Static task
static1
Behavioral task
behavioral1
Sample
ba78277aabeafe749a69374b228ea0a41475902816572ca433faf459e70efa0d.exe
Resource
win7-20220812-en
General
-
Target
ba78277aabeafe749a69374b228ea0a41475902816572ca433faf459e70efa0d
-
Size
376KB
-
MD5
a231654f072b41b8e1b817cc32b705f0
-
SHA1
d9ea9ece6f7b6567870312034fba1305722175de
-
SHA256
ba78277aabeafe749a69374b228ea0a41475902816572ca433faf459e70efa0d
-
SHA512
693be56043ee12d15b3c5d5ff33005681359ac8110fa82867a3a448dd4d2ce3b5c082d686c355c58f0d6ba40a7fb0e079b031dac818813de53c029038fadd2c2
-
SSDEEP
6144:DsLc5BzTvDICbWAisaVuQYClkrLEI8eYKPzlMeGY2ubKGYUz5fqFl9hKZ:DT5BzrvismuQYClkrt8eYkKe72u+GLEK
Malware Config
Signatures
Files
-
ba78277aabeafe749a69374b228ea0a41475902816572ca433faf459e70efa0d.exe windows x86
f0e2662e89e1fadbf0a53cf8771836a6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GlobalUnlock
GlobalLock
GlobalAlloc
SetCurrentDirectoryW
DeleteFileW
GetPrivateProfileIntW
GetPrivateProfileStringW
RemoveDirectoryW
WideCharToMultiByte
MultiByteToWideChar
OpenEventW
GetVersionExW
CreateMutexW
GetTickCount
CreateEventW
WaitForSingleObject
SetEvent
CreateThread
GetModuleHandleW
lstrcmpiW
SizeofResource
LoadResource
FindResourceW
GetFileSizeEx
GetCommandLineW
lstrlenA
InterlockedIncrement
GetProcAddress
FreeLibrary
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
GetLocaleInfoA
ReadFile
GetModuleFileNameW
GetStringTypeA
LCMapStringA
QueryPerformanceCounter
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleHandleA
LCMapStringW
GetConsoleMode
GetConsoleCP
HeapCreate
HeapSize
InitializeCriticalSectionAndSpinCount
GetModuleFileNameA
GetStdHandle
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
HeapReAlloc
GetStartupInfoW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
ExitProcess
Sleep
RtlUnwind
TlsFree
TlsAlloc
ReleaseMutex
OpenThread
TlsSetValue
SetEnvironmentVariableW
TlsGetValue
GetEnvironmentVariableW
GetSystemTime
LocalFree
FormatMessageW
WriteFile
SetFilePointerEx
LocalFileTimeToFileTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
MulDiv
lstrcmpW
GetLastError
InitializeCriticalSection
SetLastError
GetCurrentProcess
FlushInstructionCache
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringW
GetStringTypeW
DebugBreak
SetFilePointer
GetCurrentProcessId
CreateFileW
DeviceIoControl
CloseHandle
LoadLibraryExW
LoadLibraryW
lstrlenW
InterlockedDecrement
LeaveCriticalSection
EnterCriticalSection
CreateFileA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
HeapAlloc
GetProcessHeap
HeapFree
InterlockedCompareExchange
RaiseException
user32
MoveWindow
SetWindowPos
IsWindowVisible
SetTimer
KillTimer
SetFocus
GetParent
IsWindow
SetWindowLongW
LoadStringW
UnregisterClassA
SetActiveWindow
GetActiveWindow
EnumChildWindows
MessageBoxW
CharNextW
ShowWindow
DispatchMessageW
TranslateMessage
GetMessageW
PeekMessageW
DefWindowProcW
DestroyWindow
GetSysColor
CreateDialogParamW
PostMessageW
SendMessageW
GetClientRect
ClientToScreen
ScreenToClient
GetDC
ReleaseDC
InvalidateRect
InvalidateRgn
GetWindowLongW
GetFocus
SendMessageTimeoutW
GetSystemMetrics
LoadImageW
DisableProcessWindowsGhosting
SystemParametersInfoW
GetClassInfoW
RegisterClassW
UpdateWindow
PostQuitMessage
IsIconic
BringWindowToTop
SetForegroundWindow
FindWindowW
CharLowerW
RegisterWindowMessageW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
CreateAcceleratorTableW
CreateWindowExW
RegisterClassExW
LoadCursorW
GetClassInfoExW
GetWindow
DestroyAcceleratorTable
GetDesktopWindow
BeginPaint
EndPaint
CallWindowProcW
FillRect
ReleaseCapture
GetClassNameW
GetDlgItem
IsChild
SetCapture
RedrawWindow
gdi32
GetStockObject
GetObjectW
CreateSolidBrush
GetDeviceCaps
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
DeleteDC
advapi32
RegCreateKeyExW
OpenProcessToken
GetTokenInformation
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExA
shell32
ShellExecuteExW
ShellExecuteW
ole32
OleInitialize
CreateStreamOnHGlobal
CoTaskMemAlloc
CoCreateInstance
CLSIDFromString
CLSIDFromProgID
CoGetClassObject
OleLockRunning
StringFromGUID2
OleUninitialize
CoUninitialize
CoInitialize
CoTaskMemRealloc
CoTaskMemFree
oleaut32
VarUI4FromStr
SafeArrayGetLBound
SafeArrayGetUBound
SysFreeString
SysAllocString
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysAllocStringLen
VariantInit
OleCreateFontIndirect
LoadRegTypeLi
LoadTypeLi
DispCallFunc
VariantChangeType
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreate
shlwapi
PathCombineW
SHGetValueW
PathAppendW
PathRemoveFileSpecW
PathIsDirectoryW
PathIsRelativeW
PathFindFileNameW
PathRemoveExtensionW
StrStrIW
PathFileExistsW
comctl32
InitCommonControlsEx
gdiplus
GdiplusStartup
GdiplusShutdown
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
Sections
.text Size: 182KB - Virtual size: 182KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 45KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 40KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 101KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE