Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
General
-
Target
tmp
-
Size
198KB
-
MD5
a31f9f2d3f565b2609ac413d11283d1d
-
SHA1
40d125a14854e09ee0e95f9bb25afa5c1a0d044d
-
SHA256
ffdf7e20539e1aa6c31d8675e83b98bcb12f28810575509f8a8a79622dc456a8
-
SHA512
fc08c3de1ef29c360e0e1984dc3f374cfdabf314e9ebf21b41bfa8c3bba7ed212fdd4c213ccb23457331d1450feb3194ebf12068b59705b6432afdbe75736901
-
SSDEEP
3072:3qowD71AbpdG3oopu/IKCYj9y24AkOvYaLFgungbNTK/lCeYk26cZAfm2G:l6J2ALuYb2jB5x7k8lCe4ZA
Malware Config
Signatures
Files
-
tmp.exe windows x86
be3e7aa073c4f5471cc568fb9e53f0a7
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathCompactPathA
PathIsRootA
SHDeleteValueA
StrStrIW
SHRegEnumUSKeyW
PathIsRelativeW
SHRegGetUSValueW
SHRegEnumUSValueA
SHEnumKeyExW
PathCompactPathExA
PathFindExtensionW
PathIsLFNFileSpecA
StrCmpNIW
DllGetVersion
PathCanonicalizeA
UrlIsNoHistoryA
StrFormatByteSize64A
SHRegOpenUSKeyW
UrlIsW
SHRegQueryInfoUSKeyA
SHCopyKeyW
AssocQueryStringW
SHRegGetPathW
PathRemoveBackslashW
SHEnumValueA
PathBuildRootA
StrCatBuffA
PathCreateFromUrlA
SHCreateThread
PathGetDriveNumberA
PathRemoveBlanksW
StrFormatKBSizeW
PathSearchAndQualifyA
SHRegSetPathA
SHRegGetBoolUSValueW
SHRegEnumUSValueW
UrlEscapeA
wnsprintfA
PathUnquoteSpacesA
SHRegisterValidateTemplate
PathCombineW
PathIsFileSpecW
UrlGetPartA
PathSetDlgItemPathW
StrTrimW
SHRegWriteUSValueW
StrChrIW
PathIsUNCW
PathIsSystemFolderA
SHDeleteValueW
UrlUnescapeA
PathSetDlgItemPathA
PathUnquoteSpacesW
StrToIntExA
StrCmpNW
PathSearchAndQualifyW
SHOpenRegStream2W
PathSkipRootA
UrlUnescapeW
PathMatchSpecW
StrChrNW
wvnsprintfA
StrRetToStrW
PathIsLFNFileSpecW
PathUnmakeSystemFolderW
StrCSpnIW
SHRegDeleteUSValueW
SHEnumKeyExA
PathGetArgsA
PathCommonPrefixW
PathIsDirectoryA
SHRegGetValueA
PathCompactPathExW
SHRegGetPathA
PathFindFileNameA
user32
UnhookWindowsHookEx
WinHelpA
HiliteMenuItem
CharLowerBuffA
GetParent
WindowFromDC
SetMenuItemInfoW
DdeUninitialize
UnhookWindowsHook
GetPropW
ShowWindowAsync
GetMessageA
InsertMenuA
DialogBoxParamW
IsChild
LoadBitmapA
WINNLSGetEnableStatus
GetReasonTitleFromReasonCode
SendMessageCallbackA
DragObject
DrawAnimatedRects
GetClipboardViewer
LockSetForegroundWindow
LoadIconW
SetCaretPos
keybd_event
RegisterWindowMessageA
ShowOwnedPopups
AllowForegroundActivation
DialogBoxIndirectParamA
ImpersonateDdeClientWindow
SetClassLongW
GetMessageTime
MessageBeep
OpenClipboard
MessageBoxTimeoutW
ToAscii
SubtractRect
MessageBoxExA
LoadMenuW
BuildReasonArray
CreateWindowStationW
InvalidateRgn
ClientToScreen
SetWindowWord
ReasonCodeNeedsBugID
MapWindowPoints
ToAsciiEx
GetClipboardFormatNameW
WaitForInputIdle
EnumPropsExA
IMPGetIMEW
RegisterSystemThread
GetWindowTextLengthA
RemovePropA
DestroyMenu
EnumDesktopWindows
CharToOemA
FlashWindowEx
wvsprintfA
CharUpperA
UnregisterClassW
SetDlgItemTextW
SetForegroundWindow
GetClassNameA
IsCharUpperA
GetWindowModuleFileNameA
IMPSetIMEW
CreateDialogParamA
SetWindowsHookExA
SetWindowRgn
WCSToMBEx
CtxInitUser32
GetClipboardSequenceNumber
ChangeDisplaySettingsW
SetClassLongA
FreeDDElParam
GetMenuCheckMarkDimensions
UserRegisterWowHandlers
PrivateExtractIconExW
CreateDialogParamW
GetWindowContextHelpId
shell32
DAD_AutoScroll
OpenAs_RunDLLA
ShellExecuteA
StrNCmpIW
StrNCmpA
SHInvokePrinterCommandA
FindExecutableA
StrRChrIW
SHGetRealIDL
SHGetNewLinkInfoW
SHFlushSFCache
ILFindChild
InternalExtractIconListW
SHGetUnreadMailCountW
SHTestTokenMembership
SHMapPIDLToSystemImageListIndex
SHBrowseForFolder
OpenAs_RunDLLW
ExtractIconExW
SHChangeNotify
Control_RunDLLAsUserW
SHAppBarMessage
ILClone
IsLFNDrive
PathIsSlowA
SHQueryRecycleBinA
WOWShellExecute
SHSetLocalizedName
StrStrW
PathGetShortPath
SHLoadNonloadedIconOverlayIdentifiers
ShellExecuteEx
SHGetMalloc
CheckEscapesW
RealShellExecuteExW
SheSetCurDrive
SHFileOperation
SHLoadInProc
ExtractAssociatedIconW
StrCmpNW
PathQualify
SHSetUnreadMailCountW
SHPathPrepareForWriteW
SHGetFolderLocation
SHCreateProcessAsUserW
SHOpenFolderAndSelectItems
DAD_DragLeave
Control_RunDLLA
PathIsExe
StrChrA
DAD_SetDragImage
SHGetDiskFreeSpaceA
IsLFNDriveW
ILFree
Win32DeleteFile
SHUpdateRecycleBinIcon
Shell_MergeMenus
SHGetIconOverlayIndexW
ShellHookProc
SHGetSettings
ILIsEqual
SHGetInstanceExplorer
SHFreeNameMappings
SHGetFileInfoW
SHSimpleIDListFromPath
SHCreateLocalServerRunDll
StrCmpNA
ExtractIconExA
ExtractAssociatedIconExA
ShellExec_RunDLL
StrNCmpW
StrRChrW
PifMgr_SetProperties
Shell_GetImageLists
SHExtractIconsW
GetFileNameFromBrowse
SHGetSetSettings
SHGetFolderPathW
SHPropStgWriteMultiple
SHEnableServiceObject
PrintersGetCommand_RunDLLW
StrRStrIA
SHGetSpecialFolderPathA
SHChangeNotifyDeregister
advapi32
CommandLineFromMsiDescriptor
CredGetTargetInfoW
RegOpenKeyA
EnableTrace
CreateServiceW
CredUnmarshalCredentialW
LsaCreateSecret
ConvertStringSecurityDescriptorToSecurityDescriptorA
QueryTraceW
ObjectCloseAuditAlarmW
GetTrusteeFormA
EncryptFileW
IsTextUnicode
LsaOpenPolicySce
ConvertSecurityDescriptorToStringSecurityDescriptorW
CryptDestroyHash
LsaCreateAccount
StartServiceCtrlDispatcherA
CreateWellKnownSid
CreateProcessAsUserA
AddAuditAccessObjectAce
SetPrivateObjectSecurityEx
LsaCreateTrustedDomainEx
CredWriteDomainCredentialsW
BuildSecurityDescriptorW
GetSecurityDescriptorDacl
LsaQueryInformationPolicy
EnumServiceGroupW
ReadEventLogW
SystemFunction008
CryptExportKey
GetInformationCodeAuthzLevelW
FreeSid
LsaSetTrustedDomainInfoByName
OpenProcessToken
RegSetValueExW
GetAuditedPermissionsFromAclA
RegQueryValueExW
BuildTrusteeWithSidA
SystemFunction011
SaferCloseLevel
RemoveUsersFromEncryptedFile
ConvertAccessToSecurityDescriptorW
RegDeleteKeyW
WmiFileHandleToInstanceNameA
CredRenameW
GetSecurityDescriptorLength
RegEnumValueA
RegOverridePredefKey
AddAccessDeniedAceEx
SystemFunction034
CreatePrivateObjectSecurity
BuildImpersonateTrusteeW
InstallApplication
ElfClearEventLogFileA
LsaICLookupSids
RegEnumKeyA
GetFileSecurityW
RegNotifyChangeKeyValue
LogonUserA
AdjustTokenGroups
CreateCodeAuthzLevel
RegQueryValueExA
IdentifyCodeAuthzLevelW
SystemFunction027
SystemFunction013
AddAce
LsaAddPrivilegesToAccount
FreeEncryptedFileKeyInfo
LsaSetSystemAccessAccount
CryptEnumProvidersA
ElfReportEventA
WmiQuerySingleInstanceA
SaferiChangeRegistryScope
LsaSetQuotasForAccount
SystemFunction007
IsValidSid
SystemFunction022
RegCreateKeyW
IsValidSecurityDescriptor
gdi32
PlayMetaFileRecord
XLATEOBJ_hGetColorTransform
GdiPrinterThunk
XFORMOBJ_bApplyXform
CreateSolidBrush
ColorCorrectPalette
CreatePatternBrush
PolylineTo
GdiGetBitmapBitsSize
PATHOBJ_vGetBounds
GetCharWidthI
DdEntry34
DdEntry9
PtInRegion
EngCreatePalette
DdEntry8
EngGetDriverName
SelectClipRgn
GetPolyFillMode
GetGlyphOutlineA
GetCharacterPlacementW
GetClipRgn
CreatePen
GetLogColorSpaceW
GetEnhMetaFileA
DdEntry46
EngQueryLocalTime
SetBkMode
DdEntry39
DdEntry48
GdiEndPageEMF
DdEntry43
CLIPOBJ_bEnum
SetBrushAttributes
SelectFontLocal
SetPixelFormat
SetMiterLimit
DdEntry22
ScaleWindowExtEx
GdiEntry2
ExtCreatePen
GetTextFaceA
PtVisible
EnumFontFamiliesA
CreateMetaFileW
AbortDoc
FONTOBJ_pvTrueTypeFontFile
DdEntry19
FONTOBJ_pfdg
MirrorRgn
EngBitBlt
CreatePenIndirect
GdiConvertBitmap
GdiConvertDC
GetClipBox
DdEntry41
GetHFONT
EngGetPrinterDataFileName
CreateICA
GetRasterizerCaps
MaskBlt
GdiPlayScript
ScaleViewportExtEx
StretchDIBits
SetICMMode
CLIPOBJ_ppoGetPath
GetEUDCTimeStamp
SetICMProfileA
GetKerningPairsA
GdiConvertAndCheckDC
DdEntry37
GetRegionData
InvertRgn
DdEntry25
GdiAlphaBlend
GetStretchBltMode
GetEnhMetaFilePaletteEntries
DdEntry16
EngMultiByteToWideChar
CreateFontIndirectExA
GdiGetBatchLimit
GdiEntry12
GdiStartPageEMF
SetRelAbs
bInitSystemAndFontsDirectoriesW
CreateICW
GdiProcessSetup
StartDocW
GetStockObject
AddFontResourceA
EngAssociateSurface
GetMiterLimit
CreateScalableFontResourceA
GetObjectW
GetMetaFileW
GdiEntry4
LineTo
PolyTextOutA
ExcludeClipRect
GetCharWidthA
EnumFontFamiliesExA
GetDIBits
GdiEntry8
Rectangle
EngStrokeAndFillPath
CombineTransform
CreateBitmap
GdiGetPageCount
kernel32
SetFirmwareEnvironmentVariableW
lstrlenW
GetNumberFormatA
SetFileTime
SetFileAttributesW
BaseQueryModuleData
_hread
CreateJobObjectW
GlobalAddAtomW
ClearCommBreak
GetVersion
IsSystemResumeAutomatic
_hwrite
GetConsoleAliasExesA
GetWindowsDirectoryA
lstrcpyn
GetCompressedFileSizeW
SetFilePointer
TerminateProcess
CreateMutexA
CreateRemoteThread
GetNumberOfConsoleFonts
VirtualAlloc
LCMapStringW
GetUserDefaultUILanguage
lstrcpyW
GetModuleHandleExW
GetCommandLineW
GetVolumeInformationW
InitAtomTable
HeapValidate
QueryDosDeviceA
RtlUnwind
GetNumberOfConsoleInputEvents
ActivateActCtx
SetComPlusPackageInstallStatus
WriteConsoleW
DuplicateConsoleHandle
CancelWaitableTimer
GetCurrentThreadId
SetConsolePalette
OpenThread
GetFileTime
AttachConsole
DnsHostnameToComputerNameW
lstrcatW
GetFileAttributesExW
SetConsoleCursorInfo
GetCurrentConsoleFont
GetPrivateProfileSectionNamesA
PrivMoveFileIdentityW
IsValidLanguageGroup
EnumResourceTypesA
GetComputerNameExA
InterlockedIncrement
HeapSize
WriteConsoleInputVDMW
CloseProfileUserMapping
LocalFlags
EnumSystemLocalesW
EnumCalendarInfoW
FindFirstFileExW
GetSystemPowerStatus
OpenJobObjectW
WriteFile
GetConsoleAliasW
GetThreadIOPendingFlag
WaitForMultipleObjectsEx
DebugBreak
SetConsoleMenuClose
BeginUpdateResourceW
GetConsoleFontSize
FindFirstVolumeMountPointW
CloseHandle
GetModuleHandleA
EnumResourceLanguagesW
GetTickCount
CreateFileMappingA
SetErrorMode
SetVDMCurrentDirectories
GetStringTypeExW
GetCurrentDirectoryA
HeapWalk
GetPrivateProfileIntA
CreateEventW
GetConsoleKeyboardLayoutNameA
GlobalFree
ZombifyActCtx
CreateFiber
QueryDosDeviceW
ChangeTimerQueueTimer
EnumCalendarInfoExW
BindIoCompletionCallback
GetProcessDEPPolicy
Process32NextW
Heap32Next
Sections
.text Size: 145KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 34KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ