Behavioral task
behavioral1
Sample
6b4ba26fcfd13b2118d7243704df5f5b949d1cb3c6fc86e6ff8edc59d8174b9d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
6b4ba26fcfd13b2118d7243704df5f5b949d1cb3c6fc86e6ff8edc59d8174b9d.exe
Resource
win10v2004-20220812-en
General
-
Target
6b4ba26fcfd13b2118d7243704df5f5b949d1cb3c6fc86e6ff8edc59d8174b9d
-
Size
184KB
-
MD5
59aa0a102d24705a9e06f2b4b1951abc
-
SHA1
b92e165640daa4c57a336161ae6f80939d5fcddd
-
SHA256
6b4ba26fcfd13b2118d7243704df5f5b949d1cb3c6fc86e6ff8edc59d8174b9d
-
SHA512
e67e236277ef5d3eb89afe595d22e04d2202431eb4abefb5b035d346b76389ca11634da1c8941d8ae92e736370ec3f753c14d29e3de076008ecc2c350793a89c
-
SSDEEP
3072:+rQgXmPFg8/FwZ/v6neQQ5NWdwwSORbvWIPx3iy5rlMRU3ph0M9nIXHIn0LlhNQ:+cgEu8/FwTzIJYbM5uon0Ll4
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
6b4ba26fcfd13b2118d7243704df5f5b949d1cb3c6fc86e6ff8edc59d8174b9d.exe windows x86
0a5de1b0db4af9316a89ccb94a1279b2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
WriteFile
CreateFileA
WaitForSingleObject
FreeLibrary
SetEvent
SetConsoleCtrlHandler
DeleteCriticalSection
TerminateThread
LeaveCriticalSection
EnterCriticalSection
WaitForMultipleObjects
GetLastError
CompareStringA
InterlockedExchange
GetModuleHandleA
GetModuleFileNameA
GetWindowsDirectoryA
GetSystemDirectoryA
LoadLibraryA
FlushInstructionCache
VirtualQuery
GetVersion
SetLastError
InitializeCriticalSection
CloseHandle
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
ExitProcess
UnmapViewOfFile
ReleaseMutex
GetCommandLineW
MapViewOfFile
advapi32
RegCloseKey
symzip
_SFXUtil_Zip2Exe@16
_ZipCreate@16
_ZipAddFile@32
_ZipPack@4
_ZipClose@4
msvcp70
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBG@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBG@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
?_Nomemory@std@@YAXXZ
msvcr70
_itow
??3@YAXPAX@Z
_wsetlocale
_putws
wcslen
wcscat
swprintf
_beginthreadex
??1exception@@UAE@XZ
??0exception@@QAE@XZ
??0exception@@QAE@ABV0@@Z
_CxxThrowException
_wcsicmp
_except_handler3
malloc
_callnewh
__security_error_handler
__dllonexit
_onexit
_c_exit
_exit
_XcptFilter
_cexit
exit
__p___winitenv
_amsg_exit
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
??1type_info@@UAE@XZ
_controlfp
?terminate@@YAXXZ
__CxxFrameHandler
wcscpy
wcsrchr
??_V@YAXPAX@Z
iswspace
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
UPX0 Size: 144KB - Virtual size: 380KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE