??4_Init_locks@std@@QAEAAV01@ABV01@@Z
Static task
static1
Behavioral task
behavioral1
Sample
5119b96968e10ee28ebc976dae7825eaf0cb8d09084b28c1e3027d088b7cf7c1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5119b96968e10ee28ebc976dae7825eaf0cb8d09084b28c1e3027d088b7cf7c1.exe
Resource
win10v2004-20220812-en
General
-
Target
5119b96968e10ee28ebc976dae7825eaf0cb8d09084b28c1e3027d088b7cf7c1
-
Size
197KB
-
MD5
506e3cc08997608d071b19de4b21d3d4
-
SHA1
d7fa8755c3e0b8675435e9db30c68767b444fc43
-
SHA256
5119b96968e10ee28ebc976dae7825eaf0cb8d09084b28c1e3027d088b7cf7c1
-
SHA512
c4c74c976ca098ea7bdbf14836179a901e7d9221b8430c9d0589b09f2c0b3b4b9d43eccc20b44d55a278ad90214479b3dba03386cb8e0ac9c7fcdf682b04b5f3
-
SSDEEP
3072:cAu974osTTXL5u66b0li/UGD0Yx+bHBFILLn0XOo/bY6i6aFqpLigOfLuic:cAosT7MNl96DpL3OD2
Malware Config
Signatures
Files
-
5119b96968e10ee28ebc976dae7825eaf0cb8d09084b28c1e3027d088b7cf7c1.exe windows x86
27b1c97e030db4b444ad0869c1af3523
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shfolder
SHGetFolderPathW
kernel32
SetErrorMode
GetCommandLineW
GetTickCount
GetCurrentThread
CreateMutexW
ReleaseMutex
GetModuleFileNameA
FormatMessageA
GetComputerNameA
OutputDebugStringA
WriteFile
SetFilePointer
CreateFileW
FindClose
FindFirstFileW
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetTempPathW
FindNextFileW
GetFileAttributesA
FileTimeToDosDateTime
FileTimeToLocalFileTime
GetFileInformationByHandle
CreateFileA
DeleteFileW
GetLocaleInfoW
SetConsoleCtrlHandler
ConvertDefaultLocale
GetUserDefaultUILanguage
GetSystemDefaultLCID
EnumUILanguagesW
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetVersionExA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
PulseEvent
SetProcessWorkingSetSize
CreateProcessW
Sleep
OutputDebugStringW
DebugBreak
lstrlenA
GetEnvironmentVariableW
SetEnvironmentVariableW
OpenProcess
WideCharToMultiByte
GetWindowsDirectoryW
lstrcpynW
GetFileAttributesW
CreateDirectoryW
LocalFree
LoadLibraryW
GetProcAddress
CreateEventW
WaitForMultipleObjects
WaitForSingleObject
FindResourceExW
LockResource
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
FindResourceW
LoadResource
SizeofResource
MultiByteToWideChar
FreeLibrary
InterlockedDecrement
InterlockedIncrement
lstrcmpiW
DeleteCriticalSection
InitializeCriticalSection
lstrlenW
SetLastError
OpenEventW
SetEvent
FlushInstructionCache
LeaveCriticalSection
EnterCriticalSection
LocalAlloc
RaiseException
GetCurrentThreadId
GetCurrentProcessId
GetLocalTime
GetVersionExW
CloseHandle
GetCurrentProcess
GetLastError
GetSystemDefaultUILanguage
user32
UnregisterClassA
DestroyWindow
SetWindowLongW
ShowWindow
GetClassInfoExW
LoadCursorW
DefWindowProcW
CallWindowProcW
GetWindowLongW
RegisterClassExW
CreateWindowExW
CharNextW
wsprintfW
SendMessageW
GetWindowThreadProcessId
FindWindowW
LoadStringW
wvsprintfW
PostThreadMessageW
PeekMessageW
MsgWaitForMultipleObjects
CharNextA
GetProcessWindowStation
GetUserObjectInformationA
GetMessageW
PostQuitMessage
DispatchMessageW
TranslateMessage
MessageBoxW
advapi32
OpenServiceW
CreateServiceW
CreateProcessAsUserW
ControlService
DeleteService
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegOpenKeyW
RegEnumKeyW
MakeSelfRelativeSD
GetSecurityDescriptorLength
OpenSCManagerW
CloseServiceHandle
RegQueryValueExW
RegFlushKey
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
GetTokenInformation
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetAclInformation
InitializeAcl
AddAce
CopySid
IsValidSid
GetLengthSid
OpenProcessToken
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
MakeAbsoluteSD
GetSecurityDescriptorControl
QueryServiceStatus
StartServiceW
RegisterServiceCtrlHandlerW
StartServiceCtrlDispatcherW
OpenThreadToken
CheckTokenMembership
GetUserNameA
ChangeServiceConfigW
ole32
CoInitializeSecurity
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CLSIDFromProgID
CoTaskMemFree
CoGetInterfaceAndReleaseStream
CoFreeUnusedLibraries
CoUninitialize
CoInitializeEx
CoMarshalInterThreadInterfaceInStream
StringFromGUID2
CoRevokeClassObject
CoRegisterClassObject
StringFromCLSID
CoCreateGuid
CoRevertToSelf
CoImpersonateClient
CoInitialize
oleaut32
SysStringByteLen
SysAllocStringByteLen
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocStringLen
SysStringLen
SysAllocString
SysFreeString
SystemTimeToVariantTime
VariantTimeToSystemTime
VarUI4FromStr
shlwapi
PathFileExistsA
PathFindFileNameA
PathFindExtensionA
PathIsDirectoryW
PathAppendW
msvcp80
?swap@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXAAV12@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIABV12@I@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIABV12@@Z
??$?HGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBG@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
msvcr80
?_open@@YAHPBDHH@Z
_onexit
_lock
__dllonexit
_encode_pointer
_unlock
_errno
_localtime64
wcsncpy
_decode_pointer
wcscmp
memmove
iswcntrl
_except_handler4_common
swscanf
_tempnam
remove
_lseek
_close
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
_read
_controlfp_s
_invoke_watson
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
__set_app_type
__p__fmode
??3@YAXPAX@Z
malloc
free
_CxxThrowException
memcpy_s
memmove_s
_purecall
calloc
memset
_resetstkoflw
__CxxFrameHandler3
??2@YAPAXI@Z
swprintf_s
_recalloc
wcsncpy_s
??_V@YAXPAX@Z
wcslen
_beginthreadex
_mktime64
_localtime64_s
wcsftime
wcscpy
wcscat
_vsnwprintf
wcschr
wcsrchr
wcsstr
memcmp
wcscpy_s
wcscat_s
_putws
iswdigit
_wtoi
memcpy
_wcsnicmp
_ltow
_wcsicmp
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
strstr
_time64
_strnicmp
strlen
strchr
_vsnwprintf_s
_vsnprintf_s
strncpy_s
_itoa_s
vsprintf_s
strtok_s
iscntrl
atoi
_snprintf_s
_stricmp
_snwprintf_s
strcpy
_write
wsock32
closesocket
WSAGetLastError
sendto
socket
ioctlsocket
htons
WSAStartup
Exports
Exports
Sections
.text Size: 104KB - Virtual size: 101KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 64KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ