Static task
static1
Behavioral task
behavioral1
Sample
ff82671fc021dee1f1aacc4244379c000f3d9710af32c06b1b152231c3883c4b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ff82671fc021dee1f1aacc4244379c000f3d9710af32c06b1b152231c3883c4b.exe
Resource
win10v2004-20220812-en
General
-
Target
ff82671fc021dee1f1aacc4244379c000f3d9710af32c06b1b152231c3883c4b
-
Size
113KB
-
MD5
a26a58cccf9ea6181495ea42048b6250
-
SHA1
1541f85aedf5721d2ed01db6e4ffd2160497ace3
-
SHA256
ff82671fc021dee1f1aacc4244379c000f3d9710af32c06b1b152231c3883c4b
-
SHA512
1747846464a144cdbb8e2bd2000bdfb555009354d3d0061090b2485bbe22855e5f8c467d7adf17a6d2688b01aee31b766938469d0d4d637bbcf6117137734a24
-
SSDEEP
3072:kMYqOO2bjw7ZtCehAuWjSjl2KJ42Wu7H4g:p1OOmjQCGAZSjYKJl7HZ
Malware Config
Signatures
Files
-
ff82671fc021dee1f1aacc4244379c000f3d9710af32c06b1b152231c3883c4b.exe windows x86
3324cf5edd25245ec601d3e268d52b54
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
outlooksyncengine
?BulkCreateItem@OutlookDataStore@@MAEJAAV?$vector@PAVItemBase@@V?$allocator@PAVItemBase@@@std@@@std@@AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@AAV?$vector@_NV?$allocator@_N@std@@@3@@Z
?RegisterCallback@OutlookDataStore@@MAEXUDSCallback@@@Z
?SyncRun@SyncStarter@@QAEJPBUSyncStarterParm@@_N@Z
?GetLastError@OutlookDataStore@@MAE?AW4DSErrCode@@XZ
?get_dsID@OutlookDataStore@@MAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
??0SyncStarter@@QAE@XZ
?FindDuplication@DeviceDataStore@@MAEPAVItemBase@@PAV2@_N@Z
??1SyncStarter@@QAE@XZ
?PrepareDupChk@DeviceDataStore@@MAEHAAV?$vector@V?$smart_ptr@VDuplItem@@@yasper@@V?$allocator@V?$smart_ptr@VDuplItem@@@yasper@@@std@@@std@@@Z
??0OlContactDataStore@@QAE@XZ
?RegisterCallback@DeviceDataStore@@MAEXUDSCallback@@@Z
?GetLastError@DeviceDataStore@@MAE?AW4DSErrCode@@XZ
?QueryInterface@DeviceDataStore@@MAGJABU_GUID@@PAPAX@Z
?AddRef@DeviceDataStore@@MAGKXZ
?get_dsID@DeviceDataStore@@MAE?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ
?Release@DeviceDataStore@@MAGKXZ
?Init@DevContactDataStore@@UAEHPAX@Z
?PostItemAction@DevContactDataStore@@MAEHW4ITEMACTION@DeviceDataStore@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$_com_ptr_t@V?$_com_IIID@UIItem@@$1?_GUID_1738da9e_76c3_4b87_bdc4_94fb92cb9d18@@3U__s_GUID@@B@@@@@Z
?PrepareDupChk@OutlookDataStore@@MAEHAAV?$vector@V?$smart_ptr@VDuplItem@@@yasper@@V?$allocator@V?$smart_ptr@VDuplItem@@@yasper@@@std@@@std@@@Z
?BulkDeleteItem@OutlookDataStore@@MAEJAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@AAV?$vector@_NV?$allocator@_N@std@@@3@@Z
?GetAllItems@DevContactDataStore@@MAEJXZ
?GetDSType@OlContactDataStore@@UAE?AW4DataStoreType@@XZ
?SupportBulkOperation@OutlookDataStore@@MAEHXZ
?SupportBulkOperation@DeviceDataStore@@MAEHXZ
?IsInFilter@OlContactDataStore@@UAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?BulkDeleteItem@DeviceDataStore@@MAEJAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@AAV?$vector@_NV?$allocator@_N@std@@@3@@Z
?GetMetaKeyField@OlContactDataStore@@UAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAJAAUMetaKeyField@@@Z
?BulkUpdateItem@DeviceDataStore@@MAEJAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@AAV?$vector@PAVItemBase@@V?$allocator@PAVItemBase@@@std@@@3@AAV?$vector@_NV?$allocator@_N@std@@@3@@Z
?GetMetaKeyFields@OlContactDataStore@@UAEHAAJAAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$smart_ptr@UMetaKeyField@@@yasper@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$smart_ptr@UMetaKeyField@@@yasper@@@std@@@2@@std@@@Z
?BulkCreateItem@DeviceDataStore@@MAEJAAV?$vector@PAVItemBase@@V?$allocator@PAVItemBase@@@std@@@std@@AAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@3@AAV?$vector@_NV?$allocator@_N@std@@@3@@Z
?GetIds@OlContactDataStore@@UAEHAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
?GetDSType@DevContactDataStore@@UAE?AW4DataStoreType@@XZ
?GetItem@OlContactDataStore@@UAEPAVItemBase@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?IsInFilter@DevContactDataStore@@UAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?DeleteItem@OlContactDataStore@@UAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?GetMetaKeyField@DevContactDataStore@@UAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAJAAUMetaKeyField@@@Z
?UpdateItem@OlContactDataStore@@UAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBVItemBase@@@Z
??1DevContactDataStore@@UAE@XZ
?GetMetaKeyFields@DevContactDataStore@@UAEHAAJAAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$smart_ptr@UMetaKeyField@@@yasper@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$smart_ptr@UMetaKeyField@@@yasper@@@std@@@2@@std@@@Z
?CreateItem@OlContactDataStore@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBVItemBase@@@Z
??0DevContactDataStore@@QAE@XZ
?GetIds@DevContactDataStore@@UAEHAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@@Z
?Exit@OlContactDataStore@@UAEHXZ
?GetItem@DevContactDataStore@@UAEPAVItemBase@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Init@OlContactDataStore@@UAEHPAX@Z
?DeleteItem@DevContactDataStore@@UAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?Release@OutlookDataStore@@MAGKXZ
?UpdateItem@DevContactDataStore@@UAEHV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBVItemBase@@@Z
?MakeMD5String_KeyFields@OlContactDataStore@@MAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAVItemBase@@@Z
?BulkUpdateItem@OutlookDataStore@@MAEJAAV?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$allocator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@@std@@AAV?$vector@PAVItemBase@@V?$allocator@PAVItemBase@@@std@@@3@AAV?$vector@_NV?$allocator@_N@std@@@3@@Z
?Item2IItem@DevContactDataStore@@MAEHPAVItemBase@@V?$_com_ptr_t@V?$_com_IIID@UIItem@@$1?_GUID_1738da9e_76c3_4b87_bdc4_94fb92cb9d18@@3U__s_GUID@@B@@@@@Z
?FindDuplication@OutlookDataStore@@MAEPAVItemBase@@PAV2@_N@Z
?AddRef@OutlookDataStore@@MAGKXZ
?CreateItem@DevContactDataStore@@UAE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PBVItemBase@@@Z
?QueryInterface@OutlookDataStore@@MAGJABU_GUID@@PAPAX@Z
?Exit@DevContactDataStore@@UAEHXZ
??1OlContactDataStore@@UAE@XZ
mfc80u
ord764
ord762
msvcr80
_unlock
_crt_debugger_hook
__dllonexit
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
__winitenv
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
printf
getchar
_lock
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_CxxThrowException
__CxxFrameHandler3
?_type_info_dtor_internal_method@type_info@@QAEXXZ
kernel32
HeapFree
GetProcessHeap
Sleep
InterlockedExchange
InterlockedCompareExchange
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
ole32
CoUninitialize
CoInitialize
msvcp80
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
Sections
.text Size: 8KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE