Static task
static1
Behavioral task
behavioral1
Sample
ff553b5e0986b2890d04075d98a22d492bbea0a49f4b7f1b9ea8baa1df798a37.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ff553b5e0986b2890d04075d98a22d492bbea0a49f4b7f1b9ea8baa1df798a37.exe
Resource
win10v2004-20220812-en
General
-
Target
ff553b5e0986b2890d04075d98a22d492bbea0a49f4b7f1b9ea8baa1df798a37
-
Size
364KB
-
MD5
e98eb75e17c063767b9719325ee80300
-
SHA1
9c46d312442391bccd81dcc883b94fd6638aa15b
-
SHA256
ff553b5e0986b2890d04075d98a22d492bbea0a49f4b7f1b9ea8baa1df798a37
-
SHA512
be1e45ec73089f5dc30484ea24cb4e64ed2ea9c175d463a852bdea1656ef3312734be87932d5af14cbb1b97cab04458677f8be83e79c7878c990969a060ab344
-
SSDEEP
6144:p3X+B0CAYjgtRSL1Ezilhaz1dIRqMcb4+IgfnGIkOAIKy/CMNcO4OIL7OPl81eUE:1+B0DYcSgQhazfblIgfnGtOilO4rENt5
Malware Config
Signatures
Files
-
ff553b5e0986b2890d04075d98a22d492bbea0a49f4b7f1b9ea8baa1df798a37.exe windows x86
46b12fcf803c8ed049fe46095ddead18
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
resutils
ClusWorkerCreate
ResUtilGetMultiSzProperty
ClusWorkerCheckTerminate
ResUtilGetProperties
ResUtilSetPropertyParameterBlockEx
ResUtilFreeEnvironment
ResUtilFindMultiSzProperty
ResUtilSetExpandSzValue
ResUtilEnumProperties
ResUtilStartResourceService
ResUtilFreeParameterBlock
ResUtilSetPropertyTableEx
ResUtilGetAllProperties
ResUtilStopResourceService
ResUtilSetPropertyTable
ResUtilVerifyPrivatePropertyList
ResUtilGetResourceDependencyByClass
ResUtilGetBinaryValue
ClusWorkerTerminate
ResUtilVerifyResourceService
ResUtilSetPropertyParameterBlock
ResUtilSetSzValue
ResUtilTerminateServiceProcessFromResDll
ResUtilDupParameterBlock
ResUtilDupString
ResUtilEnumResources
ResUtilGetResourceName
ResUtilFindDwordProperty
ResUtilGetSzProperty
ResUtilGetDwordValue
ClusWorkerStart
ResUtilFindLongProperty
ResUtilIsResourceClassEqual
ResUtilEnumPrivateProperties
ResUtilGetPrivateProperties
ResUtilSetResourceServiceStartParameters
ResUtilSetResourceServiceEnvironment
ResUtilSetDwordValue
ResUtilResourceTypesEqual
ResUtilFindDependentDiskResourceDriveLetter
ResUtilGetEnvironmentWithNetName
ResUtilSetMultiSzValue
ResUtilGetDwordProperty
ResUtilGetResourceDependentIPAddressProps
kernel32
GetCurrentProcessId
GetComputerNameExA
GetSystemInfo
OpenProfileUserMapping
RtlCaptureStackBackTrace
GetStartupInfoA
CancelDeviceWakeupRequest
GetCurrentThreadId
RemoveDirectoryW
IsValidLanguageGroup
GetCalendarInfoA
GetQueuedCompletionStatus
GetComputerNameA
GetEnvironmentVariableA
GlobalMemoryStatus
GetSystemDefaultLangID
LoadLibraryA
VirtualAlloc
CompareStringA
ActivateActCtx
WriteConsoleA
EnumTimeFormatsW
FormatMessageW
GetConsoleHardwareState
GetWindowsDirectoryA
GetNumaAvailableMemoryNode
SetFirmwareEnvironmentVariableW
SetProcessWorkingSetSize
QueryPerformanceCounter
SetWaitableTimer
GetConsoleAliasExesW
mmcbase
??BSC@mmcerror@@QBE_NXZ
??0CEventBuffer@@QAE@ABV0@@Z
?HrFromSc@@YGJABVSC@mmcerror@@@Z
?FromMMC@SC@mmcerror@@QAEAAV12@J@Z
?ScEmitOrPostpone@CEventBuffer@@QAE?AVSC@mmcerror@@PAUIDispatch@@JPAVCComVariant@ATL@@H@Z
?SetHinst@SC@mmcerror@@SGXPAUHINSTANCE__@@@Z
?ScFromMMC@@YG?AVSC@mmcerror@@J@Z
?TraceAndClear@SC@mmcerror@@QAEXXZ
?MakeSc@SC@mmcerror@@AAEXW4facility_type@12@J@Z
?IsLocked@CEventBuffer@@QAE_NXZ
?GetEventBuffer@@YGAAVCEventBuffer@@XZ
??4?$CEventLock@UAppEvents@@@@QAEAAV0@ABV0@@Z
?FromWin32@SC@mmcerror@@QAEAAV12@J@Z
?GetComObjectEventSource@@YGAAV?$CEventSource@VCComObjectObserver@@VCVoid@@V2@V2@V2@@@XZ
?ScFlushPostponed@CEventBuffer@@AAE?AVSC@mmcerror@@XZ
?SetMainThreadID@SC@mmcerror@@SGXK@Z
?MMCErrorBox@@YGHIVSC@mmcerror@@I@Z
??7SC@mmcerror@@QBEHXZ
?GetHinst@SC@mmcerror@@SGPAUHINSTANCE__@@XZ
?GetFacility@SC@mmcerror@@ABE?AW4facility_type@12@XZ
??9SC@mmcerror@@QBE_NJ@Z
?GetStringModule@@YGPAUHINSTANCE__@@XZ
?SCODEFromSc@@YGJABVSC@mmcerror@@@Z
?GetHelpFile@SC@mmcerror@@SGPBGXZ
?GetSingletonObject@CMMCStrongReferences@@CGAAV1@XZ
?s_hWnd@SC@mmcerror@@0PAUHWND__@@A
?GetHelpID@SC@mmcerror@@QAEKXZ
?MMCErrorBox@@YGHII@Z
?AddRef@CMMCStrongReferences@@SGKXZ
??0CMMCStrongReferences@@AAE@XZ
?InternalLastRefReleased@CMMCStrongReferences@@AAE_NXZ
??1CEventBuffer@@QAE@XZ
??8SC@mmcerror@@QBE_NABV01@@Z
?MMCErrorBox@@YGHVSC@mmcerror@@I@Z
?Lock@CEventBuffer@@QAEXXZ
?InternalRelease@CMMCStrongReferences@@AAEKXZ
?FormatErrorString@@YGXPBGVSC@mmcerror@@IPAGH@Z
??8SC@mmcerror@@QBE_NJ@Z
?SetHWnd@SC@mmcerror@@SGXPAUHWND__@@@Z
?MMCErrorBox@@YGHPBGI@Z
??0?$CEventLock@UAppEvents@@@@QAE@XZ
?ToHr@SC@mmcerror@@QBEJXZ
?s_hInst@SC@mmcerror@@0PAUHINSTANCE__@@A
?GetHWnd@SC@mmcerror@@SGPAUHWND__@@XZ
query
?_ftFile@CGlobalPropFileRefresher@@0U_FILETIME@@A
??1CPropertyList@@UAE@XZ
?EnumVPaths@CMetaDataMgr@@QAEXAAVCMetaDataCallBack@@@Z
?Copy@CDbPropSet@@QAEHABUtagDBPROPSET@@@Z
?UpdateDiskLowInfo@CDiskFreeStatus@@QAEXXZ
LoadBinaryFilter
?IsCIPaused@CMachineAdmin@@QAEHXZ
?Next@CPropertyList@@UAEPBVCPropEntry@@XZ
InitializeCIPerformanceData
??0CFileMapView@@QAE@PBG@Z
?Empty@CRcovStrmWriteTrans@@QAEXXZ
??1?$XPtr@VCDbColumnNode@@@@QAE@XZ
?Read@CRegAccess@@QAEKPBGK@Z
LocateCatalogsA
?SetUI8@CStorageVariant@@QAEXT_ULARGE_INTEGER@@I@Z
?IsCIStarted@CMachineAdmin@@QAEHXZ
?AddArg@CFwEventItem@@QAEXPBG@Z
?SetPhrase@CNatLanguageRestriction@@QAEXPBG@Z
??1CEventItem@@QAE@XZ
?ClearList@CCombinedPropertyList@@QAEXXZ
?GetUShort@CMemDeSerStream@@UAEGXZ
?Empty@CSdidLookupTable@@QAEXXZ
?_dwLastCheckMoment@CGlobalPropFileRefresher@@0KA
?ReadProperty@CPropStoreManager@@QAEHKKPAUtagPROPVARIANT@@PAI@Z
?PidToRealPid@CPidMapper@@QAEKK@Z
?QueryPidLookupTable@CiStorage@@QAEPAVPRcovStorageObj@@K@Z
?EnableVPathNotify@CMetaDataMgr@@QAEXPAVCMetaDataVPathChangeCallBack@@@Z
?DoFailTest@@YGXJ@Z
?LookupSDID@CSdidLookupTable@@QAEKPAXK@Z
?Open@CMmStream@@QAEXPBGKKKKH@Z
??0CPropNameArray@@QAE@AAVPDeSerStream@@@Z
??1CProcess@@QAE@XZ
??1CDbQueryResults@@QAE@XZ
??1CDynStream@@QAE@XZ
?CoTaskAllocator@@3VCCoTaskAllocator@@A
?GetWString@CMemDeSerStream@@UAEPAGXZ
?GetScodeError@@YGJAAVCException@@@Z
?SetR4@CStorageVariant@@QAEXMI@Z
??1CPidRemapper@@QAE@XZ
?SetDWORDParam@CMachineAdmin@@QAEXPBGK@Z
?SetDefaultProperty@CCatState@@QAEXPBG@Z
??1CPhysStorage@@UAE@XZ
?SetCurrentProperty@CQueryParser@@AAEXPBGW4PropertyType@@@Z
?CleanupDataValue@CDbCmdTreeNode@@IAEXXZ
?ChangeCurrentDepth@CCatState@@QAEXH@Z
gdi32
EnumFontsA
WidenPath
PolyBezierTo
SetMapperFlags
SetBitmapBits
GdiGetPageCount
GetKerningPairsW
SetGraphicsMode
GdiEntry2
STROBJ_vEnumStart
EngCheckAbort
DdEntry21
SetPixelFormat
GetTextExtentPoint32W
GdiInitializeLanguagePack
CreatePolygonRgn
OffsetClipRgn
EnumICMProfilesW
SetPaletteEntries
GdiGetCodePage
GdiArtificialDecrementDriver
SetMagicColors
GdiEntry14
GetTextMetricsA
ColorMatchToTarget
RemoveFontMemResourceEx
FontIsLinked
UpdateICMRegKeyA
PathToRegion
EngMultiByteToUnicodeN
DdEntry43
DeviceCapabilitiesExW
CreateColorSpaceW
GetDCBrushColor
GetTextExtentExPointI
MoveToEx
CreateSolidBrush
SetBoundsRect
dnsapi
DnsRecordCopyEx
Dns_ParseMessage
DnsAsyncRegisterHostAddrs
Dns_UpdateLib
DnsNameCopyAllocate
DnsDhcpSrvRegisterInitialize
DnsDhcpSrvRegisterHostName
DnsIpv6StringToAddress
DnsUpdate
Dns_WriteDottedNameToPacket
DnsRemoveRegistrations
Dns_BuildPacket
DnsApiHeapReset
DnsQueryConfigAllocEx
DnsValidateUtf8Byte
DnsRecordListFree
Dns_SendAndRecvUdp
Dns_PingAdapterServers
Dns_ResetNetworkInfo
DnsQuery_W
DnsFreeConfigStructure
NetInfo_Copy
DnsIsAMailboxType
DnsQueryExUTF8
Dns_GetRandomXid
DnsReplaceRecordSetW
DnsSetConfigDword
DnsRecordSetCompare
Dns_SkipPacketName
DnsNameCompare_A
DnsDhcpSrvRegisterTerm
DnsUpdateTest_A
DnsRegisterClusterAddress
Reg_ReadGlobalsEx
NetInfo_Free
CombineRecordsInBlob
msvcp60
??4?$basic_istringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??8std@@YA_NABV?$complex@O@0@ABO@Z
?quiet_NaN@?$numeric_limits@I@std@@SAIXZ
?sungetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??9std@@YA_NABV?$complex@N@0@ABN@Z
?arg@std@@YAMABV?$complex@M@1@@Z
?seekpos@?$basic_streambuf@GU?$char_traits@G@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
??_7?$messages@D@std@@6B@
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@F@Z
??1?$numpunct@G@std@@UAE@XZ
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@PBX@Z
??1?$basic_istream@GU?$char_traits@G@std@@@std@@UAE@XZ
?table_size@?$ctype@D@std@@2IB
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDH@Z
??5std@@YAAAV?$basic_istream@GU?$char_traits@G@std@@@0@AAV10@PAG@Z
??0?$money_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@QAE@ABV_Locinfo@1@I@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAK@Z
?pow@?$_Ctr@N@std@@SANNN@Z
??Nstd@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
wctype
??8std@@YA_NABV?$complex@M@0@ABM@Z
?_Getcat@?$moneypunct@D$00@std@@SAIXZ
?peek@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEGXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAJ@Z
?quiet_NaN@?$numeric_limits@_N@std@@SA_NXZ
??_8?$basic_ostream@DU?$char_traits@D@std@@@std@@7B@
?quiet_NaN@?$numeric_limits@C@std@@SACXZ
?find_first_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?ignore@?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV12@HG@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z
??_7?$basic_iostream@DU?$char_traits@D@std@@@std@@6B@
?is_open@?$basic_ofstream@DU?$char_traits@D@std@@@std@@QBE_NXZ
?osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??Z?$_Complex_base@N@std@@QAEAAV01@ABN@Z
?conj@std@@YA?AV?$complex@O@1@ABV21@@Z
?imag@std@@YAOABV?$complex@O@1@@Z
?_Getcat@?$_Mpunct@G@std@@SAIXZ
?_Getcat@?$time_put@GV?$ostreambuf_iterator@GU?$char_traits@G@std@@@std@@@std@@SAIXZ
?infinity@?$numeric_limits@M@std@@SAMXZ
Sections
.text Size: 25KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 244KB - Virtual size: 714KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 296B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ