Static task
static1
Behavioral task
behavioral1
Sample
f98e2029cd93cc24d4e3d07951502c1de3be955d7dcc77e06c3aa9ed14416a40.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f98e2029cd93cc24d4e3d07951502c1de3be955d7dcc77e06c3aa9ed14416a40.exe
Resource
win10v2004-20220812-en
General
-
Target
f98e2029cd93cc24d4e3d07951502c1de3be955d7dcc77e06c3aa9ed14416a40
-
Size
317KB
-
MD5
0aae8329dfee35adc03801a6f153d4db
-
SHA1
c51be7120e6d31e668187608ea59b9eadbd4a9bf
-
SHA256
f98e2029cd93cc24d4e3d07951502c1de3be955d7dcc77e06c3aa9ed14416a40
-
SHA512
32cf643098038e080d5d8b3e44e50c95f74aa2d52c2c79ee58c59ac2e794ae8394416937c391fd43c28c358612176c19f59cd62d31fc05dd9154ec378fe8d921
-
SSDEEP
6144:apYYzo+/VRDc7DM0ZVDyy8CmCO+e6swxREM+JmRUr3h:oYYcKJcHM0ZVut6RRU4Ur3h
Malware Config
Signatures
Files
-
f98e2029cd93cc24d4e3d07951502c1de3be955d7dcc77e06c3aa9ed14416a40.exe windows x86
be410f990ff4f8fd07ff2086786e6a42
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
atl80
ord11
ord18
ord22
ord64
ord58
ord17
ord10
ord27
ord26
ord49
ord23
ord61
ord31
ord44
ord43
ord30
ord20
ord32
shlwapi
PathFileExistsW
wininet
InternetSetCookieW
InternetCrackUrlA
kernel32
WaitForSingleObject
GetTickCount
SetEvent
ResetEvent
WaitForMultipleObjects
Sleep
GetLastError
OpenEventW
OpenProcess
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
lstrlenA
lstrlenW
FlushInstructionCache
GetCurrentProcess
SetLastError
GetProcAddress
LoadLibraryW
DeleteFileW
GetTempFileNameW
GetTempPathW
GetModuleFileNameW
lstrcmpiA
InterlockedIncrement
CreateThread
lstrcmpiW
GetCurrentThreadId
GetCommandLineW
RaiseException
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetCurrentProcessId
EnterCriticalSection
LeaveCriticalSection
UnmapViewOfFile
CloseHandle
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
CreateEventW
InitializeCriticalSection
DeleteCriticalSection
TerminateThread
GetSystemTimeAsFileTime
user32
BeginPaint
PostMessageW
UnregisterClassA
DestroyWindow
DefWindowProcW
GetClassInfoExW
SendMessageW
RegisterClassExA
UnregisterClassW
LoadCursorA
GetClassInfoExA
GetMessageW
GetFocus
IsChild
LoadCursorW
GetClientRect
EndPaint
CharNextW
PostThreadMessageW
IsWindow
SetWindowLongW
CreateWindowExW
SetTimer
KillTimer
RegisterClassExW
GetWindowLongW
CallWindowProcW
SetRectEmpty
DispatchMessageW
TranslateMessage
MsgWaitForMultipleObjects
PeekMessageW
LoadStringW
gdi32
GetDeviceCaps
LPtoDP
SaveDC
SetMapMode
SetWindowOrgEx
SetViewportOrgEx
DeleteDC
RestoreDC
SetTextAlign
TextOutW
advapi32
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
ole32
CoCreateGuid
CoUninitialize
CoInitialize
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
StringFromCLSID
CoCreateInstance
oleaut32
LoadTypeLi
LoadRegTypeLi
DispCallFunc
VariantInit
SysStringLen
SysAllocString
SysStringByteLen
SysAllocStringByteLen
VariantClear
SysFreeString
GetErrorInfo
VariantChangeType
SetErrorInfo
CreateErrorInfo
qqplayer
?URLEncode@qzonemusic@@YA?AVCQmString@@PB_W@Z
?GetFileText@qzonemusic@@YA?AVCQmString@@PB_W@Z
?GetRegisterComponentPath@qzonemusic@@YA?AVCQmString@@ABU_GUID@@H@Z
?IsEmpty@CQmString@@QBEHXZ
?GetModulePath@qzonemusic@@YA?AVCQmString@@PAUHINSTANCE__@@@Z
?IsCurComponentBetter@qzonemusic@@YAHQB_W0@Z
?GetAppDataFolder@qzonemusic@@YA?AVCQmString@@XZ
?SetExceptionCatcher@@YAXPB_WH@Z
?EndLog@@YAXXZ
?InitLog@@YAHPB_W@Z
?GetVersionInfoFromFile@qzonemusic@@YAHPB_WAAE1AAK2@Z
?CreateObjectFromFile@@YAJPB_WPAUIUnknown@@ABU_GUID@@2PAPAX@Z
?GetExeFolder@qzonemusic@@YA?AVCQmString@@XZ
??0CQmString@@QAE@ABV0@@Z
??0CQmString@@QAE@PB_W@Z
??YCQmString@@QAEXABV0@@Z
?STR2DWORD@qzonemusic@@YAHPB_WAAK@Z
?SetQQUin@@YAXI@Z
?GetTempFile@qzonemusic@@YA?AVCQmString@@PB_W@Z
??BCQmString@@QAEPB_WXZ
??1CQmString@@QAE@XZ
?Create@CMyMutex@@QAEHPAU_SECURITY_ATTRIBUTES@@HPB_W@Z
?DoLog@@YAHPB_WZZ
??0CMyMutex@@QAE@XZ
??1CMyMutex@@QAE@XZ
?Lock@CMyMutex@@QAEHK@Z
?Unlock@CMyMutex@@QAEXXZ
?TrimString@qzonemusic@@YAXAAVCQmString@@@Z
msvcp80
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?size@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIXZ
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$allocator@D@std@@QAE@XZ
?allocate@?$allocator@D@std@@QAEPADIPBX@Z
?deallocate@?$allocator@D@std@@QAEXPADI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
msvcr80
atoi
_time64
srand
rand
strcmp
memmove_s
_vsnprintf_s
sprintf_s
_resetstkoflw
malloc
memcmp
wcsstr
wcsncpy_s
atol
_wcsicmp
calloc
_purecall
free
memcpy_s
??_V@YAXPAX@Z
wcsncmp
_beginthread
_CxxThrowException
_endthread
?terminate@@YAXXZ
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_invalid_parameter_noinfo
swprintf_s
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_recalloc
fread
ftell
_lock
_onexit
_decode_pointer
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_vsnwprintf_s
memcpy
fseek
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_amsg_exit
??3@YAXPAX@Z
fclose
fwrite
fopen
__CxxFrameHandler3
_snprintf
strchr
strlen
strstr
strncmp
memset
ws2_32
socket
bind
sendto
inet_addr
htons
htonl
WSAGetLastError
gethostname
gethostbyname
inet_ntoa
WSACleanup
closesocket
recvfrom
WSAStartup
ntohl
Sections
.text Size: 132KB - Virtual size: 128KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 60KB - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.crdata Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE