Static task
static1
Behavioral task
behavioral1
Sample
eb8cd6a6ae40f82774288301da0c558421001429ecbcbd2b9fa17651619bbdd3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
eb8cd6a6ae40f82774288301da0c558421001429ecbcbd2b9fa17651619bbdd3.exe
Resource
win10v2004-20220812-en
General
-
Target
eb8cd6a6ae40f82774288301da0c558421001429ecbcbd2b9fa17651619bbdd3
-
Size
276KB
-
MD5
a352b1235a0a2f6dc906508fba060940
-
SHA1
d42ed9697be7dc86ce4cff2765ec393533e15083
-
SHA256
eb8cd6a6ae40f82774288301da0c558421001429ecbcbd2b9fa17651619bbdd3
-
SHA512
467c01cf32438c4178f4aff5e6ea4b72e3e81d6cfd309058d3dc1355bc9f2db35974969bb2995e75ef7adfee9441fbd39d9fa34e0df211b1e58ce57ddc6c4d59
-
SSDEEP
6144:azpLKY0bvIZNCCBTBqeggutOUbqwqMfu7t3SsQLH5AdD:af0bQyCBTseguwqMWJ3SsPdD
Malware Config
Signatures
Files
-
eb8cd6a6ae40f82774288301da0c558421001429ecbcbd2b9fa17651619bbdd3.exe windows x86
9f0101d63a32334a87a64e90757cff3e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
dbghelp
SymLoadModule
SymGetModuleInfoW
SymInitialize
SymSetOptions
SymCleanup
wininet
InternetOpenUrlA
InternetOpenA
HttpSendRequestA
InternetCloseHandle
InternetConnectA
HttpOpenRequestA
InternetReadFile
psapi
GetModuleFileNameExA
GetModuleFileNameExW
comctl32
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_Create
tinyxml
??1TiXmlDocument@@UAE@XZ
?Print@TiXmlDocument@@UBEXPAU_iobuf@@H@Z
?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z
?ToDocument@TiXmlDocument@@UAEPAV1@XZ
?ToDocument@TiXmlDocument@@UBEPBV1@XZ
?ToElement@TiXmlNode@@UAEPAVTiXmlElement@@XZ
?ToElement@TiXmlNode@@UBEPBVTiXmlElement@@XZ
?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ
?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ
?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ
??0TiXmlDocument@@QAE@XZ
?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ
?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ
?Clone@TiXmlDocument@@MBEPAVTiXmlNode@@XZ
?Accept@TiXmlDocument@@UBE_NPAVTiXmlVisitor@@@Z
?Value@TiXmlNode@@QBEPBDXZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?GetText@TiXmlElement@@QBEPBDXZ
?Attribute@TiXmlElement@@QBEPBDPBD@Z
?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z
?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ
kernel32
GetVersionExA
HeapSize
InterlockedExchange
GetACP
HeapDestroy
GetThreadLocale
InterlockedCompareExchange
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetLocaleInfoA
HeapReAlloc
InitializeCriticalSection
VirtualQuery
MoveFileW
SetFileAttributesW
GetSystemTimeAsFileTime
GetCurrentProcess
GetProcessTimes
QueryPerformanceCounter
LeaveCriticalSection
EnterCriticalSection
GetCommandLineW
MultiByteToWideChar
GetCurrentThreadId
GetCurrentProcessId
GetFileAttributesW
GetThreadSelectorEntry
CreateDirectoryW
GetModuleHandleW
HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
HeapFree
GetTickCount
SetCurrentDirectoryW
OpenProcess
lstrlenW
lstrcatW
DeleteFileW
CopyFileW
LoadLibraryW
FindFirstFileW
VirtualQueryEx
GetExitCodeProcess
FindNextFileW
CreateFileA
TerminateProcess
FindClose
SetEvent
lstrcpyW
WaitForSingleObject
CreateProcessW
SizeofResource
LockResource
LoadResource
FreeLibrary
OpenThread
FindResourceExW
ReadProcessMemory
WriteProcessMemory
FindResourceW
CreateThread
GlobalAlloc
GlobalLock
GlobalUnlock
GetLastError
GlobalFree
InterlockedIncrement
InterlockedDecrement
WideCharToMultiByte
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
CreateEventW
ResumeThread
FreeResource
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
Sleep
CreateFileW
WriteFile
DeleteCriticalSection
RaiseException
GetVersionExW
ReadFile
SetFilePointer
GetProcAddress
GetFileSize
GetModuleFileNameW
GetPrivateProfileSectionW
GetSystemDefaultLCID
GetPrivateProfileIntW
GetTempPathW
WritePrivateProfileStringW
user32
UnregisterClassA
LoadIconW
SendMessageW
SetWindowTextW
SetWindowPos
LoadImageW
ShowWindow
GetClientRect
GetDlgItem
DrawIconEx
EndDialog
GetDesktopWindow
PostMessageW
KillTimer
ClientToScreen
SetWindowLongW
MapWindowPoints
GetWindowRect
MapDialogRect
InvalidateRect
CallWindowProcW
RegisterClipboardFormatW
OpenClipboard
SendDlgItemMessageW
EmptyClipboard
EnableWindow
CreateWindowExW
RegisterClassExW
GetClassInfoExW
DefWindowProcW
DestroyWindow
IsWindow
DestroyMenu
TrackPopupMenu
GetWindowThreadProcessId
GetMenuItemCount
CreatePopupMenu
ReleaseDC
GetDC
GetKeyState
MessageBoxW
SetDlgItemTextW
GetWindow
DialogBoxParamW
GetWindowTextW
SetTimer
CloseClipboard
GetWindowTextLengthW
SetClipboardData
gdi32
DeleteObject
SetTextColor
GetStockObject
advapi32
RegSetValueExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
shell32
SHGetDesktopFolder
ord155
ShellExecuteW
SHGetFileInfoW
SHGetSpecialFolderPathW
SHBindToParent
ole32
OleUninitialize
DoDragDrop
OleInitialize
CreateStreamOnHGlobal
oleaut32
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysAllocString
gdiplus
GdipCloneImage
GdipImageSelectActiveFrame
GdipGetImageHeight
GdipDrawImageRectI
GdipDeleteGraphics
GdipDisposeImage
GdipCreateFromHDC
GdipGetPropertyItem
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdiplusStartup
GdiplusShutdown
GdipFree
GdipAlloc
GdipGetImageWidth
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
shlwapi
PathFileExistsW
msvcp80
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
msvcr80
strrchr
strchr
strncmp
wcsstr
towlower
_beginthreadex
wcscat
wcscpy
fprintf
fclose
fwrite
ftell
fseek
_wfopen
strtoul
strcmp
_wcsicmp
memcmp
iswspace
wcsncmp
__wargv
__argc
vsprintf_s
free
_vscprintf
vswprintf_s
_mbscmp
_vscwprintf
wcschr
_wcslwr_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
wcsrchr
atoi
isspace
_gmtime32
wcscpy_s
wcscat_s
fread
iswdigit
iswalpha
__CxxFrameHandler3
_controlfp_s
_invoke_watson
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?terminate@@YAXXZ
_crt_debugger_hook
memset
wcscmp
??0exception@std@@QAE@ABV01@@Z
??_V@YAXPAX@Z
??0exception@std@@QAE@ABQBD@Z
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
_CxxThrowException
_adjust_fdiv
??2@YAPAXI@Z
_mbslwr_s
_mbsstr
_snprintf
strlen
_time32
??0exception@std@@QAE@XZ
memcpy
_snwprintf
_invalid_parameter_noinfo
malloc
swscanf
srand
wcslen
memcpy_s
_purecall
memmove_s
??3@YAXPAX@Z
iswalnum
_time64
_wtoi
wcsncpy
memmove
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationW
crypt32
CertGetNameStringW
wintrust
WinVerifyTrust
WTHelperGetProvCertFromChain
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
Sections
.text Size: 112KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 56KB - Virtual size: 53KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 97KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ