Behavioral task
behavioral1
Sample
361b2a0e3ec64dd31a14215a821cd7187bf34268b0ab531eb94a6db29511dce3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
361b2a0e3ec64dd31a14215a821cd7187bf34268b0ab531eb94a6db29511dce3.exe
Resource
win10v2004-20220812-en
General
-
Target
361b2a0e3ec64dd31a14215a821cd7187bf34268b0ab531eb94a6db29511dce3
-
Size
190KB
-
MD5
5e88dca88030c4a5dc2c28ebe92f8c67
-
SHA1
a845ba1a17586d394739cb60dcaaaa9611db124c
-
SHA256
361b2a0e3ec64dd31a14215a821cd7187bf34268b0ab531eb94a6db29511dce3
-
SHA512
82c8b7dc5140b036bb6ecc0c7f2cff66023c73bc145fffde3c3d37fc4b3948f628e2659dccb966af9d4f6b50a0907d4d84ea4da2b5950804d7673bfd4568f538
-
SSDEEP
3072:NOWBokcdaH7vrCOp7CTX5xBGyQeZSkZ/Qf3GZ8BqFF0zdS2IngScQZ:NOExcduDrCOlCBGaFQOZ8BqhVg6
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
361b2a0e3ec64dd31a14215a821cd7187bf34268b0ab531eb94a6db29511dce3.exe windows x86
20cc7adf5ee7770f065f3d5b04e6414f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileW
CreateDirectoryW
GetFileAttributesW
ExpandEnvironmentStringsW
lstrlenW
CreateProcessW
VerSetConditionMask
VerifyVersionInfoW
OutputDebugStringW
WideCharToMultiByte
WriteFile
FlushFileBuffers
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
GetSystemTime
GetLastError
SetLastError
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetFilePointer
SetEndOfFile
ReleaseMutex
WaitForSingleObject
CreateMutexW
CloseHandle
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
InterlockedExchange
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetSystemDirectoryW
LoadLibraryExW
GetDriveTypeW
GetVolumePathNameW
GetFileType
GetSystemInfo
GetModuleHandleW
CompareStringW
GetProcessHeap
HeapFree
HeapAlloc
GetCommandLineW
FreeLibrary
LoadLibraryW
InterlockedCompareExchange
OpenEventW
GetProcAddress
msvcrt
_controlfp
?terminate@@YAXXZ
free
malloc
memmove
memcpy
memset
__set_app_type
__p__fmode
__p__commode
__setusermatherr
_amsg_exit
_initterm
_wcmdln
exit
_XcptFilter
_exit
_unlock
_vsnwprintf
__dllonexit
_lock
_onexit
__wgetmainargs
_cexit
ntdll
RtlUnwind
ole32
CoTaskMemFree
CoUninitialize
CoCreateInstance
CoInitialize
CoInitializeEx
advapi32
AllocateAndInitializeSid
FreeSid
GetTokenInformation
DuplicateTokenEx
CheckTokenMembership
IsValidSid
CopySid
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
RegEnumValueW
RegDeleteValueW
GetUserNameW
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegOpenKeyExW
RegCloseKey
user32
IsWindow
PostMessageW
oleaut32
VariantClear
VariantInit
shlwapi
StrRChrW
StrChrW
ord176
PathIsRelativeW
PathIsUNCW
PathStripToRootW
PathIsRootW
Sections
.text Size: 38KB - Virtual size: 37KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE