Static task
static1
Behavioral task
behavioral1
Sample
330aed213f162fc9973f878c2bce894eefa4c494e37a6b92fcb74ae8a111a09d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
330aed213f162fc9973f878c2bce894eefa4c494e37a6b92fcb74ae8a111a09d.exe
Resource
win10v2004-20220901-en
General
-
Target
330aed213f162fc9973f878c2bce894eefa4c494e37a6b92fcb74ae8a111a09d
-
Size
477KB
-
MD5
724947595bd0e493364d2e992a4e06f7
-
SHA1
6b6b548086e76480c1f717d0d8a421e8ba25fe77
-
SHA256
330aed213f162fc9973f878c2bce894eefa4c494e37a6b92fcb74ae8a111a09d
-
SHA512
e66b56db652839920e28addee16a936250c6c4217fa9a534693391a5b1c59973a4eb217291a62ea855dbfe8b3afcd6a4fb82e7957e338318edc29255719b723f
-
SSDEEP
12288:sqWY1CpudYlBBg8M3mroFvvdjwX+Lf3rtT3N8N33:9MPBK3BLf7dCd3
Malware Config
Signatures
Files
-
330aed213f162fc9973f878c2bce894eefa4c494e37a6b92fcb74ae8a111a09d.exe windows x86
55ccc6ad63de13405e1a51e69338913f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
atl80
ord11
ord18
ord22
ord64
ord58
ord17
ord10
ord27
ord26
ord49
ord23
ord61
ord31
ord44
ord43
ord30
ord20
ord32
shlwapi
PathFileExistsW
wininet
InternetCrackUrlA
InternetSetOptionW
HttpOpenRequestW
InternetReadFileExA
HttpQueryInfoW
InternetCrackUrlW
InternetCanonicalizeUrlW
InternetConnectW
InternetOpenW
InternetWriteFile
HttpEndRequestW
HttpSendRequestExW
HttpAddRequestHeadersW
HttpSendRequestW
InternetCloseHandle
InternetSetCookieW
InternetQueryOptionW
InternetSetStatusCallbackW
qqplayer
??0CQmString@@QAE@ABV0@@Z
?DoLog@@YAHPB_WZZ
??0CQmString@@QAE@PB_W@Z
??YCQmString@@QAEXABV0@@Z
??1CQmString@@QAE@XZ
??BCQmString@@QAEPB_WXZ
?GetAppDataFolder@qzonemusic@@YA?AVCQmString@@XZ
?Unlock@CMyMutex@@QAEXXZ
?Lock@CMyMutex@@QAEHK@Z
??1CMyMutex@@QAE@XZ
??0CMyMutex@@QAE@XZ
?Create@CMyMutex@@QAEHPAU_SECURITY_ATTRIBUTES@@HPB_W@Z
?GetTempFile@qzonemusic@@YA?AVCQmString@@PB_W@Z
?SetQQUin@@YAXI@Z
?STR2DWORD@qzonemusic@@YAHPB_WAAK@Z
?GetExeFolder@qzonemusic@@YA?AVCQmString@@XZ
?CreateObjectFromFile@@YAJPB_WPAUIUnknown@@ABU_GUID@@2PAPAX@Z
?GetVersionInfoFromFile@qzonemusic@@YAHPB_WAAE1AAK2@Z
?InitLog@@YAHPB_W@Z
?EndLog@@YAXXZ
?SetExceptionCatcher@@YAXPB_WH@Z
?IsCurComponentBetter@qzonemusic@@YAHQB_W0@Z
?GetModulePath@qzonemusic@@YA?AVCQmString@@PAUHINSTANCE__@@@Z
?IsEmpty@CQmString@@QBEHXZ
?GetRegisterComponentPath@qzonemusic@@YA?AVCQmString@@ABU_GUID@@H@Z
?GetFileText@qzonemusic@@YA?AVCQmString@@PB_W@Z
?URLEncode@qzonemusic@@YA?AVCQmString@@PB_W@Z
?TrimString@qzonemusic@@YAXAAVCQmString@@@Z
kernel32
GetLocaleInfoA
GetACP
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetThreadLocale
InterlockedCompareExchange
LoadLibraryA
IsProcessorFeaturePresent
VirtualFree
GetStartupInfoW
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
VirtualAlloc
SetFilePointer
WriteFile
WritePrivateProfileStringW
GetPrivateProfileStringW
VirtualQuery
CreateDirectoryW
RaiseException
GetCommandLineW
GetCurrentThreadId
lstrcmpiW
EnterCriticalSection
LeaveCriticalSection
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
MultiByteToWideChar
WideCharToMultiByte
FormatMessageW
GetLastError
UnmapViewOfFile
CloseHandle
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
CreateEventW
InitializeCriticalSection
DeleteCriticalSection
TerminateThread
WaitForSingleObject
GetTickCount
SetEvent
ResetEvent
WaitForMultipleObjects
Sleep
OpenEventW
OpenProcess
lstrlenA
InterlockedDecrement
lstrlenW
FlushInstructionCache
GetCurrentProcess
SetLastError
GetSystemInfo
GlobalMemoryStatusEx
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
GetProcessTimes
GetSystemTimeAsFileTime
GetProcAddress
LoadLibraryW
DeleteFileW
GetTempFileNameW
GetTempPathW
CreateFileW
GetFileSize
ReadFile
GetModuleFileNameW
lstrcmpiA
InterlockedIncrement
CreateThread
user32
IsWindow
DefWindowProcW
DestroyWindow
RegisterClassExW
SetTimer
LoadCursorW
GetClassInfoExW
PostMessageW
KillTimer
SetRectEmpty
DispatchMessageW
TranslateMessage
MsgWaitForMultipleObjects
PeekMessageW
SetWindowLongW
PostThreadMessageW
CharNextW
EndPaint
GetClientRect
BeginPaint
IsChild
GetFocus
GetMessageW
GetClassInfoExA
LoadCursorA
UnregisterClassW
RegisterClassExA
SendMessageW
SetRect
CreateWindowExW
GetWindowLongW
LoadStringW
CallWindowProcW
UnregisterClassA
gdi32
DeleteDC
SetViewportOrgEx
SetWindowOrgEx
SetMapMode
SaveDC
TextOutW
LPtoDP
GetDeviceCaps
SetTextAlign
RestoreDC
advapi32
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetSpecialFolderPathW
ole32
CoCreateInstance
StringFromCLSID
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
CoInitialize
CoUninitialize
CoCreateGuid
oleaut32
LoadTypeLi
LoadRegTypeLi
DispCallFunc
VariantInit
SysStringLen
SysAllocString
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysFreeString
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
msvcp80
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$allocator@D@std@@QAE@XZ
?allocate@?$allocator@D@std@@QAEPADIPBX@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?empty@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE_NXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
msvcr80
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
fseek
_wfopen
fopen_s
_vsnwprintf_s
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
_initterm_e
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
_vsnprintf_s
_invalid_parameter_noinfo
strncmp
strstr
strlen
ftell
wcscat
fwrite
fread
wcsstr
memmove
wcsncpy
wcscpy
wcscmp
fclose
wcstol
_initterm
_endthread
_beginthread
free
_wcsicmp
calloc
_purecall
atol
_wtoi
wcsncpy_s
wcsrchr
memcmp
_wsplitpath
malloc
_resetstkoflw
sprintf_s
_vscwprintf
vswprintf_s
strcmp
rand
srand
_time64
atoi
_atoi64
wcsncat
_findclose
_wfindfirst64i32
_findfirst64i32
_beginthreadex
_wtof
isdigit
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
_except_handler4_common
_decode_pointer
_onexit
??1exception@std@@UAE@XZ
_lock
??3@YAXPAX@Z
memcpy_s
__CxxFrameHandler3
_CxxThrowException
swprintf_s
wcslen
memmove_s
??_V@YAXPAX@Z
_recalloc
_vswprintf
memset
wcschr
wcsncmp
memcpy
??2@YAPAXI@Z
strchr
psapi
GetProcessMemoryInfo
ws2_32
WSAStartup
gethostname
gethostbyname
inet_ntoa
htonl
socket
bind
sendto
inet_addr
htons
recvfrom
WSAGetLastError
ntohl
WSACleanup
closesocket
Sections
.text Size: 256KB - Virtual size: 255KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 96KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.crdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE