Static task
static1
Behavioral task
behavioral1
Sample
b5a368110d0b74c0882ba54f22a306e2e8163fdb138f202f90066c5d27201047.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
b5a368110d0b74c0882ba54f22a306e2e8163fdb138f202f90066c5d27201047.exe
Resource
win10v2004-20220812-en
General
-
Target
b5a368110d0b74c0882ba54f22a306e2e8163fdb138f202f90066c5d27201047
-
Size
205KB
-
MD5
63e01d9d445a18059a852d9bf586dc53
-
SHA1
11c95be991d14b9287c07150624b4e449daa579d
-
SHA256
b5a368110d0b74c0882ba54f22a306e2e8163fdb138f202f90066c5d27201047
-
SHA512
604addf8aad23b4699f9e582601153d3ed95390a1f98f6ab14a5f81be98710c32fd61111412f062291d27770a3d26395a63699c247dc323998ed02127d1c2e09
-
SSDEEP
6144:yNB4wJ8t9K66kazFGDjVrivWF/cp7pYYfO8q3LF/6zH9PJNx:yW3NLlq9Pnx
Malware Config
Signatures
Files
-
b5a368110d0b74c0882ba54f22a306e2e8163fdb138f202f90066c5d27201047.exe windows x86
c43433e3a3387e6b20ed8e6a56802c64
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
common
?PropertyStr@CFmtString@@QAEHPB_W0@Z
??0CFmtString@@QAE@XZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
??1CTXBSTR@@QAE@XZ
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
??BCTXBSTR@@QBEPA_WXZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
??4CTXStringW@@QAEAAV0@_W@Z
?Replace@CTXStringW@@QAEH_W0@Z
ord34
??9@YA_NABVCTXStringW@@PB_W@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
??8@YA_NABVCTXStringW@@PB_W@Z
??0CTXStringW@@QAE@PA_W@Z
??1CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@PB_W@Z
?GetRegulatedTime@Time@Util@@YA_NAAJ@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
??YCTXStringW@@QAEAAV0@_W@Z
??9@YA_NABVCTXStringW@@_W@Z
?Right@CTXStringW@@QBE?AV1@H@Z
??4CTXStringW@@QAEAAV0@PA_W@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
??1CTXCommPack@@UAE@XZ
?GetBufferOut@CTXCommPack@@QAEHAAVCTXBuffer@@@Z
?AddWord@CTXCommPack@@QAEHGH@Z
?AddByte@CTXCommPack@@QAEHE@Z
?AddFmtString@TXStringBundle@@YAXABVCFmtString@@@Z
??0CTXBSTR@@QAE@ABV0@@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
?DoFormat@CFmtString@@QAEPB_WPB_W@Z
??4CTXBSTR@@QAEAAV0@ABV0@@Z
??0CTXStringW@@QAE@ABV0@@Z
??ICTXBSTR@@QAEPAPA_WXZ
?IsEmpty@CTXBSTR@@QAEHXZ
??0CTXBSTR@@QAE@PB_W@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
ord26
?AddTLV@CTXCommPack@@QAEHKABVCTXBuffer@@W4TXCommPackDataType@@@Z
?FlushLog@TXLog@@YAXXZ
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?PropertyDWord@CFmtString@@QAEHPB_WK0@Z
??0CTXBSTR@@QAE@XZ
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?IsEmpty@CTXStringW@@QBE_NXZ
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
??1CTXThreadModel@@MAE@XZ
??0CTXThreadModel@@IAE@XZ
?WaitThread@CTXThreadModel@@QAEHK@Z
?Format@CTXStringW@@QAAXPB_WZZ
??M@YA_NABVCTXStringW@@0@Z
?StartThread@CTXThreadModel@@QAEHXZ
?Mid@CTXStringW@@QBE?AV1@HH@Z
?Left@CTXStringW@@QBE?AV1@H@Z
?Find@CTXStringW@@QBEHPB_WH@Z
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
??ACTXStringW@@QBE_WH@Z
?GetLength@CTXStringW@@QBEHXZ
?ReleaseBuffer@CTXStringW@@QAEXH@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
??1CFmtString@@QAE@XZ
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
??BCTXStringW@@QBEPB_WXZ
??0CTXCommPack@@QAE@XZ
?OnUninitCom@Misc@Util@@YAXXZ
gf
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@0H@Z
afutil
?MessageBoxW@Misc@Util@@YAHPAUIGFFrame@@VCTXStringW@@1H@Z
?MessageBoxExW@Misc@Util@@YAHPAUIGFFrame@@PA_W1IPAUITXData@@PAPAU4@@Z
kernel32
WaitForSingleObject
CreateMutexW
OpenMutexW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
SetEvent
WriteFile
CreateFileW
lstrlenW
GetModuleFileNameW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
Sleep
WritePrivateProfileStringW
CloseHandle
GetLastError
MoveFileExW
CopyFileW
RemoveDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
GetCurrentProcessId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
RaiseException
InitializeCriticalSection
DeleteFileW
DeleteCriticalSection
user32
UnregisterClassA
PostMessageW
DispatchMessageW
GetMessageW
TranslateMessage
PostThreadMessageW
shell32
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ShellExecuteW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
oleaut32
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysFreeString
atl80
ord31
ord32
ord64
ord58
ord30
shlwapi
StrCmpW
StrCmpIW
msvcp80
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
msvcr80
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_configthreadlocale
?terminate@@YAXXZ
??3@YAXPAX@Z
_CxxThrowException
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
__CxxFrameHandler3
free
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
??_V@YAXPAX@Z
_time64
__wargv
__argc
memset
_cexit
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_amsg_exit
__wgetmainargs
_controlfp_s
Sections
.text Size: 84KB - Virtual size: 81KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 28KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE