Static task
static1
Behavioral task
behavioral1
Sample
f2ddcdb757abba6e911008159740be44c81d98b1f548b01e8a768230314318c7.exe
Resource
win7-20220812-en
General
-
Target
f2ddcdb757abba6e911008159740be44c81d98b1f548b01e8a768230314318c7
-
Size
445KB
-
MD5
90c6cbbbc2210204ed457a36e4da3000
-
SHA1
e413322c324403f047ee74fbd64681095ed0d319
-
SHA256
f2ddcdb757abba6e911008159740be44c81d98b1f548b01e8a768230314318c7
-
SHA512
e2075b5448259d202121a814c82dacc342174dfae7ecf6f6e3a125aadefe592f2e374978a46f69951891100cac91d5d685c3de2712a10e637669f419f270c4e4
-
SSDEEP
6144:PLzq//nkdzSd+Sds/r3K6B7YQkvjqAQg8fqL6ggptFyO5Li66AnivKojP:PLzq3nCSd+Tr3Kq7YQkxTStG6mvN
Malware Config
Signatures
Files
-
f2ddcdb757abba6e911008159740be44c81d98b1f548b01e8a768230314318c7.exe windows x86
a0ac44b2395708f0ead5d5c692ad000d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FindNextFileA
FindFirstFileA
LoadLibraryA
GetProcAddress
GetSystemDirectoryA
LocalFree
CopyFileA
GetPrivateProfileIntA
GetTempFileNameA
GetEnvironmentVariableA
GetVersionExA
WritePrivateProfileStringA
GetLastError
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
RaiseException
WaitForSingleObject
InterlockedDecrement
lstrcmpiA
SetEvent
CreateThread
CreateEventA
FindClose
GetModuleHandleW
IsDBCSLeadByte
FreeLibrary
SizeofResource
LoadResource
FindResourceA
LoadLibraryExA
Sleep
GetCurrentThreadId
GetCommandLineA
ReleaseMutex
OpenMutexA
OpenEventA
GetUserDefaultLCID
GetCurrentProcessId
GetTickCount
GetFileType
SetHandleCount
GetProcessHeap
FlushFileBuffers
lstrlenA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
InitializeCriticalSection
GetTempPathA
DeleteCriticalSection
QueryPerformanceCounter
WriteFile
OutputDebugStringA
CreateFileA
SetFilePointer
GetModuleHandleA
GetModuleFileNameA
EnterCriticalSection
CloseHandle
LeaveCriticalSection
InterlockedIncrement
SetEnvironmentVariableA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoW
InterlockedExchange
SetConsoleCtrlHandler
GetEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
GetConsoleMode
GetConsoleCP
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
HeapSize
GetStringTypeW
GetStringTypeA
CompareStringW
CompareStringA
LCMapStringW
LCMapStringA
GetStdHandle
IsValidLocale
EnumSystemLocalesA
GetSystemTimeAsFileTime
RtlUnwind
GetTimeFormatA
GetDateFormatA
HeapAlloc
HeapFree
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
GetStartupInfoA
GetTimeZoneInformation
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
FatalAppExitA
VirtualFree
HeapCreate
HeapDestroy
ExitProcess
GetLocaleInfoA
user32
CharNextA
GetMessageA
PostThreadMessageA
DispatchMessageA
CharNextW
MessageBoxA
advapi32
RegEnumKeyExA
RegQueryInfoKeyA
RegDeleteKeyA
RegEnumValueA
RegEnumKeyA
RegDeleteValueA
RegSetValueExA
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
GetNamedSecurityInfoA
SetNamedSecurityInfoA
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
ConvertStringSecurityDescriptorToSecurityDescriptorA
shell32
SHFileOperationA
ole32
CoTaskMemRealloc
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemFree
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemAlloc
StringFromGUID2
oleaut32
LoadRegTypeLi
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocString
SysStringLen
SysFreeString
SysReAllocString
SysAllocStringLen
CreateErrorInfo
VariantClear
GetErrorInfo
VariantChangeType
VariantInit
SetErrorInfo
shlwapi
SHDeleteKeyA
Sections
.text Size: 211KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 166KB - Virtual size: 168KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE