Static task
static1
Behavioral task
behavioral1
Sample
ee8486de932a1b1b561cf1be8fae1847.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ee8486de932a1b1b561cf1be8fae1847.exe
Resource
win10v2004-20220901-en
General
-
Target
ee8486de932a1b1b561cf1be8fae1847.exe
-
Size
12.7MB
-
MD5
ee8486de932a1b1b561cf1be8fae1847
-
SHA1
005e17497969fa4405a340cdc1b4e55153db61ac
-
SHA256
8f0a6eb6f314b58ca80b93ff4e79717883e8b753e51e06c826eacebf1b9f1e2f
-
SHA512
cb04cbebf8e42f5c739cb8e5db09c1b4a4ab8ecae4cf94fdc1527c1a8fe946f1993bcd73d3038d7fd96f37e487cfd4018ee9806c0866b39929475ccf46e83f57
-
SSDEEP
196608:bzPHxyJOBMhMmA/qnfXMPj7tfLiAUYimYlKPRWIZLD:XPHxy4T/qfgfLiAU+YAHZ
Malware Config
Signatures
Files
-
ee8486de932a1b1b561cf1be8fae1847.exe.exe windows x64
e9e0b1fa1177f07130f345f2074f0bd3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetShortPathNameW
GetModuleFileNameW
SetThreadPriority
GetDynamicTimeZoneInformation
GetEnvironmentVariableW
CreateMutexW
GetCurrentThreadId
ResumeThread
GetConsoleMode
GetLastError
GetCurrentThread
lstrcatW
QueryPerformanceFrequency
CloseHandle
LoadLibraryW
CreateThread
GetProcAddress
ExitProcess
GetCurrentProcessId
GetModuleHandleW
lstrcpyW
QueryPerformanceCounter
SizeofResource
LockResource
LoadResource
FindResourceW
GlobalUnlock
ReadFile
CancelIo
WaitForSingleObject
CreateEventW
FormatMessageW
CreateFileA
LoadLibraryA
ResetEvent
WriteFile
LocalFree
FreeLibrary
DeleteFileA
GetTempPathA
GetTempFileNameA
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetExitCodeProcess
GetFileAttributesExA
LockFileEx
UnlockFileEx
FindClose
FindFirstFileExA
FindNextFileA
GetModuleHandleA
GetNativeSystemInfo
GetModuleFileNameA
GetModuleHandleExA
CreateFileMappingA
CreateEventA
lstrcmpA
GetEnvironmentVariableA
CreateSemaphoreA
DebugBreak
WriteConsoleW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
WriteConsoleA
GetStdHandle
GetCurrentProcess
SetConsoleTextAttribute
SetPriorityClass
GetConsoleScreenBufferInfo
GetOverlappedResult
Sleep
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetStdHandle
RemoveDirectoryW
CreateDirectoryW
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetFileSizeEx
ReadConsoleW
GetConsoleOutputCP
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
SleepConditionVariableSRW
FormatMessageA
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeSRWLock
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
TryEnterCriticalSection
DeleteCriticalSection
WideCharToMultiByte
WaitForSingleObjectEx
SwitchToThread
GetExitCodeThread
RtlPcToFileHeader
RaiseException
CreateEventExW
CreateSemaphoreExW
FlushProcessWriteBuffers
GetCurrentProcessorNumber
GetSystemTimeAsFileTime
GetTickCount64
FreeLibraryWhenCallbackReturns
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringEx
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
AreFileApisANSI
HeapCreate
HeapFree
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
GetTempPathW
CreateFileW
GetFileAttributesW
UnmapViewOfFile
HeapValidate
HeapSize
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
DeleteFileW
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetFileSize
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
CreateFileMappingW
MapViewOfFile
GetTickCount
FlushFileBuffers
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RegisterWaitForSingleObject
SetLastError
SignalObjectAndWait
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
UnregisterWait
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
CreateTimerQueue
RtlUnwindEx
RtlUnwind
GetModuleHandleExW
ExitThread
GetFileType
SetFilePointerEx
user32
FindWindowA
SetWindowsHookExW
GetForegroundWindow
MessageBoxA
CallNextHookEx
GetKeyState
SendInput
GetMessageW
MessageBoxW
GetCursorPos
GetSystemMetrics
GetDC
gdi32
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetDIBits
DeleteDC
DeleteObject
BitBlt
shell32
ShellExecuteExW
SHChangeNotify
ws2_32
socket
htons
inet_addr
WSAStartup
WSACleanup
send
recv
WSAGetLastError
connect
d3d11
D3D11CreateDevice
winmm
PlaySoundW
setupapi
SetupDiGetDeviceRegistryPropertyA
SetupDiEnumDeviceInfo
SetupDiGetDeviceInterfaceDetailA
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiDestroyDeviceInfoList
Sections
.text Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 161KB - Virtual size: 707KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 228KB - Virtual size: 227KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3.3MB - Virtual size: 3.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ