Behavioral task
behavioral1
Sample
31a9a85081c7cc614b624bf3e2d80c0ffaf32aefc04dc82238c1ab80eb5fe01d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
31a9a85081c7cc614b624bf3e2d80c0ffaf32aefc04dc82238c1ab80eb5fe01d.exe
Resource
win10v2004-20220812-en
General
-
Target
31a9a85081c7cc614b624bf3e2d80c0ffaf32aefc04dc82238c1ab80eb5fe01d
-
Size
120KB
-
MD5
7bf15fe80a1d8c92c16131043db63951
-
SHA1
beeb7d69f0af2336659daad51623e0af0ea1f7ca
-
SHA256
31a9a85081c7cc614b624bf3e2d80c0ffaf32aefc04dc82238c1ab80eb5fe01d
-
SHA512
6f003c525a916d36ce7142d11e58612a641ec23f2945245e5af812c2a682e8865418331d342db7f228c7b6637250cb35f26c606384293243661a0d9e0d44ed1d
-
SSDEEP
3072:+ML+Bl+wNad5A/+9lTTcUjwOxu/MNrd2Dd7HwbpcBV7Y:qVk5VlTTqmukNGJHaWBV7Y
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
31a9a85081c7cc614b624bf3e2d80c0ffaf32aefc04dc82238c1ab80eb5fe01d.exe windows x86
f15a37e8e8a1d6bc14c56a7292fad777
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegDeleteKeyW
RegEnumKeyExW
kernel32
lstrcmpiW
CloseHandle
GlobalFree
GlobalAlloc
lstrlenW
CompareStringW
ReleaseMutex
WaitForSingleObject
CreateMutexW
GetCommandLineW
GetModuleHandleW
HeapSetInformation
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
UnhandledExceptionFilter
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
user32
MessageBoxW
LoadStringW
msvcrt
_except_handler4_common
?terminate@@YAXXZ
__set_app_type
__p__fmode
_adjust_fdiv
__p__commode
_amsg_exit
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
_vsnwprintf
__setusermatherr
_controlfp
__getmainargs
tapi32
lineRemoveProvider
lineAddProviderW
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 838B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE