??4_Init_locks@std@@QAEAAV01@ABV01@@Z
Static task
static1
Behavioral task
behavioral1
Sample
cf42f3988848d1ec4f78bb5e17d28972f9739c94d4568bb62d02837502d927d1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cf42f3988848d1ec4f78bb5e17d28972f9739c94d4568bb62d02837502d927d1.exe
Resource
win10v2004-20220812-en
General
-
Target
cf42f3988848d1ec4f78bb5e17d28972f9739c94d4568bb62d02837502d927d1
-
Size
575KB
-
MD5
43ffd24ebdc80d904599b64933e8bc20
-
SHA1
0da67edf773f275d2f57054290a4cf7bb00e7478
-
SHA256
cf42f3988848d1ec4f78bb5e17d28972f9739c94d4568bb62d02837502d927d1
-
SHA512
e7cd3cae165255b9deacf3d60862437b0de6df9c9b206e8668a0c7712cab225b935bcdaa762172120f8baa646459583e32746f1bb96a4ea885ec4d5490585609
-
SSDEEP
3072:eq9fP1cj1GZQn+n/CrLYbdq3URUwOjzOsrkju7lLroCLjtGoJ/GtRA4wCTf5T5N2:/9fKZGZQn+qgqnXOs1f+oFGXAShTSy0
Malware Config
Signatures
Files
-
cf42f3988848d1ec4f78bb5e17d28972f9739c94d4568bb62d02837502d927d1.exe windows x86
e4853d719befd610a0a285eb725f68f9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
bdlogicutils
?BDLogicUtilsLibrary_Unit@BDLogicUtils@@YAHXZ
?GetBDCrashCatcher@BDLogicUtils@@YAPAVIBDCrashCatcher@1@XZ
?GetBDMReportMgr@BDLogicUtils@@YAPAVIBDMReportMgr@1@XZ
?BDLogicUtilsLibrary_Init@BDLogicUtils@@YAHXZ
shlwapi
PathFileExistsW
PathAppendW
PathAddBackslashW
wnsprintfW
kernel32
FreeLibrary
GetFileSize
SetFilePointer
HeapAlloc
GetProcessHeap
HeapFree
WriteFile
LocalAlloc
ReleaseMutex
WaitForSingleObject
WideCharToMultiByte
MapViewOfFile
OpenProcess
CreateFileMappingW
GetTickCount
CreateEventW
SetEvent
WaitForMultipleObjects
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
OpenEventW
MultiByteToWideChar
SetLastError
GetModuleHandleExW
OutputDebugStringA
GetLocalTime
InterlockedCompareExchange
GetModuleFileNameA
QueryPerformanceCounter
CreateFileW
TlsAlloc
TlsSetValue
GetExitCodeThread
TlsFree
TlsGetValue
OutputDebugStringW
FileTimeToSystemTime
WriteFileEx
GetACP
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
GetCurrentThreadId
Sleep
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
MoveFileExW
SetEnvironmentVariableW
lstrcmpiW
GetCurrentProcessId
LoadLibraryW
GetModuleFileNameW
GetWindowsDirectoryW
QueryPerformanceFrequency
ReadFile
Process32NextW
GetProcAddress
GetLastError
GetLocaleInfoA
GetThreadLocale
MoveFileW
GetBinaryTypeW
IsBadReadPtr
GetSystemWow64DirectoryW
GetSystemWindowsDirectoryW
DebugBreak
GetFileSizeEx
GetSystemDirectoryW
GetSystemTimeAsFileTime
InterlockedDecrement
InterlockedIncrement
LocalFree
OpenMutexW
GetProcessTimes
CreateMutexW
GetModuleHandleW
CreateToolhelp32Snapshot
Process32FirstW
GetVersionExW
TerminateProcess
CloseHandle
OpenFileMappingW
GetCurrentProcess
UnmapViewOfFile
user32
IsWindow
PostMessageW
KillTimer
CreateWindowExW
ShowWindow
RegisterClassExW
SendMessageW
DefWindowProcW
DispatchMessageW
UpdateWindow
GetMessageW
TranslateMessage
SetTimer
UnregisterClassA
SendMessageTimeoutW
DestroyIcon
GetWindowLongW
SetWindowLongW
DestroyWindow
FindWindowA
advapi32
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegNotifyChangeKeyValue
RegDeleteKeyW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegQueryValueExW
shell32
SHGetFolderPathW
CommandLineToArgvW
msvcp80
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
msvcr80
?terminate@@YAXXZ
_CxxThrowException
memcpy
malloc
??2@YAPAXI@Z
_purecall
??3@YAXPAX@Z
wcsncpy_s
vswprintf_s
wcschr
_wcsicmp
??_V@YAXPAX@Z
_wcsnicmp
??0exception@std@@QAE@ABQBD@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
swscanf_s
??0exception@std@@QAE@XZ
_wtoi
wcsrchr
memcpy_s
memmove_s
_snprintf_s
_snwprintf_s
wcsncat_s
_snwprintf
_time64
strncpy_s
_vscwprintf
strrchr
strchr
printf_s
setlocale
_fsopen
fwrite
_vsnwprintf_s
fflush
_memicmp
_beginthreadex
_itow_s
wcsncmp
__CxxFrameHandler3
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_encode_pointer
__set_app_type
_unlock
__dllonexit
_lock
_onexit
_decode_pointer
_except_handler3
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
_invoke_watson
_controlfp_s
memset
free
_itoa
imagehlp
UnMapAndLoad
MapAndLoad
Exports
Exports
Sections
.text Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 36KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 340KB - Virtual size: 337KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 92KB - Virtual size: 92KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE