Static task
static1
Behavioral task
behavioral1
Sample
1_dispci.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1_dispci.exe
Resource
win10v2004-20220812-en
General
-
Target
1_dispci.exe
-
Size
145KB
-
MD5
729aac64b0cb298a7c3b8afd79579cec
-
SHA1
63f4f51922b8f3c45606c8b3c2a8f8d06b0a15c4
-
SHA256
1b5bd11dc1f70206bbd084bb99000794367d91604611ebbc241c5402bbff52a8
-
SHA512
594982198a545152b2e1858f0cc3dc769ee161579a3b3f61f290f7123aeab29d22dc97c82d21559f35e66b7c0eb7a777a2e9a0125b189961497f0f95f2a20df9
-
SSDEEP
3072:RkeK/MwGT0834YW3pvyh8fcl/iL62iL6KK:2n/MZd4YW3pvyxl/ini
Malware Config
Signatures
Files
-
1_dispci.exe.exe windows x86
94f57453c539227031b918edd52fc7f1
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TlsSetValue
FindNextVolumeW
DeviceIoControl
FindFirstVolumeW
GetFileSize
SetFilePointer
FindResourceW
LoadResource
WriteFile
SizeofResource
LockResource
VirtualQuery
GetCurrentProcess
VirtualFree
LoadLibraryW
VirtualUnlock
GetProcAddress
VirtualAlloc
VirtualLock
QueryPerformanceCounter
GetTickCount
GetCurrentThread
GetProcessHeap
GetProcessTimes
GlobalMemoryStatusEx
GetOEMCP
GetCurrentThreadId
GetCurrentProcessId
GetThreadTimes
GetCommandLineW
GetCommandLineA
SetConsoleCursorPosition
GetStdHandle
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
HeapAlloc
HeapFree
WideCharToMultiByte
Sleep
TlsGetValue
MultiByteToWideChar
SetConsoleCtrlHandler
GetVersion
ExpandEnvironmentStringsW
GetEnvironmentVariableW
CreateProcessW
SystemTimeToFileTime
GetSystemDirectoryW
FileTimeToSystemTime
GetLocalTime
lstrcatW
SetStdHandle
IsProcessorFeaturePresent
FlushFileBuffers
HeapReAlloc
GetStringTypeW
GetConsoleCP
RtlUnwind
GetSystemTimeAsFileTime
GetStartupInfoW
GetFileType
SetHandleCount
GetEnvironmentStringsW
HeapSize
FreeEnvironmentStringsW
LCMapStringW
WriteConsoleW
SetLastError
TlsFree
TlsAlloc
IsValidCodePage
FindVolumeClose
GetFileAttributesW
CreateThread
CloseHandle
FindNextFileW
WaitForMultipleObjects
CreateEventW
CreateFileMappingW
FindClose
GetFileSizeEx
CreateFileW
ReadFile
FlushViewOfFile
GetLogicalDrives
SetEvent
WaitForSingleObject
SetFilePointerEx
SetEndOfFile
GetDriveTypeW
UnmapViewOfFile
MapViewOfFile
FindFirstFileW
LocalFree
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
LocalAlloc
GetLastError
GetTimeZoneInformation
GetModuleFileNameW
GetSystemDefaultLCID
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
ExitProcess
GetModuleHandleW
HeapCreate
EncodePointer
DecodePointer
LeaveCriticalSection
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
HeapSetInformation
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EnterCriticalSection
user32
GetOpenClipboardWindow
GetShellWindow
GetWindowThreadProcessId
GetMessageTime
GetWindowRect
GetLastActivePopup
GetFocus
CallNextHookEx
GetWindowInfo
GetClientRect
GetQueueStatus
GetCapture
GetKBCodePage
GetForegroundWindow
GetGUIThreadInfo
GetCursorInfo
GetInputState
GetWindowTextW
GetDesktopWindow
GetCaretPos
GetActiveWindow
GetCursor
SetWindowsHookExW
GetClipboardOwner
EnumWindows
advapi32
CryptDestroyHash
CryptAcquireContextW
CryptDeriveKey
CryptDuplicateKey
CryptDuplicateHash
CryptHashData
CryptGetHashParam
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptGenRandom
CryptReleaseContext
CryptGetKeyParam
CryptSetKeyParam
ole32
CoInitialize
CoUninitialize
CoCreateInstance
crypt32
CryptImportPublicKeyInfo
CryptStringToBinaryW
CryptDecodeObjectEx
CryptBinaryToStringW
shlwapi
PathAppendW
PathCombineW
StrStrIW
PathFindExtensionW
psapi
GetProcessMemoryInfo
netapi32
NetWkstaGetInfo
NetApiBufferFree
Sections
.text Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 215KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.BadDay Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE