Behavioral task
behavioral1
Sample
3660eff204267561a42187d23204106ae7c76ee401e1b6b2e38dd37f896f9b56.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3660eff204267561a42187d23204106ae7c76ee401e1b6b2e38dd37f896f9b56.exe
Resource
win10v2004-20220812-en
General
-
Target
3660eff204267561a42187d23204106ae7c76ee401e1b6b2e38dd37f896f9b56
-
Size
200KB
-
MD5
7ad9faee427d691f0bc7a641b0403cea
-
SHA1
8fd42c25e58340a8d423471603acd1423b61b414
-
SHA256
3660eff204267561a42187d23204106ae7c76ee401e1b6b2e38dd37f896f9b56
-
SHA512
132b24dd0c447278ae96645205cf2e16c8c51e3f8d02c71036fd2dbd65197f360a9543b80cc9711563a39c8dc33da7ae26b451704f90c9cbf6c03c0de6300c4c
-
SSDEEP
3072:dpj82SFbLoGHcByE/J2o+ovApbQOJbmNh7MMGdl9oFGKbIq2T2FB+Hk6CmJsk:dpjjaPopB+obFFS9oFGKbIq2KFBeJt
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
3660eff204267561a42187d23204106ae7c76ee401e1b6b2e38dd37f896f9b56.exe windows x86
6ce227a884170e7c855293ac75f4eeb9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
lstrcpyA
MultiByteToWideChar
CopyFileA
GetTempFileNameA
GetVersionExA
WritePrivateProfileStringA
GetWindowsDirectoryA
GetModuleFileNameA
CreateProcessA
GetCommandLineA
LoadLibraryA
InterlockedDecrement
GetShortPathNameA
GetProcAddress
FreeLibrary
FindClose
FindFirstFileA
FindNextFileA
Sleep
GetSystemDirectoryA
DeleteFileA
GetTempPathA
MoveFileExA
SizeofResource
EnterCriticalSection
LeaveCriticalSection
FindResourceA
SetStdHandle
CreateFileA
CloseHandle
ReadFile
IsBadWritePtr
WriteFile
IsBadReadPtr
FlushFileBuffers
SetFilePointer
SetEndOfFile
SetLastError
CreateDirectoryA
RemoveDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetEnvironmentVariableA
lstrlenA
GetCurrentProcess
lstrlenW
LocalFree
WideCharToMultiByte
GetLocaleInfoA
GetACP
GetCPInfo
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetVersion
ExitProcess
HeapFree
InterlockedIncrement
HeapAlloc
RaiseException
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsGetValue
InitializeCriticalSection
DeleteCriticalSection
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadCodePtr
GetOEMCP
LCMapStringA
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
HeapCreate
VirtualFree
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapReAlloc
GetStringTypeA
GetStringTypeW
VirtualAlloc
HeapSize
user32
LoadStringA
wvsprintfA
MessageBoxA
GetActiveWindow
FindWindowA
PostMessageA
IsWindow
MsgWaitForMultipleObjects
PeekMessageA
shell32
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
ShellExecuteA
ole32
StringFromGUID2
CoGetMalloc
CoUninitialize
CoFreeUnusedLibraries
CoInitialize
OleRun
CoCreateInstance
oleaut32
SysAllocString
SysStringByteLen
VariantClear
SysAllocStringByteLen
SysFreeString
GetErrorInfo
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
advapi32
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
Sections
.text Size: 68KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 104KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE