Behavioral task
behavioral1
Sample
9ba84f9e8f0db4974884ee55fef9a11584966f01ff4abc106782a48153f3a755.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9ba84f9e8f0db4974884ee55fef9a11584966f01ff4abc106782a48153f3a755.exe
Resource
win10v2004-20220812-en
General
-
Target
9ba84f9e8f0db4974884ee55fef9a11584966f01ff4abc106782a48153f3a755
-
Size
149KB
-
MD5
730b9dcbf5101cee71eb8c02f580b334
-
SHA1
a3cb49e26f126471374d50da5d17b6a26975d07f
-
SHA256
9ba84f9e8f0db4974884ee55fef9a11584966f01ff4abc106782a48153f3a755
-
SHA512
ae8dd9ac010189bef74c87108e48d9121ef7f584a53b6e6c81d02a2c04df733508bdb4fb5e9e91c7b5685c78e6da3e948e1b4eb7d7c53a13abdd6f67cd398540
-
SSDEEP
3072:erjXA8Xqpm2HMh69XJTq2bI/JyySn5pHRBnMpdfsAxeClfdqUxKqL:erjw8aTO69ZWhyyALxM/fjxFPxl
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
9ba84f9e8f0db4974884ee55fef9a11584966f01ff4abc106782a48153f3a755.exe windows x86
cd4f9a244dd2c7a42816d083709c844d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegDeleteKeyW
RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegQueryInfoKeyW
RegEnumValueW
InitializeSecurityDescriptor
CopySid
GetLengthSid
IsValidSid
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
GetTokenInformation
LookupAccountNameW
AddAce
GetAce
GetAclInformation
AddAccessAllowedAce
InitializeAcl
RegEnumKeyExW
SetSecurityDescriptorDacl
OpenProcessToken
OpenThreadToken
FreeSid
LookupAccountSidW
AllocateAndInitializeSid
RegQueryValueExW
RegOpenCurrentUser
kernel32
VirtualAlloc
GetSystemInfo
VirtualQuery
MultiByteToWideChar
lstrlenW
lstrcpyW
VirtualProtect
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
HeapDestroy
SetEvent
CreateThread
CreateEventW
LeaveCriticalSection
EnterCriticalSection
lstrcpynW
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
GetCurrentProcess
GetCurrentThread
lstrcatW
lstrlenA
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
LocalFree
Sleep
GetCurrentThreadId
LocalAlloc
HeapSetInformation
GetCommandLineW
SetLastError
InitializeCriticalSectionAndSpinCount
OutputDebugStringA
GetVersionExW
WaitForSingleObject
CloseHandle
GetLastError
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
ProcessIdToSessionId
GetExitCodeThread
UnhandledExceptionFilter
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
user32
CharNextW
CharPrevW
DispatchMessageW
GetMessageW
PostThreadMessageW
UpdatePerUserSystemParameters
msvcrt
_except_handler4_common
??1type_info@@UAE@XZ
_unlock
__dllonexit
_lock
_onexit
_controlfp
_vsnwprintf
memset
malloc
free
realloc
memcpy
__CxxFrameHandler3
_purecall
_CxxThrowException
_vsnprintf
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_callnewh
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@XZ
?terminate@@YAXXZ
ole32
CoInitialize
CoInitializeSecurity
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoRegisterClassObject
CoRevokeClassObject
oleaut32
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
VarUI4FromStr
LoadRegTypeLi
SysFreeString
Sections
.text Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE