Static task
static1
Behavioral task
behavioral1
Sample
5988e6ac11d7713734f11be426a718308fab19c653f680f4fe7463bd2ad47202.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5988e6ac11d7713734f11be426a718308fab19c653f680f4fe7463bd2ad47202.exe
Resource
win10v2004-20220812-en
General
-
Target
5988e6ac11d7713734f11be426a718308fab19c653f680f4fe7463bd2ad47202
-
Size
272KB
-
MD5
7b44bb0ab90f1645e269f9d8d7729580
-
SHA1
3b7bd1436402d8c66590c0c3b63618c8a223dc5f
-
SHA256
5988e6ac11d7713734f11be426a718308fab19c653f680f4fe7463bd2ad47202
-
SHA512
8c1cf12e46164bdc07ba94843bee4198b6684ce14ec2eaf0e35f4f7015717d83c2a8c76379f0381ee05e0edfabbcb2439ded9a4412d25186642efd97a8dbde7f
-
SSDEEP
6144:py1KxJu1aWDeS60UTBXTQPpmZO4xqwqMfu7t/zo0naGa:Fo1aGF60UTt8wqMWJ/PaGa
Malware Config
Signatures
Files
-
5988e6ac11d7713734f11be426a718308fab19c653f680f4fe7463bd2ad47202.exe windows x86
1c9d1724c7e5168e40d85f128914e784
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
dbghelp
SymLoadModule
SymGetModuleInfoW
SymInitialize
SymSetOptions
SymCleanup
wininet
InternetCloseHandle
InternetOpenUrlA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetReadFile
InternetOpenA
psapi
GetModuleFileNameExA
GetModuleFileNameExW
comctl32
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_Create
tinyxml
?Print@TiXmlDocument@@UBEXPAU_iobuf@@H@Z
?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z
?ToDocument@TiXmlDocument@@UAEPAV1@XZ
?ToDocument@TiXmlDocument@@UBEPBV1@XZ
?ToElement@TiXmlNode@@UAEPAVTiXmlElement@@XZ
?ToElement@TiXmlNode@@UBEPBVTiXmlElement@@XZ
?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ
?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ
?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ
??0TiXmlDocument@@QAE@XZ
?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ
?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ
?Clone@TiXmlDocument@@MBEPAVTiXmlNode@@XZ
?Accept@TiXmlDocument@@UBE_NPAVTiXmlVisitor@@@Z
?Value@TiXmlNode@@QBEPBDXZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?GetText@TiXmlElement@@QBEPBDXZ
??1TiXmlDocument@@UAE@XZ
?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z
?Attribute@TiXmlElement@@QBEPBDPBD@Z
?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ
kernel32
GetVersionExA
HeapSize
InterlockedExchange
GetACP
HeapDestroy
GetThreadLocale
InterlockedCompareExchange
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLocaleInfoA
HeapReAlloc
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualQuery
MoveFileW
SetFileAttributesW
GetSystemTimeAsFileTime
GetCurrentProcess
GetProcessTimes
MultiByteToWideChar
GetCurrentThreadId
GetCurrentProcessId
GetFileAttributesW
GetThreadSelectorEntry
SetFilePointer
GetModuleHandleW
HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
HeapFree
GetTickCount
SetCurrentDirectoryW
OpenProcess
lstrlenW
lstrcatW
DeleteFileW
CopyFileW
LoadLibraryW
FindFirstFileW
VirtualQueryEx
GetExitCodeProcess
FindNextFileW
CreateFileA
TerminateProcess
FindClose
SetEvent
lstrcpyW
WaitForSingleObject
CreateProcessW
SizeofResource
LockResource
LoadResource
FreeLibrary
OpenThread
FindResourceExW
ReadProcessMemory
WriteProcessMemory
FindResourceW
CreateThread
GlobalAlloc
GlobalLock
GlobalUnlock
GetLastError
GlobalFree
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
CreateEventW
ResumeThread
FreeResource
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Sleep
CreateFileW
WriteFile
DeleteCriticalSection
RaiseException
GetProcAddress
GetFileSize
GetModuleFileNameW
GetPrivateProfileSectionW
GetSystemDefaultLCID
GetPrivateProfileIntW
GetTempPathW
WritePrivateProfileStringW
CreateDirectoryW
GetVersionExW
ReadFile
GetCommandLineW
user32
UnregisterClassA
LoadIconW
SendMessageW
SetWindowTextW
SetWindowPos
LoadImageW
ShowWindow
GetClientRect
GetDlgItem
DrawIconEx
EndDialog
GetDesktopWindow
PostMessageW
KillTimer
ClientToScreen
SetWindowLongW
MapWindowPoints
GetWindowRect
MapDialogRect
InvalidateRect
CallWindowProcW
RegisterClipboardFormatW
OpenClipboard
SendDlgItemMessageW
EmptyClipboard
EnableWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
GetClassInfoExW
DefWindowProcW
DestroyMenu
TrackPopupMenu
GetWindowThreadProcessId
GetMenuItemCount
CreatePopupMenu
IsWindow
ReleaseDC
GetDC
GetKeyState
MessageBoxW
SetDlgItemTextW
GetWindow
DialogBoxParamW
GetWindowTextW
SetTimer
CloseClipboard
GetWindowTextLengthW
SetClipboardData
gdi32
DeleteObject
SetTextColor
GetStockObject
advapi32
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
shell32
SHBindToParent
SHGetDesktopFolder
ShellExecuteW
SHGetFileInfoW
SHGetSpecialFolderPathW
ord155
ole32
OleUninitialize
DoDragDrop
OleInitialize
CreateStreamOnHGlobal
oleaut32
SysAllocString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysFreeString
gdiplus
GdipCloneImage
GdipImageSelectActiveFrame
GdipGetImageHeight
GdipDrawImageRectI
GdipDeleteGraphics
GdipDisposeImage
GdipCreateFromHDC
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdiplusStartup
GdiplusShutdown
GdipFree
GdipAlloc
GdipGetImageWidth
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
shlwapi
PathFileExistsW
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
msvcr80
towlower
wcsstr
_beginthreadex
wcscat
wcscpy
fprintf
fclose
fwrite
ftell
fseek
_wfopen
strtoul
strcmp
_wcsicmp
memcmp
iswspace
wcsncmp
__wargv
__argc
vsprintf_s
free
_vscprintf
vswprintf_s
_mbscmp
_vscwprintf
wcschr
_wcslwr_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
wcsrchr
isspace
strncmp
strchr
strrchr
atoi
_gmtime32
wcscpy_s
wcscat_s
fread
iswdigit
iswalpha
__CxxFrameHandler3
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
memset
wcscmp
??0exception@std@@QAE@ABV01@@Z
??_V@YAXPAX@Z
??0exception@std@@QAE@ABQBD@Z
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_CxxThrowException
_adjust_fdiv
??2@YAPAXI@Z
_mbslwr_s
_mbsstr
_snprintf
strlen
_time32
??0exception@std@@QAE@XZ
memcpy
_snwprintf
_invalid_parameter_noinfo
malloc
swscanf
srand
wcslen
memcpy_s
_purecall
memmove_s
??3@YAXPAX@Z
iswalnum
_time64
wcsncpy
memmove
_wtoi
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
crypt32
CertGetNameStringW
wintrust
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
Sections
.text Size: 112KB - Virtual size: 111KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ