Static task
static1
Behavioral task
behavioral1
Sample
ff49efe29fd39290a4073ba152241c419b23f8102df0f03a6e6e06c256b8a1c7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ff49efe29fd39290a4073ba152241c419b23f8102df0f03a6e6e06c256b8a1c7.exe
Resource
win10v2004-20220812-en
General
-
Target
ff49efe29fd39290a4073ba152241c419b23f8102df0f03a6e6e06c256b8a1c7
-
Size
25KB
-
MD5
81c30d7f10a45494786182c6f708fca5
-
SHA1
916d39316ca767b4b0e230cf1c7ea3eacf711c3a
-
SHA256
ff49efe29fd39290a4073ba152241c419b23f8102df0f03a6e6e06c256b8a1c7
-
SHA512
8c52288e90b0c13b5bfadfe997a79585275288618ca551c42dd3ac7588d4094a7ffa944528f34b4ea69ff8280340da107fae60456b8cbc1dbe170ae014a1e8ef
-
SSDEEP
384:ZCCZsTv7Ub0PRfYEtOvmTFaAX0BJs3WdEMJuCSUe27wk:LZsr742YLvmTQA4PZwi1
Malware Config
Signatures
Files
-
ff49efe29fd39290a4073ba152241c419b23f8102df0f03a6e6e06c256b8a1c7.exe windows x86
e2197028061120c3a9fe900804ea03a6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RemoveDirectoryA
GetTickCount
ClearCommBreak
GetModuleHandleA
OpenProcess
OpenEventW
CreateFileA
GetFileAttributesA
GetCommandLineW
SetLastError
ReleaseMutex
ResetEvent
HeapSize
WriteConsoleA
SetConsoleCP
GetEnvironmentVariableW
ExitProcess
DeleteFileA
VirtualAllocEx
SetEvent
GetStartupInfoA
user32
DispatchMessageW
DispatchMessageW
GetClassInfoA
GetKeyState
GetDC
GetCursorInfo
FindWindowA
GetSysColor
PeekMessageA
GetWindowLongA
GetDC
GetCaretPos
CallWindowProcW
linkinfo
CreateLinkInfoA
CreateLinkInfoA
CreateLinkInfoA
CreateLinkInfoA
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 10B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 19KB - Virtual size: 47KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
qdotnip Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE