Static task
static1
Behavioral task
behavioral1
Sample
ff06a6aa6329412cbbef30cacd194a12e9f7848d128aca36bb2ce44dae21aff7.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ff06a6aa6329412cbbef30cacd194a12e9f7848d128aca36bb2ce44dae21aff7.exe
Resource
win10v2004-20220812-en
General
-
Target
ff06a6aa6329412cbbef30cacd194a12e9f7848d128aca36bb2ce44dae21aff7
-
Size
780KB
-
MD5
47ae7435ceab26ee6c3f9d0a36011360
-
SHA1
3eb56832fbab95d57fbbaa55f679e64cd635a8f0
-
SHA256
ff06a6aa6329412cbbef30cacd194a12e9f7848d128aca36bb2ce44dae21aff7
-
SHA512
c8cf975c6a691c6673568d1324cfb7003cd0ae367a157a66e12941098fe326d311dbdff3ce2c7d5319e2c8033dee48d24dd29db931667beeb81cd6f5676ac907
-
SSDEEP
12288:8s/GATwx+HIYpAD627YmebXqh+adh3Bc/iIgtUHZF4gf:8s/GATaL+2UmMBSIgSFtf
Malware Config
Signatures
Files
-
ff06a6aa6329412cbbef30cacd194a12e9f7848d128aca36bb2ce44dae21aff7.exe windows x86
19e3a40c31fe52ef385ba59985515720
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
kernel32
GetLastError
TerminateProcess
WaitForSingleObject
Sleep
CreateFileA
CreateEventA
MapViewOfFile
CreateFileMappingA
CreateProcessA
ResetEvent
GetExitCodeProcess
WaitForMultipleObjects
SetProcessWorkingSetSize
GetCurrentProcess
LoadLibraryA
GetVersionExA
ExitProcess
FreeLibrary
GetCurrentProcessId
LocalFree
FormatMessageA
GetProcAddress
MultiByteToWideChar
CompareStringA
FindClose
GetFileAttributesA
FindFirstFileA
CopyFileA
ExpandEnvironmentStringsA
ReadFile
GetFileSize
FindNextFileA
SetFileAttributesA
CreateDirectoryA
HeapFree
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
GetCommandLineA
GetProcessHeap
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
GetTickCount
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
HeapReAlloc
SetHandleCount
GetStdHandle
GetFileType
GetModuleHandleA
TlsGetValue
CreateFileW
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
InitializeCriticalSection
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetEndOfFile
GetLocaleInfoW
QueryPerformanceCounter
GetModuleFileNameA
UnmapViewOfFile
SetFilePointer
WriteFile
CloseHandle
DeleteFileA
SetEvent
GetLocalTime
DeleteCriticalSection
TlsAlloc
user32
RegisterClassExA
LoadCursorA
LoadIconA
FindWindowA
CharNextA
CreateWindowExA
ShowWindow
UpdateWindow
GetMessageA
DispatchMessageA
TranslateMessage
UnregisterDeviceNotification
RegisterDeviceNotificationA
PostQuitMessage
DefWindowProcA
UnregisterClassA
advapi32
RegQueryValueExA
RegCloseKey
StartServiceCtrlDispatcherA
SetServiceStatus
CreateServiceA
CloseServiceHandle
OpenSCManagerA
DeleteService
QueryServiceStatus
ControlService
OpenServiceA
RegisterServiceCtrlHandlerA
RegOpenKeyExA
Sections
.text Size: 144KB - Virtual size: 143KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
srvmain_ Size: 4KB - Virtual size: 861B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
srvmain_ Size: 4KB - Virtual size: 390B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
srvmain_ Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
srvmain_ Size: 4KB - Virtual size: 567B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 580KB - Virtual size: 2.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE