Static task
static1
Behavioral task
behavioral1
Sample
f3fc9074959529599ca39e4d336df9a521ba739a29ff4987635c1cbf0349cdfe.exe
Resource
win7-20220812-en
General
-
Target
f3fc9074959529599ca39e4d336df9a521ba739a29ff4987635c1cbf0349cdfe
-
Size
301KB
-
MD5
59e0e07f08e792bfa6e4c1ccce72acf0
-
SHA1
bd7cf6a486a65dedd3a074f5d0791be896992c41
-
SHA256
f3fc9074959529599ca39e4d336df9a521ba739a29ff4987635c1cbf0349cdfe
-
SHA512
6177897a983a275d67a4e433fc323136718d9a6b539d2a8113b04607f9ddac1c76306a5a6d113056f522fd4c52fa8c1cf883ad3796cbd125ddae79410e2c5bf4
-
SSDEEP
6144:6FEhx6EbfIrf7KjTBNcC8xjOMv/HkCflmKsRYvSA:6FEhx6E8KjTbcHjnX3psRYKA
Malware Config
Signatures
Files
-
f3fc9074959529599ca39e4d336df9a521ba739a29ff4987635c1cbf0349cdfe.exe windows x86
0a0aba4bea67f11419b4554ea849a6b7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleFileNameExW
dbghelp
SymGetOptions
SymInitialize
SymSetOptions
StackWalk
SymGetModuleInfo
SymFunctionTableAccess
SymLoadModule
wininet
InternetCrackUrlW
InternetCloseHandle
InternetOpenA
InternetSetOptionA
InternetConnectA
HttpOpenRequestA
HttpAddRequestHeadersA
HttpSendRequestExA
InternetWriteFile
HttpEndRequestA
kernel32
GetStringTypeW
GetStringTypeA
FlushFileBuffers
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetStartupInfoA
GetFileType
SetHandleCount
GetCurrentDirectoryA
LocalFree
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetProcAddress
LoadLibraryW
CloseHandle
WaitForSingleObject
WideCharToMultiByte
lstrlenW
RaiseException
GetLastError
InterlockedDecrement
lstrcmpiW
SetEvent
CreateThread
CreateEventW
GetModuleFileNameW
InterlockedIncrement
lstrlenA
DebugBreak
OutputDebugStringW
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
Sleep
GetCurrentThreadId
GetCommandLineW
VirtualFreeEx
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
GetModuleFileNameA
VirtualQueryEx
UnmapViewOfFile
FlushInstructionCache
GetCurrentProcess
MapViewOfFile
CreateFileMappingW
SetLastError
CreateFileW
DeleteFileW
GetTempPathW
GetTickCount
ReadFile
GetFileSize
InterlockedExchange
GetSystemDefaultLCID
GetVersionExW
WriteFile
GlobalFree
GlobalAlloc
GetCurrentProcessId
SetFilePointer
GetShortPathNameW
FindClose
FindFirstFileW
HeapDestroy
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
GetStartupInfoW
GetFileAttributesA
GetDriveTypeW
FileTimeToLocalFileTime
FileTimeToSystemTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
HeapReAlloc
RtlUnwind
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
HeapCreate
ExitProcess
GetStdHandle
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapSize
GetLocaleInfoA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
TlsFree
GetTimeZoneInformation
CreateFileA
SetEndOfFile
GetDriveTypeA
CompareStringA
CompareStringW
SetEnvironmentVariableA
OpenThread
GetConsoleCP
GetConsoleMode
GetFullPathNameW
user32
CharLowerBuffW
LoadImageW
GetParent
GetWindow
GetWindowRect
SystemParametersInfoW
GetClientRect
MapWindowPoints
SetWindowPos
SendMessageW
GetDlgItem
ShowWindow
GetWindowLongW
GetActiveWindow
DestroyWindow
EndDialog
DialogBoxParamW
LoadStringW
SetWindowLongW
GetMessageW
TranslateMessage
DispatchMessageW
CharNextW
PostThreadMessageW
GetSystemMetrics
UnregisterClassA
advapi32
RegOpenKeyW
RegCreateKeyW
OpenProcessToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegQueryValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
shell32
SHGetFolderPathW
ShellExecuteExW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
CoTaskMemRealloc
StringFromGUID2
CoTaskMemAlloc
oleaut32
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
RegisterTypeLi
VarUI4FromStr
UnRegisterTypeLi
shlwapi
StrCmpNIW
PathFileExistsW
Sections
.text Size: 140KB - Virtual size: 139KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 44KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rrdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE