Static task
static1
Behavioral task
behavioral1
Sample
f3a908e87df10830f198f8a25c6be98c733cc18a84f15815e5403b17359b2bea.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f3a908e87df10830f198f8a25c6be98c733cc18a84f15815e5403b17359b2bea.exe
Resource
win10v2004-20220812-en
General
-
Target
f3a908e87df10830f198f8a25c6be98c733cc18a84f15815e5403b17359b2bea
-
Size
1.1MB
-
MD5
446538979d06ffbd4f715717c9b67393
-
SHA1
62229b1be1df11590210272c60b6f7118ef44ee9
-
SHA256
f3a908e87df10830f198f8a25c6be98c733cc18a84f15815e5403b17359b2bea
-
SHA512
4d446c2223185e1500d2bb99c531597c874c3946696c11eda453526572ef51645ec647d6f25df93beb11d0ae54f3593394d7d2613f46af15fed3307cb900c51f
-
SSDEEP
24576:nEMFLHvcqNnDSQiEfV69P1+mLZA2qvdksNk0wrQ9vbfg:RHvNn+Qi762qvdk497g
Malware Config
Signatures
Files
-
f3a908e87df10830f198f8a25c6be98c733cc18a84f15815e5403b17359b2bea.exe windows x86
6a807d0a74c41bba88b15738ad6fe6f5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetEnvironmentVariableA
LoadLibraryA
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
ReleaseMutex
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
UnlockFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
LoadLibraryW
Sleep
FormatMessageW
HeapDestroy
GetFileAttributesA
LeaveCriticalSection
HeapCreate
HeapValidate
GetEnvironmentVariableA
FlushFileBuffers
GetTempPathW
GetLastError
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetCurrentThreadId
DeleteFileW
GetCurrentProcessId
GetTempPathA
GetSystemTime
AreFileApisANSI
DeleteFileA
GetModuleFileNameW
lstrlenW
ReadConsoleW
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetTimeZoneInformation
SetFilePointerEx
GetConsoleMode
lstrcatW
GetConsoleCP
GetFileType
MoveFileExW
GetOEMCP
GetACP
IsValidCodePage
lstrcpyW
CloseHandle
ReadFile
CreateFileW
LocalFree
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
FindClose
FindFirstFileW
GetFileAttributesW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
EncodePointer
DecodePointer
GetStringTypeW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCPInfo
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
LoadLibraryExW
GetCommandLineW
RaiseException
RtlUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
user32
LoadAcceleratorsW
LoadCursorW
RegisterClassExW
LoadStringW
LoadIconW
PostQuitMessage
EndDialog
DialogBoxParamW
EndPaint
BeginPaint
DefWindowProcW
DestroyWindow
UpdateWindow
CreateWindowExW
advapi32
CryptGenRandom
CryptAcquireContextA
GetCurrentHwProfileA
RegCloseKey
RegSetValueExW
RegCreateKeyExW
CryptReleaseContext
shell32
SHGetFolderPathW
ShellExecuteA
shlwapi
SHGetValueA
crypt32
CryptStringToBinaryA
CryptUnprotectData
ws2_32
WSAStartup
getaddrinfo
WSACleanup
socket
connect
closesocket
freeaddrinfo
send
recv
Sections
.text Size: 944KB - Virtual size: 944KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 127KB - Virtual size: 127KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ