Behavioral task
behavioral1
Sample
e5ece5bec30501f237bac4eb55afe71d6dc79c8609ca9c45862f5faa62aa1916.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e5ece5bec30501f237bac4eb55afe71d6dc79c8609ca9c45862f5faa62aa1916.exe
Resource
win10v2004-20220812-en
General
-
Target
e5ece5bec30501f237bac4eb55afe71d6dc79c8609ca9c45862f5faa62aa1916
-
Size
584KB
-
MD5
11a2f493604e36030ce9d0ccb4487ae0
-
SHA1
e39e9e619185b8873cb9179231cb59b25be0f9f3
-
SHA256
e5ece5bec30501f237bac4eb55afe71d6dc79c8609ca9c45862f5faa62aa1916
-
SHA512
1188f7802dba3f1712938840e0f85424812cb890f9e0b8d089e839ccb33068d81f99d36228b75e7bdcbe0cd1034ccf68b0295711ac7d799eba17ffc30efc1894
-
SSDEEP
12288:frxC+a9jEXiDcu4nalJRdgHZoEXRs/4v+o:frE9jEy76KP6vhs/I+
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
e5ece5bec30501f237bac4eb55afe71d6dc79c8609ca9c45862f5faa62aa1916.exe windows x86
ea3bc2c5f6847769ad87134ec162b475
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetCloseHandle
HttpSendRequestA
HttpOpenRequestW
InternetConnectW
InternetSetOptionW
InternetOpenA
kernel32
SetFilePointer
InterlockedIncrement
InterlockedDecrement
LocalAlloc
LocalFree
GetCommandLineW
lstrcmpiW
Sleep
CopyFileW
DeleteFileW
GetLastError
CreateThread
WaitForSingleObject
CloseHandle
CreateProcessW
GetExitCodeProcess
InterlockedCompareExchange
CreateDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
WideCharToMultiByte
GetVersionExW
GetSystemDefaultLangID
GetSystemInfo
GetSystemTimeAsFileTime
CreateFileW
GetFileSize
GetConsoleCP
WriteFile
FindFirstFileW
FindClose
GetSystemDirectoryW
DeviceIoControl
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
GetStringTypeW
GetStringTypeA
InterlockedExchange
RtlUnwind
GetLocaleInfoA
GetLocaleInfoW
LoadLibraryA
LCMapStringW
LCMapStringA
HeapReAlloc
VirtualAlloc
GetCurrentDirectoryA
GetFullPathNameW
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
GetConsoleMode
GetTimeZoneInformation
SetStdHandle
WriteConsoleA
ReadFile
GetModuleHandleA
HeapCreate
GetStartupInfoA
GetConsoleOutputCP
GetFileType
InitializeCriticalSection
SetEnvironmentVariableA
CompareStringW
SetHandleCount
CompareStringA
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlushFileBuffers
CreateFileA
GetDriveTypeA
WriteConsoleW
GetModuleFileNameW
IsValidCodePage
GetOEMCP
GetACP
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDriveTypeW
HeapFree
HeapAlloc
GetStdHandle
GetModuleFileNameA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapSize
ExitProcess
RaiseException
GetCPInfo
user32
PostMessageW
DestroyMenu
TrackPopupMenu
SetForegroundWindow
AppendMenuW
CreatePopupMenu
GetCursorPos
EndPaint
BeginPaint
RemovePropW
TranslateMessage
GetMessageW
LoadStringW
DefWindowProcW
DispatchMessageW
GetPropW
SetPropW
CreateWindowExW
RegisterClassExW
LoadCursorW
LoadIconW
IsWindow
DestroyWindow
PostQuitMessage
advapi32
RegOpenKeyExA
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegQueryValueExA
shell32
Shell_NotifyIconW
CommandLineToArgvW
ShellExecuteExW
SHGetSpecialFolderPathW
ole32
CoInitialize
CoCreateGuid
CoCreateInstance
CoUninitialize
shlwapi
PathAppendW
ws2_32
htons
htonl
urlmon
URLDownloadToCacheFileW
netapi32
Netbios
NetApiBufferFree
NetWkstaTransportEnum
Sections
.text Size: 194KB - Virtual size: 194KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 95KB - Virtual size: 95KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX Size: 241KB - Virtual size: 244KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE