ServiceMain
Static task
static1
Behavioral task
behavioral1
Sample
f748e7f5ef77aea601aa440a4f4c71eb125f318102f041abb09b8fe757f26523.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f748e7f5ef77aea601aa440a4f4c71eb125f318102f041abb09b8fe757f26523.dll
Resource
win10v2004-20220812-en
General
-
Target
f748e7f5ef77aea601aa440a4f4c71eb125f318102f041abb09b8fe757f26523
-
Size
167KB
-
MD5
8347cb2e88c1890f155ee052de3c5826
-
SHA1
4207bc2f9db535cfe2cd42aae26665b49fe51371
-
SHA256
f748e7f5ef77aea601aa440a4f4c71eb125f318102f041abb09b8fe757f26523
-
SHA512
1bc846d67edd3283c0bd9fe858c080b830e748289b20e6d8958833e2e7521abd6bf1d5abbd52c659b9a2b1849cef911ed0a3481a08442a46dd1b28bb5df39043
-
SSDEEP
3072:EVFzV2RqdUiRcUv1E5/r2IzWXsjIOf59fhQ1I5YRr9T:E4WH64vuT5kl3
Malware Config
Signatures
Files
-
f748e7f5ef77aea601aa440a4f4c71eb125f318102f041abb09b8fe757f26523.dll windows x86
cb9306991f88cc29462810ba76a3497b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempPathA
DeleteFileA
WideCharToMultiByte
GetFileSize
SetEndOfFile
SetFilePointer
WriteFile
GetExitCodeProcess
TerminateProcess
GlobalAlloc
FindFirstFileA
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
FindClose
CopyFileA
MoveFileExA
MoveFileA
CreateDirectoryA
RemoveDirectoryA
ReadFile
GetVolumeInformationA
LoadLibraryA
GetProcAddress
GetCurrentDirectoryA
GetVersionExA
GetWindowsDirectoryA
FreeLibrary
SystemTimeToFileTime
GetTempFileNameA
SizeofResource
LockResource
GetLastError
FindResourceA
FindResourceExA
GetLogicalDrives
GetDriveTypeA
GetModuleFileNameA
MultiByteToWideChar
CreateEventA
GetLocalTime
WaitForSingleObject
CreateThread
Sleep
CloseHandle
SetFileTime
GetFileTime
CreateFileA
FlushFileBuffers
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetModuleHandleA
GetConsoleMode
GetConsoleCP
RtlUnwind
VirtualAlloc
LoadResource
GetSystemDirectoryA
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetCommandLineA
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LCMapStringA
LCMapStringW
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
advapi32
RegSetValueExA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegCloseKey
shlwapi
PathFileExistsA
StrStrIA
PathIsDirectoryA
ws2_32
WSACleanup
WSAStartup
recv
send
setsockopt
__WSAFDIsSet
shutdown
select
connect
inet_addr
htons
ioctlsocket
closesocket
WSAGetLastError
socket
gethostname
inet_ntoa
getsockopt
gethostbyname
rpcrt4
UuidFromStringA
iphlpapi
GetAdaptersInfo
Exports
Exports
Sections
.text Size: 132KB - Virtual size: 131KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 18KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ