Behavioral task
behavioral1
Sample
2b18adc862f1bc73439668f02efff4d14a934093940cf8507ff8fd8e15670d9f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2b18adc862f1bc73439668f02efff4d14a934093940cf8507ff8fd8e15670d9f.exe
Resource
win10v2004-20220812-en
General
-
Target
2b18adc862f1bc73439668f02efff4d14a934093940cf8507ff8fd8e15670d9f
-
Size
35KB
-
MD5
84b9e535f164294d1061ee5866b26070
-
SHA1
44670fed2db1706ba364ab8a79ee57c6a666fb24
-
SHA256
2b18adc862f1bc73439668f02efff4d14a934093940cf8507ff8fd8e15670d9f
-
SHA512
cb9895c3ec322a0c1b4643446a823699fb1c5c4edbeee6967a7254b03a81b0d7ae8f1763244fd55ae68a40c4aa0ec14dadbcd59d18fefb972030678beed221d7
-
SSDEEP
384:KnpJcYaHwSeD+dQtXdJQuSZoHAbNV5VmHFZBuGZbpAaSRBGJzuR9br4+E:Ar+OtXgZ063yHFZtpAaSRIJar4+E
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
2b18adc862f1bc73439668f02efff4d14a934093940cf8507ff8fd8e15670d9f.exe windows x86
52e70af114994deeb453213b0537d657
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
GetTempPathA
GetVersionExA
GetUserDefaultLangID
SetFileAttributesA
GetDriveTypeA
GetLogicalDriveStringsA
TerminateProcess
OpenProcess
DeleteFileA
ExpandEnvironmentStringsA
FindNextFileA
FindFirstFileA
Sleep
lstrcpynA
Process32Next
MoveFileExA
Process32First
CreateToolhelp32Snapshot
GetTickCount
ExitProcess
GetLastError
CreateFileMappingA
GetModuleHandleA
GetStartupInfoA
GetTempFileNameA
GetVolumeInformationA
GetCurrentProcess
CloseHandle
GetFileAttributesA
lstrcpyA
lstrcatA
LoadLibraryA
GetProcAddress
lstrlenA
SetCurrentDirectoryA
advapi32
OpenServiceA
OpenSCManagerA
CloseServiceHandle
ChangeServiceConfigA
ControlService
DeleteService
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
msvcrt
_strdup
_strcmpi
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
toupper
strstr
malloc
_except_handler3
fclose
ftell
fseek
fopen
fwrite
fputs
fread
memset
strlen
abs
strcat
strcpy
strrchr
strcmp
strtok
__p___argv
__p___argc
time
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
netapi32
NetShareEnum
NetApiBufferFree
psapi
EnumProcessModules
GetModuleFileNameExA
user32
wsprintfA
version
GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA
Sections
UPX0 Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE