Static task
static1
Behavioral task
behavioral1
Sample
57c112ede1bcd1544540dc267ef0e20d9c60917eb0851bb31e47c5bfb2a28da9.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
57c112ede1bcd1544540dc267ef0e20d9c60917eb0851bb31e47c5bfb2a28da9.exe
Resource
win10v2004-20220812-en
General
-
Target
57c112ede1bcd1544540dc267ef0e20d9c60917eb0851bb31e47c5bfb2a28da9
-
Size
332KB
-
MD5
0ec1baf78a039b53d91e3390cbc30ee0
-
SHA1
647f3017a9b93645f6d6ac3c4526363e8762e295
-
SHA256
57c112ede1bcd1544540dc267ef0e20d9c60917eb0851bb31e47c5bfb2a28da9
-
SHA512
27ed48f00451f3eadad329605decc2f55a4bdd84d2b35eb814ef35d514ed3926b48d83acee5e4993d0c900c91a0ca30eeffacf67f3a0bd2379dc6afe55a7deb9
-
SSDEEP
6144:Khcw+bPFzu4AQVIr2gQRjgyevG3prRahAaKycmy:Khj+FzRdy2dwvG33ahnKQy
Malware Config
Signatures
Files
-
57c112ede1bcd1544540dc267ef0e20d9c60917eb0851bb31e47c5bfb2a28da9.exe windows x86
4f94d49c44202d4af1840b5ecf7b369a
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetFilePointer
WriteFile
LocalFree
FormatMessageA
CreateEventA
OutputDebugStringA
CloseHandle
WaitForSingleObject
SetEvent
InterlockedIncrement
GetVolumeInformationA
lstrcmpiA
GetFileAttributesA
MoveFileA
DeleteFileA
ResumeThread
GetLocaleInfoA
GetSystemTime
InterlockedDecrement
GetStartupInfoA
GetModuleFileNameA
lstrcmpA
lstrcatA
lstrlenA
lstrcpyA
CreateThread
GetDriveTypeA
HeapDestroy
CreateFileA
SystemTimeToFileTime
LocalFileTimeToFileTime
FileTimeToLocalFileTime
GetFileSize
ReadFile
EnterCriticalSection
FileTimeToSystemTime
CreateDirectoryA
LoadLibraryA
LeaveCriticalSection
GetVersionExA
IsDBCSLeadByte
GetProcAddress
InitializeCriticalSection
GetLastError
lstrcpynA
LoadLibraryExA
SizeofResource
FindResourceA
LoadResource
GetShortPathNameA
FreeLibrary
GetModuleHandleA
WideCharToMultiByte
MultiByteToWideChar
lstrlenW
Sleep
GetCommandLineA
GetCurrentThreadId
DeleteCriticalSection
GetFullPathNameA
user32
IsIconic
GetSystemMetrics
SetTimer
GetMessageA
DispatchMessageA
KillTimer
CharNextA
SetDlgItemInt
SetFocus
EnableWindow
DialogBoxParamA
ScreenToClient
LoadMenuA
GetSubMenu
DeleteMenu
TrackPopupMenu
DestroyMenu
LoadIconA
LoadImageA
SendDlgItemMessageA
CreateWindowExA
GetDesktopWindow
IsWindow
GetParent
MessageBoxA
GetMenuItemID
GetMenuItemCount
GetWindowTextA
GetWindowLongA
SetWindowLongA
PostMessageA
GetWindowRect
SetWindowPos
UpdateWindow
LoadCursorA
SetCursor
GetDlgItem
ShowWindow
SetDlgItemTextA
SendMessageA
wsprintfA
EndDialog
DestroyIcon
PostThreadMessageA
LoadStringA
advapi32
RegSetValueExA
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegEnumValueA
RegQueryInfoKeyA
RegEnumKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteKeyA
shfolder
SHGetFolderPathA
shell32
SHGetPathFromIDListA
SHBrowseForFolderA
SHGetFileInfoA
ole32
CoInitialize
CoTaskMemAlloc
CoUninitialize
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemRealloc
CoDisconnectObject
CoTaskMemFree
CoCreateInstance
oleaut32
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysAllocString
SysFreeString
VariantClear
comctl32
ImageList_Destroy
ImageList_SetOverlayImage
ImageList_ReplaceIcon
ImageList_Create
mpr
WNetOpenEnumA
WNetEnumResourceA
WNetCloseEnum
extdb
?DeleteFileEntry@CExtendedDB@@QAEHPAD@Z
?CopyFolder@CExtendedDB@@QAEHPAD0@Z
?CopyFileEntry@CExtendedDB@@QAEHPAD000@Z
?RenameFile@CExtendedDB@@QAEHPAD0@Z
?MoveFileA@CExtendedDB@@QAEHPAD000@Z
?GetCategoryMatches@CExtendedDB@@QAEHPAPADHPAPAJAAHPAPAH@Z
?MoveFolder@CExtendedDB@@QAEHPAD0@Z
?RemoveFileFromOneCategory@CExtendedDB@@QAEHPADJ@Z
?RemoveFileFromAllCategories@CExtendedDB@@QAEHPAD@Z
?CategoryNodeListGetFilesMatchAll@CExtendedDB@@QAEHPAJJAAHH@Z
?GetNthCategoryNodeFile@CExtendedDB@@QAEPADH@Z
?CategoryNodeGetFiles@CExtendedDB@@QAEHJAAHH@Z
?CategoryNodeListGetFiles@CExtendedDB@@QAEHPAJJAAHH@Z
?CategoryNodeGetName@CExtendedDB@@QAEHJPAD@Z
?CatNodeHasChildren@CExtendedDB@@QAEHJ@Z
?CategoryNodeAddFile@CExtendedDB@@QAEHJPAD@Z
?CatGetFirstChild@CExtendedDB@@QAEHJAAJ@Z
?DeleteCategoryNode@CExtendedDB@@QAEHJ@Z
?CatGetNextSibling@CExtendedDB@@QAEHJAAJ@Z
?AddCategoryNode@CExtendedDB@@QAEHJPADAAJ@Z
?SetDateSource@CExtendedDB@@QAEXW4DateSource@@@Z
?RenameCategoryNode@CExtendedDB@@QAEHJPADAAJ@Z
?GetFilesForDateRange@CExtendedDB@@QAEHVACDTime@@0AAH@Z
?SetMultiDateTimeForFile@CExtendedDB@@QAEHPADVACDTime@@11@Z
?GetNthTimeLineFile@CExtendedDB@@QAEPADH@Z
?CloseExtendedDB@CExtendedDB@@QAEHXZ
?SetDBDirectory@CExtendedDB@@QAEXPAD@Z
?FindDateTimeForFile@CExtendedDB@@QAEHPADAAVACDTime@@@Z
?CreateExtendedDB@CExtendedDB@@QAEHXZ
?OpenExtendedDB@CExtendedDB@@QAEHXZ
?Init@CExtendedDB@@QAEHXZ
??1CExtendedDB@@UAE@XZ
??0CExtendedDB@@QAE@XZ
?IsExtendedDBOpen@CExtendedDB@@QAEHXZ
?FileHasDateSourceItem@CExtendedDB@@QAEHPADW4DateSource@@@Z
?RemoveFilesFromCategories@CExtendedDB@@QAEHPAPADHPAJHH@Z
?DeleteFolder@CExtendedDB@@QAEHPAD@Z
?GetNextDateWithFiles@CExtendedDB@@QAEHVACDTime@@AAV2@@Z
?GetDateRangeInDB@CExtendedDB@@QAEHAAVACDTime@@0@Z
?RenameFolder@CExtendedDB@@QAEHPAD0@Z
?Optimize@CExtendedDB@@QAEHXZ
?GetSize@CExtendedDB@@QAEHAAJ@Z
?SetDBFilter@CExtendedDB@@QAEXPAPADHHH@Z
?CategoriesHaveFiles@CExtendedDB@@QAEHPAJH@Z
?SetAbort@CExtendedDB@@QAEHH@Z
?LockDB@CExtendedDB@@QAEHXZ
?GetPrevDateWithFiles@CExtendedDB@@QAEHVACDTime@@AAV2@@Z
?UnlockDB@CExtendedDB@@QAEHXZ
msvcp60
?max_size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?_Xlen@std@@YAXXZ
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
msvcrt
_XcptFilter
vsprintf
_mbschr
_controlfp
__set_app_type
__p__fmode
__p__commode
??2@YAPAXI@Z
_purecall
__CxxFrameHandler
free
realloc
malloc
_beginthreadex
_mbsrchr
_ftol
_mbsnbcmp
sprintf
fclose
fputs
fopen
_mbscmp
atoi
strtok
_CxxThrowException
strtol
strchr
strncmp
toupper
_mbsbtype
__setusermatherr
_adjust_fdiv
wcslen
??1type_info@@UAE@XZ
_strdup
_stricmp
_exit
__dllonexit
_onexit
_except_handler3
__getmainargs
_acmdln
exit
_initterm
Sections
.text Size: 128KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
marclqd Size: 80KB - Virtual size: 80KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE