Static task
static1
Behavioral task
behavioral1
Sample
d5e07a3ee109a17e791fedd367b4082ccbcba50149e0be2c188466dd5baf9696.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d5e07a3ee109a17e791fedd367b4082ccbcba50149e0be2c188466dd5baf9696.exe
Resource
win10v2004-20220812-en
General
-
Target
d5e07a3ee109a17e791fedd367b4082ccbcba50149e0be2c188466dd5baf9696
-
Size
700KB
-
MD5
a376412cf5f8a73be9103becf8f87b08
-
SHA1
a247386ca698d472a395d12bfc9dcff3c0ad7196
-
SHA256
d5e07a3ee109a17e791fedd367b4082ccbcba50149e0be2c188466dd5baf9696
-
SHA512
ea963c87dd1e6327109d86c9121153d27c6af516c1c048385ee45b7fdbd5887f65b7f30632cebf3412237f3db71f806e49c9c678192fdfd84504e57749f4ca38
-
SSDEEP
12288:YnBT0jyNbc36W5hapn/jNpVJgsKCQDgw0g8WPeXWi8iSf+gCx8:Yt0jObc36Kw/hJlKCXuemi8iSf+xx8
Malware Config
Signatures
Files
-
d5e07a3ee109a17e791fedd367b4082ccbcba50149e0be2c188466dd5baf9696.exe windows x86
7e18607f33b80f89585db065f0ca77fb
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_AGGRESIVE_WS_TRIM
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
SizeofResource
LockResource
LoadResource
FindResourceA
FindResourceExA
WideCharToMultiByte
FreeLibrary
LoadLibraryA
lstrcatA
GetLastError
CloseHandle
CreateFileA
WriteFile
SetFilePointer
GetFileAttributesA
Sleep
CopyFileA
GetTickCount
lstrlenA
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
RaiseException
lstrcmpiA
lstrlenW
EnterCriticalSection
LeaveCriticalSection
lstrcpynA
lstrcpyA
GetModuleFileNameA
IsDBCSLeadByte
LoadLibraryExA
GetModuleHandleA
LocalAlloc
FormatMessageA
GetProcAddress
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetStartupInfoA
ExitProcess
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
LocalFree
user32
wsprintfA
PostThreadMessageA
TranslateMessage
DispatchMessageA
GetMessageA
CharNextA
ole32
CoCreateGuid
CoInitializeSecurity
CoRevokeClassObject
CoRegisterClassObject
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoResumeClassObjects
StringFromGUID2
CoDisconnectObject
CoSuspendClassObjects
OleRun
CoCreateInstance
oleaut32
VariantClear
SafeArrayPutElement
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
LoadTypeLi
SysAllocStringByteLen
SysFreeString
SysStringLen
SysAllocString
SafeArrayGetUBound
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayCreateVector
VariantInit
msvcp71
?_Nomemory@std@@YAXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?find_first_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?find_last_not_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??A?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEABGI@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
?end@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AViterator@12@XZ
?begin@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE?AViterator@12@XZ
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIPBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHPBG@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@G@Z
ccl40
ord1454
ord1487
ord1456
ord2079
ord2077
ord971
ord972
ord970
ord969
ord968
ord967
ord966
ord965
ord1683
ord1677
ord1676
ord1675
ord1674
ord1673
ord1672
ord1641
ord1640
ord1639
ord1638
ord1637
ord1636
ord1635
ord1634
ord1633
ord1632
ord1631
ord1630
ord1629
ord1628
ord1687
ord1551
ord894
ord1452
ord1006
ord962
ord1550
ord893
ord1450
ord1004
ord961
ord1334
ord325
ord2051
ord1662
ord1661
ord1658
ord896
ord1663
ord1660
ord1657
ord1667
ord1493
ord1499
ord2063
ord2052
ord2050
ord938
ord939
ord936
ord1258
ord1659
ord1656
ord1410
ord1403
ord1413
ord1409
ord1122
ord1306
ord1316
ord1313
ord1309
ord1304
ord1115
ord2115
ord1137
ord1333
ord2114
ord1558
ord1556
ord2040
ord1395
ord1852
ord1837
ord1855
ord1836
ord1853
ord1851
ord2021
ord2045
ord2044
ord2038
ord2017
ord1215
ord898
ord797
ord778
ord1214
ord1111
ord1112
ord1139
ord1124
ord1123
ord754
ord1114
ord1106
ord1108
ord753
ord1119
ord1121
ord1117
ord1118
ord1479
ord1417
ord1416
ord1415
ord1414
ord802
ord800
ord794
ord777
ord1915
ord1909
ord1669
ord1671
ord1787
ord1908
ord1907
ord1455
ord2011
ord1986
ord1987
ord1345
ord1344
ord1346
ord1343
ord1342
ord1985
ord1980
ord1976
ord160
ord142
ord1756
ord1771
ord1786
ord1802
ord964
ord144
ord1167
ord529
ord1092
ord1284
ord1754
ord1757
ord1761
ord1804
ord1755
ord1286
ord1295
ord1297
ord1299
ord1289
ord1301
ord1298
ord1303
ord1093
ord1689
ord493
ord1691
ord1769
ord1015
ord145
ord1034
ord1439
ord986
ord1014
ord1019
ord1024
ord1664
ord1026
ord1914
ord1922
ord1888
ord1887
ord1886
ord1877
ord1876
ord324
ord1178
ord1176
ord1174
ord1179
ord158
ord157
ord161
ord140
ord139
ord128
ord1166
ord842
ord143
ord1021
msvcr71
wcsncpy
realloc
memset
_callnewh
__security_error_handler
??1type_info@@UAE@XZ
__dllonexit
_onexit
?terminate@@YAXXZ
_c_exit
_exit
_XcptFilter
_ismbblead
_cexit
exit
_acmdln
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_resetstkoflw
free
malloc
??0exception@@QAE@ABQBD@Z
?what@exception@@UBEPBDXZ
_except_handler3
_mbsicmp
_ltow
_wtol
_ultow
towupper
??_V@YAXPAX@Z
towlower
_mbsinc
wcslen
wcscpy
??0exception@@QAE@ABV0@@Z
??0exception@@QAE@XZ
??1exception@@UAE@XZ
_localtime64
strftime
_time64
vsprintf
_vscprintf
??3@YAXPAX@Z
__CxxFrameHandler
_purecall
memmove
_CxxThrowException
_wcsicmp
Sections
.text Size: 92KB - Virtual size: 89KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 48KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp1 Size: 540KB - Virtual size: 1.6MB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE