Static task
static1
Behavioral task
behavioral1
Sample
317f8c7db38934fe2f9291f1ae254953a50a858f934993ed24caba20b989440a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
317f8c7db38934fe2f9291f1ae254953a50a858f934993ed24caba20b989440a.exe
Resource
win10v2004-20220901-en
General
-
Target
317f8c7db38934fe2f9291f1ae254953a50a858f934993ed24caba20b989440a
-
Size
144KB
-
MD5
818c254f213ea98ef1f4a9cc5ce1066c
-
SHA1
05f700825663c15547e3b70f46f8aa263493ce91
-
SHA256
317f8c7db38934fe2f9291f1ae254953a50a858f934993ed24caba20b989440a
-
SHA512
7c46601e3086b3a15b9406b96dd8cf043ff8b5b07ab0bdf931c90172e9fc6cf68f6693f18e4e73f08567fce8543b37a8b87642b17109a08ebdb9b74f00b792eb
-
SSDEEP
3072:M/WjCf8TBIclWTl1uH67T8P7Qga3KcyjbHCg92:6C5kAas7Qga3KcyjLb
Malware Config
Signatures
Files
-
317f8c7db38934fe2f9291f1ae254953a50a858f934993ed24caba20b989440a.exe windows x86
e2d8439306b164c3285b91f0ce6cfbb5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
RpcBindingInqAuthClientW
RpcImpersonateClient
RpcRevertToSelf
RpcBindingVectorFree
RpcEpUnregister
RpcMgmtWaitServerListen
RpcServerListen
RpcServerRegisterAuthInfoW
RpcEpRegisterW
RpcServerInqBindings
RpcServerRegisterIfEx
NdrServerCall2
RpcMgmtStopServerListening
RpcServerUseProtseqW
kernel32
lstrcpyW
CloseHandle
GetFileSize
FlushFileBuffers
WaitForSingleObject
GetExitCodeProcess
CreateEventW
SetEvent
OpenEventW
ResetEvent
GetVersion
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
lstrcpynW
SetErrorMode
CopyFileW
CompareFileTime
GetModuleHandleW
SetFileAttributesW
GetSystemDirectoryW
HeapAlloc
GetProcessHeap
HeapFree
FormatMessageW
Sleep
SetConsoleCtrlHandler
GetCommandLineW
RtlUnwind
LoadLibraryA
GetStartupInfoA
LoadLibraryW
GetProcAddress
FreeLibrary
GetSystemInfo
SuspendThread
ResumeThread
TerminateProcess
GetWindowsDirectoryW
lstrlenW
lstrcatW
CreateFileW
CreateProcessW
GetLocaleInfoA
GetLastError
LocalAlloc
GetCurrentThread
LocalFree
InterlockedExchange
VirtualQuery
SetFilePointer
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
HeapSize
LCMapStringA
LCMapStringW
GetACP
GetOEMCP
GetCPInfo
SetStdHandle
VirtualProtect
GetModuleFileNameW
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
UnhandledExceptionFilter
GetStdHandle
WriteFile
IsBadWritePtr
HeapReAlloc
ExitProcess
GetModuleHandleA
GetCurrentProcess
GetCommandLineA
GetVersionExA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
user32
WaitForInputIdle
wsprintfW
advapi32
AllocateAndInitializeSid
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
OpenServiceW
ControlService
QueryServiceStatus
DeleteService
OpenSCManagerW
CreateServiceW
CloseServiceHandle
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
IsValidAcl
IsValidSecurityDescriptor
RegOpenKeyW
RegQueryValueExW
RegCloseKey
InitializeSecurityDescriptor
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
ImpersonateSelf
OpenThreadToken
AccessCheck
FreeSid
RevertToSelf
shell32
CommandLineToArgvW
ole32
OleUninitialize
OleInitialize
netapi32
NetShareGetInfo
NetApiBufferFree
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
�w\ND� Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE