Static task
static1
Behavioral task
behavioral1
Sample
89f63cbc28e017aa2dd3a58ebb45f10d1d3e3783eb2593969d8b4fb386b79c9c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
89f63cbc28e017aa2dd3a58ebb45f10d1d3e3783eb2593969d8b4fb386b79c9c.exe
Resource
win10v2004-20220812-en
General
-
Target
89f63cbc28e017aa2dd3a58ebb45f10d1d3e3783eb2593969d8b4fb386b79c9c
-
Size
244KB
-
MD5
93c23b4285c79aa4032405de0f7bc670
-
SHA1
dfdeb305b130dac72e9e5bde6a598e5ac7e23708
-
SHA256
89f63cbc28e017aa2dd3a58ebb45f10d1d3e3783eb2593969d8b4fb386b79c9c
-
SHA512
c8ab5321efdf608fb5e9f759d76dee385625f7aacfe2e9c99f23429984f6156be9009731eb35a781504d9e79f88965bf60f9accd78efe0891b3cfb3974144b7b
-
SSDEEP
3072:5DWgcAP9bfzKnuDnoKUgRKhIAEzVd8YsXpeS/rsQL+rOjd45i7dQz/RoRuJXM8RA:BWgc+CKUu2Nvrs5rOPaz5oSM8djgV7
Malware Config
Signatures
Files
-
89f63cbc28e017aa2dd3a58ebb45f10d1d3e3783eb2593969d8b4fb386b79c9c.exe windows x86
1ef6617c8aac0543e478b22aba53f8d1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpynW
InterlockedIncrement
InterlockedDecrement
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleHandleW
GetModuleFileNameW
GetTickCount
GetFileAttributesW
WaitForSingleObject
GetCurrentProcessId
CreateEventW
SetEvent
PostQueuedCompletionStatus
CreateIoCompletionPort
ReadDirectoryChangesW
DuplicateHandle
GetCurrentProcess
CancelIo
CreateFileW
GetQueuedCompletionStatus
Sleep
lstrcmpiW
lstrcatW
GetCurrentThreadId
CreateMutexW
SetLastError
GetCommandLineW
GetProcAddress
LocalFree
GetCurrentThread
OpenMutexW
GetLastError
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
GetModuleHandleA
ExitProcess
GetVersionExA
GetExitCodeThread
WideCharToMultiByte
InterlockedCompareExchange
IsBadReadPtr
GetEnvironmentVariableW
LoadLibraryW
OpenEventW
CloseHandle
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrcpyW
lstrlenW
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetACP
CreateThread
InterlockedExchange
LeaveCriticalSection
EnterCriticalSection
user32
GetMessageW
CharNextW
PostMessageW
RegisterWindowMessageW
KillTimer
DefWindowProcW
PostQuitMessage
TranslateMessage
SetTimer
CreateWindowExW
RegisterClassW
DestroyWindow
SetWindowLongW
GetWindowLongW
UnregisterClassW
CharUpperW
PostThreadMessageW
DispatchMessageW
MessageBoxW
advapi32
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
RegEnumKeyExW
RegQueryInfoKeyW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
RegQueryValueExW
OpenThreadToken
ole32
CoTaskMemRealloc
CoInitialize
CoUninitialize
CoRevokeClassObject
CoRegisterClassObject
StringFromGUID2
CoTaskMemFree
CoTaskMemAlloc
CoCreateInstance
oleaut32
SysAllocString
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysAllocStringLen
SysStringByteLen
SysAllocStringByteLen
SysStringLen
SysFreeString
ws2_32
inet_addr
shlwapi
SHRegWriteUSValueW
SHRegQueryUSValueW
UrlCreateFromPathW
SHRegDeleteUSValueW
SHRegCreateUSKeyW
SHRegCloseUSKey
PathFindExtensionW
PathRemoveBackslashW
PathFindFileNameW
PathAppendW
PathIsUNCW
PathCreateFromUrlW
UrlIsW
UrlCanonicalizeW
PathIsURLW
msvcp71
?_Nomemory@std@@YAXXZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD0@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AViterator@12@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IG@Z
?to_int_type@?$char_traits@D@std@@SAHABD@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??$?MGU?$char_traits@G@std@@V?$allocator@G@1@@std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
?clear@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAGI@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG0@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
msvcr71
realloc
_wcsdup
_wcsicmp
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_amsg_exit
_wcmdln
exit
_cexit
_XcptFilter
_exit
_c_exit
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
__security_error_handler
_callnewh
memset
_beginthreadex
_itow
isdigit
strchr
_snwprintf
_wtoi
wcslen
_vsnwprintf
memmove
wcsncpy
wprintf
_wcsnicmp
_wsplitpath
??_V@YAXPAX@Z
??0exception@@QAE@ABV0@@Z
__CxxFrameHandler
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_except_handler3
_CxxThrowException
free
malloc
??3@YAXPAX@Z
_purecall
Sections
.text Size: 92KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE