Behavioral task
behavioral1
Sample
d59b3c232ac456318c64d9e78cca8278d813a3fe1265910a09e1c5bd285b5f79.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
d59b3c232ac456318c64d9e78cca8278d813a3fe1265910a09e1c5bd285b5f79.exe
Resource
win10v2004-20220901-en
General
-
Target
d59b3c232ac456318c64d9e78cca8278d813a3fe1265910a09e1c5bd285b5f79
-
Size
186KB
-
MD5
809228692102297c9c1ad39a53057690
-
SHA1
2b5fe62436ff8c6e9098646fb8dfd2876388e647
-
SHA256
d59b3c232ac456318c64d9e78cca8278d813a3fe1265910a09e1c5bd285b5f79
-
SHA512
01be7138e7a576bf644f73e310b8fac3faea2b9d5f5cf664f411b84a0466d7ba21cc0ccc9a2cd08944fe602a5fc173a80d6d269386d3175c2702a9ada193bb5e
-
SSDEEP
3072:E9uAUfuMuHsDuhruuoIuu+SIu8cVg8ePApGNqI02Qw4lsfGAUf4/M4dn5llSyyLP:E8AUPcV2Ap3I02QfQCOMyiyyu/9m
Malware Config
Signatures
Files
-
d59b3c232ac456318c64d9e78cca8278d813a3fe1265910a09e1c5bd285b5f79.exe windows x86
04060cbab3c772fb3815c0cab3e02aca
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strcat
strcmp
free
_except_handler3
strrchr
rename
_iob
atoi
_errno
wcscpy
strtok
vsprintf
strncat
memset
rand
_beginthreadex
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
malloc
strcpy
memcmp
strlen
_ftol
memmove
_CxxThrowException
__CxxFrameHandler
memcpy
??3@YAXPAX@Z
??2@YAPAXI@Z
calloc
ws2_32
accept
getpeername
bind
getsockname
inet_addr
inet_ntoa
recv
send
select
closesocket
ntohs
socket
gethostbyname
htons
connect
setsockopt
WSACleanup
listen
WSAStartup
sendto
gethostname
__WSAFDIsSet
msvcp60
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
kernel32
GetProcessHeap
CreateEventA
GetLocalTime
Sleep
GlobalFree
WriteFile
RemoveDirectoryA
LocalAlloc
GetDriveTypeA
OutputDebugStringA
ReleaseMutex
lstrcmpA
SetErrorMode
GetModuleHandleA
GetStartupInfoA
CreateProcessA
CreateDirectoryA
GetVersionExA
WideCharToMultiByte
MultiByteToWideChar
FreeLibrary
GetPrivateProfileSectionNamesA
SetEvent
lstrcpyA
VirtualAlloc
VirtualFree
CloseHandle
LoadLibraryA
GetProcAddress
user32
GetThreadDesktop
PostMessageA
CreateWindowExA
CloseWindow
SendMessageA
IsWindow
GetSystemMetrics
OpenClipboard
IsWindowVisible
CloseClipboard
SetCursorPos
WindowFromPoint
SetCapture
GetKeyState
GetAsyncKeyState
GetForegroundWindow
GetWindowTextA
CharNextA
GetWindowThreadProcessId
GetCursorPos
LoadCursorA
SetRect
ReleaseDC
SetClipboardData
advapi32
RegOpenKeyExA
LookupAccountNameA
LsaClose
LsaRetrievePrivateData
LsaOpenPolicy
RegCloseKey
RegQueryValueA
RegSetValueExA
RegCreateKeyExA
FreeSid
RegSetKeySecurity
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
RegEnumKeyExA
RegQueryValueExA
RegOpenKeyA
IsValidSid
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
LookupAccountSidA
GetTokenInformation
gdi32
CreateDIBSection
GetDIBits
CreateCompatibleBitmap
BitBlt
SelectObject
DeleteDC
DeleteObject
shell32
SHGetFileInfoA
SHGetSpecialFolderPathA
msvfw32
ICSeqCompressFrameEnd
ICSendMessage
Sections
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 153KB - Virtual size: 157KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ