Static task
static1
Behavioral task
behavioral1
Sample
e23e6d08a920a243cd35fbc963e9a97f4cf3f26a9252bb8ce041fe32a4fb92b9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e23e6d08a920a243cd35fbc963e9a97f4cf3f26a9252bb8ce041fe32a4fb92b9.exe
Resource
win10v2004-20220812-en
General
-
Target
e23e6d08a920a243cd35fbc963e9a97f4cf3f26a9252bb8ce041fe32a4fb92b9
-
Size
842KB
-
MD5
76edf8f1417565dbda337dbd1da6c360
-
SHA1
9106421426c58e0f9bed446c130999d9e584bde3
-
SHA256
e23e6d08a920a243cd35fbc963e9a97f4cf3f26a9252bb8ce041fe32a4fb92b9
-
SHA512
f3679e22a74f0b117e87923ca4a6b07b5aa6417cd50968490f4b1af78464fe043eb6910bb751edfc5133116a2c3648fd070557543f55911cd15ad09c83bfd191
-
SSDEEP
12288:Gz5amlVZtf3nHOuFhnalDzSqQTBLqDaUZ38ZrZMYCOXx1OM0emw7izeJtFvX/aL:y133dhnQDzSLTBuiF1zBsM0PwWzk/a
Malware Config
Signatures
Files
-
e23e6d08a920a243cd35fbc963e9a97f4cf3f26a9252bb8ce041fe32a4fb92b9.exe windows x86
6fe47002f518962500adc10fb754b088
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
vc9.0_xerces-c_2_8
?endIntSubset@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?endExtSubset@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?entityDecl@AbstractDOMParser@xercesc_2_8@@UAEXABVDTDEntityDecl@2@_N1@Z
?resetDocType@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?notationDecl@AbstractDOMParser@xercesc_2_8@@UAEXABVXMLNotationDecl@2@_N@Z
?startAttList@AbstractDOMParser@xercesc_2_8@@UAEXABVDTDElementDecl@2@@Z
?startIntSubset@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?startExtSubset@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?TextDecl@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0@Z
?handleElementPSVI@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0PAVPSVIElement@2@@Z
?handlePartialElementPSVI@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0PAVPSVIElement@2@@Z
?handleAttributesPSVI@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0PAVPSVIAttributeList@2@@Z
??1XercesDOMParser@xercesc_2_8@@UAE@XZ
?endAttList@AbstractDOMParser@xercesc_2_8@@UAEXABVDTDElementDecl@2@@Z
?elementDecl@AbstractDOMParser@xercesc_2_8@@UAEXABVDTDElementDecl@2@_N@Z
?doctypeWhitespace@AbstractDOMParser@xercesc_2_8@@UAEXQB_WI@Z
?doctypePI@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0@Z
?doctypeDecl@AbstractDOMParser@xercesc_2_8@@UAEXABVDTDElementDecl@2@QB_W1_N2@Z
?doctypeComment@AbstractDOMParser@xercesc_2_8@@UAEXQB_W@Z
?attDef@AbstractDOMParser@xercesc_2_8@@UAEXABVDTDElementDecl@2@ABVDTDAttDef@2@_N@Z
?startInputSource@XercesDOMParser@xercesc_2_8@@UAEXABVInputSource@2@@Z
?resolveEntity@XercesDOMParser@xercesc_2_8@@UAEPAVInputSource@2@QB_W00@Z
?resolveEntity@XercesDOMParser@xercesc_2_8@@UAEPAVInputSource@2@PAVXMLResourceIdentifier@2@@Z
?resetEntities@XercesDOMParser@xercesc_2_8@@UAEXXZ
?expandSystemId@XercesDOMParser@xercesc_2_8@@UAE_NQB_WAAVXMLBuffer@2@@Z
?endInputSource@XercesDOMParser@xercesc_2_8@@UAEXABVInputSource@2@@Z
?resetErrors@XercesDOMParser@xercesc_2_8@@UAEXXZ
?error@XercesDOMParser@xercesc_2_8@@UAEXIQB_WW4ErrTypes@XMLErrorReporter@2@000JJ@Z
?createElementNSNode@AbstractDOMParser@xercesc_2_8@@MAEPAVDOMElement@2@PB_W0@Z
?setPSVIHandler@AbstractDOMParser@xercesc_2_8@@UAEXQAVPSVIHandler@2@@Z
?elementTypeInfo@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0@Z
?XMLDecl@AbstractDOMParser@xercesc_2_8@@UAEXQB_W000@Z
?startEntityReference@AbstractDOMParser@xercesc_2_8@@UAEXABVXMLEntityDecl@2@@Z
?startElement@AbstractDOMParser@xercesc_2_8@@UAEXABVXMLElementDecl@2@IQB_WABV?$RefVectorOf@VXMLAttr@xercesc_2_8@@@2@I_N3@Z
?startDocument@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?resetDocument@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?ignorableWhitespace@AbstractDOMParser@xercesc_2_8@@UAEXQB_WI_N@Z
?endEntityReference@AbstractDOMParser@xercesc_2_8@@UAEXABVXMLEntityDecl@2@@Z
?endElement@AbstractDOMParser@xercesc_2_8@@UAEXABVXMLElementDecl@2@I_NQB_W@Z
?endDocument@AbstractDOMParser@xercesc_2_8@@UAEXXZ
?docPI@AbstractDOMParser@xercesc_2_8@@UAEXQB_W0@Z
?docComment@AbstractDOMParser@xercesc_2_8@@UAEXQB_W@Z
?docCharacters@AbstractDOMParser@xercesc_2_8@@UAEXQB_WI_N@Z
??0XercesDOMParser@xercesc_2_8@@QAE@QAVXMLValidator@1@QAVMemoryManager@1@QAVXMLGrammarPool@1@@Z
??0MemBufInputSource@xercesc_2_8@@QAE@QBEIQBD_NQAVMemoryManager@1@@Z
?setLoadExternalDTD@AbstractDOMParser@xercesc_2_8@@QAEX_N@Z
?setErrorHandler@XercesDOMParser@xercesc_2_8@@QAEXQAVErrorHandler@2@@Z
?parse@AbstractDOMParser@xercesc_2_8@@QAEXABVInputSource@2@@Z
?adoptDocument@AbstractDOMParser@xercesc_2_8@@QAEPAVDOMDocument@2@XZ
??1MemBufInputSource@xercesc_2_8@@UAE@XZ
?getColumnNumber@SAXParseException@xercesc_2_8@@QBEJXZ
?getLineNumber@SAXParseException@xercesc_2_8@@QBEJXZ
??1MemBufFormatTarget@xercesc_2_8@@UAE@XZ
?flush@XMLFormatTarget@xercesc_2_8@@UAEXXZ
?writeChars@MemBufFormatTarget@xercesc_2_8@@UAEXQBEIQAVXMLFormatter@2@@Z
?getDOMImplementation@DOMImplementationRegistry@xercesc_2_8@@SAPAVDOMImplementation@2@PB_W@Z
?fgMemoryManager@XMLPlatformUtils@xercesc_2_8@@2PAVMemoryManager@2@A
?fgDOMWRTSplitCdataSections@XMLUni@xercesc_2_8@@2QB_WB
?fgDOMWRTDiscardDefaultContent@XMLUni@xercesc_2_8@@2QB_WB
?fgDOMWRTFormatPrettyPrint@XMLUni@xercesc_2_8@@2QB_WB
?fgDOMWRTBOM@XMLUni@xercesc_2_8@@2QB_WB
??2XMemory@xercesc_2_8@@SAPAXI@Z
??0MemBufFormatTarget@xercesc_2_8@@QAE@HQAVMemoryManager@1@@Z
?getRawBuffer@MemBufFormatTarget@xercesc_2_8@@QBEPBEXZ
??3XMemory@xercesc_2_8@@SAXPAX@Z
??_7ErrorHandler@xercesc_2_8@@6B@
?getSrcFile@XMLException@xercesc_2_8@@QBEPBDXZ
?Terminate@XMLPlatformUtils@xercesc_2_8@@SAXXZ
?fgXercescDefaultLocale@XMLUni@xercesc_2_8@@2QBDB
?Initialize@XMLPlatformUtils@xercesc_2_8@@SAXQBD0QAVPanicHandler@2@QAVMemoryManager@2@_N@Z
msvcp90
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1locale@std@@QAE@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Init@locale@std@@CAPAV_Locimp@12@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?widen@?$ctype@_W@std@@QBE_WD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Decref@facet@locale@std@@QAEPAV123@XZ
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@I_W@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W0@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?_Tidy@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@IAEX_NI@Z
??$?O_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?insert@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W0@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??0?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@H@Z
?setw@std@@YA?AU?$_Smanip@H@1@H@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@I@Z
?str@?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??_D?$basic_stringstream@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?toupper@?$ctype@_W@std@@QBE_W_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0_Lockit@std@@QAE@H@Z
?id@?$ctype@_W@std@@2V0locale@2@A
??1_Lockit@std@@QAE@XZ
?_Id_cnt@id@locale@std@@0HA
?_Getfacet@locale@std@@QBEPBVfacet@12@I@Z
?_Getcat@?$ctype@_W@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?_Incref@facet@locale@std@@QAEXXZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@I_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
mfc90u
ord1276
ord6693
ord1137
ord814
ord1354
ord3537
ord2106
ord3543
ord2458
ord2523
ord2954
ord2953
ord399
ord6835
ord1565
ord2326
ord1254
ord287
ord6698
ord3187
ord6079
ord5770
ord6813
ord1552
ord403
ord663
ord290
ord799
ord578
ord5793
ord6686
ord781
ord5938
ord4518
ord5979
ord933
ord4490
ord4405
ord6013
ord2478
ord4519
ord6687
ord899
ord608
ord5939
ord2676
ord1603
ord2537
ord935
ord938
ord939
ord4235
ord2479
ord1607
ord285
ord3220
ord1599
ord4448
ord4423
ord6801
ord4173
ord6803
ord4747
ord2251
ord2206
ord324
ord4179
ord1048
ord5548
ord6741
ord5830
ord4213
ord2087
ord3217
ord291
ord1219
ord5674
ord5676
ord2447
ord4347
ord4996
ord5680
ord5663
ord6018
ord2771
ord404
ord5535
ord6164
ord6699
ord2983
ord3112
ord4728
ord2966
ord3115
ord2774
ord2893
ord2764
ord3285
ord4080
ord4081
ord4071
ord2891
ord4348
ord4905
ord4681
ord949
ord3670
ord3589
ord5767
ord1243
ord6811
ord5778
ord6822
ord266
ord6104
ord1609
ord1664
ord773
ord572
ord5933
ord280
ord2084
ord1183
ord4211
ord794
ord589
ord1248
ord6630
ord813
ord286
ord811
ord600
ord1250
ord296
ord801
ord6035
ord1272
ord3531
msvcr90
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
??8type_info@@QBE_NABV0@@Z
memmove
??0exception@std@@QAE@ABQBDH@Z
__RTtypeid
_invalid_parameter_noinfo
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
abort
memcpy
strncpy
strstr
qsort
wprintf
_mktime64
_purecall
free
malloc
_localtime64_s
wcsftime
wcspbrk
wcschr
_time64
_wsplitpath
memmove_s
_CxxThrowException
atoi
sprintf
__CxxFrameHandler3
??0exception@std@@QAE@ABQBD@Z
memset
exit
?what@exception@std@@UBEPBDXZ
??0bad_cast@std@@QAE@PBD@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
memcpy_s
??0bad_cast@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABV01@@Z
??1bad_cast@std@@UAE@XZ
kernel32
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetStartupInfoW
LCMapStringW
InterlockedCompareExchange
LoadLibraryA
InterlockedIncrement
FindNextFileW
FindFirstFileW
GetSystemTimeAsFileTime
Sleep
FreeLibrary
GetStringTypeExW
GetUserDefaultLCID
CreateFileW
SetFilePointer
ReadFile
InterlockedExchange
CloseHandle
FileTimeToLocalFileTime
FileTimeToSystemTime
SetCurrentDirectoryW
GetCurrentDirectoryW
MultiByteToWideChar
WideCharToMultiByte
FindClose
user32
LoadStringW
MessageBoxW
gdi32
CreateFontIndirectW
GetObjectW
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
comctl32
ord17
wsock32
WSAStartup
Sections
.text Size: 185KB - Virtual size: 184KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 592KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE