Static task
static1
Behavioral task
behavioral1
Sample
f70904ec203fae0a4f048df9c0336179b50c90c666e78559ae12e2d90f0777b7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f70904ec203fae0a4f048df9c0336179b50c90c666e78559ae12e2d90f0777b7.exe
Resource
win10v2004-20220901-en
General
-
Target
f70904ec203fae0a4f048df9c0336179b50c90c666e78559ae12e2d90f0777b7
-
Size
288KB
-
MD5
819f4aadc1dfebcc632a1d5bc87cfa47
-
SHA1
8475e21e2714c51487dada4c6cb0777e35db1a44
-
SHA256
f70904ec203fae0a4f048df9c0336179b50c90c666e78559ae12e2d90f0777b7
-
SHA512
e91d20eb7c3418c53351101333a25d049c604b409f232f41b49ee0bac95f83a490fefae6e2858f0a0f934b81824c857187d0bce4fd797c57e0cc845a8092db49
-
SSDEEP
6144:O4AxmgUdN8phkiZS6gPfzUEOsN2vb+xloHdPsaObLQ+6zMq:/gphkwngPfAEN2jtmaUBIMq
Malware Config
Signatures
Files
-
f70904ec203fae0a4f048df9c0336179b50c90c666e78559ae12e2d90f0777b7.exe windows x86
6080ea30ab7636c9f5df42a197d5cada
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mydefragdll
MydAttachWindow
MydRunCommandline
MydMessage
MydFree
GetDiskMap
MydStop
MydCleanup
MydInit
MydSetRefreshDiskMap
kernel32
FindNextFileW
GetFileAttributesW
LoadLibraryW
SystemTimeToFileTime
GetDriveTypeW
GetLogicalDriveStringsW
SetFileAttributesW
MoveFileExW
GetFileAttributesExW
MoveFileW
LocalFree
FormatMessageW
CreateFileW
ReadFile
SetFilePointerEx
GetDiskFreeSpaceW
FindFirstFileW
GetTickCount
GetVolumeInformationW
GetDiskFreeSpaceExW
HeapFree
GetProcessHeap
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
InterlockedCompareExchange
HeapSize
HeapReAlloc
FindClose
GetTempPathW
GetTempFileNameW
DeleteFileW
InterlockedExchange
GetCommandLineW
LoadLibraryExW
MultiByteToWideChar
FreeLibrary
InterlockedDecrement
InterlockedIncrement
SetEvent
GetProcAddress
CreateEventW
CreateThread
Sleep
GetCurrentThreadId
GetModuleHandleW
GetModuleFileNameW
WaitForSingleObject
lstrcmpiW
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
RaiseException
lstrlenW
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
GetCurrentThread
CloseHandle
GetLastError
HeapAlloc
HeapDestroy
GetCurrentProcess
ResumeThread
ResetEvent
GetCompressedFileSizeW
GetVersionExW
DeviceIoControl
WaitForMultipleObjects
user32
GetMessageW
SendMessageW
UnregisterClassW
RegisterClassExW
GetWindowLongW
SetWindowLongW
CreateWindowExW
DefWindowProcW
LoadStringW
CharNextW
PostThreadMessageW
CharUpperW
TranslateMessage
PostMessageW
DestroyWindow
MessageBoxW
DispatchMessageW
advapi32
RegisterServiceCtrlHandlerW
ControlService
DeleteService
CreateServiceW
RegEnumKeyExW
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
GetAclInformation
InitializeAcl
AddAce
OpenSCManagerW
OpenServiceW
CloseServiceHandle
SetServiceStatus
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryInfoKeyW
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
InitializeSecurityDescriptor
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
MakeAbsoluteSD
GetSecurityDescriptorControl
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
CheckTokenMembership
IsValidSid
GetLengthSid
CopySid
GetTokenInformation
ImpersonateSelf
OpenThreadToken
RevertToSelf
StartServiceCtrlDispatcherW
ole32
CoTaskMemAlloc
CoTaskMemRealloc
CoRegisterClassObject
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoSuspendClassObjects
StringFromGUID2
CoCreateInstance
CoResumeClassObjects
CoInitializeSecurity
CoSetProxyBlanket
CoRevokeClassObject
oleaut32
SafeArrayLock
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayUnlock
SysAllocStringLen
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
SysStringByteLen
VariantInit
VariantClear
VariantCopy
VariantChangeType
shlwapi
PathFileExistsW
PathFindFileNameW
PathRemoveFileSpecW
PathRemoveExtensionW
PathFindExtensionW
userenv
UnloadUserProfile
msvcr90
vswprintf_s
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_controlfp_s
_invoke_watson
_crt_debugger_hook
??3@YAXPAX@Z
free
_purecall
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler3
??_U@YAPAXI@Z
??_V@YAXPAX@Z
memset
memmove_s
memcpy_s
wcsstr
malloc
wcscpy_s
wcsncpy_s
wcscat_s
_putws
_vsnwprintf_s
calloc
_recalloc
wcsnlen
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_invalid_parameter_noinfo
??0exception@std@@QAE@ABV01@@Z
_wtoi
_aligned_free
_aligned_malloc
memcpy
_itow_s
__RTDynamicCast
_vscwprintf
_vswprintf_c_l
_wcmdln
_except_handler4_common
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
?_type_info_dtor_internal_method@type_info@@QAEXXZ
msvcp90
?close@?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
??0?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAE@PB_WHH@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??_D?$basic_fstream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?allocate@?$allocator@_W@std@@QAEPA_WIPBX@Z
?construct@?$allocator@_W@std@@QAEXPA_WAB_W@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?endl@std@@YAAAV?$basic_ostream@_WU?$char_traits@_W@std@@@1@AAV21@@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEHPB_WH@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
?allocate@?$allocator@_W@std@@QAEPA_WI@Z
?deallocate@?$allocator@_W@std@@QAEXPA_WI@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
shell32
SHPathPrepareForWriteW
SHFileOperationW
Sections
.text Size: 111KB - Virtual size: 110KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 11KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.srdata Size: 76KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE