Static task
static1
Behavioral task
behavioral1
Sample
41b092b837fc0484ede58b282978a37e05e88f5d6ade2c903a7b2bdbad80e997.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
41b092b837fc0484ede58b282978a37e05e88f5d6ade2c903a7b2bdbad80e997.exe
Resource
win10v2004-20220812-en
General
-
Target
41b092b837fc0484ede58b282978a37e05e88f5d6ade2c903a7b2bdbad80e997
-
Size
131KB
-
MD5
96528c870d97321224fa59dd7797801a
-
SHA1
29b3d5d7c250d720f37303093649ffc4d4b977f9
-
SHA256
41b092b837fc0484ede58b282978a37e05e88f5d6ade2c903a7b2bdbad80e997
-
SHA512
0178542c849e78d34e6413474fc3095bda389bec88af2907f682637e1cc1fa34dc358f48cadc9be2f63d4c07faee88d4394111303ae621da4efcadfcf3d73c2a
-
SSDEEP
3072:toOCcyCLGtXe6HmSGU6MCVJMvIXisK7YD5sGunDmV04KJ4L8:xCcDLyeSmSV6mIvK7YCG4DmV04h
Malware Config
Signatures
Files
-
41b092b837fc0484ede58b282978a37e05e88f5d6ade2c903a7b2bdbad80e997.exe windows x86
144930a9497e0d65cdaaa5aaafc3af64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TlsSetValue
EnumSystemLocalesA
CompareStringA
SetEnvironmentVariableW
SystemTimeToFileTime
LCMapStringA
CompareStringW
IsValidCodePage
GetFileAttributesExW
GetFileInformationByHandle
ResumeThread
TerminateProcess
FindNextFileW
FindFirstFileA
GetDriveTypeA
GetConsoleOutputCP
ExitThread
GetFullPathNameA
SetConsoleMode
GetFileType
FreeEnvironmentStringsW
SleepEx
GetTempPathW
TlsGetValue
GetEnvironmentStringsW
InterlockedCompareExchange
GetModuleHandleA
RemoveDirectoryW
ReleaseMutex
FileTimeToLocalFileTime
LeaveCriticalSection
IsValidLocale
HeapCreate
HeapReAlloc
TlsFree
FreeLibrary
IsDebuggerPresent
MultiByteToWideChar
SetUnhandledExceptionFilter
GetProcessHeap
GetSystemTime
OpenFileMappingW
CreateDirectoryW
CreateFileA
GetCurrentThreadId
GlobalMemoryStatus
FormatMessageA
InterlockedIncrement
LCMapStringW
SetFilePointer
GetEnvironmentStrings
GetSystemTimeAsFileTime
GetConsoleMode
GetModuleFileNameA
QueryPerformanceFrequency
GetCurrentDirectoryA
GetVersion
WaitForSingleObject
VirtualFree
SetHandleCount
PeekConsoleInputA
DeleteFileW
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
GetModuleHandleW
SetFileAttributesW
ExitProcess
Sleep
WriteConsoleA
SetFilePointerEx
GetACP
GetProcAddress
InterlockedDecrement
FormatMessageW
FlushConsoleInputBuffer
UnmapViewOfFile
SetThreadPriority
GetLastError
GetConsoleCP
CreateFileW
SetConsoleCtrlHandler
WideCharToMultiByte
WriteConsoleW
FlushFileBuffers
ResetEvent
GetProcessTimes
CloseHandle
GetCurrentProcess
MoveFileW
ExpandEnvironmentStringsA
LocalFree
CopyFileW
QueryPerformanceCounter
HeapSize
InitializeCriticalSection
InterlockedExchange
FindFirstFileW
GetOEMCP
UnhandledExceptionFilter
OutputDebugStringW
GetSystemDirectoryA
lstrlenA
VirtualAlloc
SetFileTime
OpenMutexW
HeapFree
EnterCriticalSection
HeapAlloc
GetCurrentThread
GetTickCount
FreeEnvironmentStringsA
GetVersionExW
SetLastError
ReadConsoleInputA
GetCommandLineA
GetLocaleInfoA
TlsAlloc
RaiseException
WriteFile
GetThreadLocale
PeekNamedPipe
SetEndOfFile
FindClose
lstrlenW
CreateSemaphoreW
SetEnvironmentVariableA
WaitForMultipleObjects
CreateThread
GetStartupInfoA
ReadFile
HeapDestroy
GetNumberOfConsoleInputEvents
CreateFileMappingW
GetVolumeInformationW
GetStdHandle
LoadLibraryA
DeleteCriticalSection
GetLocaleInfoW
RtlUnwind
LocalAlloc
GetUserDefaultLCID
GetFileAttributesW
CreateMutexW
lstrcmpW
GetCurrentProcessId
FileTimeToSystemTime
ReleaseSemaphore
SetEvent
SetStdHandle
GetExitCodeProcess
GetModuleFileNameW
CreateProcessW
MapViewOfFile
CreateEventW
GetVersionExA
GetSystemDefaultLangID
GetUserDefaultLangID
LoadLibraryW
VirtualProtectEx
lstrcmpiW
GetCPInfo
user32
wsprintfW
MessageBoxA
GetUserObjectInformationW
GetDesktopWindow
GetProcessWindowStation
ole32
CoCreateGuid
CoCreateInstance
StringFromGUID2
CoInitialize
CoUninitialize
winhttp
WinHttpConnect
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReadData
WinHttpCrackUrl
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpReceiveResponse
iphlpapi
GetIfTable
psapi
GetProcessMemoryInfo
GetModuleBaseNameA
msvcrt
_vsnwprintf
_CIsin
Sections
.text1 Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.itext Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idat_0 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ