Static task
static1
Behavioral task
behavioral1
Sample
4f423722fae4c4a8b30d6913073d7fc8a1412f41fb577ff61035521524e7060c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4f423722fae4c4a8b30d6913073d7fc8a1412f41fb577ff61035521524e7060c.exe
Resource
win10v2004-20220901-en
General
-
Target
4f423722fae4c4a8b30d6913073d7fc8a1412f41fb577ff61035521524e7060c
-
Size
76KB
-
MD5
815130572a15c3b62a1259c08dad2147
-
SHA1
6a4d2f5cf974d1c40189668f121f3f89748ac427
-
SHA256
4f423722fae4c4a8b30d6913073d7fc8a1412f41fb577ff61035521524e7060c
-
SHA512
157b706cda26e2edd67f8a35ff084b0a089b8ba86fd4aadcbfbd7dd33366effe3a62b309e81282218f8f51e55acae0c9dba57544afc696493d3591bd0f49177c
-
SSDEEP
1536:BQxPG5P+wQqJ3Q+U/0GtEEs01G3lTDBz8RKtd05j83w/ZRk+3Kj:BQc5h1C+U/ltEEj43dDS4dgggZRkj
Malware Config
Signatures
Files
-
4f423722fae4c4a8b30d6913073d7fc8a1412f41fb577ff61035521524e7060c.exe windows x86
f7475010f54aee70cabc836aeb43a090
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
atl
AtlInternalQueryInterface
AtlDevModeW2A
AtlAdvise
AtlAxWinInit
AtlAxCreateControlEx
AtlUnadvise
AtlMarshalPtrInProc
AtlModuleLoadTypeLib
AtlModuleUnregisterServer
AtlModuleUpdateRegistryFromResourceD
AtlAxAttachControl
AtlHiMetricToPixel
AtlAxDialogBoxW
AtlComQIPtrAssign
AtlModuleRegisterWndClassInfoW
AtlAxCreateDialogA
AtlRegisterClassCategoriesHelper
AtlModuleRegisterClassObjects
AtlComPtrAssign
AtlSetErrorInfo
AtlModuleTerm
AtlModuleRegisterTypeLib
AtlModuleUnregisterServerEx
AtlAxCreateDialogW
AtlWaitWithMessageLoop
AtlModuleAddTermFunc
AtlPixelToHiMetric
AtlCreateTargetDC
AtlModuleInit
AtlGetObjectSourceInterface
AtlAxDialogBoxA
AtlModuleRegisterServer
AtlAxGetHost
AtlGetVersion
AtlIPersistStreamInit_Save
AtlFreeMarshalStream
AtlModuleUnRegisterTypeLib
AtlIPersistStreamInit_Load
AtlModuleAddCreateWndData
AtlModuleRegisterWndClassInfoA
AtlAxGetControl
AtlModuleGetClassObject
AtlIPersistPropertyBag_Load
ntdll
NtSetSystemEnvironmentValue
RtlIsValidIndexHandle
ZwOpenMutant
RtlUpcaseUnicodeToOemN
ZwCreateMailslotFile
NtRequestWaitReplyPort
isdigit
ZwSetSecurityObject
DbgUiSetThreadDebugObject
ZwStopProfile
RtlNumberGenericTableElementsAvl
NtOpenKey
RtlSetUserValueHeap
RtlInitializeResource
RtlGetCurrentPeb
NtDuplicateToken
NtWriteRequestData
RtlTimeToSecondsSince1970
ZwDuplicateToken
RtlCharToInteger
RtlDeleteAce
RtlNtStatusToDosErrorNoTeb
RtlSubtreePredecessor
RtlMapGenericMask
ZwRequestPort
NtAccessCheckByTypeResultListAndAuditAlarmByHandle
ZwEnumerateSystemEnvironmentValuesEx
RtlCompareMemory
wcspbrk
ZwFlushVirtualMemory
NtQueryVolumeInformationFile
KiUserCallbackDispatcher
LdrShutdownProcess
ZwAreMappedFilesTheSame
RtlUnicodeToMultiByteSize
RtlGenerate8dot3Name
strrchr
RtlMultiAppendUnicodeStringBuffer
RtlMoveMemory
_wtoi64
RtlInitNlsTables
ZwQueryInformationFile
NtSetInformationFile
wcstoul
mapistub
WrapCompressedRTFStream@12
OpenTnefStreamEx@32
BMAPIFindNext
HrComposeMsgID@24
FPropCompareProp@12
UNKOBJ_ScSzFromIdsAlloc@20
MAPILogon
OpenIMsgSession@12
MAPIAddress
BMAPIGetAddress
MAPIAdminProfiles
CbOfEncoded@4
cmc_free
HrComposeEID@28
cmc_act_on
UNKOBJ_ScCOAllocate@12
RTFSync@12
OpenStreamOnFile
MNLS_WideCharToMultiByte@32
MAPIOpenFormMgr
ScUNCFromLocalPath@12
MAPIFreeBuffer@4
UlRelease@4
BMAPIDetails
MNLS_CompareStringW@24
SwapPword@8
CchOfEncoding@4
HrDispatchNotifications@4
HrAddColumnsEx@20
MAPIUninitialize
PpropFindProp@12
LPropCompareProp@8
cmc_read
FBadRglpNameID@8
UlPropSize@4
OpenTnefStream
ScLocalPathFromUNC@12
UNKOBJ_FreeRows@8
FPropExists@8
IsBadBoundedStringPtr@8
MAPIReadMail
SzFindLastCh@8
MAPIDeleteMail
HrQueryAllRows@24
mmcbase
?GetEventBuffer@@YGAAVCEventBuffer@@XZ
??0CEventBuffer@@QAE@ABV0@@Z
?FromLastError@SC@mmcerror@@QAEAAV12@XZ
?s_hWnd@SC@mmcerror@@0PAUHWND__@@A
?SetHinst@SC@mmcerror@@SGXPAUHINSTANCE__@@@Z
?Clear@SC@mmcerror@@QAEXXZ
??4SC@mmcerror@@QAEAAV01@ABV01@@Z
??_FSC@mmcerror@@QAEXXZ
?FromMMC@SC@mmcerror@@QAEAAV12@J@Z
?MMCErrorBox@@YGHII@Z
??0CMMCStrongReferences@@AAE@XZ
?LastRefReleased@CMMCStrongReferences@@SG_NXZ
??8SC@mmcerror@@QBE_NABV01@@Z
?HrFromSc@@YGJABVSC@mmcerror@@@Z
?FromWin32@SC@mmcerror@@QAEAAV12@J@Z
?TraceAndClear@SC@mmcerror@@QAEXXZ
?s_pDispatcher@CConsoleEventDispatcherProvider@@0PAVCConsoleEventDispatcher@@A
??9SC@mmcerror@@QBE_NJ@Z
?Trace_@SC@mmcerror@@QBEXXZ
??4CEventBuffer@@QAEAAV0@ABV0@@Z
?ScFlushPostponed@CEventBuffer@@AAE?AVSC@mmcerror@@XZ
?MMCErrorBox@@YGHVSC@mmcerror@@I@Z
?GetHWnd@SC@mmcerror@@SGPAUHWND__@@XZ
?ScEmitOrPostpone@CEventBuffer@@QAE?AVSC@mmcerror@@PAUIDispatch@@JPAVCComVariant@ATL@@H@Z
?GetCode@SC@mmcerror@@QBEJXZ
??1CEventBuffer@@QAE@XZ
?MMCUpdateRegistry@@YGJHPBVCObjectRegParams@@PBVCControlRegParams@@@Z
?Unlock@CEventBuffer@@QAEXXZ
?GetHinst@SC@mmcerror@@SGPAUHINSTANCE__@@XZ
?s_hInst@SC@mmcerror@@0PAUHINSTANCE__@@A
?Throw@SC@mmcerror@@QAEXJ@Z
?SetMainThreadID@SC@mmcerror@@SGXK@Z
?GetMainThreadID@SC@mmcerror@@SGKXZ
?FatalError@SC@mmcerror@@QBEXXZ
?MMCErrorBox@@YGHPBGVSC@mmcerror@@I@Z
??0?$CEventLock@UAppEvents@@@@QAE@XZ
?MakeSc@SC@mmcerror@@AAEXW4facility_type@12@J@Z
?Release@CMMCStrongReferences@@SGKXZ
??1?$CEventLock@UAppEvents@@@@QAE@XZ
??4CMMCStrongReferences@@QAEAAV0@ABV0@@Z
?GetHelpID@SC@mmcerror@@QAEKXZ
?IsError@SC@mmcerror@@QBE_NXZ
?SetHWnd@SC@mmcerror@@SGXPAUHWND__@@@Z
??8SC@mmcerror@@QBE_NJ@Z
?ToHr@SC@mmcerror@@QBEJXZ
wintrust
WVTAsn1SpcFinancialCriteriaInfoEncode
CryptCATAdminResolveCatalogPath
AddPersonalTrustDBPages
WVTAsn1CatMemberInfoDecode
WTHelperIsInRootStore
CryptCATAdminReleaseContext
CryptSIPPutSignedDataMsg
CryptCATCDFClose
CryptCATCDFEnumMembersByCDFTag
mssip32DllUnregisterServer
CryptSIPVerifyIndirectData
CryptCATAdminAddCatalog
CryptCATAdminCalcHashFromFileHandle
IsCatalogFile
SoftpubDefCertInit
WVTAsn1CatNameValueDecode
TrustOpenStores
DriverCleanupPolicy
WVTAsn1SpcSpOpusInfoDecode
CryptCATCDFEnumMembers
CryptCATCDFEnumAttributes
WVTAsn1SpcIndirectDataContentEncode
DriverFinalPolicy
HTTPSCertificateTrust
CryptCATCatalogInfoFromContext
CryptCATCDFEnumAttributesWithCDFTag
CryptCATPersistStore
TrustDecode
WVTAsn1SpcLinkEncode
CryptCATPutAttrInfo
WintrustCertificateTrust
kernel32
MapViewOfFileEx
LockResource
SetCalendarInfoA
GetSystemDefaultUILanguage
Process32Next
VirtualQuery
GetLocaleInfoW
_hwrite
_lwrite
GetComputerNameExW
SetNamedPipeHandleState
VirtualProtectEx
Heap32Next
FlushInstructionCache
ConvertDefaultLocale
GetStartupInfoW
VirtualAlloc
GetLogicalDrives
GetTickCount
ShowConsoleCursor
PostQueuedCompletionStatus
SetConsoleTitleW
ActivateActCtx
LoadLibraryA
GlobalFree
ReadConsoleOutputAttribute
DeleteFileA
CreateNamedPipeA
MulDiv
GetVolumePathNameA
SetProcessWorkingSetSize
SetVolumeLabelW
PrepareTape
SetHandleContext
InterlockedExchange
WriteProfileSectionA
VerLanguageNameA
SetCriticalSectionSpinCount
LocalAlloc
SetConsoleKeyShortcuts
CreateProcessInternalA
GlobalWire
EnumResourceNamesA
GetCommMask
OutputDebugStringW
user32
DlgDirListW
EndDialog
LoadStringA
GetAsyncKeyState
GetTitleBarInfo
TranslateAccelerator
SetCaretBlinkTime
IsCharUpperA
LoadAcceleratorsW
ReasonCodeNeedsBugID
DdeConnectList
DisableProcessWindowsGhosting
UserClientDllInitialize
ChangeDisplaySettingsW
GetRawInputData
TranslateMessageEx
SetParent
GetClassNameW
GetWindowTextLengthA
MapVirtualKeyA
IsClipboardFormatAvailable
GetClassInfoW
GetWindowPlacement
GetMenuDefaultItem
GetListBoxInfo
SetWindowStationUser
CharToOemBuffA
LoadBitmapA
GetComboBoxInfo
DlgDirSelectExW
UnloadKeyboardLayout
DrawFocusRect
GetDlgItem
DdeCmpStringHandles
DrawCaption
Sections
.text Size: 49KB - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ