?TLS@@YGXK@Z
Static task
static1
Behavioral task
behavioral1
Sample
d3835a63ef066197e04c2ae346b7a83107076071c524298a25d3a85be934a8ea.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d3835a63ef066197e04c2ae346b7a83107076071c524298a25d3a85be934a8ea.exe
Resource
win10v2004-20220812-en
General
-
Target
d3835a63ef066197e04c2ae346b7a83107076071c524298a25d3a85be934a8ea
-
Size
145KB
-
MD5
a1dc1f36ecd4f7d45bbe38592a525914
-
SHA1
b99b5ab38df90e2c6bd7037cf7db26edd99b1864
-
SHA256
d3835a63ef066197e04c2ae346b7a83107076071c524298a25d3a85be934a8ea
-
SHA512
c3189fb639d8f55bd981743dc3a790cccefb91eeb538db5bfbd29fa0300090827a55f6cbaaab697fdba16a8a8d671f8594710a3d6818097e57d505095cd9c4e9
-
SSDEEP
3072:Z5YfzKejaplQHSxNIR5lYy2d8+elIWT6K90puNxWvDg:Z+f3japGHaqzYV8+elIWNGv
Malware Config
Signatures
Files
-
d3835a63ef066197e04c2ae346b7a83107076071c524298a25d3a85be934a8ea.exe windows x86
a9a5bcc7b541703ea04e2405c650ae2d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
user32
GetWindowDC
GetKeyState
kernel32
WinExec
DeviceIoControl
CreateMutexW
FoldStringW
FlushViewOfFile
GetCommandLineW
OpenSemaphoreW
GetWindowsDirectoryA
LoadLibraryA
GetWindowsDirectoryW
VirtualProtect
EnumSystemLocalesA
SetCommMask
DeleteFileA
SystemTimeToFileTime
GetComputerNameExW
GetUserDefaultLCID
CopyFileW
GetFileAttributesExA
SetFilePointer
GlobalReAlloc
ClearCommError
ReleaseSemaphore
GetTempFileNameA
GetModuleFileNameA
GetSystemDefaultUILanguage
HeapWalk
FileTimeToLocalFileTime
FreeResource
HeapUnlock
SetupComm
TransactNamedPipe
SetFileTime
GetCommTimeouts
AddAtomA
GetExitCodeThread
GetShortPathNameW
FindResourceA
OpenFile
IsDBCSLeadByteEx
SetSystemTime
GlobalGetAtomNameW
EnumResourceNamesW
InitializeCriticalSection
GetOverlappedResult
lstrlenW
SetCommState
CreateWaitableTimerW
GlobalAddAtomW
GetFileSize
ReadFile
GetFileAttributesA
CreateFileMappingA
GetTempFileNameW
DeleteAtom
SetThreadLocale
GetShortPathNameA
LocalReAlloc
LeaveCriticalSection
CreateFileA
GetCurrentThread
GetHandleInformation
GetNumberFormatW
IsBadStringPtrW
IsValidLanguageGroup
GlobalLock
CreateEventA
FindCloseChangeNotification
FindFirstFileA
MulDiv
GetFullPathNameW
ReleaseMutex
TlsGetValue
SetPriorityClass
GlobalAddAtomA
FindFirstChangeNotificationW
FormatMessageA
IsBadReadPtr
EnumResourceLanguagesA
DeleteFileW
RemoveDirectoryW
GetStartupInfoW
GetThreadLocale
FindClose
lstrcatA
CreateThread
GetLongPathNameW
GetVersionExW
GetEnvironmentStringsW
SetCurrentDirectoryA
lstrcmpiW
CreateEventW
VirtualFree
SetThreadContext
GetCurrentDirectoryW
GlobalFlags
TryEnterCriticalSection
CompareStringA
WideCharToMultiByte
HeapSize
IsBadCodePtr
GetUserDefaultLangID
EscapeCommFunction
SetNamedPipeHandleState
shlwapi
ord29
Exports
Exports
Sections
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.text Size: 50KB - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 668B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 558B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ