Static task
static1
Behavioral task
behavioral1
Sample
047e6ab241ccc100337d82ca35949777d3894dd98041b1fc9d8a85478d7868b7.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
047e6ab241ccc100337d82ca35949777d3894dd98041b1fc9d8a85478d7868b7.dll
Resource
win10v2004-20220812-en
General
-
Target
047e6ab241ccc100337d82ca35949777d3894dd98041b1fc9d8a85478d7868b7
-
Size
119KB
-
MD5
9287e6356a84cc2c13ff2ac01bb60f65
-
SHA1
47a00c3c65aaa7c4cdf2ea53dfe84e7d1da25ce7
-
SHA256
047e6ab241ccc100337d82ca35949777d3894dd98041b1fc9d8a85478d7868b7
-
SHA512
3cba77b3c22e00f19d2c579d7cb270d52ddcc6d45057a652e8e2a727dec1fe8ed843c6a649cb3dcceaceba5311823fa9608c221745f26f5b2660366617cc834d
-
SSDEEP
1536:claZtJQyP3TrnIWwkEv6+QsdtKKYOko+HA5Y+jzgKsjuPodM+2:cwZtJQyLrjFMQktSOko+H4LcKSuPoW
Malware Config
Signatures
Files
-
047e6ab241ccc100337d82ca35949777d3894dd98041b1fc9d8a85478d7868b7.dll windows x86
c9be434f626592d727e9c9ce48926d84
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shlwapi
PathFindExtensionW
wnsprintfA
PathIsRelativeW
PathFindFileNameA
PathFindExtensionA
PathFindFileNameW
SHCreateStreamOnFileW
PathIsURLW
UrlIsW
PathCreateFromUrlW
PathStripPathW
PathRemoveExtensionW
UrlCanonicalizeW
PathMakePrettyW
UrlGetPartW
urlmon
URLDownloadToCacheFileW
kernel32
EnterCriticalSection
LeaveCriticalSection
RaiseException
InitializeCriticalSection
DeleteCriticalSection
GetModuleFileNameW
InterlockedIncrement
InterlockedDecrement
lstrlenW
GetModuleHandleW
GetLastError
FreeLibrary
MultiByteToWideChar
SizeofResource
LoadResource
FindResourceW
LoadLibraryExW
lstrcmpiW
lstrcpynW
GlobalUnlock
GlobalLock
GlobalReAlloc
GlobalSize
GlobalAlloc
GetSystemDefaultLCID
GetUserDefaultLCID
LoadLibraryW
LockResource
FormatMessageW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
VirtualProtect
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetProcAddress
HeapFree
HeapAlloc
GetProcessHeap
GetVersionExA
Sleep
GlobalFree
CreateFileW
ReadFile
CloseHandle
FileTimeToSystemTime
GetOEMCP
GetCurrencyFormatW
GetCurrencyFormatA
GetTimeFormatW
GetTimeFormatA
GetDateFormatW
GetDateFormatA
IsBadStringPtrW
OutputDebugStringW
GetLocaleInfoW
DisableThreadLibraryCalls
GetVersionExW
GetThreadLocale
GetLocaleInfoA
GetSystemDefaultLangID
CompareStringW
SetLastError
GetStringTypeW
GetStringTypeExW
LCMapStringW
CreateFileA
GetFileType
GetFileTime
GetFileSize
SetFilePointer
GetACP
InterlockedExchange
GetUserDefaultLangID
SetCurrentDirectoryW
GetCurrentDirectoryW
lstrcmpiA
LoadLibraryExA
MulDiv
GetSystemInfo
WideCharToMultiByte
LocalFree
WriteFile
WaitForSingleObject
GetCurrentDirectoryA
SearchPathA
LocalHandle
LocalUnlock
LocalAlloc
LocalLock
LoadLibraryA
GetCPInfo
GlobalHandle
IsDBCSLeadByteEx
OutputDebugStringA
GetVersion
GetFileAttributesW
GetModuleHandleA
GetCurrentThread
ResumeThread
CreateThread
ExitThread
InterlockedCompareExchange
CreateEventA
SetEvent
VirtualAlloc
VirtualFree
GetStdHandle
CreateEventW
oleaut32
SysFreeString
SysAllocString
SysStringLen
VarUI4FromStr
SetErrorInfo
CreateErrorInfo
SafeArrayGetUBound
OleCreatePictureIndirect
VarBstrCmp
QueryPathOfRegTypeLi
VariantInit
VariantClear
GetErrorInfo
SysAllocStringLen
SafeArrayGetElement
SafeArrayCreateVector
SafeArrayCreate
SafeArrayAccessData
SafeArrayUnaccessData
SafeArrayDestroy
VariantChangeType
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
ole32
CoFileTimeNow
CoUninitialize
CoInitializeEx
StgOpenStorageOnILockBytes
CreateILockBytesOnHGlobal
OleUninitialize
ReadClassStg
OleInitialize
OleLoad
GetHGlobalFromStream
FreePropVariantArray
PropVariantClear
StgOpenStorage
CoTaskMemFree
CreateStreamOnHGlobal
CoTaskMemAlloc
CoTaskMemRealloc
ReleaseStgMedium
CoCreateGuid
CoCreateInstance
ReadClassStm
usp10
ScriptItemize
ScriptPlace
ScriptShape
ScriptJustify
ScriptTextOut
ScriptCPtoX
ScriptXtoCP
ScriptFreeCache
ScriptCacheGetHeight
ScriptGetFontProperties
ScriptApplyDigitSubstitution
ScriptRecordDigitSubstitution
ScriptGetProperties
ScriptGetCMap
ScriptLayout
ScriptBreak
ScriptGetLogicalWidths
ScriptGetGlyphABCWidth
ScriptIsComplex
msls31
ord43
ord48
ord50
ord49
ord42
ord2
ord51
ord52
ord1
ord66
ord63
ord71
ord40
ord5
ord44
ord72
ord3
ord67
Sections
.text Size: 65KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.cbss Size: - Virtual size: 120KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ctls Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.msshare Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.mstp Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.shared2 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 23KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ