Static task
static1
Behavioral task
behavioral1
Sample
6946ffed94460a190caf8746892dff7f6de4248a35a3a9a39b5716996df79a8b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6946ffed94460a190caf8746892dff7f6de4248a35a3a9a39b5716996df79a8b.exe
Resource
win10v2004-20220812-en
General
-
Target
6946ffed94460a190caf8746892dff7f6de4248a35a3a9a39b5716996df79a8b
-
Size
949KB
-
MD5
6bcf03c5aed7e1487f064522ec76c171
-
SHA1
cb38ec82a3349618e881a0708a389a66bcb52dc9
-
SHA256
6946ffed94460a190caf8746892dff7f6de4248a35a3a9a39b5716996df79a8b
-
SHA512
3c1f8747480994529d8fd5dcbf5c170ce80fbc96726a650e79253d2cbb0d392942444129858247f2c1ca559f9775f0e2b2de150b5c5151097047bc2affa63802
-
SSDEEP
12288:bcSzmwKK7yvXXN3MnXU3kP+9J46HgtXdS2QddjiVhRE:HKK7yvXXN3MnXU3kP+9J4agtXdguVTE
Malware Config
Signatures
Files
-
6946ffed94460a190caf8746892dff7f6de4248a35a3a9a39b5716996df79a8b.exe windows x86
378a1abcf5695ba163421e67eba163d7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DisableThreadLibraryCalls
MultiByteToWideChar
BuildCommDCBW
CloseHandle
CreateFileMappingW
CreateFileW
CreateMutexW
CreateProcessA
DeviceIoControl
FindFirstVolumeA
GetCommState
GetCurrentProcess
GetModuleHandleW
GetVersionExW
LocalAlloc
LocalFree
MapViewOfFile
OpenJobObjectW
ReadConsoleA
ReadConsoleOutputAttribute
ReleaseMutex
SetCommState
SetUnhandledExceptionFilter
TerminateProcess
UnmapViewOfFile
WaitForSingleObject
lstrcatW
lstrcpyW
lstrlenW
DnsHostnameToComputerNameA
FindNextVolumeA
FindResourceA
FreeLibrary
GetConsoleAliasExesLengthW
GetEnvironmentVariableA
GetFileAttributesA
GetStringTypeExA
GlobalReAlloc
InterlockedDecrement
InterlockedIncrement
IsDBCSLeadByte
LoadLibraryExA
LoadResource
ScrollConsoleScreenBufferW
SetErrorMode
SetStdHandle
SizeofResource
WideCharToMultiByte
WritePrivateProfileStringA
lstrcatA
lstrcmpiA
lstrcpyA
lstrcpynA
lstrlenA
FindResourceW
GetCommandLineW
GetConsoleScreenBufferInfo
GetDateFormatA
GetLocalTime
InterlockedCompareExchange
InterlockedExchange
LockResource
Sleep
WriteProfileSectionW
AreFileApisANSI
BackupSeek
BuildCommDCBA
ChangeTimerQueueTimer
ConvertDefaultLocale
CreateDirectoryW
CreateEventA
CreateTimerQueueTimer
DefineDosDeviceA
DeleteFileA
DeleteTimerQueueTimer
EnumDateFormatsExA
EnumResourceLanguagesW
FatalAppExitW
FlushViewOfFile
GetComputerNameW
GetCurrentDirectoryW
GetCurrentThread
GetLocaleInfoW
GetLogicalDriveStringsA
GetProcessIoCounters
GetProfileSectionA
GetSystemInfo
GetWindowsDirectoryW
HeapValidate
IsDebuggerPresent
MapUserPhysicalPages
MapViewOfFileEx
Module32FirstW
Module32NextW
MoveFileExW
OpenFileMappingW
OutputDebugStringA
PrepareTape
RegisterWaitForSingleObject
RegisterWaitForSingleObjectEx
SetCommTimeouts
SetCurrentDirectoryW
UnregisterWait
UnregisterWaitEx
WaitForSingleObjectEx
WriteFile
lstrcmpi
CompareFileTime
GetDefaultCommConfigW
GetFileSize
GetLocaleInfoA
GetOverlappedResult
InterlockedExchangeAdd
LocalHandle
PeekConsoleInputA
Process32First
SetEvent
Thread32First
UnlockFileEx
VerLanguageNameW
WaitForMultipleObjectsEx
CreateJobObjectA
FormatMessageW
GetExitCodeThread
GetProcessHeap
SetCommConfig
UnhandledExceptionFilter
VirtualAlloc
FreeUserPhysicalPages
GetModuleFileNameA
GetVersion
GlobalFree
GlobalUnlock
OpenSemaphoreW
WriteConsoleOutputCharacterA
lstrcmp
GetEnvironmentVariableW
GetFileAttributesW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
GetPrivateProfileStringW
GetTimeZoneInformation
Heap32ListNext
SetFileAttributesW
WaitForDebugEvent
WritePrivateProfileStringW
lstrcpynW
FreeLibraryAndExitThread
GetComputerNameExW
GetConsoleAliasesA
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExA
GetFullPathNameW
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
ReleaseSemaphore
WriteConsoleOutputW
WritePrivateProfileStructA
CopyFileW
FoldStringA
GetACP
GetLogicalDrives
GetModuleFileNameW
GetProcAddress
GetVersionExA
LoadLibraryW
RemoveDirectoryW
RequestWakeupLatency
SetCalendarInfoW
SystemTimeToFileTime
VirtualQueryEx
WritePrivateProfileSectionA
lstrcmpW
ExitProcess
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
IsProcessorFeaturePresent
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetLastError
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
GetStdHandle
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
HeapCreate
HeapDestroy
GetCPInfo
GetOEMCP
IsValidCodePage
HeapFree
HeapSize
RtlUnwind
LCMapStringW
HeapAlloc
HeapReAlloc
ole32
OleCreateLinkEx
OleCreateEx
HBRUSH_UserFree
StringFromIID
OleMetafilePictFromIconAndLabel
CoRevokeClassObject
CoGetClassVersion
CoGetCancelObject
CoGetApartmentID
CoFreeUnusedLibraries
WriteOleStg
HkOleRegisterObject
CoTreatAsClass
OleRegEnumFormatEtc
CreateILockBytesOnHGlobal
CoGetPSClsid
StringFromGUID2
CreateBindCtx
UtConvertDvtd32toDvtd16
OleCreate
OleBuildVersion
HBITMAP_UserUnmarshal
HACCEL_UserMarshal
CoReleaseMarshalData
CoRegisterMallocSpy
CoGetMarshalSizeMax
CoGetInstanceFromFile
OleCreateFromDataEx
OleConvertIStorageToOLESTREAMEx
HPALETTE_UserUnmarshal
HMENU_UserSize
FreePropVariantArray
CoTaskMemRealloc
CoTaskMemFree
CoCreateInstance
HBRUSH_UserUnmarshal
CoGetClassObject
oleaut32
LPSAFEARRAY_UserUnmarshal
VariantTimeToDosDateTime
VarTokenizeFormatString
SafeArrayDestroyDescriptor
VarI1FromCy
SafeArrayAllocDescriptor
VarI2FromDec
VarBstrFromI2
VarR4FromUI4
VarDateFromUI4
VectorFromBstr
VarUI2FromR4
VarUI2FromDec
VarI4FromI2
VarBoolFromDec
VarAbs
VarUI4FromR8
VarI1FromUI4
SafeArraySetIID
LoadTypeLibEx
LPSAFEARRAY_UserMarshal
VariantCopyInd
VarR8Round
VarCyFromR4
VarUI2FromR8
VARIANT_UserSize
rpcrt4
NdrNonConformantStringBufferSize
NdrConformantArrayBufferSize
RpcServerUseProtseqEpExW
NdrServerInitializeUnmarshall
NdrProxyFreeBuffer
NdrNsGetBuffer
I_RpcTransServerNewConnection
RpcStringBindingParseA
RpcServerRegisterAuthInfoA
RpcMgmtInqStats
RpcBindingSetObject
NdrXmitOrRepAsMemorySize
TowerExplode
NdrAllocate
NdrNonEncapsulatedUnionMemorySize
RpcBindingInqAuthInfoExA
UuidHash
I_RpcConnectionSetSockBuffSize
I_UuidCreate
NdrMapCommAndFaultStatus
NdrServerInitializeMarshall
NdrSimpleStructMemorySize
RpcIfInqId
RpcServerUseProtseqIfExW
NdrServerContextUnmarshall
I_RpcServerRegisterForwardFunction
CStdStubBuffer_DebugServerQueryInterface
CStdStubBuffer_Connect
RpcServerInqBindings
RpcEpRegisterA
RpcIfIdVectorFree
NdrDllCanUnloadNow
NDRCContextUnmarshall
I_RpcReceive
NDRSContextUnmarshallEx
NdrPointerMarshall
I_RpcAsyncSetHandle
shell32
ShellAboutW
SHGetSpecialFolderPathW
SHGetFileInfoW
SHGetDesktopFolder
SHFileOperationW
SHFreeNameMappings
DuplicateIcon
SHGetDiskFreeSpaceExW
DragQueryFile
DoEnvironmentSubstA
SHChangeNotify
ExtractIconExA
user32
SwitchDesktop
CharUpperA
DlgDirSelectComboBoxExW
EndMenu
SetDoubleClickTime
GetWindowContextHelpId
LoadImageW
SetProcessDefaultLayout
LoadStringA
PostThreadMessageW
SetDlgItemTextA
UpdateLayeredWindow
VkKeyScanA
GetSystemMenu
HiliteMenuItem
InSendMessage
IsCharAlphaW
VkKeyScanExA
ChangeDisplaySettingsExW
CreateDialogParamA
DdeGetLastError
GetClipCursor
GetClipboardOwner
GetMenuItemInfoW
GetSysColorBrush
IsDlgButtonChecked
LoadAcceleratorsW
OffsetRect
RegisterWindowMessageW
AttachThreadInput
DrawFrameControl
GetDlgItemTextW
IMPGetIMEW
LoadIconW
ReleaseDC
SystemParametersInfoW
TrackMouseEvent
EndDeferWindowPos
GetUserObjectInformationA
ValidateRect
CallNextHookEx
CloseDesktop
GetAsyncKeyState
GetKeyState
GetKeyboardLayout
GetUserObjectInformationW
IsWindow
OpenDesktopW
OpenInputDesktop
PostMessageW
SetWindowsHookExW
wsprintfW
CharNextA
GetDC
GetDCEx
GetDlgItemTextA
OpenDesktopA
WinHelpA
wsprintfA
BeginPaint
DefDlgProcW
DefWindowProcW
EnableWindow
EndDialog
EndPaint
FrameRect
GetActiveWindow
GetDlgItem
GetSystemMetrics
GetWindowRect
LoadStringW
MessageBoxW
RedrawWindow
RemovePropW
SendDlgItemMessageW
SendMessageW
SetFocus
SetWindowLongW
SetWindowPos
SetWindowTextW
ShowWindow
CharLowerBuffA
CreateIconIndirect
CreateMDIWindowA
DefWindowProcA
DrawEdge
DrawIconEx
EnumDisplayDevicesW
EnumPropsExW
FindWindowA
FindWindowW
GetKeyNameTextW
GetPropW
GetWindowModuleFileName
ReuseDDElParam
SendMessageA
SendMessageCallbackA
SendNotifyMessageW
ShowOwnedPopups
Sections
.text Size: 216KB - Virtual size: 216KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 483KB - Virtual size: 483KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 245KB - Virtual size: 254KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE