Static task
static1
Behavioral task
behavioral1
Sample
02f256330d29e5065ef17fceab016fa8bb76ab71ac1c931b98ffc6003528da78.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
02f256330d29e5065ef17fceab016fa8bb76ab71ac1c931b98ffc6003528da78.exe
Resource
win10v2004-20220901-en
General
-
Target
02f256330d29e5065ef17fceab016fa8bb76ab71ac1c931b98ffc6003528da78
-
Size
236KB
-
MD5
92739bfd2ecdb8c27f212c0c991abe70
-
SHA1
a65176219ca7a53e4437741a2deb4a8072c026ad
-
SHA256
02f256330d29e5065ef17fceab016fa8bb76ab71ac1c931b98ffc6003528da78
-
SHA512
b92a673eb2d5297d9d6380311db99c9b9257c3c08f0bb55ef73a904bccb91053f2547a899362266289ddeeb570b8002362e46deeb8b4c71a846d0c97b437e371
-
SSDEEP
6144:AT0sRVTphyAHBHpEKDznG9K5eVB4N1EWOT5LWxK6/WzkKO:AjTpoCHy6Z0B4N3cE39
Malware Config
Signatures
Files
-
02f256330d29e5065ef17fceab016fa8bb76ab71ac1c931b98ffc6003528da78.exe windows x86
15363ccca39153bedd11b50b6a03e3f3
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ImageList_Merge
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_exit
_XcptFilter
kernel32
GetStartupInfoA
GetModuleHandleA
FlushFileBuffers
GetLocaleInfoW
CreateEventW
FatalAppExitA
GetProcessAffinityMask
GlobalReAlloc
DeleteCriticalSection
GetOEMCP
shell32
ShellExecuteA
SHBrowseForFolderA
imm32
ImmSetConversionStatus
ImmGetConversionListW
ImmSetCompositionFontW
ImmNotifyIME
ImmRegisterWordA
ImmGetGuideLineA
ImmEnumRegisterWordA
ImmSetStatusWindowPos
ImmIsUIMessageW
ImmUnregisterWordW
ImmGetCandidateWindow
ImmGetCompositionFontW
ImmSetOpenStatus
ImmGetIMEFileNameA
ImmGetCompositionFontA
ImmIsIME
ImmGetStatusWindowPos
ImmEscapeW
ImmGetOpenStatus
ImmGetContext
ImmReleaseContext
ImmSimulateHotKey
ImmGetConversionStatus
ImmAssociateContext
ImmInstallIMEA
ImmRegisterWordW
ImmGetCompositionStringW
ImmSetCandidateWindow
ImmGetIMEFileNameW
ImmSetCompositionStringA
ImmGetGuideLineW
ImmEnumRegisterWordW
ImmGetProperty
ImmConfigureIMEA
ImmConfigureIMEW
ImmSetCompositionFontA
ImmCreateContext
ImmGetCompositionStringA
ImmGetDescriptionA
shlwapi
PathFindNextComponentW
PathStripPathA
PathGetDriveNumberW
PathIsUNCServerShareA
SHQueryInfoKeyW
StrCmpW
SHRegEnumUSKeyA
PathIsRootA
SHDeleteKeyW
PathIsUNCW
PathUnmakeSystemFolderA
SHEnumKeyExW
PathIsURLW
PathRemoveArgsA
PathRemoveBackslashA
SHRegGetBoolUSValueA
StrIsIntlEqualW
PathMakeSystemFolderW
SHQueryValueExA
PathIsDirectoryA
PathIsURLA
StrNCatW
PathSkipRootW
SHRegSetUSValueW
SHGetValueA
StrPBrkA
PathFindExtensionW
PathCanonicalizeA
PathFindOnPathA
PathAddExtensionW
SHDeleteValueW
SHRegDeleteUSValueA
StrTrimW
PathSearchAndQualifyW
PathIsPrefixW
StrFromTimeIntervalW
PathFindFileNameA
StrDupA
SHDeleteKeyA
SHQueryValueExW
PathIsUNCServerA
StrFormatByteSizeA
SHSetValueW
SHRegEnumUSKeyW
PathQuoteSpacesA
PathFindOnPathW
PathRenameExtensionW
PathCompactPathA
PathCanonicalizeW
PathCombineW
PathIsUNCA
PathSetDlgItemPathW
PathRelativePathToA
PathGetArgsW
StrCpyW
PathIsRelativeA
SHDeleteValueA
PathIsSameRootW
PathIsSystemFolderW
SHRegDeleteEmptyUSKeyA
PathRenameExtensionA
SHRegCloseUSKey
PathStripToRootA
SHSetValueA
SHRegGetUSValueW
StrToIntExW
PathRemoveBackslashW
PathFileExistsW
PathIsFileSpecA
SHRegWriteUSValueA
SHDeleteEmptyKeyA
PathCompactPathW
StrCSpnIA
PathRemoveBlanksA
PathFindNextComponentA
StrCSpnIW
SHGetValueW
advapi32
ObjectPrivilegeAuditAlarmA
SetFileSecurityA
OpenBackupEventLogA
GetLengthSid
DeleteService
BuildImpersonateTrusteeW
IsTextUnicode
BuildExplicitAccessWithNameA
ChangeServiceConfig2A
RegCreateKeyExA
AreAnyAccessesGranted
GetSidSubAuthorityCount
RegOpenKeyW
BuildImpersonateExplicitAccessWithNameW
GetTrusteeTypeA
RegCreateKeyExW
StartServiceA
LsaClose
GetSecurityDescriptorLength
CreateServiceA
LsaNtStatusToWinError
LsaOpenPolicy
LookupPrivilegeNameA
RegLoadKeyW
AddAuditAccessAce
RegDeleteKeyA
RegEnumValueW
OpenServiceW
RegDeleteValueA
InitiateSystemShutdownW
SetSecurityDescriptorGroup
CreateProcessAsUserA
EncryptFileW
LsaQueryTrustedDomainInfoByName
QueryServiceConfig2A
RegQueryValueExW
RegUnLoadKeyW
GetNumberOfEventLogRecords
GetOldestEventLogRecord
GetSecurityDescriptorOwner
BackupEventLogA
SetSecurityDescriptorOwner
NotifyChangeEventLog
GetSecurityDescriptorDacl
GetExplicitEntriesFromAclA
LsaSetTrustedDomainInfoByName
GetSecurityDescriptorControl
RegSetKeySecurity
StartServiceCtrlDispatcherW
RegCreateKeyW
QueryServiceConfig2W
MakeSelfRelativeSD
LookupSecurityDescriptorPartsA
DuplicateToken
GetServiceKeyNameA
GetSecurityDescriptorGroup
RegQueryValueA
RegSetValueA
GetTokenInformation
RegConnectRegistryA
AllocateLocallyUniqueId
GetMultipleTrusteeW
OpenSCManagerW
RegLoadKeyA
RegReplaceKeyW
RegSaveKeyA
RegCloseKey
RegEnumKeyA
RegQueryValueW
LsaLookupNames
GetSidIdentifierAuthority
LookupPrivilegeDisplayNameW
LsaEnumerateTrustedDomains
LsaDeleteTrustedDomain
RegOpenKeyA
SetPrivateObjectSecurity
LookupPrivilegeValueW
RegUnLoadKeyA
ChangeServiceConfigW
AbortSystemShutdownW
RegReplaceKeyA
GetTrusteeFormW
AllocateAndInitializeSid
LookupPrivilegeDisplayNameA
RegNotifyChangeKeyValue
RegQueryMultipleValuesA
GetPrivateObjectSecurity
InitializeSecurityDescriptor
GetMultipleTrusteeA
IsTokenRestricted
SetServiceObjectSecurity
SetEntriesInAclA
LsaSetTrustedDomainInformation
LsaQueryInformationPolicy
QueryServiceLockStatusW
GetFileSecurityA
SetServiceStatus
AdjustTokenGroups
CreateRestrictedToken
ObjectCloseAuditAlarmA
DuplicateTokenEx
GetExplicitEntriesFromAclW
RegOverridePredefKey
RegisterEventSourceA
OpenEventLogA
SetAclInformation
DeregisterEventSource
GetTrusteeFormA
ImpersonateSelf
LookupAccountNameA
GetServiceKeyNameW
LsaSetDomainInformationPolicy
GetEffectiveRightsFromAclA
GetAce
ImpersonateLoggedOnUser
LookupPrivilegeValueA
LookupPrivilegeNameW
DecryptFileW
RegEnumKeyExW
AdjustTokenPrivileges
ClearEventLogW
GetSecurityInfo
RegisterServiceCtrlHandlerA
InitiateSystemShutdownA
RegSetValueExW
QueryServiceObjectSecurity
RegSetValueW
RegCreateKeyA
GetSecurityDescriptorSacl
BuildTrusteeWithNameW
EqualSid
EnumDependentServicesW
BuildTrusteeWithNameA
CopySid
OpenProcessToken
IsValidSid
UnlockServiceDatabase
AddAccessAllowedAce
LsaQueryTrustedDomainInfo
StartServiceCtrlDispatcherA
QueryServiceLockStatusA
MapGenericMask
LsaEnumerateAccountRights
RegQueryInfoKeyW
IsValidAcl
MakeAbsoluteSD
RegOpenKeyExA
SetTokenInformation
LsaSetInformationPolicy
SetThreadToken
RegSetValueExA
RegDeleteKeyW
AccessCheck
SetSecurityDescriptorSacl
SetKernelObjectSecurity
SetSecurityInfo
RegEnumValueA
PrivilegedServiceAuditAlarmW
BackupEventLogW
LsaCreateTrustedDomainEx
LsaEnumerateAccountsWithUserRight
GetNamedSecurityInfoA
RegConnectRegistryW
GetAuditedPermissionsFromAclW
OpenServiceA
BuildSecurityDescriptorW
RevertToSelf
GetSidLengthRequired
AddAce
RegDeleteValueW
GetUserNameW
GetTrusteeNameW
QueryServiceStatus
GetAclInformation
ObjectDeleteAuditAlarmW
RegisterServiceCtrlHandlerW
BuildImpersonateTrusteeA
LsaAddAccountRights
CreatePrivateObjectSecurity
GetNamedSecurityInfoW
GetKernelObjectSecurity
LsaFreeMemory
RegOpenKeyExW
QueryServiceConfigA
BuildImpersonateExplicitAccessWithNameA
LogonUserA
ReportEventW
GetSidSubAuthority
FreeSid
RegGetKeySecurity
GetServiceDisplayNameW
OpenBackupEventLogW
Sections
.text Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 933KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ