Static task
static1
Behavioral task
behavioral1
Sample
3f579b2e59a370654e190c09559f779a46c406b52e58452bc515684e07bbd8b6.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3f579b2e59a370654e190c09559f779a46c406b52e58452bc515684e07bbd8b6.exe
Resource
win10v2004-20220812-en
General
-
Target
3f579b2e59a370654e190c09559f779a46c406b52e58452bc515684e07bbd8b6
-
Size
740KB
-
MD5
81b7afce5b8d62bf2e97ffc029d43ae0
-
SHA1
17f60aef03854dd3a8f0d7ff1c5ea74e1e44395c
-
SHA256
3f579b2e59a370654e190c09559f779a46c406b52e58452bc515684e07bbd8b6
-
SHA512
c8d3edc14b0a5a43dc0d09c82cba2a29c0022b7a5354ea494cdc3f021b0608cae8dac7a4d4e9e885f28fcbbf520f1a9a21e4e4bbb8f99f9742c0f3afe6078781
-
SSDEEP
12288:0JRi/4vHI4fjLgJd2WoHP5sMrV3FQImZIVlWL/6FykyEAkWbGq5:ai/nTJ4lRx4IVs76FyknnEGe
Malware Config
Signatures
Files
-
3f579b2e59a370654e190c09559f779a46c406b52e58452bc515684e07bbd8b6.exe windows x86
0c7089fa64c6acfce5242fbd74b0eea1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnmapViewOfFile
WaitForMultipleObjects
MapViewOfFile
OpenFileMappingA
CloseHandle
GetLastError
CreateFileMappingA
OpenProcess
OpenSemaphoreA
SetThreadPriority
Sleep
GetCurrentThread
CreateThread
ReleaseSemaphore
SetEvent
LoadResource
SizeofResource
FindResourceA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
HeapReAlloc
VirtualAlloc
RaiseException
GetConsoleMode
GetConsoleCP
SetFilePointer
HeapSize
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapCreate
HeapDestroy
GetFileType
SetHandleCount
GetEnvironmentStringsW
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
InitializeCriticalSection
LoadLibraryA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetModuleFileNameA
GetStdHandle
WriteFile
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetStartupInfoA
GetProcessHeap
HeapAlloc
GetVersionExA
HeapFree
GetCommandLineA
RtlUnwind
ExitProcess
GetModuleHandleA
GetProcAddress
user32
PostMessageA
vatengine
?GetFileNameExt@@YAPADPAD@Z
??1TaggedValue@@QAE@XZ
?MemFree@@YAXPAX@Z
?SetVariableValue@AppContext@@QAE_NPAD0AAVTaggedValue@@PAVObjEnvironment@@0@Z
?SetCallStack@AppContext@@QAE_NKPAD@Z
?GetCallStack@AppContext@@QAE_NPAVObjEnvironment@@PAD@Z
?RecalVariable@AppContext@@QAE_NPADPAVObjType@@KAAVTaggedValue@@PAVObjEnvironment@@0@Z
?ExpandAttribute@AppContext@@QAE_NAAVTaggedValue@@PAVObjEnvironment@@PAD@Z
?ExpandChildren@AppContext@@QAE_NAAVTaggedValue@@PAVObjEnvironment@@PAD@Z
?ParseVariable@AppContext@@QAE_NPADPAVObjType@@PAVObjEnvironment@@0@Z
?MemCopy@@YAXPAX0K@Z
?MemAlloc@@YAPAXK@Z
??0TaggedValue@@QAE@XZ
?ValidSerialNumber@@YAHPADHAAH@Z
?StartMessageDialogue@@YAHPAD00PAVDrawingComposite@@PA_NH@Z
?CreateAppDefaFont@AppModel@@QAEXXZ
?SetGlobalString@@YA_NPAD0@Z
??2Node@@SAPAXI@Z
?FilePathAvailable@@YA_NPAD_N@Z
?NewString@@YAPADPAD@Z
?GetFilePathAndName@@YAXPAD00_N@Z
??2AppContext@@SAPAXI@Z
?Initialize@AppContext@@UAEXXZ
?SystemPath@AppContext@@UAEPADXZ
?AppName@AppContext@@UAEPADXZ
?ClearErrorLog@AppContext@@UAEXXZ
?CreateObject@AppContext@@UAEPAVNamedObject@@PAVObjType@@PADPAV2@@Z
??3AppContext@@SAXPAX@Z
?SetGCScale@AppContext@@UAEXMM@Z
?GetGCScale@AppContext@@UAE?AUXY@@XZ
?HandleEmergency@AppContext@@UAEXXZ
?DebugBreak@AppContext@@UAEXPADH@Z
?RequestUpdate@AppContext@@UAEXPAVNamedDrawingObject@@PAUHRGN__@@@Z
?CheckMenu@AppContext@@UAEXPAD0_N@Z
?EnableMenu@AppContext@@UAEXPAD0_N@Z
?DynamicReportError@AppContext@@UAEXPADPAVNamedObject@@@Z
?ReportException@AppContext@@UAEXPAVNamedObject@@@Z
?ReportError@AppContext@@UAEXPADPAVNamedObject@@@Z
?SetDefaultWinStyle@AppContext@@UAEX_N@Z
?GetIcon@AppContext@@UAEPAVNamedObject@@PAV2@PAD@Z
?TextInfo@AppContext@@UAE?AUWH@@PADHPAVFontNode@@@Z
?GetTextMatrix@AppContext@@UAEXPAVFontNode@@@Z
?OriginalSize@AppContext@@UAE_NAAH0@Z
?IsFullScreen@AppContext@@UAE_NXZ
?RestoreSize@AppContext@@UAEXXZ
?ResizeFullScreen@AppContext@@UAEXXZ
?SetFocus@AppContext@@UAEPAUHWND__@@PAU2@@Z
?GetFocus@AppContext@@UAEPAUHWND__@@XZ
?GetFont@AppContext@@UAEPAVFontNode@@PAVNamedObject@@PADKHHGNPAVLanguageSpec@@_N@Z
?GetFont@AppContext@@UAEPAVFontNode@@PAD_N@Z
?UpdateApplication@AppContext@@UAEXXZ
?GetScaledFont@AppContext@@UAEPAVFontNode@@PAV2@@Z
?ActivateTimer@AppContext@@UAEXXZ
?DispatchTimerEvent@AppContext@@UAEXXZ
?DeleteTimerEvent@AppContext@@UAEXPAVNamedObject@@I@Z
?ClearTimerEventQueue@AppContext@@UAEXXZ
vatool
??3BreakPoint@@SAXPAX@Z
??1BreakPoint@@QAE@XZ
?RemoveBreakPoint@VStudioAppContext@@QAEXPAVBreakPoint@@@Z
?AddBreakPoint@VStudioAppContext@@QAEXPAVBreakPoint@@@Z
??0BreakPoint@@QAE@XZ
??2BreakPoint@@SAPAXI@Z
??0VStudioAppModel@@QAE@PAD@Z
?InitializeVStudioClasses@@YAXPAVAppContext@@@Z
?ReadBreakPointsFile@VStudioAppContext@@QAEXXZ
??0VStudioAppContext@@QAE@PAUHINSTANCE__@@@Z
?WorkingPath@VStudioAppContext@@UAEPADPAVNamedObject@@@Z
?GetObjFileIndexContent@VStudioAppContext@@UAEXPAVNamedObject@@AAPAD11@Z
?AddTimerEvent@VStudioAppContext@@UAEXGPAVNamedObject@@IPAXNH@Z
?GetEnvironment@VStudioAppContext@@UAEPAVAppSetting@@PAVNamedObject@@@Z
?StartDownLoadThread@VStudioAppContext@@UAEPAVThreadPreloadPackage@@PAD0H@Z
?LoadAppCursors@VStudioAppContext@@UAEXXZ
?GetGeoScalarUnit@VStudioAppContext@@UAEGXZ
?ActionNotify@VStudioAppContext@@UAEHGPAX@Z
?ShowObjectInfo@VStudioAppContext@@UAEXPAVNamedObject@@@Z
?ExistBreakPoint@VStudioAppContext@@UAE_N_NPADI11HH0@Z
?SetObjectFilePosition@VStudioAppContext@@UAEXPAVNamedObject@@I@Z
?RegisterTool@VStudioAppContext@@UAEXPAD0@Z
??1VStudioAppContext@@UAE@XZ
?CurrentColorType@VStudioAppContext@@UAEG_N@Z
?GetProjectPath@VStudioAppContext@@UAEPADXZ
?ActiveTool@VStudioAppContext@@UAEPAVNamedObject@@XZ
?SetStatusBarStep@VStudioAppContext@@UAE_NGPAX0_N@Z
?WhenAnimateStep@VStudioAppContext@@UAE_NH_N@Z
?GetDefaultOpenDirectory@VStudioAppContext@@UAEPADPAD0@Z
Sections
.text Size: 48KB - Virtual size: 44KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 664KB - Virtual size: 2.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE