Static task
static1
Behavioral task
behavioral1
Sample
1479735b0a9a8a7502791ae4766866d41ca2d5605e6fac524924b6d25986e65f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1479735b0a9a8a7502791ae4766866d41ca2d5605e6fac524924b6d25986e65f.exe
Resource
win10v2004-20220812-en
General
-
Target
1479735b0a9a8a7502791ae4766866d41ca2d5605e6fac524924b6d25986e65f
-
Size
2.7MB
-
MD5
f2c2ec2041d0736e9897d069571efb13
-
SHA1
52b25d0d524dd1126ce545b7a28775459e0b08ef
-
SHA256
1479735b0a9a8a7502791ae4766866d41ca2d5605e6fac524924b6d25986e65f
-
SHA512
ae07783f02957cf5c68b955e29c8cee8a861ac280385bf52d64db9b3f97ea9e1fc87cf6b9541e2d548263594200226fb758abfddcc7dc78d6261f72b0002a1d6
-
SSDEEP
49152:OrwJ2Mqk1QVSbm7rKo3mnVn+CqQsOTYwGgFuEsGkH4mlJOWx5bDTMXLKZ8HX6d:5OVSy7OR+CqQaGk3R5v47KZCX
Malware Config
Signatures
Files
-
1479735b0a9a8a7502791ae4766866d41ca2d5605e6fac524924b6d25986e65f.exe windows x86
cf015454fd4e1581bd84954caba7449e
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetEnvironmentVariableA
CompareStringW
GetLocalTime
SystemTimeToFileTime
GetTempPathA
GetDiskFreeSpaceA
GetACP
GetUserDefaultUILanguage
IsBadReadPtr
GetComputerNameA
GetSystemDirectoryA
GetWindowsDirectoryA
GetSystemInfo
SetLastError
GetExitCodeThread
DuplicateHandle
GetProcessHeap
HeapAlloc
TerminateProcess
CompareStringA
GetLocaleInfoW
HeapFree
GetModuleHandleA
GetModuleFileNameA
SetThreadPriority
SetPriorityClass
GetCurrentThread
IsValidLocale
VirtualQuery
GetUserDefaultLCID
GetLocaleInfoA
GetCurrentThreadId
SetConsoleCtrlHandler
OpenEventA
GetConsoleCP
GetStringTypeW
GetStringTypeA
HeapSize
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetOEMCP
HeapReAlloc
VirtualAlloc
LCMapStringW
LCMapStringA
GetCPInfo
GetStartupInfoA
GetFileType
SetHandleCount
GetModuleHandleW
VirtualFree
HeapDestroy
HeapCreate
SetEvent
GetCurrentDirectoryA
GetTickCount
GetCurrentProcess
RaiseException
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlUnwind
InterlockedExchange
InterlockedDecrement
InterlockedIncrement
LockFile
UnlockFile
IsBadStringPtrW
IsBadStringPtrA
DeviceIoControl
VirtualProtect
FlushInstructionCache
GetDriveTypeA
ReleaseSemaphore
OpenSemaphoreA
CreateSemaphoreA
GetFileTime
GetFileSize
SetEndOfFile
FlushFileBuffers
GetCurrentProcessId
SetFilePointer
ReadFile
WriteFile
GetSystemTimeAsFileTime
GetVersion
EnumSystemLocalesA
GetVersionExA
IsBadWritePtr
CreateDirectoryA
MultiByteToWideChar
WideCharToMultiByte
TlsFree
LocalFree
TlsGetValue
TlsSetValue
LocalAlloc
ExitProcess
TlsAlloc
GetFileAttributesA
GetFullPathNameA
SetCurrentDirectoryA
FileTimeToSystemTime
GetTimeZoneInformation
GetSystemTime
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetLastError
GetPrivateProfileSectionA
WritePrivateProfileSectionA
AreFileApisANSI
LoadLibraryA
GetEnvironmentVariableA
CloseHandle
UnmapViewOfFile
OpenFileMappingA
CreateFileMappingA
MapViewOfFile
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetProcAddress
GetProfileStringA
GetStdHandle
GetConsoleMode
Sleep
WaitForSingleObject
OpenProcess
GetExitCodeProcess
CreateEventA
WaitForMultipleObjects
DeleteFileA
SetFileTime
CreateFileA
user32
CharLowerBuffA
CharUpperBuffA
DrawMenuBar
AppendMenuA
GetSystemMenu
GetSystemMetrics
CallMsgFilterA
TranslateMessage
DispatchMessageA
PeekMessageA
wsprintfA
MessageBoxA
LoadStringA
advapi32
RegOpenKeyExA
ConvertStringSecurityDescriptorToSecurityDescriptorA
GetSecurityDescriptorSacl
SetSecurityDescriptorSacl
RegCreateKeyExA
QueryServiceConfigA
StartServiceA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
RegDeleteValueA
RegFlushKey
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
GetUserNameA
RegEnumValueA
RegEnumKeyExA
RegDeleteKeyA
RegSetValueExA
RegQueryValueExA
RegCloseKey
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
shell32
ShellExecuteExA
wsock32
accept
gethostbyaddr
gethostname
ioctlsocket
WSAStartup
gethostbyname
WSACleanup
getpeername
getsockopt
WSAGetLastError
recv
__WSAFDIsSet
select
closesocket
shutdown
send
connect
inet_ntoa
setsockopt
socket
inet_addr
bind
recvfrom
sendto
htons
Sections
__wibu00 Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
__wibu01 Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu02 Size: - Virtual size: 3KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu03 Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu04 Size: - Virtual size: 64B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu05 Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu06 Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 196KB - Virtual size: 196KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
__wibu07 Size: 1.3MB - Virtual size: 1.3MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu08 Size: 32KB - Virtual size: 48KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
__wibu09 Size: 60KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ