Static task
static1
Behavioral task
behavioral1
Sample
975ffedd4450baad3a1def7b72245db5090997b4bdaf13fb04b7a8f4d9cde0d7.exe
Resource
win7-20220901-en
General
-
Target
975ffedd4450baad3a1def7b72245db5090997b4bdaf13fb04b7a8f4d9cde0d7
-
Size
206KB
-
MD5
00f06799f81b6721467cf999b4863500
-
SHA1
ba902d18226ba67af541b83927ce8c1961f1ef7e
-
SHA256
975ffedd4450baad3a1def7b72245db5090997b4bdaf13fb04b7a8f4d9cde0d7
-
SHA512
c3d2b39a799fe9ded115bbb175e9d96d43633c451c300d09c79ee703e42f717c3ebcb7a36b9be2098a384e9021304dc928ae207f852a78d1f5992fc7633cf630
-
SSDEEP
3072:N/44pqAHYjCbZ6QV+M8xC+z0p0MlhwYNZYChS6hv5LU5TobPKPp:Bpq2YjCbZ6g+M8Bzrmw5Ae5TobPKh
Malware Config
Signatures
Files
-
975ffedd4450baad3a1def7b72245db5090997b4bdaf13fb04b7a8f4d9cde0d7.exe windows x86
c675b91d95b4cf853611320b9d9a4fc6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ShellExecuteExW
SHGetFolderPathW
crypt32
CertGetNameStringW
mfc42u
ord858
ord940
ord535
ord925
ord2606
ord927
ord2822
ord860
ord942
ord2910
ord5568
ord861
ord538
ord540
ord2810
ord825
ord823
ord800
msvcrt
rand
memcpy
strcmp
strlen
sprintf
strstr
__CxxFrameHandler
_wtoi
_ftol
wcscspn
wcsspn
_wcsnicmp
wcslen
wcsncpy
memset
free
malloc
_wcsicmp
wcstoul
wcscpy
wcscmp
memcmp
_wtol
isspace
isalnum
_wcsdup
__set_app_type
iswdigit
strcpy
strcat
strrchr
strncpy
_except_handler3
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
_controlfp
__p__fmode
__p__commode
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
kernel32
GetModuleFileNameA
GetStartupInfoA
GetModuleHandleA
GetModuleHandleW
CreateFileA
DeviceIoControl
GetFileSize
DebugBreak
InterlockedDecrement
GetModuleFileNameW
OutputDebugStringW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
CopyFileW
GetCurrentProcess
FlushInstructionCache
EnterCriticalSection
LeaveCriticalSection
DeleteFileW
DeleteCriticalSection
HeapDestroy
InitializeCriticalSection
WideCharToMultiByte
lstrlenW
GetTickCount
GetCurrentThreadId
LoadLibraryW
GetProcAddress
FreeLibrary
SetLastError
CreateMutexW
OpenFileMappingW
ResetEvent
UnmapViewOfFile
MapViewOfFile
SetEvent
CreateEventW
CreateFileMappingW
GetEnvironmentVariableW
OpenEventW
CreateProcessW
WaitForSingleObject
GetTempPathW
GetTempFileNameW
MultiByteToWideChar
CreateThread
CloseHandle
lstrlenA
GetLastError
CreateFileW
WriteFile
GetVersionExW
user32
PostThreadMessageW
CharNextW
RegisterClassExW
LoadCursorW
wvsprintfW
IsWindow
GetClassInfoExW
wsprintfW
CallWindowProcW
GetWindowLongW
SetWindowLongW
PostMessageW
SetTimer
SendMessageW
KillTimer
DestroyWindow
PostQuitMessage
DefWindowProcW
FindWindowW
GetMessageW
TranslateMessage
DispatchMessageW
CreateWindowExW
ShowWindow
UpdateWindow
advapi32
RegQueryValueExW
RegDeleteKeyW
RegCloseKey
RegQueryValueExA
RegDeleteValueW
RegSetValueExW
RegEnumValueA
RegOpenKeyExW
RegCreateKeyExW
RegOpenKeyExA
ole32
CoTaskMemFree
CoInitialize
CreateBindCtx
CoUninitialize
CoTaskMemAlloc
oleaut32
SysFreeString
SysAllocString
urlmon
RevokeBindStatusCallback
RegisterBindStatusCallback
CreateURLMoniker
URLDownloadToFileW
msvcp60
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@XZ
?empty@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE_NXZ
?length@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?data@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
wintrust
WinVerifyTrust
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
WTHelperGetProvCertFromChain
wininet
HttpOpenRequestW
InternetOpenUrlW
InternetCrackUrlW
InternetOpenW
InternetConnectW
HttpSendRequestW
HttpQueryInfoW
InternetReadFile
InternetCloseHandle
shlwapi
PathRemoveFileSpecW
StrStrIW
PathFileExistsW
StrCmpW
PathFindFileNameW
PathAppendW
Sections
.text Size: 72KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE