Static task
static1
Behavioral task
behavioral1
Sample
d8c944c7609af99e478eba07e28f4fe86aeee4a0b371f6e1139fc96ea7ec0e27.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d8c944c7609af99e478eba07e28f4fe86aeee4a0b371f6e1139fc96ea7ec0e27.exe
Resource
win10v2004-20220901-en
General
-
Target
d8c944c7609af99e478eba07e28f4fe86aeee4a0b371f6e1139fc96ea7ec0e27
-
Size
603KB
-
MD5
a302d18887a7d523cbcef073a918dad8
-
SHA1
accb3721886a367300b1e7453c68823a2f2608dd
-
SHA256
d8c944c7609af99e478eba07e28f4fe86aeee4a0b371f6e1139fc96ea7ec0e27
-
SHA512
5716f2cd4cd863b3b5b5a0d35782f5fba3c3028946019cac1bf02fcbfb93f8f4cab66524808ee5423223ebcea4f24fc8145c1bd5c36bcde71910bc1c4f148f17
-
SSDEEP
12288:MNr6KnO+uh0Ohca7OhOnwlIImoW4wOzXdsD:Kjuh0OhcIWeWtRwAs
Malware Config
Signatures
Files
-
d8c944c7609af99e478eba07e28f4fe86aeee4a0b371f6e1139fc96ea7ec0e27.exe windows x86
47c16a3e32fffa39f9256841add12e27
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
Imports
atl
AtlAdvise
msls31
LsCompressSubline
LsCreateContext
LsCreateLine
LsCreateSubline
LsDestroyContext
LsDestroyLine
LsDestroySubline
LsDisplayLine
LsDisplaySubline
LsEnumLine
LsEnumSubline
LsExpandSubline
LsFindNextBreakSubline
LsFindPrevBreakSubline
LsFinishCurrentSubline
LsForceBreakSubline
LsGetHihLsimethods
LsGetLineDur
LsGetMinDurBreaks
LsGetReverseLsimethods
LsGetRubyLsimethods
LsGetWarichuLsimethods
LsLwMultDivR
LsMatchPresSubline
LsModifyLineHeight
LsPointUV2FromPointUV1
LsPointXYFromPointUV
LsQueryCpPpointSubline
LsQueryFLineEmpty
LsQueryLineCpPpoint
LsQueryLineDup
kernel32
AllocConsole
CreateFileA
GetWindowsDirectoryA
AllocConsole
AttachConsole
AllocConsole
GetCurrencyFormatA
QueryDosDeviceA
GetTempPathW
_lwrite
_lread
authz
AuthziFreeAuditParams
AuthziSourceAudit
AuthziInitializeAuditEvent
AuthziInitializeAuditEventType
AuthziInitializeAuditParams
AuthziInitializeAuditParamsFromArray
AuthziInitializeAuditParamsWithRM
AuthziInitializeAuditQueue
AuthziLogAuditEvent
AuthziModifyAuditEvent
AuthziModifyAuditEventType
AuthziModifyAuditQueue
AuthzFreeContext
AuthzFreeHandle
AuthziSourceAudit
advpack
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
AddDelBackupEntry
Sections
.text Size: 28KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 270KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 549KB - Virtual size: 552KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE