Behavioral task
behavioral1
Sample
c753cef82b1caf4e95005eaab59ba75039145c3acb2aba604343212f02011303.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c753cef82b1caf4e95005eaab59ba75039145c3acb2aba604343212f02011303.exe
Resource
win10v2004-20220901-en
General
-
Target
c753cef82b1caf4e95005eaab59ba75039145c3acb2aba604343212f02011303
-
Size
919KB
-
MD5
80d67942d744a08f61de84189b126dc8
-
SHA1
de0827f03af686966f6c5cdbbca0bd47e7ce2bd9
-
SHA256
c753cef82b1caf4e95005eaab59ba75039145c3acb2aba604343212f02011303
-
SHA512
113c58f0489ee93e93b498d884a64520ae64f4dbe49772d45ddd984e96e069392c32eac8ad66f25e0aba20567ba1fb483b8a05aecf06cd1ff4a52c54918f2655
-
SSDEEP
12288:w0plsReOYAuuQGGIKa2UVqnLoSl4tWE15IpoEl1ViO5:wolOe/GiJLog44w5IpoEl1Vi
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
c753cef82b1caf4e95005eaab59ba75039145c3acb2aba604343212f02011303.exe windows x86
2e18ac2bac0d6442f521ad765da636ef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
bdguictl
??0CBDComboBox@@QAE@XZ
??0CBDEdit@@QAE@XZ
??1CBDStatic@@UAE@XZ
??1CBDEdit@@UAE@XZ
?GetExternalBkRect@CBDBtnBase@@SA_NPAUHWND__@@PAUtagRECT@@@Z
?SetExternalBkRect@CBDBtnBase@@SA_NPAUHWND__@@PAUtagRECT@@@Z
??1CBDRadio@@UAE@XZ
?OnResetStoredObjects@CBDBtnBase@@MAEXXZ
?OnInitSkin@CBDRadio@@MAEXXZ
?DrawItem@CBDRadio@@MAEXPAUtagDRAWITEMSTRUCT@@@Z
?WindowProc@CBDBtnBase@@MAEJIIJ@Z
?PreTranslateMessage@CBDBtnBase@@MAEHPAUtagMSG@@@Z
?PreSubclassWindow@CBDRadio@@MAEXXZ
?GetMessageMap@CBDRadio@@MBEPBUAFX_MSGMAP@@XZ
??0CBDRadio@@QAE@XZ
?bdMessageBox@@YAHPAVCWnd@@PB_W1I1@Z
?Add@CBDRadioGroup@@QAEXPAVCBDRadio@@@Z
?OnPaint@CBDDialog@@IAEXXZ
?SetCheck@CBDRadioGroup@@QAEPAVCBDRadio@@H@Z
?GetRuntimeClass@CBDDialog@@UBEPAUCRuntimeClass@@XZ
??0CBDRadioGroup@@QAE@XZ
??1CBDRadioGroup@@QAE@XZ
??1CBDGDIManager@@UAE@XZ
??0CBDGDIManager@@QAE@XZ
?Init@CBDGDIManager@@QAE_NPB_W@Z
?SetGDIManager@CBDBaseCtrl@@QAEXPAVCBDGDIManager@@@Z
?GetCtrlManager@@YAAAVCCoolControlManager@@XZ
?InstallHook@CCoolControlManager@@QAEXHKH@Z
?SetColors@CTxFlatHeader@@QAEXKKHV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?GetFont@CBDGDIManager@@QAE_NV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@PAPAUHFONT__@@@Z
?GetCaptionCtrl@CBDDialog@@QAEPAVCBDCaptionCtrl@@XZ
?SetTitle@CBDCaptionCtrl@@QAEXPB_WH@Z
?GetTitle@CBDCaptionCtrl@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@XZ
?OnResetStoredObjects@CBDStatic@@MAEXXZ
?OnInitSkin@CBDStatic@@MAEXXZ
?DrawItem@CBDStatic@@MAEXPAUtagDRAWITEMSTRUCT@@@Z
?DefWindowProcW@CBDStatic@@MAEJIIJ@Z
?PreSubclassWindow@CBDStatic@@MAEXXZ
?GetMessageMap@CBDStatic@@MBEPBUAFX_MSGMAP@@XZ
?OnInitDialog@CBDDialog@@MAEHXZ
?SetSkinIcon@CBDIconStatic@@QAEXPB_W@Z
?GetThisMessageMap@CBDDialog@@KGPBUAFX_MSGMAP@@XZ
??0CBDDialog@@QAE@HPAVCWnd@@K@Z
??0CBDButton@@QAE@XZ
??0CBDIconStatic@@QAE@XZ
??1CBDDialog@@UAE@XZ
??1CBDButton@@UAE@XZ
??1CBDIconStatic@@UAE@XZ
?GetThisClass@CBDDialog@@SGPAUCRuntimeClass@@XZ
?SendHelpMessageToParent@CBDBaseCtrl@@IAEXPAUHWND__@@_NPAX@Z
?OnResetStoredObjects@CBDBaseCtrl@@MAEXXZ
?OnInitSkin@CBDBaseCtrl@@MAEXXZ
?OnSkinChange@CBDBaseCtrl@@MAEXK@Z
??0CBDBaseCtrl@@QAE@XZ
??0CTxFlatHeader@@QAE@XZ
??1CBDBaseCtrl@@UAE@XZ
??1CTxFlatHeader@@UAE@XZ
?SetSkin@CBDBaseCtrl@@QAEIPB_W@Z
?SetHelp@CBDBaseCtrl@@QAEXPB_W0@Z
?OnResetStoredObjects@CBDDialog@@MAEXXZ
?OnInitSkin@CBDDialog@@MAEXXZ
?OnSkinChange@CBDDialog@@MAEXK@Z
?OnShowHelp@CBDDialog@@MAE_NPB_WPAX@Z
?Create@CBDDialog@@UAEHIPAVCWnd@@KPB_W@Z
?DefWindowProcW@CBDDialog@@MAEJIIJ@Z
?PreSubclassWindow@CBDDialog@@MAEXXZ
??0CBDStatic@@QAE@XZ
??1CBDComboBox@@UAE@XZ
bdutils
?SetMode@CBDDebug@@QAEXH@Z
??0CBDDebug@@QAE@H@Z
??1CBDDebug@@QAE@XZ
?SetOutputFile@CBDDebug@@QAEXPB_W@Z
productinfo
?GetInstance@CProductInfo@@SAPAV1@XZ
?ReplaceVariables@CProductInfo@@QAEPB_WPA_WI@Z
txmlutil
?Attribute@TiXmlElement@@QBEPB_WPB_WPAH@Z
??0TiXmlDocument@@QAE@XZ
?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?Attribute@TiXmlElement@@QBEPB_WPB_W@Z
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@PB_W@Z
??1TiXmlDocument@@UAE@XZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
npcomm
?getNewEndpoint@NpcPipeEndpoint@@SAPAV1@XZ
sqlite3
??1SQLite3DB@sqlite@@UAE@XZ
??0SQLite3DB@sqlite@@QAE@XZ
?finalize@SQLite3Query@sqlite@@QAEXXZ
?nextRow@SQLite3Query@sqlite@@QAEXXZ
?getStringField@SQLite3Query@sqlite@@QAEPB_WHPB_W@Z
?execQuery@SQLite3DB@sqlite@@QAEPAVSQLite3Query@2@PB_W@Z
?getIntField@SQLite3Query@sqlite@@QAEHHH@Z
?open@SQLite3DB@sqlite@@QAEXPB_W@Z
?eof@SQLite3Query@sqlite@@QAE_NXZ
?finalize@SQLite3Statement@sqlite@@QAEXXZ
?compileStatement@SQLite3DB@sqlite@@QAEPAVSQLite3Statement@2@PB_W@Z
?execDML@SQLite3DB@sqlite@@QAEHPB_W@Z
?interrupt@SQLite3DB@sqlite@@QAEXXZ
?close@SQLite3DB@sqlite@@QAEXXZ
mfc90u
ord5979
ord6703
ord2695
ord2537
ord286
ord4490
ord3185
ord938
ord1783
ord1716
ord3651
ord4131
ord775
ord2597
ord1108
ord1357
ord2596
ord2130
ord4512
ord2282
ord3577
ord6666
ord2592
ord1665
ord4652
ord3489
ord524
ord744
ord6807
ord2360
ord4211
ord4448
ord4423
ord4173
ord6803
ord4747
ord2251
ord2206
ord6035
ord4179
ord1048
ord5548
ord6741
ord5830
ord4213
ord2087
ord3217
ord5674
ord5676
ord2447
ord4347
ord4996
ord5680
ord5663
ord6018
ord3115
ord4905
ord3670
ord589
ord794
ord4967
ord4043
ord4262
ord5767
ord1243
ord6811
ord265
ord6822
ord5778
ord266
ord3589
ord654
ord3528
ord2283
ord3286
ord2593
ord1315
ord2828
ord803
ord267
ord909
ord4494
ord2479
ord6577
ord1719
ord4660
ord3654
ord6604
ord6065
ord5653
ord778
ord811
ord280
ord600
ord296
ord813
ord2595
ord3252
ord3563
ord595
ord2069
ord3736
ord1063
ord1088
ord1607
ord6350
ord5650
ord1688
ord3061
ord6636
ord4527
ord4010
ord686
ord2280
ord3355
ord6411
ord1493
ord4658
ord2074
ord5664
ord4681
ord436
ord693
ord3842
ord1250
ord1248
ord799
ord4543
ord6579
ord1938
ord5632
ord4631
ord5167
ord5324
ord2208
ord1810
ord1809
ord1675
ord3353
ord6408
ord1754
ord1751
ord4345
ord1492
ord4664
ord5602
ord5512
ord6800
ord4603
ord3743
ord5154
ord4702
ord1728
ord6466
ord5685
ord5683
ord960
ord965
ord969
ord967
ord971
ord2615
ord2635
ord2619
ord2625
ord2623
ord2621
ord2638
ord2633
ord2617
ord2640
ord2628
ord2610
ord2612
ord2630
ord2375
ord2368
ord1641
ord6802
ord4174
ord6804
ord3682
ord5404
ord6376
ord3226
ord1442
ord5625
ord2139
ord1792
ord1791
ord1727
ord2771
ord2983
ord3112
ord4728
ord2966
ord3140
ord2774
ord2893
ord2764
ord4080
ord4081
ord4071
ord2891
ord4348
ord4910
ord4682
ord801
ord285
ord3220
ord6630
ord1137
ord6801
ord1272
msvcr90
_invoke_watson
_controlfp_s
_crt_debugger_hook
?terminate@@YAXXZ
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_vsnwprintf_s
malloc
realloc
free
memmove
_localtime64_s
wcsncpy_s
strnlen
strlen
_read
_write
_wsopen_s
_close
memcpy
_wfopen
_errno
__sys_errlist
mbstowcs
fclose
wcsspn
fread
ferror
feof
_snwprintf
isalnum
wcscpy
_wtoi
_time64
_itow_s
strcmp
_free_locale
_create_locale
_wcsicmp_l
_vsnwprintf
wcscpy_s
wcscspn
__CxxFrameHandler3
memcpy_s
memmove_s
_invalid_parameter_noinfo
memset
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_wcsicmp
wcsstr
wcslen
wcschr
_wcsupr_s
_wcslwr_s
iswspace
wcscmp
wcsnlen
_gmtime64_s
_purecall
qsort_s
_vscwprintf
vswprintf_s
wcsrchr
wcsncmp
_encode_pointer
kernel32
CreateThread
InterlockedDecrement
SetThreadPriority
ResumeThread
CreateDirectoryW
GetModuleFileNameW
LocalFree
EnterCriticalSection
LeaveCriticalSection
ReleaseSemaphore
GetCurrentThreadId
CloseHandle
CreateMutexW
OpenMutexW
CreateFileMappingW
OpenFileMappingW
ReleaseMutex
WaitForSingleObject
MapViewOfFile
UnmapViewOfFile
FreeLibrary
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
GetTempPathW
DeleteFileW
GetModuleHandleW
LoadLibraryW
GetProcAddress
GetLastError
SetLastError
GetFileAttributesW
InterlockedExchange
Sleep
InterlockedIncrement
DeleteCriticalSection
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsDebuggerPresent
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
RaiseException
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetTimeFormatW
WideCharToMultiByte
MultiByteToWideChar
LocalAlloc
GetVersion
OutputDebugStringW
GetVersionExW
GetTickCount
GetCurrentProcess
GetEnvironmentVariableW
ExpandEnvironmentStringsW
GetDateFormatW
CreateSemaphoreW
user32
GetSubMenu
LoadMenuW
AllowSetForegroundWindow
MsgWaitForMultipleObjects
DispatchMessageW
PeekMessageW
GetForegroundWindow
GetUserObjectInformationW
GetThreadDesktop
EnableMenuItem
PostMessageW
GetAncestor
OffsetRect
SystemParametersInfoW
BringWindowToTop
AttachThreadInput
GetWindowThreadProcessId
SetForegroundWindow
ShowWindow
CopyRect
GetParent
MapWindowPoints
MoveWindow
KillTimer
SetTimer
IsIconic
DrawIcon
GetSystemMetrics
LoadBitmapW
LoadImageW
RegisterWindowMessageW
DestroyIcon
InvalidateRect
IsWindow
GetClientRect
GetDlgItem
SendMessageW
EnableWindow
GetClassNameW
GetWindowRect
SetMenuItemInfoW
gdi32
GetCurrentObject
GetObjectW
CreateFontIndirectW
SelectObject
DeleteObject
GetStockObject
advapi32
SetFileSecurityW
RegOpenKeyExW
RegCloseKey
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegEnumKeyExW
RegDeleteKeyW
GetTokenInformation
GetUserNameW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegSetValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
shell32
ShellExecuteExW
CommandLineToArgvW
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteW
comctl32
FlatSB_SetScrollProp
_TrackMouseEvent
InitializeFlatSB
shlwapi
PathIsRelativeW
PathRemoveExtensionW
PathStripPathW
UrlUnescapeW
PathFileExistsW
ole32
CoInitialize
CoUninitialize
CoGetObject
StringFromGUID2
CoCreateInstance
oleaut32
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysFreeString
SysAllocString
msvcp90
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IPB_W@Z
Sections
.text Size: 309KB - Virtual size: 308KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 382KB - Virtual size: 382KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE