Static task
static1
Behavioral task
behavioral1
Sample
f0276707febe9a70020d22fed8816e74f3eb069c3146d28bccb8dd8806c7d50a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f0276707febe9a70020d22fed8816e74f3eb069c3146d28bccb8dd8806c7d50a.exe
Resource
win10v2004-20220812-en
General
-
Target
f0276707febe9a70020d22fed8816e74f3eb069c3146d28bccb8dd8806c7d50a
-
Size
258KB
-
MD5
81cb35e9ccd5660045eee0bf6a868090
-
SHA1
6bc1b933e1bc965538ddfe35a5989426699a7a90
-
SHA256
f0276707febe9a70020d22fed8816e74f3eb069c3146d28bccb8dd8806c7d50a
-
SHA512
219777c4092f48dc1eb4527759df0590e5d0009f7844280462f58023f65b3c25dc37ce08d37ee0000f1137b932471c59252789859e9012b9640a48be5b3c17a3
-
SSDEEP
6144:YwWx6F2TU8nmPDbYd2Ly0M7+ciTIsZDyNGVTo2:YcF2/nmTLy0M7+ciTIxI62
Malware Config
Signatures
Files
-
f0276707febe9a70020d22fed8816e74f3eb069c3146d28bccb8dd8806c7d50a.exe windows x86
b80f918ec4888279f5a5e613f6b8f77c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetFileSize
FindFirstFileW
DeleteFileW
GetLastError
SetFileAttributesW
FindNextFileW
FindClose
RemoveDirectoryW
CreateFileW
DuplicateHandle
GetCurrentProcess
GetLogicalDriveStringsW
GetFileAttributesW
WritePrivateProfileStringW
WaitForSingleObject
LocalAlloc
LocalFree
Module32FirstW
Module32NextW
VirtualAllocEx
WriteProcessMemory
VirtualFreeEx
CreateRemoteThread
ReadProcessMemory
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetDriveTypeW
GetModuleFileNameW
GetComputerNameA
GetModuleFileNameA
GetPrivateProfileStringW
WriteFile
CreateMutexW
GetSystemDirectoryA
CopyFileA
GetFileAttributesA
InitializeCriticalSection
InterlockedCompareExchange
SetEnvironmentVariableA
GetProcessHeap
SetEndOfFile
WriteConsoleW
SetStdHandle
HeapReAlloc
SetEnvironmentVariableW
CompareStringW
GetTickCount
QueryPerformanceCounter
InterlockedExchange
CreateFileA
SetLocalTime
LoadLibraryW
TerminateProcess
OpenProcess
GetCurrentProcessId
GetModuleHandleW
GetProcAddress
CreateToolhelp32Snapshot
CreateEventW
SetEvent
CloseHandle
CreateThread
Sleep
HeapSize
FlushFileBuffers
ReadFile
SetFilePointer
GetConsoleMode
GetConsoleCP
CreateDirectoryA
IsValidLocale
EnumSystemLocalesA
CopyFileW
CreateProcessW
GetPrivateProfileIntW
GetLocaleInfoA
GetUserDefaultLCID
RtlUnwind
GetStartupInfoW
GetFileType
SetHandleCount
GetTimeZoneInformation
GetLocaleInfoW
GetStringTypeW
LCMapStringW
GetStdHandle
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetCurrentThreadId
SetLastError
TlsFree
HeapFree
HeapAlloc
InterlockedDecrement
GetCPInfo
GetSystemTimeAsFileTime
DeleteFileA
WideCharToMultiByte
CreateDirectoryW
MultiByteToWideChar
InterlockedIncrement
EnterCriticalSection
LeaveCriticalSection
EncodePointer
DecodePointer
MoveFileA
ExitProcess
GetCommandLineA
HeapSetInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
IsProcessorFeaturePresent
HeapCreate
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
user32
GetClassNameW
GetWindowThreadProcessId
ShowWindow
GetWindowTextW
ChangeDisplaySettingsW
FindWindowW
FindWindowExW
MessageBoxW
EnumWindows
PostMessageW
SendMessageW
IsWindowVisible
EnumDisplaySettingsW
wsprintfW
advapi32
RegEnumKeyExW
LookupAccountNameA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetNamedSecurityInfoW
BuildExplicitAccessWithNameW
GetNamedSecurityInfoW
SetEntriesInAclW
RegDeleteKeyW
GetUserNameA
RegSetValueExW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
FreeSid
ConvertSidToStringSidA
shell32
ShellExecuteW
ShellExecuteExW
SHChangeNotify
SHFileOperationW
ole32
CoCreateInstance
CoInitialize
psapi
GetModuleFileNameExW
iphlpapi
GetIfTable
GetAdaptersInfo
ws2_32
closesocket
WSAStartup
socket
WSACleanup
htons
inet_addr
connect
send
recv
bind
listen
accept
inet_ntoa
imagehlp
MapFileAndCheckSumW
version
GetFileVersionInfoA
VerQueryValueA
GetFileVersionInfoSizeA
Sections
.text Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 44KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ