Static task
static1
Behavioral task
behavioral1
Sample
3b0bbdc398271f37543d311006affb02e1b5cbad75d11bcf01c113c672d91050.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3b0bbdc398271f37543d311006affb02e1b5cbad75d11bcf01c113c672d91050.exe
Resource
win10v2004-20220812-en
General
-
Target
3b0bbdc398271f37543d311006affb02e1b5cbad75d11bcf01c113c672d91050
-
Size
653KB
-
MD5
4af0b4d96d5b50fa850cdd1cf378af90
-
SHA1
f62f68128391609ca71d21c3b36d4a524b954833
-
SHA256
3b0bbdc398271f37543d311006affb02e1b5cbad75d11bcf01c113c672d91050
-
SHA512
46c8958eb5483837cfd695d5c09c85c3775d8d95915d4f06ccc5ec595ac1eefb4b42857e9df7531ccc9653c2a5a8f43a2b7c2aca307008894b0af6ad4db79e2d
-
SSDEEP
12288:0VYRLOMFLXd7JAuHvYlfu72VNIv7mRZfw6jU9CIeUIBD6FQswixm2ZeUv:0SOOX87myVN4KR/o9GB0VZe
Malware Config
Signatures
Files
-
3b0bbdc398271f37543d311006affb02e1b5cbad75d11bcf01c113c672d91050.exe windows x86
dd11c6f685b57e72a4575bfe3959833d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
psapi
GetModuleBaseNameW
EnumProcessModules
EnumProcesses
kernel32
GetVersionExW
CreateProcessW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
ReleaseMutex
OpenEventW
Sleep
GetTickCount
GetCommandLineW
SetCurrentDirectoryW
FormatMessageW
SetEvent
GetLastError
CreateMutexW
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
InterlockedCompareExchange
InterlockedExchange
LocalFree
ExitProcess
GetModuleHandleW
GetProcAddress
CloseHandle
OpenProcess
GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
GetModuleFileNameW
IsDebuggerPresent
user32
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
DefWindowProcW
UpdateWindow
ShowWindow
CreateWindowExW
GetSystemMetrics
RegisterClassExW
LoadCursorW
LoadImageW
SetWindowLongW
wsprintfW
FindWindowW
IsWindowVisible
GetWindowTextW
GetClassNameW
UnregisterClassW
BeginPaint
GetClientRect
EndPaint
EnumWindows
GetWindowLongW
GetWindowThreadProcessId
MessageBoxW
DestroyWindow
SetForegroundWindow
gdi32
DeleteDC
SelectObject
CreateCompatibleDC
DeleteObject
GetObjectW
GetStockObject
BitBlt
advapi32
DuplicateTokenEx
OpenProcessToken
shell32
CommandLineToArgvW
msvcp80
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHPB_W@Z
?compare@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEHIIPB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV?$_String_const_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
msvcr80
_amsg_exit
__initenv
exit
_XcptFilter
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_controlfp_s
_invoke_watson
_except_handler4_common
?terminate@@YAXXZ
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
??_V@YAXPAX@Z
??3@YAXPAX@Z
_vswprintf
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
__CxxFrameHandler3
free
_wcsdup
memset
_invalid_parameter_noinfo
??2@YAPAXI@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
_exit
__getmainargs
_cexit
_initterm
Sections
.text Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 628KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE