Static task
static1
Behavioral task
behavioral1
Sample
b81df65d7099970d95f7ef71cda6dafff520d349b5b49356d7da013ce3b2be2b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b81df65d7099970d95f7ef71cda6dafff520d349b5b49356d7da013ce3b2be2b.exe
Resource
win10v2004-20220901-en
General
-
Target
b81df65d7099970d95f7ef71cda6dafff520d349b5b49356d7da013ce3b2be2b
-
Size
792KB
-
MD5
697a50fb8e54cb483bb439c18e391cc0
-
SHA1
b2566606330180b0226b03149f34f7f381aaf6c7
-
SHA256
b81df65d7099970d95f7ef71cda6dafff520d349b5b49356d7da013ce3b2be2b
-
SHA512
a06ce6f155a805858e79d57db288fd9d1b824cbb4b958b7028398df7ff8da33edd90102da705514441a06663d0108f0e708a3bbeaf51f2b6a77b100116396d30
-
SSDEEP
24576:nQgOKT3E9E231vcqb3txm7/qVu6iOnzLg:QtKTG1vce6rBJOnzc
Malware Config
Signatures
Files
-
b81df65d7099970d95f7ef71cda6dafff520d349b5b49356d7da013ce3b2be2b.exe windows x86
84fe39a8044e4cd36f1286c576a77212
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
SHGetFolderPathW
ShellExecuteW
kernel32
InitializeCriticalSection
InterlockedDecrement
MulDiv
LeaveCriticalSection
EnterCriticalSection
FlushInstructionCache
GetCurrentProcess
LocalFree
GetTempPathW
CloseHandle
VirtualFreeEx
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetExitCodeThread
CreateThread
TlsAlloc
TlsFree
TlsGetValue
GlobalFree
CreateFileW
SizeofResource
LockResource
LoadResource
FindResourceW
GetModuleHandleW
GetWindowsDirectoryW
DeviceIoControl
GetLastError
GetVersionExW
GetVolumeInformationW
WaitForSingleObject
CreateRemoteThread
GetProcAddress
GetCurrentThreadId
CompareFileTime
SystemTimeToFileTime
GetStartupInfoW
lstrlenA
MultiByteToWideChar
GetSystemDirectoryW
GlobalUnlock
GlobalLock
GlobalAlloc
lstrlenW
Sleep
user32
GetDC
GetActiveWindow
DialogBoxParamW
PostThreadMessageW
FindWindowW
GetWindowThreadProcessId
PostMessageW
ShowWindow
InvalidateRect
UpdateWindow
GetMessageW
DispatchMessageW
DestroyWindow
CallWindowProcW
ReleaseDC
GetClassInfoExW
LoadCursorW
wsprintfW
RegisterClassExW
RedrawWindow
IsWindow
FillRect
MessageBoxW
GetWindowTextW
SetFocus
HideCaret
SetWindowLongW
CreateWindowExW
GetWindowDC
DefWindowProcW
GetWindowLongW
GetParent
GetWindow
SystemParametersInfoW
MapWindowPoints
SetWindowPos
EndDialog
GetWindowRect
MoveWindow
GetClientRect
SendMessageW
SetWindowTextW
gdi32
GetDeviceCaps
CreateFontIndirectW
CreateSolidBrush
GetTextExtentPoint32W
DeleteDC
DeleteObject
CreateFontW
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
IsTextUnicode
ole32
CoInitialize
CoUninitialize
CreateStreamOnHGlobal
CoCreateInstance
CLSIDFromProgID
oleaut32
OleLoadPicture
SysAllocString
VariantInit
VariantCopy
VariantClear
SysStringByteLen
SysAllocStringByteLen
SysFreeString
VariantChangeType
CreateErrorInfo
msvcp60
?do_scan_not@?$ctype@G@std@@MBEPBGFPBG0@Z
?do_tolower@?$ctype@G@std@@MBEPBGPAGPBG@Z
?do_tolower@?$ctype@G@std@@MBEGG@Z
?do_toupper@?$ctype@G@std@@MBEPBGPAGPBG@Z
?do_toupper@?$ctype@G@std@@MBEGG@Z
?do_widen@?$ctype@G@std@@MBEPBDPBD0PAG@Z
?do_widen@?$ctype@G@std@@MBEGD@Z
?do_narrow@?$ctype@G@std@@MBEPBGPBG0DPAD@Z
?do_narrow@?$ctype@G@std@@MBEDGD@Z
??1?$ctype@D@std@@UAE@XZ
??0_Lockit@std@@QAE@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??Bid@locale@std@@QAEIXZ
?_Getfacet@locale@std@@QBEPBVfacet@12@I_N@Z
?_Iscloc@locale@std@@QBE_NXZ
??0?$ctype@D@std@@QAE@PBF_NI@Z
??1_Lockit@std@@QAE@XZ
??_7bad_cast@std@@6B@
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
?do_tolower@?$ctype@D@std@@MBEPBDPADPBD@Z
?do_tolower@?$ctype@D@std@@MBEDD@Z
?do_toupper@?$ctype@D@std@@MBEPBDPADPBD@Z
?do_toupper@?$ctype@D@std@@MBEDD@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?_Freeze@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??1locale@std@@QAE@XZ
??0locale@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?do_is@?$ctype@G@std@@MBE_NFG@Z
?do_is@?$ctype@G@std@@MBEPBGPBG0PAF@Z
??0?$ctype@G@std@@QAE@I@Z
?_Xlen@std@@YAXXZ
?id@?$ctype@G@std@@2V0locale@2@A
??1?$ctype@G@std@@UAE@XZ
?_Incref@facet@locale@std@@QAEXXZ
?_Decref@facet@locale@std@@QAEPAV123@XZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBGI@Z
?do_scan_is@?$ctype@G@std@@MBEPBGFPBG0@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0runtime_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0runtime_error@std@@QAE@ABV01@@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
?_Xran@std@@YAXXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_Doraise@runtime_error@std@@MBEXXZ
?what@runtime_error@std@@UBEPBDXZ
??_7runtime_error@std@@6B@
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
msvcrt
_wfopen
srand
clock
_wgetenv
??0exception@@QAE@ABV0@@Z
abs
time
_CxxThrowException
_wtol
_lrotr
malloc
free
wcstok
_wsplitpath
strcpy
rand
??0exception@@QAE@ABQBD@Z
sprintf
strncpy
memcmp
strcat
isalnum
_lrotl
wcscat
localtime
__dllonexit
_onexit
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_findclose
wcscmp
_wfindnext
_wfindfirst
_wgetcwd
fwrite
__CxxFrameHandler
swprintf
memcpy
wcslen
wcschr
??2@YAPAXI@Z
_ftol
strlen
__p___wargv
__p___argc
_wremove
_waccess
_wcsicmp
??1exception@@UAE@XZ
wcscpy
memset
fabs
wcsncpy
_wcsnicmp
_wmkdir
_wchdir
fclose
Sections
.text Size: 76KB - Virtual size: 74KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 672KB - Virtual size: 668KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ