Static task
static1
Behavioral task
behavioral1
Sample
f38e002de598e2c9edc69ed6333479ca2479a721ac7459219cfb43c124572063.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f38e002de598e2c9edc69ed6333479ca2479a721ac7459219cfb43c124572063.exe
Resource
win10v2004-20220901-en
General
-
Target
f38e002de598e2c9edc69ed6333479ca2479a721ac7459219cfb43c124572063
-
Size
1004KB
-
MD5
9064bfc5f171c596a43ab747130a73f0
-
SHA1
6239b5fe881657ae9a084fb2644bf5ee1aed5390
-
SHA256
f38e002de598e2c9edc69ed6333479ca2479a721ac7459219cfb43c124572063
-
SHA512
fd580a40df68c7c308b3da3345ef6832a7d66e10cc2396e5489e76ab2b0ee1aed55c42f6ffa9801d08016b5b248af18a81ae12820a0b41276a503b5a4a38c33a
-
SSDEEP
12288:XNGtL/dB9R+PuPbp+UFGyzL2CE2rspPjzhGuk6:XNAL/jj0UF1nyfpPjzhY6
Malware Config
Signatures
Files
-
f38e002de598e2c9edc69ed6333479ca2479a721ac7459219cfb43c124572063.exe windows x86
273aa6af5457896983f1ff76a85036df
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegCreateKeyExA
RegQueryValueExA
RegQueryValueExW
CloseServiceHandle
GetManagedApplications
RegEnumKeyExW
RegOpenKeyExW
ConvertSidToStringSidW
CopySid
FreeSid
GetLengthSid
GetTokenInformation
ImpersonateSelf
MapGenericMask
OpenThreadToken
RevertToSelf
SetServiceStatus
FileEncryptionStatusW
SetServiceObjectSecurity
CryptHashSessionKey
LookupPrivilegeValueW
RegDeleteKeyA
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExA
kernel32
CloseHandle
CreateFileW
LocalAlloc
LocalFree
ReadConsoleInputA
lstrcatW
lstrcpyW
lstrlenW
CreateDirectoryExW
CreateSemaphoreW
GetModuleHandleA
GetProcAddress
GetProcessHeap
InterlockedDecrement
InterlockedExchange
InterlockedIncrement
LoadLibraryA
ResetEvent
Sleep
WaitForSingleObject
_lread
AddConsoleAliasW
CreateFileA
CreateProcessA
DeleteFileA
FileTimeToSystemTime
FlushFileBuffers
GetCurrentThreadId
GetFileInformationByHandle
GetFileType
GetLocalTime
GetNamedPipeHandleStateA
GetTempFileNameA
GetTempPathA
GetTimeFormatW
HeapCompact
IsBadReadPtr
IsBadWritePtr
MultiByteToWideChar
ReleaseMutex
SetEndOfFile
SetFilePointer
WideCharToMultiByte
WriteFile
lstrcmpiW
lstrlenA
CreateNamedPipeW
DeleteFileW
DeleteVolumeMountPointW
ExpandEnvironmentStringsW
FindClose
FindFirstFileW
FindNextFileW
GetCurrentProcess
GetFileAttributesW
GetFullPathNameW
GetLongPathNameW
GetTempFileNameW
GetTempPathW
OutputDebugStringA
SearchPathW
SetFileApisToOEM
SetLocaleInfoA
SetUnhandledExceptionFilter
TerminateProcess
UnhandledExceptionFilter
UnmapViewOfFile
CancelWaitableTimer
CompareFileTime
CreateFileMappingW
DuplicateHandle
FreeLibrary
GetCurrentConsoleFont
GetCurrentProcessId
GetCurrentThread
GetDriveTypeW
GetFileSizeEx
GetFileTime
GetSystemTimeAsFileTime
GetTickCount
GetVolumeInformationW
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
LoadLibraryW
MapViewOfFile
ReleaseSemaphore
SetEvent
SetFilePointerEx
SetFileTime
SetWaitableTimer
TlsGetValue
TlsSetValue
WaitForMultipleObjects
WaitForMultipleObjectsEx
lstrcmpW
InterlockedCompareExchange
QueryPerformanceCounter
DisableThreadLibraryCalls
FindFirstFileExW
IsDebuggerPresent
CreateEventA
EnumUILanguagesA
SetMessageWaitingIndicator
VirtualAlloc
GetModuleHandleW
ExitProcess
GetLastError
HeapFree
RtlUnwind
TlsAlloc
TlsFree
SetLastError
HeapAlloc
GetTimeZoneInformation
GetCommandLineA
GetStartupInfoA
GetStdHandle
GetModuleFileNameA
DeleteCriticalSection
LeaveCriticalSection
FatalAppExitA
EnterCriticalSection
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
RaiseException
HeapCreate
HeapDestroy
VirtualFree
HeapReAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetStdHandle
GetConsoleCP
GetConsoleMode
SetHandleCount
CompareStringA
CompareStringW
LCMapStringW
LCMapStringA
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeA
GetStringTypeW
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetLocaleInfoW
GetExitCodeProcess
GetFileAttributesA
FileTimeToLocalFileTime
FindFirstFileA
FindNextFileA
ReadFile
SetEnvironmentVariableA
ole32
WriteClassStg
StringFromCLSID
ProgIDFromCLSID
OleIsCurrentClipboard
OleCreateLinkFromDataEx
CoRevokeClassObject
CoRevertToSelf
CoRegisterClassObject
CoCreateGuid
CLSIDFromString
CoImpersonateClient
StringFromGUID2
HMETAFILEPICT_UserFree
CoUninitialize
CoInitialize
CoCreateInstance
CreateBindCtx
CoTaskMemFree
CoTaskMemAlloc
oleaut32
VarCyNeg
VarMul
VarR4FromUI2
VarUI1FromCy
BstrFromVector
SysAllocStringLen
VarR8FromDisp
DispInvoke
VARIANT_UserFree
shell32
SHGetFolderPathW
SHEmptyRecycleBinA
user32
SendMessageTimeoutW
RegisterClassA
MessageBoxIndirectW
SetMessageQueue
SetProcessWindowStation
EnumChildWindows
wsprintfA
wsprintfW
wvsprintfW
CharNextW
GetWindowLongA
OemToCharA
ExcludeUpdateRgn
GetMessageW
DefFrameProcA
EnumThreadWindows
GetScrollPos
EqualRect
Sections
.text Size: 408KB - Virtual size: 408KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 529KB - Virtual size: 529KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 64KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE