Static task
static1
Behavioral task
behavioral1
Sample
e0f03a1e205abc2151d8594828365c4118fddcce4c9a868eb0058d4c18afa7de.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e0f03a1e205abc2151d8594828365c4118fddcce4c9a868eb0058d4c18afa7de.exe
Resource
win10v2004-20220812-en
General
-
Target
e0f03a1e205abc2151d8594828365c4118fddcce4c9a868eb0058d4c18afa7de
-
Size
81KB
-
MD5
562f513ac9fccb78033c4407422ceec0
-
SHA1
f7ecfdad477220186bf9c75db6e3a0eff67033a1
-
SHA256
e0f03a1e205abc2151d8594828365c4118fddcce4c9a868eb0058d4c18afa7de
-
SHA512
89dca939714b45c2dabbd7a50f1b8c7c0011e55089d09459b5b27cc80f454dac6259066bb982a4deaa6a3e5943975b05024b9ab53101c1b174d369fb45afc01d
-
SSDEEP
1536:2rqIrFYqRTFzETE3AtpuGxrUh1+SQptDr59:2rqIrFYuTlAvvDtf
Malware Config
Signatures
Files
-
e0f03a1e205abc2151d8594828365c4118fddcce4c9a868eb0058d4c18afa7de.exe windows x86
9cb7b0ce00d4022b8cdfc046536803d6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
NdrInterfacePointerUnmarshall
I_RpcBindingToStaticStringBindingW
RpcServerUseProtseqExW
RpcStringBindingParseW
RpcServerUseProtseqIfW
NdrClientInitialize
NdrStubForwardingFunction
RpcSsEnableAllocate
NdrMesTypeDecode
NdrConformantArrayMemorySize
I_RpcDeleteMutex
RpcNsBindingInqEntryNameA
MesDecodeIncrementalHandleCreate
NdrProxySendReceive
NdrSimpleTypeUnmarshall
NdrConformantVaryingStructMarshall
NdrConformantStringBufferSize
NdrClearOutParameters
NdrVaryingArrayUnmarshall
RpcBindingSetAuthInfoA
UuidHash
NdrStubCall2
RpcBindingInqAuthInfoA
I_RpcTransConnectionReallocPacket
NdrByteCountPointerUnmarshall
RpcServerInqDefaultPrincNameW
NdrConformantVaryingArrayMemorySize
NdrFixedArrayBufferSize
I_UuidCreate
RpcEpRegisterW
I_RpcTransIoCancelled
RpcRevertToSelf
NdrServerUnmarshall
NdrAllocate
I_RpcTransDatagramFree
RpcEpRegisterNoReplaceW
RpcMgmtInqStats
NdrOleFree
RpcMgmtEpEltInqBegin
RpcStringFreeA
NdrPointerFree
MesEncodeIncrementalHandleCreate
RpcCancelThreadEx
RpcSmEnableAllocate
NdrRpcSmSetClientToOsf
NdrServerContextMarshall
NdrNonConformantStringBufferSize
I_RpcTransGetThreadEvent
CStdStubBuffer_Invoke
RpcBindingFree
NdrOleAllocate
RpcServerTestCancel
NdrEncapsulatedUnionMarshall
RpcSsDisableAllocate
RpcSmGetThreadHandle
NdrConformantStructUnmarshall
RpcServerUseProtseqW
RpcBindingInqAuthInfoW
NdrEncapsulatedUnionFree
RpcSsSetThreadHandle
NdrCStdStubBuffer2_Release
NdrPointerMemorySize
RpcBindingInqAuthClientW
RpcMgmtEpEltInqNextA
RpcBindingCopy
NdrUserMarshalFree
RpcProtseqVectorFreeA
RpcServerRegisterAuthInfoW
RpcCancelThread
RpcServerListen
I_RpcBindingInqWireIdForSnego
I_RpcTransDatagramAllocate
RpcNetworkIsProtseqValidW
NdrClientInitializeNew
I_RpcRequestMutex
NdrPointerUnmarshall
RpcStringBindingParseA
I_RpcServerRegisterForwardFunction
I_RpcServerUseProtseq2A
RpcServerRegisterAuthInfoA
NdrConformantVaryingArrayFree
NDRCContextUnmarshall
NdrVaryingArrayFree
NdrServerCall
NDRCContextMarshall
RpcSmSwapClientAllocFree
RpcSmSetClientAllocFree
NdrNsGetBuffer
I_RpcBindingInqDynamicEndpointW
TowerExplode
NdrSimpleTypeMarshall
I_RpcServerAllocateIpPort
RpcBindingInqAuthClientExA
NdrProxyGetBuffer
I_RpcServerInqTransportType
RpcBindingSetObject
DceErrorInqTextW
RpcSmClientFree
NdrDllUnregisterProxy
NdrInterfacePointerMarshall
I_RpcTransDatagramAllocate2
MesEncodeFixedBufferHandleCreate
NdrConformantStructFree
NdrUserMarshalUnmarshall
RpcBindingInqAuthInfoExA
NdrMesSimpleTypeAlignSize
RpcServerUseAllProtseqs
NdrDcomAsyncStubCall
RpcMgmtSetServerStackSize
RpcSmFree
RpcServerRegisterIfEx
RpcMgmtInqServerPrincNameW
NdrFixedArrayUnmarshall
RpcBindingSetOption
RpcBindingServerFromClient
NdrXmitOrRepAsUnmarshall
I_RpcFreeBuffer
RpcSsGetThreadHandle
RpcRevertToSelfEx
NdrRpcSsDefaultFree
NdrConformantStringMarshall
NdrMapCommAndFaultStatus
I_RpcSendReceive
RpcBindingSetAuthInfoExW
I_RpcFreePipeBuffer
NdrConformantVaryingStructMemorySize
NdrGetUserMarshalInfo
RpcMgmtInqComTimeout
RpcCertGeneratePrincipalNameW
RpcMgmtIsServerListening
I_RpcPauseExecution
NdrComplexArrayBufferSize
NdrVaryingArrayMemorySize
MesDecodeBufferHandleCreate
RpcRaiseException
NdrFixedArrayMarshall
RpcServerInqDefaultPrincNameA
user32
DlgDirListW
TranslateAcceleratorA
SetDlgItemTextW
DdeQueryConvInfo
SetClassLongA
DialogBoxIndirectParamW
CharUpperBuffA
EndDialog
DialogBoxParamA
CharLowerA
UnionRect
ExcludeUpdateRgn
ExitWindowsEx
CheckDlgButton
ChangeClipboardChain
GetCursorInfo
GetSystemMetrics
SetWindowsHookExA
SetMessageExtraInfo
SendMessageA
VkKeyScanW
resutils
ResUtilStartResourceService
ResUtilGetProperties
ResUtilFindLongProperty
ResUtilGetPropertySize
ResUtilEnumPrivateProperties
ResUtilIsPathValid
ResUtilSetMultiSzValue
ResUtilFindDwordProperty
ResUtilFindDependentDiskResourceDriveLetter
ResUtilResourceTypesEqual
ResUtilSetResourceServiceEnvironment
ResUtilPropertyListFromParameterBlock
ResUtilSetSzValue
ResUtilSetResourceServiceStartParameters
ResUtilGetResourceNameDependency
ResUtilVerifyPrivatePropertyList
ResUtilGetPrivateProperties
ResUtilGetDwordValue
ResUtilVerifyResourceService
ResUtilIsResourceClassEqual
ResUtilGetPropertiesToParameterBlock
ResUtilSetPropertyParameterBlock
ResUtilGetBinaryValue
ResUtilEnumProperties
ResUtilCreateDirectoryTree
ResUtilSetPrivatePropertyList
ResUtilSetDwordValue
ResUtilVerifyPropertyTable
ClusWorkerCreate
ResUtilGetProperty
ResUtilStopResourceService
kernel32
ReplaceFileA
FileTimeToDosDateTime
MulDiv
GetProcAddress
InterlockedDecrement
AssignProcessToJobObject
pdh
PdhGetRawCounterArrayW
PdhGetCounterInfoW
PdhBrowseCountersA
PdhOpenQueryW
PdhGetDllVersion
PdhParseCounterPathA
PdhEnumObjectsW
PdhCollectQueryDataEx
PdhGetDataSourceTimeRangeA
PdhGetDefaultPerfCounterW
PdhMakeCounterPathA
PdhAddCounterW
PdhVbCreateCounterPathList
PdhUpdateLogFileCatalog
PdhSelectDataSourceW
PdhLookupPerfNameByIndexA
PdhVbGetLogFileSize
PdhExpandCounterPathW
PdhVbUpdateLog
PdhParseInstanceNameW
PdhBrowseCountersW
PdhConnectMachineW
PdhOpenLogW
PdhSetDefaultRealTimeDataSource
PdhVbGetDoubleCounterValue
PdhGetCounterInfoA
PdhValidatePathA
PdhExpandWildCardPathA
PdhMakeCounterPathW
PdhLookupPerfIndexByNameW
PdhParseInstanceNameA
PdhVbAddCounter
PdhUpdateLogA
PdhGetFormattedCounterValue
PdhValidatePathW
PdhGetDefaultPerfCounterA
PdhVbIsGoodStatus
PdhEnumObjectItemsW
PdhCloseLog
PdhComputeCounterStatistics
PdhGetFormattedCounterArrayW
comdlg32
ChooseColorA
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ