Static task
static1
Behavioral task
behavioral1
Sample
dbfe771b50d29ad8c21b98f43845d9856d435ccf69cbb4efe823ab3873712e16.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dbfe771b50d29ad8c21b98f43845d9856d435ccf69cbb4efe823ab3873712e16.exe
Resource
win10v2004-20220812-en
General
-
Target
dbfe771b50d29ad8c21b98f43845d9856d435ccf69cbb4efe823ab3873712e16
-
Size
1.7MB
-
MD5
8caf6e80ef8937c05daaf29360599cea
-
SHA1
572a98fd968ff902d9ad9910fdb6bac3a94a15f1
-
SHA256
dbfe771b50d29ad8c21b98f43845d9856d435ccf69cbb4efe823ab3873712e16
-
SHA512
cca828551951d1df81c850303b7e79ae812780d53300a737a3275c040f7208e14bda639fa51f598dcde94f2797526f354f8fc3f4d39a2ea9f4a62043d920e12c
-
SSDEEP
49152:HXNhd9U/0ZoIOFSIIHx2cVEEMJvJ2xn8SrFEzV0TKzc:VSfbSVRV3MJCn8RBt
Malware Config
Signatures
Files
-
dbfe771b50d29ad8c21b98f43845d9856d435ccf69cbb4efe823ab3873712e16.exe windows x86
fe35e4bb98988adee47df2380f210c35
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
winhttp
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpOpen
shell32
CommandLineToArgvW
SHFileOperationW
psapi
EnumProcessModules
GetModuleFileNameExW
EnumProcesses
advapi32
OpenServiceW
RegCreateKeyExW
FreeSid
CheckTokenMembership
AllocateAndInitializeSid
RegOpenKeyExA
RegQueryValueExW
StartServiceA
QueryServiceStatusEx
RegOpenKeyExW
OpenSCManagerA
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
GetUserNameW
RegSetValueExW
RegCloseKey
kernel32
LCMapStringW
LoadLibraryExW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
OutputDebugStringW
GetStringTypeW
SetStdHandle
WriteConsoleW
GetCommandLineW
ExpandEnvironmentStringsW
CreateDirectoryW
CloseHandle
GetLastError
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateThread
CreateProcessW
FreeLibrary
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryW
GetSystemTime
GetLocalTime
GetVersionExW
CreateFileA
GetFileSize
ReadFile
SetFilePointer
WriteFile
LocalAlloc
LocalFree
GetCurrentProcess
TerminateProcess
OpenProcess
FlushFileBuffers
GetTickCount
VirtualAlloc
VirtualFree
LoadResource
LockResource
SizeofResource
FindResourceA
CreateToolhelp32Snapshot
Process32First
Process32Next
CreateFileW
FindClose
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
WideCharToMultiByte
GetCurrentProcessId
GetCurrentThreadId
GetVolumeInformationW
GetSystemDirectoryW
SetUnhandledExceptionFilter
HeapReAlloc
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
lstrcpyA
lstrlenA
MultiByteToWideChar
GetWindowsDirectoryW
lstrcpynW
lstrcatW
GetBinaryTypeW
GlobalMemoryStatusEx
GetTimeZoneInformation
GetSystemInfo
GetVersionExA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetModuleFileNameA
GetFileType
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetStdHandle
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
UnhandledExceptionFilter
HeapSize
GetModuleHandleExW
GetVersion
GetModuleFileNameW
ExitProcess
GetCommandLineA
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
EncodePointer
DecodePointer
RaiseException
RtlUnwind
IsDebuggerPresent
wininet
InternetSetOptionA
dbghelp
SymInitialize
user32
GetForegroundWindow
GetMessageTime
GetDesktopWindow
GetSysColor
wsprintfW
ole32
CoUninitialize
CoInitializeEx
CoInitializeSecurity
CoCreateInstance
oleaut32
SysFreeString
VariantInit
VariantClear
SysAllocString
iphlpapi
GetAdaptersInfo
version
VerQueryValueA
GetFileVersionInfoSizeW
GetFileVersionInfoW
Sections
.text Size: 666KB - Virtual size: 665KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 984KB - Virtual size: 984KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ