Static task
static1
Behavioral task
behavioral1
Sample
14a37fe22bf836aee83b6d1f9a27a83fc805e46356fc413d83b70a67ca22edad.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
14a37fe22bf836aee83b6d1f9a27a83fc805e46356fc413d83b70a67ca22edad.exe
Resource
win10v2004-20220812-en
General
-
Target
14a37fe22bf836aee83b6d1f9a27a83fc805e46356fc413d83b70a67ca22edad
-
Size
504KB
-
MD5
78ad0b77cebe99ed7a76a54b3e272d40
-
SHA1
e8c607e8cd1ea5fabf037b59635838e08e02f5d0
-
SHA256
14a37fe22bf836aee83b6d1f9a27a83fc805e46356fc413d83b70a67ca22edad
-
SHA512
45ad823e967ce2a8633171fe39c69188ea82afe43ffb5c8514406635b2a0d491fba73ecea77f3ed7223af06984f8453b8f981acbb23fd6ba7dc056f3d8fc5ff3
-
SSDEEP
12288:tsNMPccL7Q2RzpXS2OcDzgWxpjGDEACf7PuZJd:Zp7Pzpi2lB3+CfL+Jd
Malware Config
Signatures
Files
-
14a37fe22bf836aee83b6d1f9a27a83fc805e46356fc413d83b70a67ca22edad.exe windows x86
827f620b09724e03c51609e0488ed0c9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InitializeCriticalSectionEx
RaiseException
GetLastError
HeapSize
LockResource
DecodePointer
GetProcessAffinityMask
DeleteCriticalSection
CloseHandle
GetEnvironmentVariableW
CreateDirectoryW
GetExitCodeProcess
GetTempPathW
GetStdHandle
ExitProcess
SetEvent
TerminateProcess
CreateEventW
WaitForMultipleObjects
DeleteFileW
CreateMutexW
GetTickCount
Sleep
GetModuleFileNameW
ResetEvent
OpenEventW
ReleaseMutex
GetCurrentProcessId
GetModuleHandleW
ReadFile
CreateFileW
GetProcAddress
GetShortPathNameW
QueryFullProcessImageNameW
OpenProcess
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
VerSetConditionMask
Thread32First
Thread32Next
VerifyVersionInfoW
OpenThread
GetModuleHandleA
MultiByteToWideChar
LoadLibraryW
ReleaseSemaphore
FreeLibraryAndExitThread
GetThreadTimes
FindFirstFileW
FindClose
GetFileAttributesW
HeapDestroy
SizeofResource
WideCharToMultiByte
GetProcessHeap
WaitForSingleObject
HeapFree
HeapAlloc
CreateProcessW
LoadResource
FindResourceW
FindResourceExW
SetProcessAffinityMask
SetFileAttributesW
SetFileTime
InitializeSListHead
VirtualProtect
SetFilePointer
GetFileSize
SetEndOfFile
WriteConsoleW
SetStdHandle
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
GetOEMCP
GetACP
IsValidCodePage
UnregisterWaitEx
VirtualFree
FreeLibrary
HeapReAlloc
GetSystemTimeAsFileTime
GetCurrentThreadId
DuplicateHandle
GetCurrentProcess
GetCurrentThread
GetExitCodeThread
EncodePointer
EnterCriticalSection
LeaveCriticalSection
GetStringTypeW
IsDebuggerPresent
OutputDebugStringW
IsProcessorFeaturePresent
CreateTimerQueue
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
CreateThread
SetThreadPriority
GetThreadPriority
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCommandLineA
RtlUnwind
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetStartupInfoW
CreateSemaphoreW
ExitThread
LoadLibraryExW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetModuleHandleExW
AreFileApisANSI
GetFileType
SetFilePointerEx
FlushFileBuffers
WriteFile
GetConsoleCP
GetConsoleMode
GetVersionExW
VirtualAlloc
user32
EnumWindows
GetWindowTextLengthW
IsWindow
PostMessageW
GetWindowTextW
FindWindowExW
GetWindowTextA
GetClassNameA
GetClassNameW
GetWindowRect
GetLastInputInfo
GetWindowThreadProcessId
advapi32
RegDeleteValueW
CryptHashData
RegSetValueExW
CryptDestroyHash
RegOpenKeyExW
CryptCreateHash
RegCloseKey
RegQueryValueExW
CryptReleaseContext
RegCreateKeyExW
CryptAcquireContextW
CryptGetHashParam
shell32
SHFileOperationW
SHCreateDirectoryExW
ShellExecuteExW
ole32
StringFromGUID2
CoCreateGuid
oleaut32
SysAllocString
VariantClear
ws2_32
WSACleanup
WSAGetLastError
WSAStartup
accept
WSAWaitForMultipleEvents
listen
send
closesocket
WSACreateEvent
socket
bind
recv
setsockopt
ntohs
WSAEventSelect
htons
WSAEnumNetworkEvents
select
ntohl
iphlpapi
GetExtendedTcpTable
Sections
.text Size: 383KB - Virtual size: 383KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 83KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ