Static task
static1
Behavioral task
behavioral1
Sample
cb8eaa434a568088bbae8e490e11382b1045a0bab2e67fffc6f4ab2339efb6a3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cb8eaa434a568088bbae8e490e11382b1045a0bab2e67fffc6f4ab2339efb6a3.exe
Resource
win10v2004-20220901-en
General
-
Target
cb8eaa434a568088bbae8e490e11382b1045a0bab2e67fffc6f4ab2339efb6a3
-
Size
35KB
-
MD5
40ef39b6fcf2d18d761df2372885d54b
-
SHA1
0155f8ddd34d03313482295b73f1983b8444ee22
-
SHA256
cb8eaa434a568088bbae8e490e11382b1045a0bab2e67fffc6f4ab2339efb6a3
-
SHA512
b9e6b21899e9623d46928074a468c528623a1f35008af80c78393f3d49c2d7da5b024598d4e5a4cad825123b7b8e0b0daaf809b42dcd120590dbadcee2305c4e
-
SSDEEP
768:YeD9PvT+Lk7wp3wyRMhUqJD3vSASstx43US1qdNUWo:YeDFvqLk0p3wdU0D3vSAS137qdFo
Malware Config
Signatures
Files
-
cb8eaa434a568088bbae8e490e11382b1045a0bab2e67fffc6f4ab2339efb6a3.exe windows x86
96e12bb94828aba3f9d44b1ef6d9ba7f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
ntdll
NtQueryInformationThread
_itoa
_strnicmp
_strcmpi
strstr
atoi
tolower
RtlImageDirectoryEntryToData
_snprintf
LdrProcessRelocationBlock
RtlImageNtHeader
NtQueueApcThread
RtlAdjustPrivilege
RtlExitUserThread
RtlInsertElementGenericTable
RtlInitializeGenericTable
RtlEnumerateGenericTable
isalpha
RtlLookupElementGenericTable
RtlDeleteElementGenericTable
_stricmp
RtlCompareMemory
memset
memcpy
shlwapi
UrlGetPartA
PathFindFileNameA
PathCombineA
wsock32
WSAStartup
closesocket
wininet
InternetReadFile
InternetOpenA
InternetOpenUrlA
InternetCrackUrlA
HttpQueryInfoA
InternetConnectA
InternetSetOptionA
HttpOpenRequestA
HttpSendRequestA
InternetCloseHandle
ws2_32
WSASocketA
kernel32
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetExitCodeThread
TerminateProcess
CreateMutexA
QueueUserWorkItem
GetModuleFileNameA
OpenMutexA
lstrcmpiA
GetLastError
CreateDirectoryA
Sleep
SetEvent
ExitProcess
GetVersionExA
LockFileEx
FlushFileBuffers
WriteFile
GetProcessHeap
UnlockFileEx
HeapFree
GetCurrentProcess
HeapAlloc
SetEndOfFile
lstrcpynA
MoveFileExA
SetFilePointer
lstrlenA
lstrcatA
lstrcpyA
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
VirtualQuery
Process32First
WaitForSingleObject
VirtualFree
CreateRemoteThread
OpenProcess
VirtualFreeEx
GetProcAddress
VirtualAlloc
VirtualAllocEx
Process32Next
GetModuleHandleA
CreateToolhelp32Snapshot
GetCurrentThreadId
CloseHandle
GetCurrentProcessId
WriteProcessMemory
CreateThread
LoadLibraryA
VirtualProtect
HeapReAlloc
CreateFileA
IsDebuggerPresent
user32
ExitWindowsEx
advapi32
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
shell32
SHGetFolderPathA
Sections
.text Size: 23KB - Virtual size: 22KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ