Static task
static1
Behavioral task
behavioral1
Sample
d4c859260ed326edf2594fb0c350b60081f5502b15a2ba7f9821325d543e1618.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d4c859260ed326edf2594fb0c350b60081f5502b15a2ba7f9821325d543e1618.exe
Resource
win10v2004-20220901-en
General
-
Target
d4c859260ed326edf2594fb0c350b60081f5502b15a2ba7f9821325d543e1618
-
Size
136KB
-
MD5
901f1b5f2a8d25c91a9703e93071723b
-
SHA1
baed6a9076dbc139d86b3a18bf476f1a8f6ee262
-
SHA256
d4c859260ed326edf2594fb0c350b60081f5502b15a2ba7f9821325d543e1618
-
SHA512
58cee01a30c50c245cf58bc5b5993652685782f0af505efb9b9fc07038b39b784723383f2916c2b9edcd91f7b10717b39ee0096144f2e68d6376e0e311e18d72
-
SSDEEP
1536:rrTLR36msR9bgI56EgAmN3KXlKg4psAZ+9qtypsUzx5X1u1vMymqrtFPJ7OwscQ2:/TLR3+TEI/gFLsgcpsUzSMnAt7ccQ0p
Malware Config
Signatures
Files
-
d4c859260ed326edf2594fb0c350b60081f5502b15a2ba7f9821325d543e1618.exe windows x86
24d85b9b4257c352d14d81d8bb89cbd9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WideCharToMultiByte
GetACP
Sleep
TerminateProcess
GetExitCodeProcess
GetCurrentDirectoryW
GetDateFormatA
GlobalUnlock
GetTimeZoneInformation
GetPrivateProfileStringA
CreateProcessA
TlsSetValue
FindClose
GetThreadContext
FreeEnvironmentStringsA
FindFirstFileA
LoadLibraryA
OpenProcess
CreateThread
SetEnvironmentVariableW
SetEvent
EnumSystemLocalesA
VirtualQuery
SetThreadContext
VirtualFreeEx
ReadFile
Thread32Next
GetVersionExA
Process32FirstW
GetLocaleInfoA
HeapDestroy
SetEndOfFile
GetStringTypeA
FatalAppExitA
SleepEx
LCMapStringA
GetFileType
TryEnterCriticalSection
ConnectNamedPipe
SetCurrentDirectoryW
MapViewOfFileEx
CompareStringW
DuplicateHandle
LCMapStringW
OutputDebugStringA
UnhandledExceptionFilter
GetLastError
FileTimeToLocalFileTime
SetUnhandledExceptionFilter
CompareStringA
TlsAlloc
GetStartupInfoA
LeaveCriticalSection
GetFileAttributesW
HeapSize
SetHandleCount
DeviceIoControl
OpenFileMappingA
Thread32First
GetProcAddress
FileTimeToSystemTime
VirtualProtect
CreateFileMappingA
GetTimeFormatA
IsValidCodePage
CreateProcessW
DisconnectNamedPipe
InterlockedIncrement
HeapCreate
CreateNamedPipeA
InterlockedCompareExchange
SetFilePointer
GetUserDefaultLCID
ResumeThread
GetDriveTypeA
ExitThread
CopyFileW
FreeEnvironmentStringsW
FindNextFileW
GetStringTypeW
SystemTimeToFileTime
FlushInstructionCache
GlobalAlloc
GetEnvironmentStringsW
GetEnvironmentStrings
GetModuleFileNameA
GlobalLock
QueryPerformanceCounter
GetModuleHandleW
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
InterlockedExchange
GetConsoleMode
HeapReAlloc
IsDebuggerPresent
GetFullPathNameA
InterlockedDecrement
FormatMessageA
TlsFree
CreateEventW
ResetEvent
CreateFileA
OpenThread
GetFullPathNameW
GetStdHandle
SetConsoleCtrlHandler
WriteFile
GetTickCount
WaitForSingleObjectEx
GlobalFree
SetStdHandle
GetCurrentThread
VirtualAllocEx
FlushFileBuffers
RemoveDirectoryW
CreateDirectoryW
WriteFileEx
GetOEMCP
WriteConsoleW
GetFileSizeEx
GetCurrentDirectoryA
SuspendThread
RtlUnwind
ReadFileEx
CloseHandle
GetCPInfo
SetLastError
CreateMutexW
RaiseException
CreateEventA
FreeLibrary
GetSystemTimeAsFileTime
GetConsoleOutputCP
InitializeCriticalSection
GetLocaleInfoW
SetFileAttributesW
lstrlenA
ExpandEnvironmentStringsA
IsValidLocale
GetModuleHandleA
GetConsoleCP
GetSystemInfo
PeekNamedPipe
MoveFileExW
SetEnvironmentVariableA
MultiByteToWideChar
DeleteFileW
TlsGetValue
CreateFileW
DeleteCriticalSection
UnmapViewOfFile
CreateToolhelp32Snapshot
FindFirstFileW
VirtualFree
GetCurrentThreadId
WriteConsoleA
GetCurrentProcessId
GetFileInformationByHandle
SetCurrentDirectoryA
LocalFree
LocalAlloc
VirtualProtectEx
MulDiv
GetCommandLineA
GetProcessHeap
HeapFree
GetCurrentProcess
HeapAlloc
GetCommandLineW
VirtualAlloc
ExitProcess
IsProcessorFeaturePresent
user32
IsZoomed
BeginPaint
LoadCursorW
DestroyWindow
GetWindowRect
CallNextHookEx
GetWindowLongA
LoadIconA
GetMessageW
BringWindowToTop
LoadImageW
SetFocus
MoveWindow
LoadCursorA
ScreenToClient
SetClipboardData
GetWindowLongW
EndPaint
GetWindowThreadProcessId
PtInRect
SetForegroundWindow
MessageBoxA
DefWindowProcA
UnregisterClassW
SetWindowsHookExW
SetWindowLongW
GetSystemMetrics
SetWindowRgn
OpenClipboard
InflateRect
MessageBoxW
InvalidateRect
CloseClipboard
TranslateMessage
RegisterClassExW
ReleaseDC
PostMessageW
RegisterClassExA
SetWindowsHookExA
PostQuitMessage
SendMessageW
SetWindowLongA
CreateWindowExW
TrackMouseEvent
EmptyClipboard
ScrollDC
GetClientRect
ShowWindow
DispatchMessageW
GetDC
UnhookWindowsHookEx
DefWindowProcW
CreateWindowExA
LoadIconW
FindWindowW
gdi32
GetStockObject
TextOutA
CreatePen
CreateCompatibleDC
Polygon
StretchBlt
SelectObject
GetDeviceCaps
StretchDIBits
BitBlt
CreateCompatibleBitmap
CreateDIBSection
GetObjectA
DeleteDC
SelectClipRgn
SetTextColor
DeleteObject
SetBkMode
CreateRectRgn
advapi32
AdjustTokenPrivileges
InitializeSecurityDescriptor
CryptDeriveKey
SetSecurityDescriptorDacl
CryptDecrypt
OpenProcessToken
RegOpenKeyExA
RegOpenKeyExW
CryptAcquireContextW
RegQueryValueExA
CryptReleaseContext
RegCloseKey
CryptDestroyKey
CryptCreateHash
CryptHashData
LookupPrivilegeValueA
RegQueryValueExW
CryptDestroyHash
shell32
SHGetFolderPathW
ShellExecuteW
ShellExecuteA
ShellExecuteExW
CommandLineToArgvW
winmm
PlaySoundW
rpcrt4
RpcStringFreeA
UuidToStringA
UuidCreate
secur32
AcceptSecurityContext
DeleteSecurityContext
EncryptMessage
InitializeSecurityContextW
QueryContextAttributesA
InitializeSecurityContextA
DecryptMessage
AcquireCredentialsHandleW
FreeCredentialsHandle
QueryContextAttributesW
avifil32
AVIStreamEndStreaming
msvcrt
tmpfile
fclose
_CIcos
fputs
sprintf
Sections
.text Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 86KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ