Static task
static1
Behavioral task
behavioral1
Sample
fcb7c21c0ed700adc27dcee379d3470a786b28c0c1527427f5b8d554a164997f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
fcb7c21c0ed700adc27dcee379d3470a786b28c0c1527427f5b8d554a164997f.exe
Resource
win10v2004-20220812-en
General
-
Target
fcb7c21c0ed700adc27dcee379d3470a786b28c0c1527427f5b8d554a164997f
-
Size
602KB
-
MD5
0c32ea24767242e992c5908ec26ee680
-
SHA1
5ad0663b20c82f9fc6269c92d6d0fae523cf9704
-
SHA256
fcb7c21c0ed700adc27dcee379d3470a786b28c0c1527427f5b8d554a164997f
-
SHA512
12e3b62c95ba472581b4f9568563bf013888e1ee84052b00bcf931d42e093bc14a698857da40d817ad9da3a6e9ca9f410640dd54cb33a8db8bed5b95eb626b82
-
SSDEEP
12288:9/suEOt52ITtbVGHBT9YqqjX8Hh62W3paCSmX2Z7C2S6vGK:JPFpm9YPX8B62W3paCSmX2Z7fSe
Malware Config
Signatures
Files
-
fcb7c21c0ed700adc27dcee379d3470a786b28c0c1527427f5b8d554a164997f.exe windows x86
b359d783aa409cabdcbb1e680d3fc8fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
TraceMessage
RegCloseKey
RegSetValueExW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTraceEnableFlags
GetTraceEnableLevel
GetTraceLoggerHandle
RegisterTraceGuidsW
UnregisterTraceGuids
RegQueryValueExW
RegOpenKeyExW
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
LsaNtStatusToWinError
LsaClose
LsaStorePrivateData
LsaOpenPolicy
MapGenericMask
AccessCheck
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
OpenProcessToken
SetThreadToken
RegisterEventSourceW
ReportEventW
OpenThreadToken
kernel32
FreeLibrary
GetProcAddress
LoadLibraryExW
CloseHandle
WaitForSingleObject
lstrlenW
lstrcpyW
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
Sleep
GetModuleFileNameW
OutputDebugStringW
OutputDebugStringA
IsDebuggerPresent
CreateThread
CreateEventW
lstrcpynW
lstrcatW
GetCurrentThreadId
SetEvent
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
GetModuleHandleW
GetCommandLineW
RtlCaptureStackBackTrace
CreateFileW
CopyFileW
GetWindowsDirectoryW
GetSystemDirectoryW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
GetLastError
HeapReAlloc
ExitProcess
GetModuleHandleA
WriteFile
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
SetHandleCount
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
VirtualQuery
VirtualAlloc
IsBadWritePtr
HeapSize
LoadLibraryA
SetFilePointer
WideCharToMultiByte
IsBadReadPtr
IsBadCodePtr
LCMapStringA
LCMapStringW
SetStdHandle
VirtualProtect
GetSystemInfo
GetCPInfo
GetStringTypeA
GetStringTypeW
FlushFileBuffers
DeleteTimerQueueEx
RegisterWaitForSingleObject
InterlockedCompareExchange
UnregisterWaitEx
GetOEMCP
GetLocaleInfoW
IsValidCodePage
IsValidLocale
EnumSystemLocalesA
GetUserDefaultLCID
CreateTimerQueueTimer
DeleteTimerQueueTimer
InitializeCriticalSectionAndSpinCount
FormatMessageW
ReadFile
WaitForMultipleObjects
DebugBreak
SetFilePointerEx
SetEndOfFile
LoadLibraryW
FindFirstFileW
DeleteFileW
FindNextFileW
FindClose
CreateSemaphoreW
QueueUserWorkItem
ResetEvent
ReleaseSemaphore
GetCurrentThread
LocalFree
DeleteCriticalSection
InitializeCriticalSection
RaiseException
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
RtlUnwind
CreateTimerQueue
user32
DispatchMessageW
CharNextW
TranslateMessage
LoadStringW
GetMessageW
PostThreadMessageW
oleaut32
SetErrorInfo
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocStringLen
GetErrorInfo
VariantCopy
VariantClear
VariantInit
SysAllocString
SysFreeString
ole32
CreateStreamOnHGlobal
IIDFromString
CoGetObjectContext
CoCreateGuid
CoImpersonateClient
CoSuspendClassObjects
CoUninitialize
CoInitializeEx
CoTaskMemRealloc
StringFromGUID2
CoResumeClassObjects
CoRevertToSelf
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoCreateInstance
CoTaskMemFree
winspool.drv
SeekPrinter
WritePrinter
GetPrinterDriverDirectoryW
ClosePrinter
AddPrintProcessorW
AddPrinterW
ReadPrinter
StartPagePrinter
EndPagePrinter
StartDocPrinterW
XcvDataW
OpenPrinterW
AddPrinterDriverExW
GetPrinterDataW
SetJobW
EndDocPrinter
DocumentPropertiesW
ntdll
memset
psapi
GetModuleInformation
EnumProcessModules
GetModuleFileNameExW
setupapi
SetupCopyOEMInfW
prntvpt
ord9
ord4
ord2
Sections
.text Size: 559KB - Virtual size: 558KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 34KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
cxhyoan Size: - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE