Static task
static1
Behavioral task
behavioral1
Sample
d0af96321780637834e3b27582983f9105665f86d3160909c74d96438ea149da.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
d0af96321780637834e3b27582983f9105665f86d3160909c74d96438ea149da.exe
Resource
win10v2004-20220812-en
General
-
Target
d0af96321780637834e3b27582983f9105665f86d3160909c74d96438ea149da
-
Size
377KB
-
MD5
8166a0f5e6ffe8a5dbdb2693d05756e8
-
SHA1
8935006108cdbf1e04cec508f5749b0daf504ab6
-
SHA256
d0af96321780637834e3b27582983f9105665f86d3160909c74d96438ea149da
-
SHA512
e66776eef26c7f6b74b0e324e930b4c8bfc9d2c917fc02e63ef42ac31b76ec1d8e482345128d7a755940c95d9f6adb09b1a7c694f48faa4e19d845bc180919ed
-
SSDEEP
6144:VfYPMnk0SmtG3CeEqQCXPPHi/Enh8074rJJACtN6/F4QL4h0Ufzk:VfIMnMmUC2QAPPHi/Ea074rJZ6z7ULk
Malware Config
Signatures
Files
-
d0af96321780637834e3b27582983f9105665f86d3160909c74d96438ea149da.exe windows x86
34af47c10117eb993ba9627585d5c6ce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetLastError
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
MultiByteToWideChar
WideCharToMultiByte
lstrcpynW
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
Sleep
CloseHandle
GetFileSizeEx
CreateFileW
lstrlenW
GetTempPathW
DeleteFileW
CreateEventW
SetEvent
SetCurrentDirectoryW
WaitForSingleObject
GlobalUnlock
GlobalLock
lstrlenA
GetDiskFreeSpaceExW
CreateThread
lstrcatW
GetCurrentThreadId
GetCommandLineW
GetExitCodeThread
GetVersionExA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetStartupInfoW
GetModuleHandleA
ExitProcess
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
SetEnvironmentVariableW
LoadLibraryW
GetProcAddress
GetTempFileNameW
FreeLibrary
LockResource
FreeResource
GetSystemDefaultLangID
GetLocaleInfoW
FormatMessageW
LocalAlloc
LocalFree
SystemTimeToTzSpecificLocalTime
GetDateFormatW
GetTimeFormatW
InterlockedCompareExchange
user32
TranslateMessage
CharUpperW
wsprintfW
CharNextW
CharLowerBuffW
DispatchMessageW
GetMessageW
PostThreadMessageW
advapi32
RegQueryInfoKeyW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegEnumKeyExW
ole32
CLSIDFromProgID
CLSIDFromString
CreateStreamOnHGlobal
CoSuspendClassObjects
CoCreateInstance
CoRegisterClassObject
CoResumeClassObjects
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
StringFromCLSID
CoUninitialize
CoInitializeEx
StringFromGUID2
CoRevokeClassObject
OleRun
GetHGlobalFromStream
oleaut32
GetErrorInfo
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
VarBstrCmp
SysAllocString
SysStringLen
VarUI4FromStr
VariantInit
VariantClear
LoadTypeLi
UnRegisterTypeLi
RegisterTypeLi
ws2_32
inet_addr
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
msvcr71
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
__security_error_handler
memcpy
strlen
strncpy
_strupr
strcmp
_wtoi
_stricmp
_vsnprintf
atoi
_itow
isdigit
strchr
memmove
memset
wcscmp
_beginthreadex
_vsnwprintf
wcsncmp
??_U@YAPAXI@Z
realloc
??_V@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
__CxxFrameHandler
??0exception@@QAE@XZ
??1exception@@UAE@XZ
??2@YAPAXI@Z
??3@YAXPAX@Z
_purecall
_except_handler3
_CxxThrowException
wcscat
wcsncpy
_wgetenv
_wcsdup
wcsrchr
wcscpy
wcslen
wcschr
_wcsnicmp
malloc
free
_wcsicmp
_wcslwr
shlwapi
UrlCanonicalizeW
PathIsURLW
UrlCreateFromPathW
UrlIsW
PathCreateFromUrlW
PathIsUNCW
PathFindExtensionW
PathRenameExtensionW
PathRemoveExtensionW
PathRemoveFileSpecW
SHCreateStreamOnFileW
msvcp71
??$?9GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?clear@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?resize@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AViterator@12@XZ
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AViterator@12@XZ
??$?8GU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?to_int_type@?$char_traits@D@std@@SAHABD@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?reserve@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXI@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
Sections
.text Size: 208KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE