Static task
static1
Behavioral task
behavioral1
Sample
a695c41e6874239276cf21b5138e356c0e028959e4e0773970284dc3ac0638c6.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a695c41e6874239276cf21b5138e356c0e028959e4e0773970284dc3ac0638c6.exe
Resource
win10v2004-20220812-en
General
-
Target
a695c41e6874239276cf21b5138e356c0e028959e4e0773970284dc3ac0638c6
-
Size
135KB
-
MD5
642e0bdfab2bb355e701c8db1d7815a0
-
SHA1
b2064f5c3f68e915259cf97957d139d3c3f0a8de
-
SHA256
a695c41e6874239276cf21b5138e356c0e028959e4e0773970284dc3ac0638c6
-
SHA512
c33b0c9f03ca15009e0fcc9a9040328af94320d18da1657d978bc8e1e0471abe3b66fd0cbb92312b7d001642bcfada0eec9d8fb93fd047e3c2c7fa25b7da7a9f
-
SSDEEP
1536:ozo6/QSskEImX3tvmsNsY279EFd9E9sPF1f4ffxm9JbibfiMJKV+K7aOw7elByWz:oVw31vbGSn9l1f4nq+dOwilByazNJ9h
Malware Config
Signatures
Files
-
a695c41e6874239276cf21b5138e356c0e028959e4e0773970284dc3ac0638c6.exe windows x86
1dcba90c3e8430bf07d0867415ec5e04
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
TlsGetValue
VirtualProtect
GetVolumePathNameW
GetLastError
ReadConsoleA
GetStartupInfoA
DeleteFileW
ReleaseMutex
ReadConsoleA
GetPrivateProfileSectionA
FindAtomW
lstrlenA
HeapFree
GetDriveTypeA
PulseEvent
GetStringTypeW
ReadConsoleA
LoadLibraryW
GetLogicalDrives
CloseHandle
Sleep
clbcatq
CheckMemoryGates
SetupOpen
SetupOpen
CheckMemoryGates
SetupOpen
ComPlusMigrate
DllGetClassObject
DllGetClassObject
CheckMemoryGates
ComPlusMigrate
CheckMemoryGates
CheckMemoryGates
ComPlusMigrate
gpedit
DllCanUnloadNow
BrowseForGPO
DllGetClassObject
ExportRSoPData
Sections
.text Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 320B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 128KB - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.orpc Size: 512B - Virtual size: 289B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.import Size: 512B - Virtual size: 38B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE