Static task
static1
Behavioral task
behavioral1
Sample
05c84d168405072f5174eba3807dccb9f25af144f1db46957addb2951d4139d6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
05c84d168405072f5174eba3807dccb9f25af144f1db46957addb2951d4139d6.exe
Resource
win10v2004-20220812-en
General
-
Target
05c84d168405072f5174eba3807dccb9f25af144f1db46957addb2951d4139d6
-
Size
1.2MB
-
MD5
93e49c23e21e8eebf947504943695c39
-
SHA1
15046813441d3e50a7da4aa5507b5d12425f024f
-
SHA256
05c84d168405072f5174eba3807dccb9f25af144f1db46957addb2951d4139d6
-
SHA512
eccfc55fd6a845bcbdd4146eb7a4b00d38c62d0795006216ad555b081f2784bd0a6fb338a9d533d3808979034071c09351d0572221006e94276548cf094ae0d0
-
SSDEEP
24576:R/dZ/lHj63uw021Ttm2B6gzpAARW5Ueu+iM1r4PGb58sEs0/SVsbOVrY:pND63H02W2LzpAu9eFisMOaqsCVs
Malware Config
Signatures
Files
-
05c84d168405072f5174eba3807dccb9f25af144f1db46957addb2951d4139d6.exe windows x86
a5bd107e668556e4394974399d4a10ef
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegGetValueW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
GetSecurityDescriptorOwner
GetSecurityDescriptorDacl
RegEnumValueW
ImpersonateLoggedOnUser
OpenThreadToken
RevertToSelf
DuplicateToken
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
CryptGenRandom
ConvertSidToStringSidW
LookupPrivilegeValueW
GetTokenInformation
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
CloseServiceHandle
RegisterTraceGuidsW
GetTraceLoggerHandle
TraceEvent
UnregisterTraceGuids
DuplicateTokenEx
ConvertStringSidToSidW
SetTokenInformation
AdjustTokenPrivileges
CreateProcessAsUserW
CryptCreateHash
CryptHashData
CryptGetHashParam
CryptDestroyHash
CryptAcquireContextW
CryptReleaseContext
CreateWellKnownSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
SetNamedSecurityInfoW
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
SetSecurityInfo
CopySid
IsValidSid
GetLengthSid
InitializeAcl
AddAce
GetUserNameW
kernel32
MapViewOfFile
UnmapViewOfFile
CreateEventW
ResetEvent
InterlockedCompareExchange
InterlockedExchangeAdd
OpenMutexW
SetFileAttributesW
RemoveDirectoryW
MoveFileExW
GetFileAttributesW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
GetPrivateProfileStringW
ReleaseMutex
WritePrivateProfileStringW
DeviceIoControl
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW
CreateFileMappingW
GetFileSize
GetTempFileNameW
CreateFileW
DeleteFileW
EnumResourceNamesW
FindResourceExW
LockResource
GetComputerNameExW
SetEnvironmentVariableA
ReadFile
GetExitCodeProcess
CreateProcessW
CopyFileW
CompareStringA
FlushFileBuffers
CreateFileA
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
SetFilePointer
InitializeCriticalSectionAndSpinCount
LoadLibraryA
HeapSize
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapDestroy
HeapCreate
GetCurrentThread
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineW
IsProcessorFeaturePresent
FreeEnvironmentStringsW
GetModuleFileNameA
GetStdHandle
WriteFile
ExitProcess
SetUnhandledExceptionFilter
VirtualQuery
GetSystemInfo
VirtualAlloc
VirtualProtect
HeapReAlloc
HeapAlloc
HeapFree
GetStartupInfoW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
InterlockedExchange
RaiseException
lstrlenW
InterlockedDecrement
LocalFree
GetLastError
FormatMessageW
CompareStringW
CloseHandle
ExitThread
GetModuleHandleA
GetShortPathNameW
QueueUserWorkItem
CreateSemaphoreW
ReleaseSemaphore
WaitForMultipleObjects
ExpandEnvironmentStringsW
VerifyVersionInfoW
SetEnvironmentVariableW
GetEnvironmentVariableW
FlushInstructionCache
TerminateThread
SetWaitableTimer
GetTempPathW
GetExitCodeThread
CreateWaitableTimerW
GlobalFree
GetFullPathNameW
OpenProcess
GetLocalTime
GetLocaleInfoEx
CreateMutexW
CreateNamedPipeW
WaitForSingleObject
CompareFileTime
GetSystemTimeAsFileTime
GetNamedPipeServerProcessId
QueryFullProcessImageNameW
FreeLibraryAndExitThread
DuplicateHandle
FreeResource
GetThreadPriority
FileTimeToSystemTime
GetLongPathNameW
OpenFileMappingW
CreateThread
GetModuleFileNameW
GetProcAddress
LoadLibraryW
SetFilePointerEx
GetSystemTime
SystemTimeToFileTime
GetProcessHeap
GetUserDefaultLocaleName
InterlockedIncrement
GetModuleHandleW
lstrcmpiW
LoadLibraryExW
GetCurrentProcessId
GetSystemDirectoryW
Sleep
HeapSetInformation
MultiByteToWideChar
FileTimeToLocalFileTime
SizeofResource
LoadResource
GetNativeSystemInfo
GetProductInfo
GetFileAttributesExW
CreateTimerQueueTimer
DeleteTimerQueueTimer
WaitForMultipleObjectsEx
GetComputerNameW
GetSystemDefaultLocaleName
GlobalMemoryStatusEx
GetFileSizeEx
WerRegisterFile
GetVersionExW
GetSystemDefaultUILanguage
GetSystemDefaultLCID
GetTempPathA
GetFullPathNameA
DeleteFileA
GetFileInformationByHandle
FindResourceW
SetLastError
LocalAlloc
SetEvent
OpenEventW
MulDiv
lstrlenA
GetFileAttributesA
FileTimeToDosDateTime
GetEnvironmentStringsW
SetThreadPriority
gdi32
GetStockObject
GetTextMetricsW
SetBkColor
DeleteDC
BitBlt
SetBkMode
SetTextColor
CreateSolidBrush
GetObjectW
CreateFontIndirectW
CreateCompatibleBitmap
CreateCompatibleDC
CreatePen
Rectangle
GetDeviceCaps
GetTextExtentPoint32W
ExcludeClipRect
IntersectClipRect
GetClipRgn
CreateRectRgn
CreateRoundRectRgn
SelectObject
DeleteObject
RestoreDC
SetLayout
SaveDC
user32
DestroyAcceleratorTable
IsDialogMessageW
TranslateAcceleratorW
GetMessageW
CreateAcceleratorTableW
BringWindowToTop
GetNextDlgTabItem
EndPaint
InflateRect
RedrawWindow
MapDialogRect
GetLayeredWindowAttributes
SetLayeredWindowAttributes
PostQuitMessage
DestroyWindow
PostMessageW
GetSystemMetrics
GetWindowTextLengthW
GetWindowTextW
GetClassNameW
SystemParametersInfoW
GetSysColor
IsWindowVisible
EnableWindow
GetParent
ShowWindow
GetWindowLongW
AdjustWindowRectEx
FillRect
DrawTextW
LoadIconW
ReleaseDC
GetDC
EndDialog
SendMessageW
GetClientRect
GetWindowInfo
SendNotifyMessageW
RegisterWindowMessageW
LoadStringW
KillTimer
BeginPaint
MapWindowPoints
SetWindowLongW
ChangeWindowMessageFilter
IsWindowEnabled
UpdateWindow
PtInRect
GetClassInfoExW
DefWindowProcW
RegisterClassExW
CallWindowProcW
GetAncestor
SetWindowPlacement
DefDlgProcW
EnumChildWindows
CreateDialogIndirectParamW
DialogBoxIndirectParamW
EnableScrollBar
SetScrollInfo
GetScrollPos
GetScrollInfo
IntersectRect
GetScrollRange
GetFocus
TrackMouseEvent
EnableMenuItem
GetSystemMenu
DrawFocusRect
GetDCEx
ScreenToClient
WindowFromPoint
PostThreadMessageW
GetShellWindow
MsgWaitForMultipleObjects
CreateWindowExW
NotifyWinEvent
MoveWindow
InvalidateRect
SetWindowTextW
SetWindowPos
SetWindowRgn
SetRect
PeekMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
DispatchMessageW
IsWindow
GetDesktopWindow
GetWindowPlacement
CopyRect
GetWindowRect
LoadCursorW
SetCursor
ExitWindowsEx
GetWindowThreadProcessId
SetFocus
CharNextW
SetProcessDefaultLayout
SetTimer
UnregisterClassA
sensapi
IsNetworkAlive
urlmon
CreateAsyncBindCtx
CoInternetGetSession
CreateURLMoniker
msi
ord173
ord270
ord195
ord150
ord266
ord48
ord171
ord92
ord32
ord205
ord113
ord190
ord141
ord254
ord70
ord203
ord118
ord115
ord116
ord88
ord240
ord8
ord286
ord285
ord160
ord159
ord78
comctl32
ord17
wintrust
WTHelperGetProvSignerFromChain
WTHelperProvDataFromStateData
WinVerifyTrustEx
userenv
UnloadUserProfile
secur32
GetUserNameExW
crypt32
CryptBinaryToStringW
CertVerifyCertificateChainPolicy
CryptStringToBinaryW
uxtheme
SetWindowTheme
psapi
EnumProcesses
shlwapi
SHCreateStreamOnFileW
StrRChrW
PathFindFileNameW
StrRChrA
StrStrA
SHSetValueW
SHCreateStreamOnFileA
PathFileExistsW
SHDeleteValueW
SHDeleteKeyW
PathIsDirectoryW
PathIsRelativeW
PathFindExtensionW
StrStrIW
PathCombineW
SHCreateStreamOnFileEx
SHGetValueW
PathAppendW
PathRemoveFileSpecW
UrlCanonicalizeW
PathStripToRootW
UrlCreateFromPathW
PathCreateFromUrlW
PathFindFileNameA
StrCmpNIW
PathStripPathW
PathUnquoteSpacesW
PathRemoveArgsW
StrCmpNW
ord437
wininet
InternetCreateUrlW
InternetCrackUrlW
InternetCombineUrlW
InternetQueryOptionW
gdiplus
GdipDrawImageRectRect
GdipCloneImage
GdipGetLogFontW
GdipDeleteFontFamily
GdipCreateFontFamilyFromName
GdipAlloc
GdipFree
GdipDrawImageRectRectI
GdipCreateFromHDC
GdipGetImageHeight
GdipCreateFont
GdipCreateFromHWND
GdipDisposeImage
GdipDeleteFont
GdipCreateBitmapFromStream
GdipGetImageWidth
GdipDeleteGraphics
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromStreamICM
GdipDrawImagePointRectI
GdipDrawImageRectI
GdipDrawImageI
winhttp
WinHttpOpen
WinHttpWriteData
WinHttpAddRequestHeaders
WinHttpTimeFromSystemTime
WinHttpSetCredentials
WinHttpCloseHandle
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpQueryOption
WinHttpSetStatusCallback
WinHttpQueryHeaders
WinHttpReadData
WinHttpSendRequest
WinHttpOpenRequest
WinHttpConnect
WinHttpCrackUrl
WinHttpGetIEProxyConfigForCurrentUser
WinHttpGetDefaultProxyConfiguration
WinHttpDetectAutoProxyConfigUrl
WinHttpGetProxyForUrl
WinHttpSetTimeouts
cabinet
ord11
ord10
ord14
ord13
ntdll
RtlAllocateHeap
RtlFreeHeap
NtQuerySystemTime
VerSetConditionMask
RtlUnwind
oleacc
AccessibleObjectFromWindow
LresultFromObject
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
wer
WerReportCloseHandle
WerReportSubmit
WerReportAddFile
WerReportSetParameter
WerReportSetUIOption
WerReportCreate
rstrtmgr
RmCancelCurrentTask
RmRestart
RmEndSession
RmStartSession
RmAddFilter
RmRegisterResources
RmShutdown
wsock32
inet_addr
gethostbyname
WSACleanup
WSAGetLastError
WSAStartup
shell32
ord43
SHGetKnownFolderPath
SHGetFolderPathW
CommandLineToArgvW
ShellExecuteExW
SHGetSpecialFolderPathW
SHGetFolderPathAndSubDirW
ord165
SHCreateDirectoryExW
ole32
CreateStreamOnHGlobal
CoInitialize
StringFromGUID2
CoCreateGuid
CoQueryProxyBlanket
CoCopyProxy
CoRegisterClassObject
CoInitializeSecurity
CoSetProxyBlanket
CoRevokeClassObject
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoInitializeEx
CoUninitialize
CoCreateInstance
CoCreateFreeThreadedMarshaler
oleaut32
SysFreeString
LoadTypeLi
LoadRegTypeLi
VariantCopy
SysAllocStringLen
VariantChangeType
LoadTypeLibEx
SysStringLen
VariantClear
VariantInit
VarUI4FromStr
SysAllocString
Sections
.text Size: 875KB - Virtual size: 874KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 16KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 228KB - Virtual size: 228KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.5data Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE