Static task
static1
Behavioral task
behavioral1
Sample
1204128975de67e38a0df63f1febcfb2da3bf54a1ea4dffad619240f14ec2f75.exe
Resource
win7-20220812-en
General
-
Target
1204128975de67e38a0df63f1febcfb2da3bf54a1ea4dffad619240f14ec2f75
-
Size
900KB
-
MD5
4f5612d58e0f97beb4b2d71cf8394d20
-
SHA1
25058ed1c4efadbca6fad6c7fb3f8d42d74e56cc
-
SHA256
1204128975de67e38a0df63f1febcfb2da3bf54a1ea4dffad619240f14ec2f75
-
SHA512
cc970d39997d3d80cf00442e1d702c6ed36003b7e7ff57436e32da08f452906239c635905349d3644b815a88c1ce4ebd44bb467d45324a2b7afb935e2c743984
-
SSDEEP
24576:C+4rVCfJWitpWXlEMcj6aCbPM0R9ZxUyrTKda:XEVcw+CEyi
Malware Config
Signatures
Files
-
1204128975de67e38a0df63f1febcfb2da3bf54a1ea4dffad619240f14ec2f75.exe windows x86
b44a3e5e6666b858d5834df70838d609
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindClose
MoveFileA
LockResource
FindNextFileA
DeleteFileA
MultiByteToWideChar
GetModuleFileNameA
GetPrivateProfileIntA
GetVersionExA
OpenProcess
CreateProcessA
CloseHandle
OutputDebugStringA
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
GetFileSize
CreateMutexW
SetFilePointer
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
LockFile
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
InitializeCriticalSection
LoadLibraryW
CopyFileA
FormatMessageW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
FlushFileBuffers
GetTempPathW
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
SetFileTime
GetCurrentDirectoryA
LocalFileTimeToFileTime
SetCurrentDirectoryA
WritePrivateProfileStringA
GetPrivateProfileSectionA
MoveFileExA
SetEnvironmentVariableA
CompareStringW
RemoveDirectoryA
GetLastError
FindFirstFileA
CreateDirectoryA
SizeofResource
WideCharToMultiByte
FindResourceExA
WriteFile
LoadResource
FindResourceA
CreateFileA
Sleep
GetModuleFileNameW
CompareStringA
GetModuleHandleA
GetLocaleInfoW
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InitializeCriticalSectionAndSpinCount
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCommandLineA
GetStartupInfoA
RtlUnwind
GetCPInfo
LCMapStringA
LCMapStringW
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStringTypeA
GetStringTypeW
VirtualFree
VirtualAlloc
GetTimeZoneInformation
FreeEnvironmentStringsA
GetEnvironmentStrings
user32
wsprintfA
advapi32
RegCloseKey
RegOpenKeyA
RegOpenKeyExW
RegOpenKeyExA
RegCreateKeyExA
RegCreateKeyA
RegDeleteKeyW
RegQueryValueExA
RegCreateKeyExW
RegSetValueExA
RegSetValueExW
shell32
SHGetSpecialFolderLocation
ShellExecuteExA
SHGetPathFromIDListA
SHGetMalloc
SHGetFolderPathA
wininet
InternetQueryOptionA
InternetSetOptionA
psapi
EnumProcesses
GetModuleBaseNameA
EnumProcessModules
version
GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA
Sections
.text Size: 702KB - Virtual size: 701KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 81KB - Virtual size: 81KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 10KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.rmnet Size: 56KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE