Static task
static1
Behavioral task
behavioral1
Sample
e3c63cf197b60e2f9edd1d86c9e3cb9c1c01afc94db2a8087153cd04b237dff5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e3c63cf197b60e2f9edd1d86c9e3cb9c1c01afc94db2a8087153cd04b237dff5.exe
Resource
win10v2004-20220812-en
General
-
Target
e3c63cf197b60e2f9edd1d86c9e3cb9c1c01afc94db2a8087153cd04b237dff5
-
Size
592KB
-
MD5
90607d7a971bc4e597a4870674aaf501
-
SHA1
0636731c71075a7487db69380980030ab4ca683e
-
SHA256
e3c63cf197b60e2f9edd1d86c9e3cb9c1c01afc94db2a8087153cd04b237dff5
-
SHA512
6176366a3f1aef3ec72d0e4272573b4b855f2d674bdc5b51f3c41504a1e780c9cd6e6260217b7c25a640f5b1c225400dba856566b1ce817251084fe6f04a98b0
-
SSDEEP
12288:Zxtzfl8EmN95SKTifcNjvYRoo1QBPP2E7ZgT7FoyNjGyDe3mj:Zbl8EmN95KkFvEook2E7ivKyNjGyD3
Malware Config
Signatures
Files
-
e3c63cf197b60e2f9edd1d86c9e3cb9c1c01afc94db2a8087153cd04b237dff5.exe windows x86
366a15cab9ba617be7218bf386b42512
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
imagehlp
ImageEnumerateCertificates
ImageGetCertificateHeader
ImageGetCertificateData
shlwapi
StrRChrA
winhttp
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpConnect
WinHttpSendRequest
WinHttpQueryHeaders
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpCloseHandle
WinHttpQueryOption
WinHttpSetOption
WinHttpCrackUrl
WinHttpReceiveResponse
WinHttpOpen
kernel32
LoadResource
FindResourceW
LoadLibraryExW
GetCommandLineW
DeleteFileW
LockResource
FindResourceExW
lstrlenA
WideCharToMultiByte
ReadFile
GetFileSize
CreateFileW
GetShortPathNameW
GetExitCodeProcess
TerminateProcess
CreateProcessW
OpenProcess
Process32NextW
ProcessIdToSessionId
Process32FirstW
CreateToolhelp32Snapshot
GetProcAddress
LoadLibraryW
GetVersionExW
IsBadReadPtr
FindClose
FindFirstFileW
GetFileAttributesW
CreateDirectoryExW
lstrcpyW
GetTempPathW
lstrcatW
RemoveDirectoryW
FindNextFileW
TryEnterCriticalSection
GetTickCount
DeleteTimerQueueTimer
CreateTimerQueueTimer
LoadLibraryA
CreateFileA
lstrcmpA
lstrcmpiA
DebugBreak
GetCurrentProcessId
QueryPerformanceCounter
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
SizeofResource
MultiByteToWideChar
FreeLibrary
SetEvent
InterlockedDecrement
InterlockedIncrement
CreateEventW
CreateThread
GetCurrentThreadId
GetModuleHandleW
Sleep
GetModuleFileNameW
WaitForSingleObject
CloseHandle
lstrcmpiW
GetLastError
RaiseException
lstrlenW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetStdHandle
VirtualQuery
GetStringTypeW
SetEndOfFile
GetStringTypeA
GetCPInfo
LCMapStringW
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
IsValidCodePage
GetOEMCP
GetModuleFileNameA
GetStdHandle
WriteFile
HeapCreate
VirtualAlloc
VirtualFree
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
ExitProcess
LCMapStringA
GetStartupInfoW
DeleteFileA
MoveFileA
GetSystemTimeAsFileTime
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
RtlUnwind
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
GetModuleHandleA
user32
UnregisterClassA
LoadStringW
PostThreadMessageW
MessageBoxW
CharNextW
TranslateMessage
CharUpperW
DispatchMessageW
GetMessageW
advapi32
CryptEncrypt
RegOpenKeyExA
RegQueryValueExA
CryptDecrypt
CryptReleaseContext
CryptDeriveKey
CryptDestroyKey
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptAcquireContextW
OpenProcessToken
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserW
ChangeServiceConfigW
ChangeServiceConfig2W
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
ControlService
DeleteService
CreateServiceW
RegEnumKeyExW
OpenSCManagerW
OpenServiceW
CloseServiceHandle
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
shell32
SHGetPathFromIDListW
SHGetMalloc
SHGetSpecialFolderLocation
ole32
CoTaskMemAlloc
CoTaskMemRealloc
CoInitializeSecurity
CoRevokeClassObject
CoRegisterClassObject
CoUninitialize
CoTaskMemFree
CoInitialize
StringFromGUID2
CoCreateInstance
CoCreateGuid
OleRun
CLSIDFromString
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoUnmarshalInterface
oleaut32
SafeArrayCreateVector
SafeArrayPutElement
SafeArrayDestroy
VariantClear
VariantInit
SysStringByteLen
SysAllocStringByteLen
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString
GetErrorInfo
Sections
.text Size: 406KB - Virtual size: 406KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 134KB - Virtual size: 134KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 42KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ