Static task
static1
Behavioral task
behavioral1
Sample
5130e636a2e82e3323870315172ee3e28e8c238d896df0fb79c566e6cc9d842c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5130e636a2e82e3323870315172ee3e28e8c238d896df0fb79c566e6cc9d842c.exe
Resource
win10v2004-20220812-en
General
-
Target
5130e636a2e82e3323870315172ee3e28e8c238d896df0fb79c566e6cc9d842c
-
Size
940KB
-
MD5
e2cd449c2e593463c18beeed988cfcc4
-
SHA1
b1af1fdddacffd79d4971209eb70ae567f954abc
-
SHA256
5130e636a2e82e3323870315172ee3e28e8c238d896df0fb79c566e6cc9d842c
-
SHA512
e45f78552bfbb5258a8145497fbb0a0f6e33d126942bca7973f2fb0837ec02e60a6de41c9c27359913a923e7646e93e60b72096183f85f931ab28d96b9231816
-
SSDEEP
12288:fPRmvjp0tfu0P8ZGGL96X1lD9rnIFeyPDoXBdvRc:fPcjp0tfu0PIGGL0xkFeyD6c
Malware Config
Signatures
Files
-
5130e636a2e82e3323870315172ee3e28e8c238d896df0fb79c566e6cc9d842c.exe windows x86
f8a7d668b6b958b852dd456f50e83bf7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
GetWindowsDirectoryA
GetACP
GetLocaleInfoA
GetThreadLocale
GetShortPathNameW
MoveFileExW
CopyFileW
GetTempFileNameW
GetVersionExW
DeleteFileW
SetFileAttributesW
RemoveDirectoryW
GetCurrentDirectoryW
GetFileAttributesW
InterlockedDecrement
InterlockedIncrement
ReleaseMutex
OutputDebugStringW
WriteFile
GetCurrentThreadId
WritePrivateProfileStructA
SetFilePointer
FindClose
FindFirstFileW
GetPrivateProfileStructA
MultiByteToWideChar
GetPrivateProfileStringA
WideCharToMultiByte
ReadFile
VirtualQuery
IsBadStringPtrA
lstrlenW
GetModuleHandleW
lstrcpyW
Sleep
CreatePipe
CreateProcessW
GetPrivateProfileStringW
GetPrivateProfileIntW
SystemTimeToFileTime
SetFileTime
WritePrivateProfileStringW
GlobalFree
lstrlenA
GlobalAlloc
SetThreadPriority
GetCurrentThread
GetCommandLineW
GetExitCodeProcess
GetTempPathW
GetWindowsDirectoryW
MoveFileW
PulseEvent
GetCurrentProcess
FindNextFileW
CreateDirectoryW
CreateMutexW
GetModuleFileNameW
GetCurrentProcessId
CreateFileW
LeaveCriticalSection
IsBadWritePtr
IsBadStringPtrW
GetFullPathNameW
SetCurrentDirectoryW
GetLocalTime
InitializeCriticalSection
FreeLibrary
DeleteCriticalSection
EnterCriticalSection
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
LocalAlloc
LocalFree
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingW
GetFileSize
GetLastError
WaitForSingleObject
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InterlockedExchange
GetVersionExA
HeapReAlloc
HeapAlloc
VirtualProtect
VirtualAlloc
GetModuleHandleA
GetSystemInfo
HeapFree
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
ExitProcess
GetCommandLineA
GetProcessHeap
GetStartupInfoA
RaiseException
RtlUnwind
HeapDestroy
HeapCreate
VirtualFree
GetCPInfo
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
HeapSize
GetStdHandle
GetModuleFileNameA
LoadLibraryA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetConsoleCP
GetConsoleMode
user32
LoadStringW
advapi32
RegCloseKey
UnlockServiceDatabase
RegOpenKeyExW
FreeSid
AllocateAndInitializeSid
ChangeServiceConfigW
ChangeServiceConfig2W
LockServiceDatabase
RegQueryValueExW
EqualSid
GetTokenInformation
CreateServiceW
OpenProcessToken
StartServiceW
ControlService
QueryServiceStatus
OpenServiceW
CloseServiceHandle
OpenSCManagerW
RegDeleteValueW
RegOpenKeyW
RegCreateKeyExA
RegEnumKeyExA
RegOpenKeyExA
RegSetValueExA
RegQueryValueExA
shell32
SHGetFolderPathW
ole32
CoInitialize
CoUninitialize
Sections
.text Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 755KB - Virtual size: 754KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ