Static task
static1
Behavioral task
behavioral1
Sample
379fab06958710bc5c296764d26399665b55e2ce806d5acab0b65883e266578c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
379fab06958710bc5c296764d26399665b55e2ce806d5acab0b65883e266578c.exe
Resource
win10v2004-20220901-en
General
-
Target
379fab06958710bc5c296764d26399665b55e2ce806d5acab0b65883e266578c
-
Size
131KB
-
MD5
a27e1a08d1ef193670c47fced1eb6a63
-
SHA1
4545316a7552fd56dd14f2af94e55aefbe63b782
-
SHA256
379fab06958710bc5c296764d26399665b55e2ce806d5acab0b65883e266578c
-
SHA512
697d49e48a95cc6fec0da158e74001dea4b5f9b60edaee448b3817096cd0bb61a9d48b9706b1d5c44992e43b01c75868e78bd8a01031749dec4466f875aabc22
-
SSDEEP
3072:Zm7035eDd0JtRCi0HvAKlzqIEo2NMvlpcoclxdfyZCKJxL9:jpeZ0JtF0PAoOIEHe9CoclxVyZCo
Malware Config
Signatures
Files
-
379fab06958710bc5c296764d26399665b55e2ce806d5acab0b65883e266578c.exe windows x86
144930a9497e0d65cdaaa5aaafc3af64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TlsSetValue
EnumSystemLocalesA
CompareStringA
SetEnvironmentVariableW
SystemTimeToFileTime
LCMapStringA
CompareStringW
IsValidCodePage
GetFileAttributesExW
GetFileInformationByHandle
ResumeThread
TerminateProcess
FindNextFileW
FindFirstFileA
GetDriveTypeA
GetConsoleOutputCP
ExitThread
GetFullPathNameA
SetConsoleMode
GetFileType
FreeEnvironmentStringsW
SleepEx
GetTempPathW
TlsGetValue
GetEnvironmentStringsW
InterlockedCompareExchange
GetModuleHandleA
RemoveDirectoryW
ReleaseMutex
FileTimeToLocalFileTime
LeaveCriticalSection
IsValidLocale
HeapCreate
HeapReAlloc
TlsFree
FreeLibrary
IsDebuggerPresent
MultiByteToWideChar
SetUnhandledExceptionFilter
GetProcessHeap
GetSystemTime
OpenFileMappingW
CreateDirectoryW
CreateFileA
GetCurrentThreadId
GlobalMemoryStatus
FormatMessageA
InterlockedIncrement
LCMapStringW
SetFilePointer
GetEnvironmentStrings
GetSystemTimeAsFileTime
GetConsoleMode
GetModuleFileNameA
QueryPerformanceFrequency
GetCurrentDirectoryA
GetVersion
WaitForSingleObject
VirtualFree
SetHandleCount
PeekConsoleInputA
DeleteFileW
GetStringTypeW
GetStringTypeA
GetTimeZoneInformation
GetModuleHandleW
SetFileAttributesW
ExitProcess
Sleep
WriteConsoleA
SetFilePointerEx
GetACP
GetProcAddress
InterlockedDecrement
FormatMessageW
FlushConsoleInputBuffer
UnmapViewOfFile
SetThreadPriority
GetLastError
GetConsoleCP
CreateFileW
SetConsoleCtrlHandler
WideCharToMultiByte
WriteConsoleW
FlushFileBuffers
ResetEvent
GetProcessTimes
CloseHandle
GetCurrentProcess
MoveFileW
ExpandEnvironmentStringsA
LocalFree
CopyFileW
QueryPerformanceCounter
HeapSize
InitializeCriticalSection
InterlockedExchange
FindFirstFileW
GetOEMCP
UnhandledExceptionFilter
OutputDebugStringW
GetSystemDirectoryA
lstrlenA
VirtualAlloc
SetFileTime
OpenMutexW
HeapFree
EnterCriticalSection
HeapAlloc
GetCurrentThread
GetTickCount
FreeEnvironmentStringsA
GetVersionExW
SetLastError
ReadConsoleInputA
GetCommandLineA
GetLocaleInfoA
TlsAlloc
RaiseException
WriteFile
GetThreadLocale
PeekNamedPipe
SetEndOfFile
FindClose
lstrlenW
CreateSemaphoreW
SetEnvironmentVariableA
WaitForMultipleObjects
CreateThread
GetStartupInfoA
ReadFile
HeapDestroy
GetNumberOfConsoleInputEvents
CreateFileMappingW
GetVolumeInformationW
GetStdHandle
LoadLibraryA
DeleteCriticalSection
GetLocaleInfoW
RtlUnwind
LocalAlloc
GetUserDefaultLCID
GetFileAttributesW
CreateMutexW
lstrcmpW
GetCurrentProcessId
FileTimeToSystemTime
ReleaseSemaphore
SetEvent
SetStdHandle
GetExitCodeProcess
GetModuleFileNameW
CreateProcessW
MapViewOfFile
CreateEventW
GetVersionExA
GetSystemDefaultLangID
GetUserDefaultLangID
LoadLibraryW
VirtualProtectEx
lstrcmpiW
GetCPInfo
user32
wsprintfW
MessageBoxA
GetUserObjectInformationW
GetDesktopWindow
GetProcessWindowStation
ole32
CoCreateGuid
CoCreateInstance
StringFromGUID2
CoInitialize
CoUninitialize
winhttp
WinHttpConnect
WinHttpOpen
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReadData
WinHttpCrackUrl
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpReceiveResponse
iphlpapi
GetIfTable
psapi
GetProcessMemoryInfo
GetModuleBaseNameA
msvcrt
_vsnwprintf
_CIsin
Sections
.text1 Size: 100KB - Virtual size: 99KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.itext Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 56KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idat_0 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ