Static task
static1
Behavioral task
behavioral1
Sample
f49b8a614b5deb643e052bd094934be7f58623484b6dea44408507e819a8c2f0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f49b8a614b5deb643e052bd094934be7f58623484b6dea44408507e819a8c2f0.exe
Resource
win10v2004-20220812-en
General
-
Target
f49b8a614b5deb643e052bd094934be7f58623484b6dea44408507e819a8c2f0
-
Size
620KB
-
MD5
5ae2d06b152ecee925d5f1f9af294000
-
SHA1
e5072ee436eeba99b5e2aef0a49dbefc23d93566
-
SHA256
f49b8a614b5deb643e052bd094934be7f58623484b6dea44408507e819a8c2f0
-
SHA512
519860250ed06fe39500daf0667c50877e689ee334f12e1ccbb27bd5df4da1fe7734599cdb1e753a7b35bd77126f8e5c9927425ff0301e505224c92fb1c14aaa
-
SSDEEP
12288:Vvvvvv3ZIPdSCZMec8DfERgLWfLnddLpDbc1DvYbyC5KxsmN7kPlA3G4cjhNatZH:7IV5ZhTDsnxd9DysyCoxN7f24czc
Malware Config
Signatures
Files
-
f49b8a614b5deb643e052bd094934be7f58623484b6dea44408507e819a8c2f0.exe windows x86
c3f658ce00eea3d461aee59d28b85f7a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
RtlUnwind
memcpy
sin
kernel32
InterlockedCompareExchange
AddVectoredExceptionHandler
GetExitCodeProcess
CreateWaitableTimerW
GetCurrentThread
RemoveVectoredExceptionHandler
SetHandleCount
GlobalAlloc
lstrcpyA
SizeofResource
GetStringTypeA
GlobalFree
GetSystemDirectoryA
GlobalUnlock
GetProcAddress
HeapAlloc
MultiByteToWideChar
FindFirstFileA
LockResource
UnhandledExceptionFilter
CreateDirectoryA
MoveFileExA
LCMapStringW
GetACP
GetModuleHandleA
MapViewOfFile
FlushFileBuffers
WritePrivateProfileStringA
lstrcmpiA
GetModuleFileNameA
lstrcatA
GetStdHandle
WideCharToMultiByte
FindResourceA
GetFileSize
GlobalLock
CompareStringA
GetStringTypeW
GetProcessHeap
FreeEnvironmentStringsA
CreateFileMappingA
LoadLibraryA
HeapFree
CloseHandle
GetShortPathNameA
UnmapViewOfFile
LCMapStringA
GetPrivateProfileStringA
IsBadCodePtr
GetTempPathA
LocalAlloc
GetDiskFreeSpaceA
IsBadReadPtr
GetLastError
GetOEMCP
lstrcpynA
LoadResource
GetEnvironmentStringsW
GetFileType
lstrlenA
GetCurrentProcess
LocalFree
ExitProcess
SetStdHandle
CreateFileA
TerminateProcess
SetEnvironmentVariableA
FindClose
GetTimeZoneInformation
GetLocaleInfoW
VirtualQuery
GetSystemInfo
VirtualProtect
CompareStringW
GetEnvironmentStrings
GetWindowsDirectoryA
WriteConsoleW
GetCommandLineA
GetVersionExA
GetStartupInfoA
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
SetUnhandledExceptionFilter
WriteFile
FreeEnvironmentStringsW
DeleteCriticalSection
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThreadId
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FatalAppExitA
GetCPInfo
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryExA
InitializeCriticalSection
Sleep
VirtualAlloc
HeapReAlloc
GetConsoleCP
GetConsoleMode
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsValidCodePage
SetFilePointer
WriteConsoleA
GetConsoleOutputCP
shell32
SHGetPathFromIDListA
SHGetMalloc
ShellExecuteA
SHBrowseForFolderA
advapi32
RegQueryValueExA
RegOpenKeyExA
Sections
.text Size: 124KB - Virtual size: 340KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
1 Size: 80KB - Virtual size: 79KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
0 Size: 108KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
3 Size: 24KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
2 Size: 56KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
5 Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
4 Size: 32KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 56KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ