Static task
static1
Behavioral task
behavioral1
Sample
8ef9394b1af75d7393ed5f96afc8718f80727679690ecc33388af427444a6862.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8ef9394b1af75d7393ed5f96afc8718f80727679690ecc33388af427444a6862.exe
Resource
win10v2004-20220812-en
General
-
Target
8ef9394b1af75d7393ed5f96afc8718f80727679690ecc33388af427444a6862
-
Size
329KB
-
MD5
913998d1e55d5d1e5875e60310adf3f8
-
SHA1
abb4e19740fccbb0f1e45bf438f8ba997df59a22
-
SHA256
8ef9394b1af75d7393ed5f96afc8718f80727679690ecc33388af427444a6862
-
SHA512
4852677fed26b8ebef4645287593495168687e382aef8987e1bf26a44c14a746fda1887ceafbc97c61884840859149d3b0959d50510f56e58019e65f048fb6ba
-
SSDEEP
6144:lyMgO2UIPJByBbSX/Ekw3ElaW/ZvWnOdYANWyuR0VDWvAaqlp:5Z1IPJB7/Ekw3LWhKOdJNW7eVDWvAaqX
Malware Config
Signatures
Files
-
8ef9394b1af75d7393ed5f96afc8718f80727679690ecc33388af427444a6862.exe windows x86
4e5096c7f810e767599a7009c4cb6c3b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileMappingA
GetVersionExW
GetCurrentProcessId
CreateWaitableTimerW
DisableThreadLibraryCalls
TerminateThread
RtlCaptureStackBackTrace
InterlockedExchangeAdd
ExitProcess
InitializeCriticalSection
InterlockedCompareExchange
GetSystemInfo
DelayLoadFailureHook
DeleteCriticalSection
CreateEventW
Sleep
IsProcessorFeaturePresent
IsDebuggerPresent
CompareStringW
LoadLibraryA
WriteFile
GlobalUnlock
ResetEvent
PulseEvent
GetCurrentThreadId
SetLastError
GetVersionExA
GetModuleHandleA
LockResource
HeapAlloc
GetLastError
QueryDepthSList
SetThreadPriority
DuplicateHandle
MapViewOfFile
VirtualQuery
SetEvent
InterlockedPushEntrySList
LeaveCriticalSection
GetCurrentProcess
RaiseException
ReadFile
CloseHandle
InitializeSListHead
InterlockedIncrement
FindResourceW
CreateFileW
GetModuleHandleW
GetFullPathNameA
GetProcessId
FindFirstFileW
TerminateProcess
VirtualFree
SetWaitableTimer
FindClose
CreateThread
LoadLibraryW
LocalAlloc
LocalFree
UnmapViewOfFile
CancelIo
GetFileSize
GetTickCount
WaitForMultipleObjects
SystemTimeToFileTime
GetProcessHeap
FreeLibrary
CreateFileA
OutputDebugStringW
WideCharToMultiByte
GetCurrentThread
InterlockedFlushSList
InterlockedDecrement
VirtualAlloc
InterlockedExchange
HeapFree
MulDiv
UnhandledExceptionFilter
GetProcAddress
ProcessIdToSessionId
WaitForSingleObjectEx
GetSystemDirectoryW
QueryPerformanceFrequency
OutputDebugStringA
WaitForSingleObject
CreateFileMappingW
InitializeCriticalSectionAndSpinCount
GetACP
GetOverlappedResult
DebugBreak
SizeofResource
VirtualLock
GetVersion
RtlUnwind
GetProcessWorkingSetSize
TryEnterCriticalSection
LoadResource
HeapReAlloc
SetUnhandledExceptionFilter
EnterCriticalSection
lstrcmpiA
SetProcessWorkingSetSize
GetSystemTimeAsFileTime
QueryPerformanceCounter
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
PropVariantClear
PropVariantCopy
CoTaskMemAlloc
msvcrt
_errno
__dllonexit
_CIatan
_initterm
_wtoi
_CIexp
qsort
isalpha
malloc
memmove
_resetstkoflw
_adjust_fdiv
_CItan
_stricmp
_lock
_CIsinh
_finite
memset
clock
wcsstr
_wtof
wcstol
_CIlog
_CIatan2
toupper
memcpy
atoi
isdigit
_CIasin
modf
ceil
_CItanh
_purecall
_copysign
_amsg_exit
setlocale
_onexit
_CIpow
_controlfp
_isnan
_CIacos
_CIcosh
atof
_CIsqrt
_strdup
_unlock
calloc
_CIfmod
_XcptFilter
_clearfp
_CIcos
strchr
isxdigit
free
_fpclass
floor
isspace
realloc
wcschr
_vsnprintf
_wcsicmp
_CIsin
isalnum
_vsnwprintf
tolower
rpcrt4
RpcServerInqBindings
RpcEpRegisterW
RpcServerInqCallAttributesW
NdrAsyncClientCall
RpcAsyncCompleteCall
RpcServerRegisterIfEx
NdrAsyncServerCall
UuidToStringW
UuidCreate
RpcAsyncCancelCall
RpcSsDestroyClientContext
RpcBindingFree
RpcStringBindingComposeW
RpcAsyncGetCallStatus
RpcServerUseProtseqW
RpcBindingSetAuthInfoExW
RpcServerUnregisterIfEx
I_RpcExceptionFilter
RpcBindingFromStringBindingW
RpcBindingVectorFree
RpcStringFreeW
RpcAsyncInitializeHandle
ntdll
DbgBreakPoint
RtlNumberGenericTableElements
NtMapViewOfSection
RtlDeleteElementGenericTable
RtlSetBits
NtCreateSection
NtQuerySystemInformation
NtAllocateVirtualMemory
RtlLookupElementGenericTable
RtlInterlockedFlushSList
DbgPrintEx
NtAddAtom
RtlFindClearBitsAndSet
RtlInsertElementGenericTable
RtlEnumerateGenericTableWithoutSplaying
RtlInitializeGenericTable
NtUnmapViewOfSection
RtlClearBits
DbgPrompt
gdi32
GetDIBits
SelectPalette
CreateDIBSection
GetDeviceCaps
SelectObject
DrawEscape
CombineRgn
DeleteObject
CreateICW
BitBlt
CreatePalette
CreateRectRgnIndirect
CreateCompatibleDC
GdiEntry13
OffsetRgn
RealizePalette
GetRgnBox
DeleteDC
RectInRegion
CreateDCW
GetDCOrgEx
CreateCompatibleBitmap
GetRegionData
SetLayout
GetSystemPaletteEntries
advapi32
TraceMessage
RegQueryValueExW
RegQueryValueExA
UnregisterTraceGuids
RegOpenKeyA
TraceEvent
RegCloseKey
GetTraceEnableLevel
RegOpenKeyExW
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableFlags
psapi
GetProcessMemoryInfo
user32
EnumDisplayDevicesW
IntersectRect
UpdateLayeredWindow
OffsetRect
GetDC
GetDesktopWindow
IsWindow
GetMonitorInfoW
CopyRect
ReleaseDC
GetGuiResources
RegisterWindowMessageW
SetRect
DispatchMessageW
GetClientRect
GetWindowDC
PeekMessageW
EnumDisplaySettingsW
TranslateMessage
SystemParametersInfoW
GetWindowLongW
InvalidateRect
EnumDisplayMonitors
ClientToScreen
PostMessageW
EqualRect
MsgWaitForMultipleObjects
SetLayeredWindowAttributes
IsRectEmpty
Sections
.text Size: 303KB - Virtual size: 302KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE