Static task
static1
Behavioral task
behavioral1
Sample
f7f3bf9b6fa214e5201126f898ec4c8a68d657ee8ec13e544ede12edd7714488.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f7f3bf9b6fa214e5201126f898ec4c8a68d657ee8ec13e544ede12edd7714488.exe
Resource
win10v2004-20220901-en
General
-
Target
f7f3bf9b6fa214e5201126f898ec4c8a68d657ee8ec13e544ede12edd7714488
-
Size
602KB
-
MD5
9249a799ffe08987ba4f441aa085c0e0
-
SHA1
84526cbea26329bff4c3a8985c136cb061ceca90
-
SHA256
f7f3bf9b6fa214e5201126f898ec4c8a68d657ee8ec13e544ede12edd7714488
-
SHA512
4bbc48b4787f716c1895fcea7e8c9aad208656d371fb212f5cd683b40a6f35521eb14e55addfbd8f56bdac549545c64f7e67781a9b9ee7e97bdbd240f0113913
-
SSDEEP
12288:PlE9NOj2NOj/jRyqYRzzcgOLv1RumaN0rnqyerKP+kkYiexthpGkeTh16IROzciO:PlEHqYZzUrEKtGkeTh1ZO
Malware Config
Signatures
Files
-
f7f3bf9b6fa214e5201126f898ec4c8a68d657ee8ec13e544ede12edd7714488.exe windows x86
5c35a0fdfbc75d81563bc7bad4897960
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
hge
hgeCreate
magic
Magic_CreateAtlases
Magic_IsIntensive
Magic_GetNextParticle
Magic_GetEmitterCount
Magic_GetEmitter
Magic_GetParticlesTypeCount
Magic_LockParticlesType
Magic_GetTextureID
Magic_FindNext
Magic_GetTextureCount
Magic_GetTexture
Magic_UnlockParticlesType
Magic_LoadEmitter
Magic_SetInterpolationMode
Magic_SetLoopMode
Magic_IsInterpolationMode
Magic_GetUpdateTime
Magic_Update
Magic_IsInterrupt
Magic_SetInterrupt
Magic_Stop
Magic_InInterval
Magic_GetScale
Magic_SetScale
Magic_GetEmitterDirectionMode
Magic_SetEmitterDirectionMode
Magic_GetEmitterDirection
Magic_FindFirst
Magic_SetCurrentFolder
Magic_OpenFile
Magic_OpenFileInMemory
Magic_SetEmitterDirection
Magic_GetEmitterPositionMode
Magic_SetEmitterPositionMode
Magic_SetEmitterPosition
Magic_GetEmitterPosition
Magic_IsInterval1
Magic_EmitterToInterval1
Magic_Restart
Magic_GetEmitterName
Magic_DuplicateEmitter
Magic_GetParticleRectangle
Magic_UnloadEmitter
Magic_CloseAllFiles
Magic_SetTextureID
binkw32
_BinkOpen@8
_BinkPause@8
_BinkSetSoundSystem@8
_BinkCopyToBuffer@28
_BinkNextFrame@4
_BinkOpenWaveOut@4
_BinkClose@4
_BinkWait@4
_BinkDoFrame@4
winmm
timeGetTime
waveOutSetVolume
waveOutGetVolume
kernel32
InterlockedCompareExchange
GetStartupInfoA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
InterlockedExchange
GetCurrentProcess
GetProcessAffinityMask
GetCurrentThread
SetThreadAffinityMask
QueryPerformanceFrequency
QueryPerformanceCounter
CopyFileA
GetModuleFileNameA
LoadLibraryA
GetProcAddress
lstrlenA
WriteFile
ClearCommError
ReadFile
GetLastError
CreateFileA
SetupComm
GetCommState
SetCommState
PurgeComm
SetCommTimeouts
SetLocalTime
Sleep
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
GetLocalTime
WaitForSingleObject
ResumeThread
SuspendThread
GetTickCount
user32
EnumDisplaySettingsA
GetDC
PostMessageA
MessageBoxA
PostQuitMessage
ChangeDisplaySettingsA
ReleaseDC
gdi32
SelectObject
CreateFontA
SetBkColor
SetTextColor
SetMapMode
CreateCompatibleDC
GetGlyphOutlineW
DeleteDC
DeleteObject
GetTextMetricsA
msvcp90
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAM@Z
??$?5DU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAD@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAH@Z
?swap@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXAAV12@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1strstreambuf@std@@UAE@XZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
??$?5DU?$char_traits@D@std@@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAD@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0strstreambuf@std@@QAE@PADH0@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?push_back@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXD@Z
?_Xran@_String_base@std@@SAXXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?9DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??_D?$basic_ofstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@PBDHH@Z
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
msvcr90
fread
fwrite
strncmp
_CIpow
strchr
strstr
memcpy_s
tolower
remove
floor
printf_s
_beginthreadex
system
vsprintf_s
memcpy
rand
clock
free
calloc
_recalloc
vsprintf
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
ftell
_CIsin
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??3@YAXPAX@Z
??0exception@std@@QAE@XZ
__CxxFrameHandler3
__RTDynamicCast
_invalid_parameter_noinfo
??_V@YAXPAX@Z
_CxxThrowException
??0exception@std@@QAE@ABV01@@Z
??2@YAPAXI@Z
_purecall
sprintf
printf
memmove_s
_CIcos
memset
_CIsqrt
atoi
_time64
srand
_CIacos
_findclose
_wfindnext64i32
_wfindfirst64i32
_snprintf
_wmkdir
_wremove
_wstat64i32
_localtime64
fflush
fputs
_wfopen
fclose
__iob_func
exit
fseek
version
GetFileVersionInfoA
GetFileVersionInfoSizeA
VerQueryValueA
Sections
.text Size: 386KB - Virtual size: 385KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 84KB - Virtual size: 83KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 35KB - Virtual size: 34KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
�m� Size: 89KB - Virtual size: 92KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE