Static task
static1
Behavioral task
behavioral1
Sample
4a30733eeeea2452f34b95c675522063ba7c855b29ba76f11ca8b4570e265164.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4a30733eeeea2452f34b95c675522063ba7c855b29ba76f11ca8b4570e265164.exe
Resource
win10v2004-20220812-en
General
-
Target
4a30733eeeea2452f34b95c675522063ba7c855b29ba76f11ca8b4570e265164
-
Size
788KB
-
MD5
8487403b0e341f0d91739d1da978e8d0
-
SHA1
d7b90d52d011b3999833cfdcf3c4d6ce057e952b
-
SHA256
4a30733eeeea2452f34b95c675522063ba7c855b29ba76f11ca8b4570e265164
-
SHA512
b217a7bb6540edb17cc8b0bf038f4922c7147091e123e9a87184af9fba15ebf0d026c075c0fc6b983eb2446967c9a1c7cde43c56e045af82957313fafed8c659
-
SSDEEP
12288:v7Tk2qpElEw4YVRLxt0FaC+P8P+bunclgNdwqfb69W:zo2qpm5VRLIX+buclU2sO9W
Malware Config
Signatures
Files
-
4a30733eeeea2452f34b95c675522063ba7c855b29ba76f11ca8b4570e265164.exe windows x64
4f8f0ef8f33e2fedd429cfe846d3e3f5
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
advapi32
RegQueryValueExW
RegCloseKey
RegSetValueExW
RegDeleteValueW
RegCreateKeyExW
RegOpenKeyExW
kernel32
GetVersionExW
CreateEventW
CloseHandle
GetLocalTime
CreateFileW
WideCharToMultiByte
WriteFile
CreateDirectoryW
lstrlenA
GetProductInfo
SetFilePointer
SetLastError
MulDiv
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
SystemTimeToFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
MultiByteToWideChar
GetProcessHeap
HeapAlloc
LocalFree
GlobalFree
LoadLibraryExW
FreeLibrary
lstrcmpiW
ExpandEnvironmentStringsW
GetUserDefaultUILanguage
GetLastError
LoadLibraryW
GetSystemTime
GetSystemTimeAsFileTime
GetProcAddress
gdi32
GetDeviceCaps
DeleteObject
user32
SetForegroundWindow
GetMessageW
AllowSetForegroundWindow
SetProcessDPIAware
GetWindowPlacement
ShowWindow
LoadIconW
DispatchMessageW
PostQuitMessage
SendMessageW
LoadImageW
IsProcessDPIAware
GetDC
ReleaseDC
PostMessageW
CallWindowProcW
SystemParametersInfoW
LoadStringW
SetWindowLongPtrW
FindWindowW
TranslateMessage
msvcrt
_amsg_exit
_initterm
_acmdln
__C_specific_handler
__getmainargs
exit
_cexit
_ismbblead
_XcptFilter
_vsnwprintf
??2@YAPEAX_K@Z
??3@YAXPEAX@Z
__setusermatherr
memset
?terminate@@YAXXZ
__set_app_type
_fmode
_commode
_exit
ntdll
RtlVirtualUnwind
WinSqmAddToStream
WinSqmEndSession
WinSqmIsOptedIn
RtlCaptureContext
RtlLookupFunctionEntry
WinSqmStartSession
WinSqmSetDWORD
ole32
CoUninitialize
CoCreateInstance
CoInitialize
oleaut32
SysFreeString
SysAllocString
shell32
ShellExecuteW
ShellExecuteExW
uxtheme
SetWindowThemeAttribute
dui70
?FireEvent@Element@DirectUI@@QEAAXPEAUEvent@2@_N1@Z
?KeyboardNavigate@Element@DirectUI@@SA?AVUID@@XZ
?SetSelected@Element@DirectUI@@QEAAJ_N@Z
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHICON__@@_N11@Z
?Remove@Element@DirectUI@@QEAAJPEAV12@@Z
?RemoveListener@Element@DirectUI@@QEAAXPEAUIElementListener@2@@Z
?GetContentString@Element@DirectUI@@QEAAPEBGPEAPEAVValue@2@@Z
?SetAccName@Element@DirectUI@@QEAAJPEBG@Z
?Release@Value@DirectUI@@QEAAXXZ
?ContentProp@Element@DirectUI@@SAPEBUPropertyInfo@2@XZ
?SetValue@Element@DirectUI@@QEAAJP6APEBUPropertyInfo@2@XZHPEAVValue@2@@Z
?CreateGraphic@Value@DirectUI@@SAPEAV12@PEAUHBITMAP__@@EI_N11@Z
?SetEnabled@Element@DirectUI@@QEAAJ_N@Z
?StartDefer@Element@DirectUI@@QEAAXPEAK@Z
?DestroyWindow@NativeHWNDHost@DirectUI@@QEAAXXZ
?Destroy@Element@DirectUI@@QEAAJ_N@Z
?Click@Button@DirectUI@@SA?AVUID@@XZ
??1NativeHWNDHost@DirectUI@@UEAA@XZ
??0NativeHWNDHost@DirectUI@@QEAA@XZ
?EndDefer@Element@DirectUI@@QEAAXK@Z
?AddListener@Element@DirectUI@@QEAAJPEAUIElementListener@2@@Z
?SetContentString@Element@DirectUI@@QEAAJPEBG@Z
StrToID
?FindDescendent@Element@DirectUI@@QEAAPEAV12@G@Z
?Add@Element@DirectUI@@QEAAJPEAV12@@Z
?LoadFromResource@DUIFactory@DirectUI@@QEAAJPEAUHINSTANCE__@@PEBG1PEAVElement@2@PEAKPEAPEAV42@1@Z
??1DUIFactory@DirectUI@@QEAA@XZ
?SetAccessible@Element@DirectUI@@QEAAJ_N@Z
?SetVisible@Element@DirectUI@@QEAAJ_N@Z
?SetLayout@Element@DirectUI@@QEAAJPEAVLayout@2@@Z
?Create@BorderLayout@DirectUI@@SAJPEAPEAVLayout@2@@Z
?Host@NativeHWNDHost@DirectUI@@QEAAXPEAVElement@2@@Z
?Create@HWNDElement@DirectUI@@SAJPEAUHWND__@@_NIPEAVElement@2@PEAKPEAPEAV42@@Z
?Initialize@NativeHWNDHost@DirectUI@@QEAAJPEBG0PEAUHWND__@@PEAUHICON__@@HHHHHHPEAUHINSTANCE__@@I@Z
UnInitProcessPriv
UnInitThread
?Destroy@NativeHWNDHost@DirectUI@@QEAAXXZ
InitThread
InitProcessPriv
winbrand
BrandingFormatString
BrandingLoadImage
BrandingLoadString
Sections
.text Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 512B - Virtual size: 492B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 243KB - Virtual size: 243KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 600B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vmp0 Size: 500KB - Virtual size: 1.8MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE