Behavioral task
behavioral1
Sample
230ff27a9f26d7f02c5d47ae0befb243f7e048068abebcfd3017583702ab843b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
230ff27a9f26d7f02c5d47ae0befb243f7e048068abebcfd3017583702ab843b.exe
Resource
win10v2004-20220901-en
General
-
Target
230ff27a9f26d7f02c5d47ae0befb243f7e048068abebcfd3017583702ab843b
-
Size
176KB
-
MD5
93d2bcc627d493aa5ece2a18c69a80d0
-
SHA1
ea83adda896e6bcbbe7f1717a5206d4498f05db2
-
SHA256
230ff27a9f26d7f02c5d47ae0befb243f7e048068abebcfd3017583702ab843b
-
SHA512
07f2f9b0f58ee71cfc1cf6c2fa9aac0fdd6a982c9fe616442de9aecc8facc92778d4be65c3e710901d18181de84f8286ceebda66e66e7667d15fdfe4e1def20e
-
SSDEEP
3072:b791jseYPF7ttxgRQnsNW87O05YHdpngwUY:L3YPxR9nsN7O05YPR
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
230ff27a9f26d7f02c5d47ae0befb243f7e048068abebcfd3017583702ab843b.exe windows x86
b8077d520cd30b046749e1483d205507
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetCommandLineA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
EnterCriticalSection
LeaveCriticalSection
CreateThread
ReadFile
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
GetPrivateProfileIntA
Sleep
GetLocalTime
LoadLibraryA
GetProcAddress
GetFileAttributesA
GetSystemTime
lstrcpyA
GetModuleHandleA
LoadLibraryExA
FindResourceA
LoadResource
SizeofResource
FreeLibrary
InterlockedDecrement
InterlockedIncrement
IsDBCSLeadByte
GetCurrentThreadId
lstrcmpiA
lstrlenA
GetModuleFileNameA
GetCurrentProcess
CloseHandle
GetLastError
DeleteCriticalSection
InitializeCriticalSection
RaiseException
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
SetFilePointer
HeapAlloc
HeapFree
VirtualProtect
VirtualAlloc
GetSystemInfo
VirtualQuery
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
HeapReAlloc
GetProcessHeap
GetStartupInfoA
GetCPInfo
GetOEMCP
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
VirtualFree
HeapDestroy
HeapCreate
ExitProcess
WriteFile
GetStdHandle
SetHandleCount
GetFileType
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
user32
CharUpperA
MessageBoxA
TranslateMessage
CharNextA
LoadStringA
UnregisterClassA
PostThreadMessageA
GetMessageA
DispatchMessageA
advapi32
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserA
OpenSCManagerW
ChangeServiceConfigA
ChangeServiceConfig2A
RegEnumKeyExA
RegQueryInfoKeyA
RegisterEventSourceA
ReportEventA
DeregisterEventSource
RegSetValueExA
ControlService
DeleteService
CreateServiceA
RegQueryValueExA
RegOpenKeyExA
RegCreateKeyExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
SetServiceStatus
OpenSCManagerA
OpenServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
ole32
CoTaskMemFree
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
shell32
SHGetSpecialFolderPathA
oleaut32
VarUI4FromStr
Sections
.text Size: 80KB - Virtual size: 76KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE