Static task
static1
Behavioral task
behavioral1
Sample
9903e4b93791eb118b7921884ac809ec47cdeb5e0e769fc57d1a6cd580f7150c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9903e4b93791eb118b7921884ac809ec47cdeb5e0e769fc57d1a6cd580f7150c.exe
Resource
win10v2004-20220812-en
General
-
Target
9903e4b93791eb118b7921884ac809ec47cdeb5e0e769fc57d1a6cd580f7150c
-
Size
592KB
-
MD5
070d9c971af59d6db3f118cc90d6ac30
-
SHA1
908c531cf52f3a7fcad44b9353b765f01daed8c1
-
SHA256
9903e4b93791eb118b7921884ac809ec47cdeb5e0e769fc57d1a6cd580f7150c
-
SHA512
4c9e0d60a64a710a13dd67c3c6599cf5b07126541732fd0faf5272a62de318499a9a438ac1202f395ec75c3dcd8a66b025256d7fb564b9902127fdab3a5cf021
-
SSDEEP
12288:F+enAxgggTkVQzLzglDvYTUjPlK0WdJW2LFT9aAa5KuahJkWSSsPdxC:kenAxgggTkVQzLzgCTUjPaLW2Z9E5Ktt
Malware Config
Signatures
Files
-
9903e4b93791eb118b7921884ac809ec47cdeb5e0e769fc57d1a6cd580f7150c.exe windows x86
a2dff2ffdd5c8669b0f08fe2054d6a15
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateThread
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
GetTempPathW
GetModuleFileNameW
GlobalReAlloc
GlobalFree
InterlockedIncrement
InterlockedDecrement
GetTickCount
GetModuleHandleW
GetProcAddress
lstrlenW
DeleteFileW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WaitForSingleObject
OpenProcess
RemoveDirectoryW
TerminateProcess
GetVersionExW
LocalFree
GetCommandLineW
Sleep
FindResourceExW
CloseHandle
LoadResource
LockResource
SizeofResource
SetFilePointer
ReadFile
GetFileSize
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStartupInfoW
InterlockedCompareExchange
GetThreadLocale
GetLocaleInfoA
GetACP
InterlockedExchange
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
DeleteCriticalSection
InitializeCriticalSection
FreeResource
GlobalLock
GlobalUnlock
GetCurrentThreadId
MulDiv
RaiseException
EnterCriticalSection
LeaveCriticalSection
FindResourceW
CreateFileW
GetCurrentProcess
user32
LoadCursorW
SetCursor
PtInRect
ReleaseCapture
ReleaseDC
DispatchMessageW
GetCapture
GetMessageW
SetCapture
SendMessageTimeoutW
SetWindowPos
SendMessageW
PostQuitMessage
MessageBoxW
TranslateMessage
UpdateWindow
MoveWindow
IsWindowVisible
GetDC
RegisterClassExW
GetParent
GetPropW
IsWindow
InvalidateRect
PostMessageW
DefWindowProcW
DestroyWindow
CreateWindowExW
SetPropW
SetWindowLongW
RemovePropW
EndDialog
GetWindowLongW
GetDesktopWindow
GetWindowRect
GetClientRect
ScreenToClient
OffsetRect
BeginPaint
EndPaint
SetFocus
GetCursorPos
SetRect
UpdateLayeredWindow
SetRectEmpty
SetTimer
SystemParametersInfoW
KillTimer
GetCursor
EqualRect
IntersectRect
IsRectEmpty
SetWindowRgn
IsZoomed
EnumThreadWindows
EnumChildWindows
InflateRect
DrawTextW
UnregisterClassA
ShowWindow
gdi32
SelectClipRgn
CreateCompatibleDC
SetBkMode
CreateDIBSection
CreateCompatibleBitmap
CreateFontIndirectW
CreateRectRgn
CombineRgn
OffsetRgn
DeleteDC
GetObjectA
SetTextColor
RectVisible
BitBlt
ExtCreateRegion
RestoreDC
DeleteObject
PatBlt
SelectObject
SaveDC
GetTextExtentPoint32W
advapi32
GetTokenInformation
RegCloseKey
RegSetValueExW
CheckTokenMembership
OpenProcessToken
CreateWellKnownSid
RegOpenKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
shell32
SHGetPathFromIDListW
SHFileOperationW
SHCreateDirectoryExW
CommandLineToArgvW
ShellExecuteW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetMalloc
SHBrowseForFolderW
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal
CoCreateGuid
shlwapi
PathFindFileNameW
PathRemoveFileSpecW
PathFileExistsW
UrlGetPartW
PathIsDirectoryEmptyW
PathIsDirectoryW
PathStripToRootW
gdiplus
GdipCreateFontFromDC
GdipMeasureString
GdipDrawString
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatFlags
GdipSetStringFormatLineAlign
GdipSetClipRectI
GdipSetStringFormatTrimming
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipDrawImageRectI
GdipCloneImage
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipCreateSolidFill
GdipDrawLineI
GdipDeletePen
GdipFree
GdipCreatePen1
GdipCloneBrush
GdipFillRectangleI
GdipDeleteBrush
GdipCreateFromHDC
GdipDeleteGraphics
GdipAlloc
msimg32
AlphaBlend
TransparentBlt
msvcp80
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?push_back@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEX_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
comctl32
_TrackMouseEvent
InitCommonControlsEx
msvfw32
DrawDibClose
DrawDibOpen
DrawDibDraw
msvcr80
_wfopen_s
malloc
_invalid_parameter_noinfo
isalpha
_vscprintf
??0exception@std@@QAE@ABQBD@Z
vsprintf_s
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
tolower
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
wcsrchr
_atoi64
_stricmp
sscanf_s
atof
sprintf_s
strpbrk
wcscpy_s
_beginthread
_purecall
_mbscmp
__RTDynamicCast
memset
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
wcsstr
fclose
free
iswspace
fwrite
memmove_s
memcpy_s
_wcsicmp
vswprintf_s
??_V@YAXPAX@Z
_vscwprintf
??2@YAPAXI@Z
??3@YAXPAX@Z
memcpy
fopen
_wfopen
fread
_ftelli64
_fseeki64
ferror
__CxxFrameHandler3
atoi
_CxxThrowException
ws2_32
WSAStartup
ioctlsocket
connect
htons
WSACleanup
inet_ntoa
gethostbyname
socket
ntohl
__WSAFDIsSet
closesocket
select
inet_addr
send
recv
Sections
.text Size: 180KB - Virtual size: 178KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 52KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 352KB - Virtual size: 349KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ