Behavioral task
behavioral1
Sample
9d72f66f4e2235b7315e1b2f9f6cd22ecf2bb96b4150af36232fb19a61d33171.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9d72f66f4e2235b7315e1b2f9f6cd22ecf2bb96b4150af36232fb19a61d33171.exe
Resource
win10v2004-20220812-en
General
-
Target
9d72f66f4e2235b7315e1b2f9f6cd22ecf2bb96b4150af36232fb19a61d33171
-
Size
200KB
-
MD5
1ad02ef3e3f5e922ba746384952b6f7c
-
SHA1
83ce8d191f4359071d3919a6e7be6d9cea8deb76
-
SHA256
9d72f66f4e2235b7315e1b2f9f6cd22ecf2bb96b4150af36232fb19a61d33171
-
SHA512
afc9d40c688e99d9cc8ddfa1b0a2682caf33b9e72ff5009669bb34a22194b3fe494d0c04b11a118d96f037325c9df4233c13ef2d8c5612b2540c6576c41f1eaf
-
SSDEEP
6144:LQrlGiaeL2l6x3Ehy9a8nu40ZJXsGqQ9eT0DPa:LQrlGiaezx59a8nu4S+GPeT0Di
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
9d72f66f4e2235b7315e1b2f9f6cd22ecf2bb96b4150af36232fb19a61d33171.exe windows x86
6ce227a884170e7c855293ac75f4eeb9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
lstrcpyA
MultiByteToWideChar
CopyFileA
GetTempFileNameA
GetVersionExA
WritePrivateProfileStringA
GetWindowsDirectoryA
GetModuleFileNameA
CreateProcessA
GetCommandLineA
LoadLibraryA
InterlockedDecrement
GetShortPathNameA
GetProcAddress
FreeLibrary
FindClose
FindFirstFileA
FindNextFileA
Sleep
GetSystemDirectoryA
DeleteFileA
GetTempPathA
MoveFileExA
SizeofResource
EnterCriticalSection
LeaveCriticalSection
FindResourceA
SetStdHandle
CreateFileA
CloseHandle
ReadFile
IsBadWritePtr
WriteFile
IsBadReadPtr
FlushFileBuffers
SetFilePointer
SetEndOfFile
SetLastError
CreateDirectoryA
RemoveDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetEnvironmentVariableA
lstrlenA
GetCurrentProcess
lstrlenW
LocalFree
WideCharToMultiByte
GetLocaleInfoA
GetACP
GetCPInfo
RtlUnwind
GetModuleHandleA
GetStartupInfoA
GetVersion
ExitProcess
HeapFree
InterlockedIncrement
HeapAlloc
RaiseException
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsGetValue
InitializeCriticalSection
DeleteCriticalSection
GetEnvironmentStrings
GetEnvironmentStringsW
SetUnhandledExceptionFilter
IsBadCodePtr
GetOEMCP
LCMapStringA
LCMapStringW
TerminateProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
HeapCreate
VirtualFree
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapReAlloc
GetStringTypeA
GetStringTypeW
VirtualAlloc
HeapSize
user32
LoadStringA
wvsprintfA
MessageBoxA
GetActiveWindow
FindWindowA
PostMessageA
IsWindow
MsgWaitForMultipleObjects
PeekMessageA
shell32
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
ShellExecuteA
ole32
StringFromGUID2
CoGetMalloc
CoUninitialize
CoFreeUnusedLibraries
CoInitialize
OleRun
CoCreateInstance
oleaut32
SysAllocString
SysStringByteLen
VariantClear
SysAllocStringByteLen
SysFreeString
GetErrorInfo
version
VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA
advapi32
RegCreateKeyExA
RegCloseKey
RegQueryValueExA
RegQueryInfoKeyA
RegSetValueExA
RegOpenKeyExA
RegEnumKeyExA
RegEnumValueA
RegDeleteKeyA
RegDeleteValueA
Sections
.text Size: 68KB - Virtual size: 65KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 104KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE