Static task
static1
Behavioral task
behavioral1
Sample
5d6b21e1ba217184c056556bf35aa7cf5ca207a6633765c97ffb0a427f104e59.exe
Resource
win7-20220812-en
General
-
Target
5d6b21e1ba217184c056556bf35aa7cf5ca207a6633765c97ffb0a427f104e59
-
Size
924KB
-
MD5
92b4771340ee29491b03a0c0981c3ee6
-
SHA1
0c6ba13d001d942b2422080d5f7a2aea9cfd47e8
-
SHA256
5d6b21e1ba217184c056556bf35aa7cf5ca207a6633765c97ffb0a427f104e59
-
SHA512
7268402fe3d5456f0d5d6280301355bd9ee70f8ab635f80c53b8614bfd050f855c3fe9c7ce9e35e220740b25fb069ba6861960d26752e4695712878fdb91544e
-
SSDEEP
12288:YnJcI2fLcSsZaFcWpiFbQbpIpYVwj8xVVsGgHIBMt3:A+dYVZE0lQpIpYVwEVVsGgHT
Malware Config
Signatures
Files
-
5d6b21e1ba217184c056556bf35aa7cf5ca207a6633765c97ffb0a427f104e59.exe windows x86
da4720762ebc28cb497ab27780a8e399
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetEvent
EnterCriticalSection
LeaveCriticalSection
ResetEvent
DeleteCriticalSection
CreateEventW
WaitForSingleObject
InitializeCriticalSection
LoadLibraryExW
FreeLibrary
LoadLibraryW
GetProcAddress
CreateMutexW
ReleaseMutex
MoveFileExW
GetModuleFileNameA
FindFirstFileA
FindClose
CreateFileA
ReadFile
GetWindowsDirectoryW
CopyFileW
DeleteFileW
GetTempPathW
GetSystemWindowsDirectoryW
GetSystemDirectoryW
GetCurrentDirectoryW
CreateFileW
MoveFileW
GetModuleFileNameW
GetCommandLineW
lstrcpynW
CompareStringW
GetExitCodeThread
QueryDosDeviceW
GetVersion
GetDriveTypeW
SetErrorMode
GetLocaleInfoW
GetUserDefaultLangID
DeviceIoControl
LoadLibraryA
GetProcessHeap
HeapAlloc
HeapFree
GetProfileStringW
WriteProfileStringW
GlobalAlloc
GlobalLock
GlobalUnlock
CreateThread
lstrlenA
DeleteFileA
InterlockedDecrement
InterlockedIncrement
ExpandEnvironmentStringsW
GetLongPathNameW
OpenEventW
WritePrivateProfileStringW
GetLocalTime
lstrlenW
LocalAlloc
LocalFree
Sleep
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetFilePointer
SetEndOfFile
GetSystemDefaultLangID
GlobalFree
WideCharToMultiByte
FindFirstFileW
FindNextFileW
GetShortPathNameW
GetWindowsDirectoryA
GetModuleHandleA
CreateProcessW
WaitForMultipleObjects
GetExitCodeProcess
GetDiskFreeSpaceExW
SetFileAttributesW
GetFileTime
FileTimeToSystemTime
GetTimeZoneInformation
GetModuleHandleW
GetVersionExA
GetVersionExW
GetFileAttributesW
GetFileAttributesA
SetCurrentDirectoryW
GetUserDefaultLCID
GetUserGeoID
GetTempPathA
CreateDirectoryW
RemoveDirectoryW
GetPrivateProfileStringW
SetLastError
GetFileSize
WriteFile
MultiByteToWideChar
GetStartupInfoA
CloseHandle
GetLastError
msvcrt
wcsrchr
wcsstr
wcschr
??2@YAPAXI@Z
??3@YAXPAX@Z
_wcsicmp
wcslen
swscanf
_wcslwr
_beginthreadex
_wtol
_wcsnicmp
_vsnprintf
_endthread
_c_exit
_exit
_XcptFilter
_cexit
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__dllonexit
_onexit
wcsncpy
_snwprintf
iswspace
wcsncmp
wcspbrk
iswdigit
towupper
iswalpha
strpbrk
_strlwr
_stricmp
iswalnum
_wcsupr
ceil
wcstol
calloc
strchr
memmove
wcscmp
malloc
free
_itow
wcstok
_vsnwprintf
strrchr
strstr
_purecall
_wtoi
time
advapi32
RegCreateKeyExW
LookupPrivilegeValueW
InitiateSystemShutdownExW
CloseServiceHandle
QueryServiceStatus
EnumDependentServicesW
ControlService
OpenServiceW
OpenSCManagerW
StartServiceW
CreateServiceW
DeleteService
QueryServiceConfigW
RegOpenKeyExA
OpenProcessToken
RegEnumKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegDeleteValueW
RegSetValueExW
AdjustTokenPrivileges
RegQueryValueExW
RegCloseKey
RegQueryValueExA
FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
gdi32
SelectObject
SetMapMode
CreateCompatibleDC
GetStockObject
GetDeviceCaps
CreateSolidBrush
SetTextColor
GetObjectW
SetBkColor
DeleteObject
CreateFontIndirectW
PatBlt
CreatePen
GetTextMetricsW
CreateFontA
GetTextFaceA
ExtTextOutW
SetBkMode
DeleteDC
user32
PeekMessageW
PostThreadMessageW
SetCursor
CallWindowProcW
DrawTextW
LoadCursorW
DestroyCursor
GetScrollInfo
SetScrollInfo
ScrollWindow
GetActiveWindow
GetMessageW
IsDialogMessageW
TranslateMessage
DispatchMessageW
LoadIconW
UpdateWindow
IsWindow
BeginPaint
CreateDialogParamW
LoadImageW
GetWindowLongW
SetWindowLongW
EndPaint
PostQuitMessage
InvalidateRect
GetSystemMetrics
SendDlgItemMessageW
DestroyWindow
CreateWindowExW
SetWindowTextA
FindWindowExW
GetSystemMenu
EnableMenuItem
MessageBoxW
ScreenToClient
SetWindowPos
PostMessageW
EnableWindow
LoadStringW
SetWindowTextW
ShowWindow
GetDlgItem
GetDC
DrawFocusRect
ReleaseDC
DefWindowProcW
GetWindowRect
GetParent
MapWindowPoints
MoveWindow
SetFocus
SendMessageW
FindWindowW
GetDesktopWindow
RegisterClassW
MsgWaitForMultipleObjects
UnregisterClassW
CharNextA
IsCharAlphaW
SetTimer
KillTimer
GetClientRect
LoadStringA
ole32
CreateStreamOnHGlobal
CoUninitialize
CoInitialize
CoCreateInstance
CLSIDFromString
OleInitialize
OleUninitialize
comctl32
InitCommonControlsEx
shell32
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHGetFolderLocation
ShellExecuteW
SHChangeNotify
ShellExecuteExW
CommandLineToArgvW
wininet
InternetCrackUrlW
setupapi
SetupCloseInfFile
SetupFindNextLine
SetupGetStringFieldW
SetupGetLineCountW
SetupFindFirstLineW
SetupGetLineTextW
SetupGetBinaryField
SetupInstallFromInfSectionW
SetupIterateCabinetA
wintrust
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain
wsock32
getsockopt
socket
select
WSAGetLastError
connect
htons
inet_ntoa
ioctlsocket
__WSAFDIsSet
WSAStartup
WSACleanup
WSAAsyncGetHostByName
WSACancelAsyncRequest
closesocket
urlmon
ObtainUserAgentString
UrlMkSetSessionOption
shlwapi
PathAddBackslashW
PathAddBackslashA
PathFindExtensionW
PathFindFileNameW
SHDeleteKeyW
PathGetCharTypeA
PathGetCharTypeW
crypt32
CertVerifyCertificateChainPolicy
oleaut32
SysAllocString
SysStringLen
SysAllocStringLen
SystemTimeToVariantTime
VariantTimeToSystemTime
SysFreeString
VariantInit
VariantClear
version
GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW
mpr
WNetCancelConnection2W
WNetAddConnection2W
WNetGetConnectionW
Sections
.text Size: 300KB - Virtual size: 298KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 484KB - Virtual size: 482KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.text Size: 124KB - Virtual size: 124KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE