Static task
static1
Behavioral task
behavioral1
Sample
a78a181eb17d2abf19fd594c69ba555aa8ac4d8d1e26d889f7d88a021606cab5.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a78a181eb17d2abf19fd594c69ba555aa8ac4d8d1e26d889f7d88a021606cab5.exe
Resource
win10v2004-20220901-en
General
-
Target
a78a181eb17d2abf19fd594c69ba555aa8ac4d8d1e26d889f7d88a021606cab5
-
Size
1.0MB
-
MD5
0982b02b2b936d1c030269d14ce43eab
-
SHA1
c85a5646a3f396e53f5e93008d2682d97862b21d
-
SHA256
a78a181eb17d2abf19fd594c69ba555aa8ac4d8d1e26d889f7d88a021606cab5
-
SHA512
f43b576305e6ba82d73e34a7b1e1171c466eeeaadd3ad2d59e6876ac78efc221df43a7717a4b5b4b066de3fbe2c5ac07ab690225c2dbd2760208300685df8250
-
SSDEEP
24576:6cY1LS94boNSQFiE8/8hgDkFYjVziyKY4R:6vGAKkEgDkFYjZiyKJR
Malware Config
Signatures
Files
-
a78a181eb17d2abf19fd594c69ba555aa8ac4d8d1e26d889f7d88a021606cab5.exe windows x86
4080f29a387b02de06eb5157c5fa9681
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winmm
PlaySoundW
timeGetTime
bugrpt
BR_SetSenderExtCmd
BR_Init
BR_SetUin
BR_SetVersion
BR_SetLogSession
BR_SetSender
BR_SetLcid
lua51
lua_tocfunction
lua_iscfunction
lua_call
lua_newuserdata
lua_rawget
lua_remove
lua_pushcclosure
lua_getfenv
lua_error
lua_setfenv
lua_gc
lua_pushlightuserdata
lua_setmetatable
lua_touserdata
lua_settop
lua_toboolean
lua_pushlstring
lua_pushvalue
lua_rawequal
lua_concat
lua_insert
lua_isstring
lua_getmetatable
lua_typename
lua_tolstring
lua_type
luaL_error
lua_gettop
lua_replace
lua_isuserdata
lua_gettable
lua_isnumber
lua_pushstring
lua_pushnumber
lua_tonumber
lua_settable
luaL_newmetatable
lua_getfield
lua_createtable
lua_rawset
lua_pushboolean
lua_pushnil
lua_next
kernel32
InterlockedCompareExchange
HeapSize
HeapReAlloc
HeapDestroy
GetVersionExA
GetThreadLocale
GetACP
InterlockedExchange
GetLocaleInfoA
GetStartupInfoW
UnhandledExceptionFilter
IsDebuggerPresent
SleepEx
GetLastError
OutputDebugStringW
GetPrivateProfileIntW
QueryPerformanceCounter
GetPrivateProfileStringW
GetTickCount
GetCurrentThreadId
GetModuleFileNameW
DeleteFileW
UnmapViewOfFile
CreateToolhelp32Snapshot
Module32FirstW
ReleaseMutex
GetProcAddress
GetSystemInfo
Module32NextW
SetProcessAffinityMask
CloseHandle
GetCurrentProcess
Process32FirstW
OpenProcess
GetModuleHandleW
SetCurrentDirectoryW
LoadLibraryW
GetCommandLineW
GetCurrentProcessId
Process32NextW
TerminateProcess
CreateMutexW
Sleep
FindFirstFileW
FindNextFileW
FindClose
CreateFileMappingW
MapViewOfFile
SearchPathW
ReadProcessMemory
SetUnhandledExceptionFilter
WriteProcessMemory
QueryPerformanceFrequency
CreateEventW
HeapFree
InitializeCriticalSection
WaitForSingleObject
DuplicateHandle
EnterCriticalSection
CreateProcessW
HeapAlloc
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
CreateFileW
DeviceIoControl
CreateThread
SetThreadPriority
ResumeThread
lstrlenA
FileTimeToSystemTime
GetProcessWorkingSetSize
SetProcessWorkingSetSize
GetSystemTimeAsFileTime
GetFileAttributesW
SetFileAttributesW
VirtualQuery
GetWindowsDirectoryW
DeleteCriticalSection
LeaveCriticalSection
SetFilePointer
WriteFile
MoveFileW
CreateDirectoryW
GetProcessTimes
lstrlenW
DebugBreak
GetLocalTime
InterlockedIncrement
SetEvent
WaitForMultipleObjectsEx
ReadFile
ConnectNamedPipe
GetOverlappedResult
CreateNamedPipeW
SetNamedPipeHandleState
DisconnectNamedPipe
WaitNamedPipeW
WaitForMultipleObjects
GlobalFree
GlobalAlloc
GlobalLock
GlobalUnlock
FreeLibrary
InterlockedDecrement
LocalAlloc
LocalFree
GetFileSize
GetVersionExW
WritePrivateProfileStringW
OpenMutexW
user32
PeekMessageW
PostQuitMessage
wsprintfW
DispatchMessageW
ClientToScreen
GetClientRect
SetWindowTextW
SetWindowPos
GetSystemMetrics
CallWindowProcW
CreateWindowExW
IsRectEmpty
SendMessageW
IsWindow
DefWindowProcW
GetClassInfoExW
DestroyWindow
GetKeyState
TranslateMessage
UnregisterClassW
ClipCursor
SetCursor
GetCursorInfo
GetCursorPos
RegisterClassExW
LoadCursorW
FindWindowExW
PostMessageW
FindWindowW
GetWindowRect
IsWindowUnicode
UnionRect
IntersectRect
EqualRect
InflateRect
ShowWindow
SetWindowLongW
GetWindowLongW
GetDC
GetAsyncKeyState
LoadIconW
gdi32
CreateCompatibleBitmap
SelectObject
BitBlt
GetStockObject
DeleteObject
DeleteDC
CreateCompatibleDC
advapi32
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
shell32
CommandLineToArgvW
ShellExecuteExW
SHGetFolderPathW
ShellExecuteA
Shell_NotifyIconW
ShellExecuteW
ole32
CreateStreamOnHGlobal
OleInitialize
OleUninitialize
CoUninitialize
CoInitializeEx
CoCreateInstance
CoInitialize
oleaut32
GetErrorInfo
SysFreeString
VariantClear
DispCallFunc
SysAllocString
SysStringLen
VariantInit
msvcp80
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?find_first_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
shlwapi
PathCombineW
PathIsURLW
PathIsRelativeW
ws2_32
ioctlsocket
connect
send
recv
select
__WSAFDIsSet
gethostbyname
ntohl
recvfrom
WSAGetLastError
sendto
inet_addr
htonl
htons
inet_ntoa
getaddrinfo
closesocket
setsockopt
WSACleanup
socket
WSAStartup
ntohs
msvcr80
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
strspn
atoi
memchr
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
_encode_pointer
__dllonexit
_unlock
_CxxThrowException
__CxxFrameHandler3
_CIsqrt
_time32
??3@YAXPAX@Z
??2@YAPAXI@Z
wcsncpy_s
_snwprintf
_time64
_snwprintf_s
_wsplitpath_s
_purecall
_vswprintf_c_l
_vsnwprintf_s
_invalid_parameter_noinfo
srand
rand
wcscpy_s
??0exception@std@@QAE@ABQBD@Z
_wfopen
fwrite
fclose
??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@XZ
wcscat_s
_wcsnicmp
wcstoul
wcschr
wcsrchr
swprintf_s
printf
??_V@YAXPAX@Z
isalnum
strncpy_s
malloc
fprintf
__iob_func
free
_stricmp
_snprintf_s
toupper
tolower
clock
memmove_s
_wcsdup
_waccess
_wmkdir
_vsnprintf_s
memmove
_vswprintf
strchr
strrchr
iswspace
wcsncpy
wcsncat
_wtoi
atof
_localtime64_s
_wcsicmp
_wrename
strcat_s
strncpy
_beginthreadex
_endthreadex
memcpy_s
wcsstr
_recalloc
calloc
fread
fseek
ftell
_localtime64
_wtol
__RTDynamicCast
strcpy_s
sscanf_s
strstr
_strlwr_s
vswprintf_s
_getpid
wprintf
sprintf_s
_vsnprintf
_snprintf
_wfopen_s
memcpy
strncat
memset
_vscwprintf
strnlen
setlocale
wcstombs
vfprintf
iphlpapi
GetAdaptersAddresses
GetAdaptersInfo
GetIpForwardTable
netapi32
Netbios
gdiplus
GdipSaveImageToFile
GdipAlloc
GdipFree
GdipCloneImage
GdipLoadImageFromStream
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipGetImageThumbnail
GdiplusShutdown
GdipGetImageWidth
GdipGetImageHeight
GdiplusStartup
GdipDisposeImage
psapi
GetModuleFileNameExW
GetProcessMemoryInfo
crypt32
CryptQueryObject
CryptMsgGetParam
CertFindCertificateInStore
CertCloseStore
CryptMsgClose
CertFreeCertificateContext
CertGetNameStringW
Sections
.text Size: 684KB - Virtual size: 683KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 207KB - Virtual size: 206KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 58KB - Virtual size: 179KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 106KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE