Static task
static1
Behavioral task
behavioral1
Sample
b5c48a78b084c486cf5d844f440f0ec45d5ee16ce09ee2b9da5d40d0bcee0e38.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b5c48a78b084c486cf5d844f440f0ec45d5ee16ce09ee2b9da5d40d0bcee0e38.exe
Resource
win10v2004-20220812-en
General
-
Target
b5c48a78b084c486cf5d844f440f0ec45d5ee16ce09ee2b9da5d40d0bcee0e38
-
Size
1.4MB
-
MD5
a38bf66ade241e0f4b3f0cf1bc15d14a
-
SHA1
4a1ac4c8b372cbfa77989a52f139313e990d40e7
-
SHA256
b5c48a78b084c486cf5d844f440f0ec45d5ee16ce09ee2b9da5d40d0bcee0e38
-
SHA512
e099fa146c23a1d6b158399e00cf880264a0df9db966d79e39c1740759d790ef0dc3e38cf47b7b465d8a9186174e33719467c04e93a7d0eaea388c6bbae70ce6
-
SSDEEP
24576:NNDsdUZ6mXxvmyN2bHRAz6Gv1etZI0i3ICvy14y:NB6m1w5Cvy1v
Malware Config
Signatures
Files
-
b5c48a78b084c486cf5d844f440f0ec45d5ee16ce09ee2b9da5d40d0bcee0e38.exe windows x86
65cdd0a824b06f3456a503bc4c2352f9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wsock32
shutdown
htons
ntohs
getsockopt
ntohl
inet_ntoa
ioctlsocket
htonl
send
connect
listen
WSAStartup
accept
select
WSAGetLastError
setsockopt
WSACleanup
recv
bind
socket
__WSAFDIsSet
closesocket
gethostbyname
kernel32
GetSystemTimeAsFileTime
GetTickCount
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
VerifyVersionInfoA
CreateDirectoryA
VerSetConditionMask
SetLastError
FormatMessageA
Sleep
FindFirstFileA
FindClose
SetCurrentDirectoryA
FindNextFileA
GetCurrentDirectoryA
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetProcAddress
LoadLibraryA
LeaveCriticalSection
InterlockedExchange
EnterCriticalSection
DeleteCriticalSection
CloseHandle
CreateThread
WaitForSingleObject
InitializeCriticalSection
GetLocalTime
GetLastError
GetCurrentProcessId
advapi32
OpenProcessToken
OpenThreadToken
StartServiceCtrlDispatcherA
SetServiceStatus
RegisterServiceCtrlHandlerA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
shell32
SHCreateDirectoryExA
SHGetSpecialFolderPathA
SHGetFolderPathA
msvcr80
strncpy
sscanf
___mb_cur_max_func
strrchr
_CxxThrowException
strstr
_strdup
isspace
toupper
tolower
isxdigit
signal
printf
strtok
strcspn
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
exit
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_vsnprintf
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
strtol
strtoul
strncat
atol
sprintf
wctomb
mbtowc
_setmode
??_V@YAXPAX@Z
_unlink
ftell
fread
fseek
_time64
_snprintf
fflush
fclose
vfprintf
fprintf
fopen
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
_purecall
??2@YAPAXI@Z
memmove_s
_invalid_parameter_noinfo
rand
_chdir
strncmp
_getcwd
realloc
malloc
free
_write
_read
_close
_open
_fdopen
__CxxFrameHandler3
memset
memcpy
strchr
msvcp80
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?str@?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
?uncaught_exception@std@@YA_NXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
Sections
.text Size: 1.1MB - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 96KB - Virtual size: 93KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 428B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: 192KB - Virtual size: 1.3MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE