_STWNDCloseConnection@4
_STWNDDeleteStateItem@4
_STWNDEndOfRequest@4
_STWNDGetLocalAddress@8
_STWNDGetLocalPort@4
_STWNDGetRemoteAddress@8
_STWNDGetRemotePort@4
_STWNDIsClientConnected@4
_STWNDSendResponse@24
Behavioral task
behavioral1
Sample
de52bc11352c2cc03657d58d3ecb53a2665ca51de4f6f20f8ae2a24ba6654519.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
de52bc11352c2cc03657d58d3ecb53a2665ca51de4f6f20f8ae2a24ba6654519.exe
Resource
win10v2004-20220812-en
Target
de52bc11352c2cc03657d58d3ecb53a2665ca51de4f6f20f8ae2a24ba6654519
Size
140KB
MD5
77d7d7e4d620804603a2d80607fc5039
SHA1
4d2527f690fece79f2c65d4b22c6ff621e0d01eb
SHA256
de52bc11352c2cc03657d58d3ecb53a2665ca51de4f6f20f8ae2a24ba6654519
SHA512
99529c98c1b22821eb9ad06672f701234179a98987dc9cf72c121c88717e55bf5a6f34797dfaacb9f673a991aa7fd73f660b5d695dd8abc09c58b863d95e945b
SSDEEP
1536:l5wCNCvb3SclJzwB/s2I82t2jfhaI/+z0idKl2tiMx3cWph1L8GvRE5ThqbeyRk6:354vb3So2IacI/edlxsWFVvkhq3+TE
resource | yara_rule |
---|---|
sample | upx |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
_controlfp
_onexit
__dllonexit
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
strchr
_amsg_exit
__p___winitenv
exit
__security_error_handler
_local_unwind2
_cexit
_XcptFilter
_exit
_c_exit
_itoa
wprintf
strstr
strtol
_purecall
strncmp
_wcsnicmp
towlower
_strnicmp
tolower
RegQueryValueExW
RegOpenKeyExW
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
RegCloseKey
InterlockedCompareExchange
SwitchToThread
ExitProcess
QueryPerformanceCounter
GetTickCount
GetModuleHandleA
WideCharToMultiByte
GetCurrentThreadId
FileTimeToLocalFileTime
GetSystemTimeAsFileTime
lstrlenW
InterlockedDecrement
InterlockedIncrement
SetConsoleCtrlHandler
CreateWaitableTimerW
CreateEventW
GetProcessAffinityMask
MultiByteToWideChar
lstrlenA
GetLastError
HeapSize
FileTimeToSystemTime
GetCurrentProcessId
LoadLibraryW
GetProcAddress
HeapCreate
FreeLibrary
HeapDestroy
HeapAlloc
HeapFree
SetEvent
WaitForSingleObject
GetSystemInfo
SetWaitableTimer
Sleep
CloseHandle
CreateThread
HeapReAlloc
GetAcceptExSockaddrs
AcceptEx
CoUninitialize
CoInitializeEx
select
recv
gethostbyname
ntohs
inet_ntoa
WSASend
WSASocketW
WSAGetOverlappedResult
WSACleanup
WSAStartup
closesocket
listen
bind
htonl
htons
setsockopt
WSAGetLastError
WSARecv
ClrCreateManagedInstance
PerfCounterInitialize
InitializeLibrary
?XspLogEvent@@YAJKPAGZZ
GetXSPHeap
AttachHandleToThreadPool
SysAllocString
SysFreeString
_STWNDCloseConnection@4
_STWNDDeleteStateItem@4
_STWNDEndOfRequest@4
_STWNDGetLocalAddress@8
_STWNDGetLocalPort@4
_STWNDGetRemoteAddress@8
_STWNDGetRemotePort@4
_STWNDIsClientConnected@4
_STWNDSendResponse@24
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE