Static task
static1
Behavioral task
behavioral1
Sample
bf551614722616b3e6a1b0685cf5c0aa751b417667b8876ee090681fca2d0a5a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
bf551614722616b3e6a1b0685cf5c0aa751b417667b8876ee090681fca2d0a5a.exe
Resource
win10v2004-20220812-en
General
-
Target
bf551614722616b3e6a1b0685cf5c0aa751b417667b8876ee090681fca2d0a5a
-
Size
716KB
-
MD5
8003bd51f9eb15ddaef06290fb9c6210
-
SHA1
c862b91026b4e8f972f2d11a772c49657d8028b8
-
SHA256
bf551614722616b3e6a1b0685cf5c0aa751b417667b8876ee090681fca2d0a5a
-
SHA512
fc094c6324deffdb7168edd746e64a030406381da337aee5dd39099ed4b507a667b05ba65b580770a6f17f648d45a4d94093601701777631038bc4aaa3cdea50
-
SSDEEP
12288:MplGz70p4c+A9X4c+A9X4c+A9X4c+A9X4c+A9X4c+A9X4c+A9X4c+A9X4c+A9X4A:MplGz+9N9N9N9N9N9N9N9N9N9N9N9N9r
Malware Config
Signatures
Files
-
bf551614722616b3e6a1b0685cf5c0aa751b417667b8876ee090681fca2d0a5a.exe windows x86
d242945f3ebffd9d06c6f6a5a6d8eb05
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
common
?AddFmtString@TXStringBundle@@YAXABVCFmtString@@@Z
?PropertyStr@CFmtString@@QAEHPB_W0@Z
??0CFmtString@@QAE@XZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
??1CTXBSTR@@QAE@XZ
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
??BCTXBSTR@@QBEPA_WXZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
??4CTXStringW@@QAEAAV0@_W@Z
?Replace@CTXStringW@@QAEH_W0@Z
ord34
??9@YA_NABVCTXStringW@@PB_W@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
??8@YA_NABVCTXStringW@@PB_W@Z
??0CTXStringW@@QAE@PA_W@Z
??1CTXStringW@@QAE@XZ
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
??0CTXStringW@@QAE@XZ
??0CTXStringW@@QAE@PB_W@Z
?GetRegulatedTime@Time@Util@@YA_NAAJ@Z
?GetTime@CTXTime@@QBE_JXZ
?GetTickCount@CTXTime@@SA?AV1@XZ
??YCTXStringW@@QAEAAV0@PB_W@Z
??YCTXStringW@@QAEAAV0@_W@Z
??9@YA_NABVCTXStringW@@_W@Z
?Right@CTXStringW@@QBE?AV1@H@Z
??4CTXStringW@@QAEAAV0@PA_W@Z
??1CTXStringA@@QAE@XZ
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
??1CTXCommPack@@UAE@XZ
?GetBufferOut@CTXCommPack@@QAEHAAVCTXBuffer@@@Z
?AddWord@CTXCommPack@@QAEHGH@Z
??1CFmtString@@QAE@XZ
??0CTXCommPack@@QAE@XZ
??0CTXBSTR@@QAE@ABV0@@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
?DoFormat@CFmtString@@QAEPB_WPB_W@Z
??4CTXBSTR@@QAEAAV0@ABV0@@Z
??0CTXStringW@@QAE@ABV0@@Z
??ICTXBSTR@@QAEPAPA_WXZ
?IsEmpty@CTXBSTR@@QAEHXZ
??0CTXBSTR@@QAE@PB_W@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
ord26
?AddTLV@CTXCommPack@@QAEHKABVCTXBuffer@@W4TXCommPackDataType@@@Z
?FlushLog@TXLog@@YAXXZ
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
?PropertyDWord@CFmtString@@QAEHPB_WK0@Z
??0CTXBSTR@@QAE@XZ
?Format@CTXStringA@@QAAXPBDZZ
??0CTXStringA@@QAE@XZ
??M@YA_NABVCTXStringA@@0@Z
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?IsEmpty@CTXStringW@@QBE_NXZ
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
??1CTXThreadModel@@MAE@XZ
??0CTXThreadModel@@IAE@XZ
?WaitThread@CTXThreadModel@@QAEHK@Z
?Format@CTXStringW@@QAAXPB_WZZ
??M@YA_NABVCTXStringW@@0@Z
?StartThread@CTXThreadModel@@QAEHXZ
?Mid@CTXStringW@@QBE?AV1@HH@Z
?Left@CTXStringW@@QBE?AV1@H@Z
?Find@CTXStringW@@QBEHPB_WH@Z
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?ReverseFind@CTXStringW@@QBEH_W@Z
??ACTXStringW@@QBE_WH@Z
?GetLength@CTXStringW@@QBEHXZ
?ReleaseBuffer@CTXStringW@@QAEXH@Z
?GetBuffer@CTXStringW@@QAEPA_WH@Z
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?LoadStringW@TXStringBundle@@YAPB_WPB_W@Z
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?TXLog_DoTXLogVW@@YAXPAUtagLogObj@@PB_W1PAD@Z
??BCTXStringW@@QBEPB_WXZ
?OnUninitCom@Misc@Util@@YAXXZ
?AddByte@CTXCommPack@@QAEHE@Z
?ClearDeadQueue@Misc@Util@@YAXXZ
gf
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@0H@Z
afutil
?MessageBoxW@Misc@Util@@YAHPAUIGFFrame@@VCTXStringW@@1H@Z
?MessageBoxExW@Misc@Util@@YAHPAUIGFFrame@@PA_W1IPAUITXData@@PAPAU4@@Z
kernel32
CreateMutexW
OpenMutexW
InitializeCriticalSection
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetModuleHandleW
InterlockedIncrement
InterlockedDecrement
SetEvent
WriteFile
CreateFileW
lstrlenW
GetModuleFileNameW
GetPrivateProfileStringW
GetPrivateProfileIntW
GetFileAttributesW
FindClose
FindNextFileW
FindFirstFileW
Sleep
WritePrivateProfileStringW
WaitForSingleObject
GetLastError
MoveFileExW
CopyFileW
RemoveDirectoryW
GetVersionExW
GetSystemTimeAsFileTime
GetCurrentProcessId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
RaiseException
CloseHandle
DeleteFileW
DeleteCriticalSection
user32
UnregisterClassA
PostMessageW
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
shell32
SHCreateDirectoryExW
SHGetSpecialFolderPathW
ShellExecuteW
ole32
CoCreateInstance
OleUninitialize
OleInitialize
oleaut32
SysStringLen
LoadRegTypeLi
LoadTypeLi
SysFreeString
atl80
ord31
ord32
ord64
ord58
ord30
shlwapi
StrCmpW
StrCmpIW
msvcp80
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
msvcr80
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_configthreadlocale
??3@YAXPAX@Z
_CxxThrowException
free
??_V@YAXPAX@Z
memset
_time64
__wargv
__argc
_purecall
__CxxFrameHandler3
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
memcmp
_cexit
?terminate@@YAXXZ
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_controlfp_s
Sections
.text Size: 76KB - Virtual size: 73KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 596KB - Virtual size: 594KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ