Static task
static1
Behavioral task
behavioral1
Sample
61c29bc83a2834b571eb2909f411c83b1fffee5b2d6f9f5d2ef9a018923bfd49.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
61c29bc83a2834b571eb2909f411c83b1fffee5b2d6f9f5d2ef9a018923bfd49.exe
Resource
win10v2004-20220812-en
General
-
Target
61c29bc83a2834b571eb2909f411c83b1fffee5b2d6f9f5d2ef9a018923bfd49
-
Size
54KB
-
MD5
564d66081a1e9e23bb151f0563cc8510
-
SHA1
80ed577dca6b51a86cc0034752687484a7a62b95
-
SHA256
61c29bc83a2834b571eb2909f411c83b1fffee5b2d6f9f5d2ef9a018923bfd49
-
SHA512
dd27982dcd2b20f7bb0129e92b6bf24e255eaf3a7a744a3f02ca3ad4048b3af42fd5e045ec3db3975943a89e632e4052855b049796ebd5b881d1737e8a4dd5ef
-
SSDEEP
1536:IqaFJJA/MXOch1Nvc8Gx6K7jjXA8iodh2PzxkJ:4rAgOcq77XCvPzx
Malware Config
Signatures
Files
-
61c29bc83a2834b571eb2909f411c83b1fffee5b2d6f9f5d2ef9a018923bfd49.exe windows x86
d23314c5bd8326712a667023f475bd80
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
RegisterConsoleIME
UnregisterConsoleIME
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
lstrlenW
lstrcpyW
lstrcatW
lstrcpynW
WideCharToMultiByte
GetSystemDirectoryW
SetCurrentDirectoryW
OpenEventW
SetEvent
CloseHandle
LocalAlloc
LocalFree
GetStartupInfoA
GetCurrentThreadId
user32
IsWindowEnabled
ActivateKeyboardLayout
PostMessageW
GetKeyboardLayoutList
SendMessageTimeoutW
PostQuitMessage
SetForegroundWindow
DefWindowProcW
EnableWindow
DestroyWindow
GetKeyState
GetKeyboardLayoutNameW
GetMessageW
TranslateMessage
DispatchMessageW
LoadStringW
LoadIconW
LoadCursorW
RegisterClassW
GetSystemMetrics
CreateWindowExW
UnregisterClassW
AttachThreadInput
ntdll
RtlLeaveCriticalSection
NtOpenProcessToken
RtlUnicodeToMultiByteSize
NtQueryInformationToken
NtClose
RtlInitializeCriticalSection
NtQueryVirtualMemory
RtlUnwind
RtlCopyLuid
RtlEnterCriticalSection
imm32
ImmGetContext
ImmReleaseContext
ImmGetConversionStatus
ImmGetGuideLineW
ImmSetConversionStatus
ImmSimulateHotKey
ImmGetIMEFileNameW
ImmEscapeW
ImmDisableTextFrameService
ImmGetOpenStatus
ImmNotifyIME
ImmGetCandidateListW
ImmGetCompositionStringW
ImmSetActiveContextConsoleIME
ImmTranslateMessage
ImmCallImeConsoleIME
ImmGetProperty
ImmCreateContext
ImmAssociateContext
ImmSetOpenStatus
ImmDestroyContext
ImmIsIME
gdi32
GetStockObject
msvcrt
_controlfp
__set_app_type
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
Sections
.text Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 472B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 30KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
glxgxbm Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE