Static task
static1
Behavioral task
behavioral1
Sample
a3861c76cea2587180072461d43059a0594dcccd44fafb9086b28c924e8202a7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a3861c76cea2587180072461d43059a0594dcccd44fafb9086b28c924e8202a7.exe
Resource
win10v2004-20220812-en
General
-
Target
a3861c76cea2587180072461d43059a0594dcccd44fafb9086b28c924e8202a7
-
Size
367KB
-
MD5
63d13c0f4310d4dd7207b68ba4fe7420
-
SHA1
b19b2dcf44d3c97b0b8a3154991ef2a32f040dd1
-
SHA256
a3861c76cea2587180072461d43059a0594dcccd44fafb9086b28c924e8202a7
-
SHA512
9cabdf840f5c4786bdf4e13bd86bd1139aab0af63c6c62591a563166452108e72b6b95b1100f92d07c5c94e0a8dd9ecb5240f38f9bcc60b41f0b010c38b6c2d5
-
SSDEEP
6144:B+YNNdZyIOKxCCR3G3eNvf/I0Y9TBq7BxNJO6xq4McDN7I7t90l8Cv+8kcetxeSk:B5fZQgCnBh9Ts7xA4Mcp7IJ90lojvZOj
Malware Config
Signatures
Files
-
a3861c76cea2587180072461d43059a0594dcccd44fafb9086b28c924e8202a7.exe windows x86
cf66198838134ae35981e469302a86fe
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
dbghelp
SymCleanup
SymGetModuleInfoW
SymLoadModule
SymInitialize
SymSetOptions
wininet
InternetCloseHandle
InternetOpenUrlA
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenA
psapi
GetModuleFileNameExW
GetModuleFileNameExA
comctl32
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_Create
tinyxml
??1TiXmlDocument@@UAE@XZ
?Print@TiXmlDocument@@UBEXPAU_iobuf@@H@Z
?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z
?ToDocument@TiXmlDocument@@UAEPAV1@XZ
?ToDocument@TiXmlDocument@@UBEPBV1@XZ
?ToElement@TiXmlNode@@UAEPAVTiXmlElement@@XZ
?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ
?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ
?GetText@TiXmlElement@@QBEPBDXZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?Value@TiXmlNode@@QBEPBDXZ
?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ
?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ
?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ
??0TiXmlDocument@@QAE@XZ
?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ
?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ
?Clone@TiXmlDocument@@MBEPAVTiXmlNode@@XZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?Accept@TiXmlDocument@@UBE_NPAVTiXmlVisitor@@@Z
?Attribute@TiXmlElement@@QBEPBDPBD@Z
?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z
?ToElement@TiXmlNode@@UBEPBVTiXmlElement@@XZ
kernel32
GetACP
GetVersionExA
GetThreadLocale
InterlockedCompareExchange
HeapReAlloc
HeapSize
GetLocaleInfoA
InterlockedExchange
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapDestroy
DeviceIoControl
SetFileAttributesW
GetSystemTimeAsFileTime
GetProcessTimes
QueryPerformanceCounter
EnterCriticalSection
LeaveCriticalSection
GetCommandLineW
InitializeCriticalSection
MoveFileW
VirtualQuery
VirtualFree
VirtualAlloc
GetModuleHandleW
HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
HeapFree
GetTickCount
SetCurrentDirectoryW
OpenThread
SizeofResource
FreeLibrary
ReadProcessMemory
LockResource
WriteProcessMemory
LoadResource
FindResourceExW
CreateThread
FindResourceW
OpenProcess
GetLastError
WideCharToMultiByte
lstrlenW
lstrcatW
DeleteFileW
CopyFileW
VirtualQueryEx
LoadLibraryW
FindFirstFileW
CreateFileA
GetExitCodeProcess
FindNextFileW
TerminateProcess
FindClose
SetEvent
lstrcpyW
WaitForSingleObject
CreateProcessW
Sleep
GlobalAlloc
GlobalLock
GlobalUnlock
MultiByteToWideChar
IsDBCSLeadByte
InterlockedIncrement
InterlockedDecrement
GlobalFree
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
ResumeThread
FreeResource
CreateEventW
GetFileAttributesW
CreateFileW
GetProcAddress
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WriteFile
DeleteCriticalSection
RaiseException
GetVersionExW
ReadFile
SetFilePointer
GetFileSize
GetModuleFileNameW
GetPrivateProfileSectionW
GetPrivateProfileIntW
GetTempPathW
WritePrivateProfileStringW
CreateDirectoryW
GetSystemDefaultLCID
GetThreadSelectorEntry
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
user32
GetClassInfoExW
DefWindowProcW
IsWindow
DestroyMenu
TrackPopupMenu
GetWindowThreadProcessId
CreatePopupMenu
GetGuiResources
ReleaseDC
EnableMenuItem
CloseClipboard
GetMenuItemID
SetClipboardData
GetMenuItemCount
EmptyClipboard
OpenClipboard
RegisterClipboardFormatW
RegisterClassExW
GetWindowTextW
SendDlgItemMessageW
GetWindowTextLengthW
SetTimer
InvalidateRect
MapDialogRect
GetWindowRect
MapWindowPoints
CallWindowProcW
DrawTextW
GetDC
SetWindowLongW
EndPaint
ClientToScreen
KillTimer
BeginPaint
GetSysColorBrush
DialogBoxParamW
SetDlgItemTextW
GetWindow
GetKeyState
GetDesktopWindow
PostMessageW
EndDialog
DrawIconEx
GetDlgItem
GetClientRect
ShowWindow
LoadImageW
SetWindowPos
SetWindowTextW
SendMessageW
LoadIconW
CreateWindowExW
DestroyWindow
UnregisterClassA
EnableWindow
GetSystemMenu
gdi32
SelectObject
GetStockObject
SetTextColor
DeleteObject
CreateFontW
SetBkMode
advapi32
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
shell32
ord155
SHBindToParent
SHGetDesktopFolder
SHGetFileInfoW
ShellExecuteW
SHGetSpecialFolderPathW
ShellExecuteExW
ole32
CreateStreamOnHGlobal
DoDragDrop
OleUninitialize
OleInitialize
oleaut32
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SysAllocString
SysStringLen
gdiplus
GdipDeleteGraphics
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipDrawImageRectI
GdipGetImageHeight
GdipGetImageWidth
GdipImageGetFrameDimensionsList
GdipCreateFromHDC
GdipDisposeImage
GdipCloneImage
GdipImageSelectActiveFrame
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
shlwapi
PathFileExistsW
msvcp80
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
msvcr80
_invalid_parameter_noinfo
memcpy
memset
malloc
vsprintf_s
_vscprintf
swscanf
wcsncmp
vswprintf_s
__wargv
__argc
_vscwprintf
_mbscmp
free
wcschr
srand
wcslen
memcpy_s
_purecall
memmove_s
??3@YAXPAX@Z
strlen
_time32
_mbsstr
_snprintf
_mbslwr_s
??0exception@std@@QAE@XZ
??_V@YAXPAX@Z
??2@YAPAXI@Z
??0exception@std@@QAE@ABQBD@Z
wcscmp
??0exception@std@@QAE@ABV01@@Z
wcsrchr
_wcslwr_s
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
iswspace
_wcsicmp
memcmp
strcmp
strtoul
fprintf
wcscpy
wcscat
_wfopen
fseek
ftell
_lock
fwrite
_encode_pointer
__dllonexit
_unlock
fclose
_beginthreadex
wcsstr
towlower
isspace
_onexit
strncpy_s
tolower
sprintf_s
isalnum
_wtoi
wcsncpy
_time64
memmove
iswalnum
iswalpha
iswdigit
fread
wcscat_s
wcscpy_s
_gmtime32
_snwprintf
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_mbsicmp
_mbschr
strncmp
strchr
__CxxFrameHandler3
strrchr
atoi
_CxxThrowException
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
crypt32
CertGetNameStringW
wintrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WinVerifyTrust
iphlpapi
GetAdaptersAddresses
GetAdaptersInfo
netapi32
Netbios
Sections
.text Size: 144KB - Virtual size: 141KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE