Behavioral task
behavioral1
Sample
2669be45829692c40eaac2aa8b4a8d4f08ba6f9721aad4d957f3462953c856b0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2669be45829692c40eaac2aa8b4a8d4f08ba6f9721aad4d957f3462953c856b0.exe
Resource
win10v2004-20220812-en
General
-
Target
2669be45829692c40eaac2aa8b4a8d4f08ba6f9721aad4d957f3462953c856b0
-
Size
285KB
-
MD5
48d0bbff23baecf7b6528649c19d93be
-
SHA1
ed32908df7c6eff662253df8139e92040fedd5fc
-
SHA256
2669be45829692c40eaac2aa8b4a8d4f08ba6f9721aad4d957f3462953c856b0
-
SHA512
f81727ed82a34d4265bc09901e69e6022a6a1e9c5e7fccb9d19047e51a867f8570ab8fb96be0be93acf4f22f2ab3862075acbe73503997e701b17a63dab0f8d8
-
SSDEEP
6144:woUuerS7kkQMHy95orabpJF24R66RnTbEphf24e7:w5PrS7mJF2i66RvEX2j
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
2669be45829692c40eaac2aa8b4a8d4f08ba6f9721aad4d957f3462953c856b0.exe windows x86
4657d0d414c30d433ad26ac10ef98d51
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_purecall
iswspace
wprintf
_wcslwr
wcstol
_except_handler3
_wtol
fprintf
_errno
swscanf
wcstoul
_wsetlocale
wcsncmp
wcschr
_CxxThrowException
_wcsupr
fputwc
_wcsicmp
_iob
wcsstr
__CxxFrameHandler
_wtoi
towupper
wcscmp
_c_exit
_exit
_XcptFilter
_cexit
??2@YAPAXI@Z
iswdigit
wcslen
printf
_vsnwprintf
exit
__winitenv
__wgetmainargs
_initterm
vswprintf
??3@YAXPAX@Z
_putws
?terminate@@YAXXZ
_controlfp
_onexit
__dllonexit
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
atl
ord16
advapi32
LookupAccountNameW
GetSecurityDescriptorLength
InitializeSecurityDescriptor
IsValidSecurityDescriptor
GetSecurityDescriptorSacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
SetEntriesInAclW
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
SetSecurityDescriptorControl
MakeSelfRelativeSD
BuildExplicitAccessWithNameW
AllocateAndInitializeSid
GetSecurityDescriptorDacl
IsValidAcl
GetAclInformation
GetAce
FreeSid
EqualSid
QueryServiceConfigW
ControlService
OpenSCManagerW
OpenServiceW
StartServiceW
QueryServiceStatus
CloseServiceHandle
ChangeServiceConfig2W
kernel32
GetStdHandle
GetConsoleOutputCP
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
GetConsoleMode
SetUnhandledExceptionFilter
SetLastError
GetProcessHeap
HeapAlloc
HeapFree
DnsHostnameToComputerNameW
SetConsoleMode
ReadConsoleW
UnhandledExceptionFilter
LocalReAlloc
LocalAlloc
GetComputerNameExW
InitializeCriticalSectionAndSpinCount
GetCommandLineW
lstrcmpiW
GetModuleHandleW
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
GetProcAddress
LoadLibraryW
FreeLibrary
CloseHandle
FormatMessageW
LocalFree
DeleteCriticalSection
Sleep
InterlockedIncrement
GetLastError
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
lstrlenA
InterlockedDecrement
lstrlenW
CompareStringW
lstrcmpW
GetLocaleInfoW
IsDebuggerPresent
OutputDebugStringA
InterlockedCompareExchange
FormatMessageA
LoadLibraryExW
user32
LoadStringW
ole32
CoInitializeSecurity
CoUninitialize
CoInitializeEx
CoCreateInstanceEx
CoCreateInstance
oleaut32
VariantInit
SysAllocString
SysStringLen
SysAllocStringLen
SysFreeString
netapi32
NetpwNameValidate
NetpNetBiosReset
NetpNetBiosStatusToApiStatus
NetUserChangePassword
Netbios
DsGetDcNameW
NetServerEnum
NetApiBufferFree
clusapi
ClusterGetEnumCount
CloseClusterNetInterface
OpenClusterNetInterface
GetClusterNetInterfaceState
ClusterNetInterfaceControl
CloseClusterNode
GetClusterNodeState
OpenClusterNode
ClusterNodeCloseEnum
ClusterNodeOpenEnum
ClusterNodeControl
PauseClusterNode
ResumeClusterNode
EvictClusterNodeEx
GetClusterNodeId
GetClusterInformation
SetClusterServiceAccountPassword
ClusterResourceControl
DeleteClusterResource
SetClusterResourceName
ClusterResourceCloseEnum
ClusterResourceOpenEnum
FailClusterResource
CreateClusterResource
OpenClusterGroup
CloseClusterGroup
ChangeClusterResourceGroup
AddClusterResourceDependency
RemoveClusterResourceDependency
AddClusterResourceNode
RemoveClusterResourceNode
GetClusterNetworkState
SetClusterNetworkName
ClusterNetworkCloseEnum
ClusterNetworkOpenEnum
ClusterNetworkControl
OpenClusterNetwork
SetClusterNetworkPriorityOrder
CloseClusterNetwork
OpenClusterResource
SetClusterQuorumResource
CloseClusterResource
SetClusterName
ClusterOpenEnum
ClusterEnum
ClusterCloseEnum
OpenCluster
ClusterControl
SetClusterGroupNodeList
ClusterResourceTypeEnum
ClusterResourceTypeCloseEnum
ClusterResourceTypeOpenEnum
ClusterResourceTypeControl
DeleteClusterResourceType
CreateClusterResourceType
GetClusterQuorumResource
GetClusterGroupState
ClusterGroupEnum
ClusterNetworkEnum
ClusterNodeEnum
GetClusterResourceState
ClusterResourceEnum
CreateClusterNotifyPort
CloseClusterNotifyPort
RegisterClusterNotify
GetClusterNotify
CreateClusterGroup
OnlineClusterResource
OfflineClusterResource
OnlineClusterGroup
OfflineClusterGroup
MoveClusterGroup
GetClusterNetInterface
DeleteClusterGroup
SetClusterGroupName
ClusterGroupCloseEnum
ClusterGroupOpenEnum
ClusterGroupControl
CloseCluster
ntdll
RtlAnsiStringToUnicodeString
RtlNtStatusToDosError
memmove
RtlInitAnsiString
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
RtlInitUnicodeString
_strnicmp
RtlUnicodeStringToOemString
toupper
RtlFreeOemString
iswctype
ws2_32
inet_addr
dnsapi
DnsValidateName_W
secur32
GetUserNameExW
Sections
.text Size: 121KB - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE