflush
memcpy
_ftol2_sse
_ftol2
__CxxFrameHandler3
fprintf
_get_osfhandle
_errno
memset
user32
LoadStringW
ws2_32
WSACleanup
ntdll
RtlCompareMemory
NtSetSecurityObject
NtOpenFile
NtSetInformationProcess
NtClose
RtlNtStatusToDosError
RtlGetControlSecurityDescriptor
NtQueryDirectoryFile
RtlDosPathNameToRelativeNtPathName_U
NtQueryInformationFile
RtlGetSaclSecurityDescriptor
NtSetInformationFile
RtlInitUnicodeString
RtlFreeHeap
NtQuerySecurityObject
RtlSetControlSecurityDescriptor
RtlGetDaclSecurityDescriptor
Sections
.text Size: 85KB - Virtual size: 85KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 36KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
imnukfh Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE