Static task
static1
Behavioral task
behavioral1
Sample
051e3abcbc558d5b213c3f25a0c0a1e801475ef5f855405166fa19ff3796cb10.exe
Resource
win7-20220812-en
General
-
Target
051e3abcbc558d5b213c3f25a0c0a1e801475ef5f855405166fa19ff3796cb10
-
Size
308KB
-
MD5
8012658ca8db705f048a54bc24015b10
-
SHA1
20963d548a9c1fcbbf020d615f7a074a7d466f7c
-
SHA256
051e3abcbc558d5b213c3f25a0c0a1e801475ef5f855405166fa19ff3796cb10
-
SHA512
f26e6db91d1d4e4fb3dac8531594ea1abbe2624884a277d68df314af06368310c8c91af0bba2550fe0d095b9d174757ed4652d319fed12a35030da8e941e1be2
-
SSDEEP
6144:LSgiURVqLXXUGCIFlWUzOpyM7DZfw8NxGfB9B4WE2UiGbs:5iSwLXEnuhWtN2bB4fyz
Malware Config
Signatures
Files
-
051e3abcbc558d5b213c3f25a0c0a1e801475ef5f855405166fa19ff3796cb10.exe windows x86
3e819be4990f02c3461f8d0b1aef39bc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
ws2_32
WSCGetProviderPath
WSCEnumProtocols
psapi
GetModuleInformation
kernel32
CreateDirectoryA
GetFileAttributesA
CreateDirectoryW
GetFileAttributesW
GetCurrentProcessId
FindClose
FindNextFileW
DeleteFileW
FindFirstFileW
MultiByteToWideChar
lstrlenA
OutputDebugStringW
GetCurrentThreadId
GlobalLock
GlobalAlloc
FlushFileBuffers
WriteFile
SetFilePointer
WritePrivateProfileStringW
GetTempPathA
CreateFileW
GetProcAddress
GetModuleHandleW
WritePrivateProfileStringA
GetPrivateProfileIntW
GetPrivateProfileStringA
GetPrivateProfileStringW
CopyFileW
MoveFileW
FindCloseChangeNotification
WaitForSingleObject
FindFirstChangeNotificationW
GetLocalTime
TlsSetValue
TlsGetValue
FreeLibrary
ReleaseMutex
UnmapViewOfFile
InterlockedDecrement
TlsFree
InterlockedExchangeAdd
InitializeCriticalSection
MapViewOfFile
CreateFileMappingW
ExitProcess
GetModuleFileNameW
TerminateProcess
ExpandEnvironmentStringsW
VirtualQuery
LoadLibraryW
GetSystemInfo
GetCurrentThread
GetSystemDirectoryW
GetModuleHandleA
LoadLibraryExW
LoadLibraryExA
LoadLibraryA
lstrlenW
FlushInstructionCache
SetCurrentDirectoryW
SetLastError
InterlockedIncrement
OpenProcess
SetEvent
DuplicateHandle
SetEnvironmentVariableW
GetCurrentDirectoryW
GetTickCount
CreateThread
lstrcatW
lstrcpyW
Sleep
GetExitCodeProcess
GetCommandLineW
GetTempPathW
GetEnvironmentVariableW
GetVersionExW
OpenMutexW
InterlockedCompareExchange
VirtualProtect
ResumeThread
SetThreadContext
GetThreadContext
VirtualFree
SuspendThread
VirtualAlloc
GetVolumeInformationA
GetSystemDirectoryA
GetSystemTimeAsFileTime
QueryPerformanceCounter
WideCharToMultiByte
GlobalUnlock
CreateMutexW
GetModuleFileNameA
IsBadCodePtr
lstrcatA
lstrcpyA
DeviceIoControl
CreateFileA
SetPriorityClass
GetVersionExA
GetCurrentProcess
LocalAlloc
LocalFree
CloseHandle
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
InterlockedExchange
GlobalFree
HeapFree
GetProcessHeap
HeapAlloc
IsProcessorFeaturePresent
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsAlloc
IsDebuggerPresent
user32
GetClassInfoExW
UnregisterClassA
UnregisterClassW
LoadCursorA
LoadCursorW
CharNextW
PostQuitMessage
wsprintfW
CallWindowProcW
DestroyWindow
SendMessageW
GetWindowLongW
DefWindowProcW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
CreateWindowExW
SetWindowLongW
MessageBoxW
RegisterClassExW
RegisterClassExA
GetClassInfoExA
advapi32
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
OpenProcessToken
GetTokenInformation
InitializeAcl
AddAccessAllowedAce
SetSecurityInfo
shell32
ord680
SHGetSpecialFolderPathA
ShellExecuteExW
SHGetFolderPathW
CommandLineToArgvW
SHFileOperationW
ord165
ole32
CoTaskMemFree
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
SysAllocStringByteLen
SysStringByteLen
SysAllocStringLen
RegisterTypeLi
UnRegisterTypeLi
SysFreeString
SysStringLen
SysAllocString
atl90
ord56
ord49
ord43
ord44
ord64
ord23
ord61
ord68
shlwapi
PathFindFileNameW
PathAddBackslashW
PathRemoveFileSpecW
StrStrIW
PathRemoveBackslashW
PathFileExistsW
PathAppendW
PathRemoveExtensionW
PathFindExtensionW
comctl32
InitCommonControlsEx
msvcp90
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??0?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?str@?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??_D?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?_Lock@_Mutex@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AA_J@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??$?5DU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAD@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
?length@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?_Myptr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEPA_WXZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@D@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
msvcr90
sprintf_s
swprintf_s
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@XZ
memset
_snwprintf
_wsplitpath
wcsncpy
wcslen
memcpy
_wtoi
free
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
calloc
_recalloc
??2@YAPAXI@Z
??_V@YAXPAX@Z
strlen
strcmp
strstr
strncpy
_snprintf
strncat
wcstok
_wcsicmp
_wstat64i32
_vsnwprintf
tolower
malloc
_wcslwr
wcscpy
memcpy_s
_wtol
_itow
wcscat
memmove_s
_except_handler4_common
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
wcsncpy_s
_CxxThrowException
memcmp
??3@YAXPAX@Z
_itoa
_time64
_ultoa
sprintf
rand
srand
isprint
isspace
isalnum
__CxxFrameHandler3
setupapi
SetupIterateCabinetW
urlmon
URLDownloadToCacheFileW
iphlpapi
GetAdaptersInfo
Sections
.text Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 75KB - Virtual size: 74KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 34KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.boltds Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE