Static task
static1
Behavioral task
behavioral1
Sample
979b2706e48037d8edf4b158c97bdb1da288a153a5b0ddebe83e79f3e7d95707.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
979b2706e48037d8edf4b158c97bdb1da288a153a5b0ddebe83e79f3e7d95707.exe
Resource
win10v2004-20220812-en
General
-
Target
979b2706e48037d8edf4b158c97bdb1da288a153a5b0ddebe83e79f3e7d95707
-
Size
385KB
-
MD5
3fa1931343bba366a4032acbe2ec7df6
-
SHA1
a7aee7d26183b0d13c91a3c0520e577635bb861a
-
SHA256
979b2706e48037d8edf4b158c97bdb1da288a153a5b0ddebe83e79f3e7d95707
-
SHA512
35d27149c35d4eabb9c42f0214268296241d4ce395cee8856740f89288971bf5ea18909aab09900445a8542ed46760a8b89359b77933aea0b23239da672074e4
-
SSDEEP
6144:1Yq3W5gQ2Flaz7c6RZirhHAylfZ63Rftur+aks8aECXTW43nyn2Hi+h4ykgtPRe:K2WiBlazI2irhHLStuCDs8aECXi43yn
Malware Config
Signatures
Files
-
979b2706e48037d8edf4b158c97bdb1da288a153a5b0ddebe83e79f3e7d95707.exe windows x86
c4a2edec7c506c92b93e41e8a5cf844d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wininet
InternetCanonicalizeUrlW
InternetCrackUrlW
ws2_32
send
ioctlsocket
WSASetLastError
WSAStartup
select
WSAGetLastError
htons
shutdown
inet_addr
WSACleanup
recv
socket
__WSAFDIsSet
closesocket
gethostbyname
connect
kernel32
HeapAlloc
GetCurrentProcess
HeapFree
SetEvent
GetTickCount
GetProcessHeap
WideCharToMultiByte
Sleep
CopyFileW
GetLastError
Process32FirstW
CreateEventW
Process32NextW
WTSGetActiveConsoleSessionId
CreateToolhelp32Snapshot
GetWindowsDirectoryW
CreateThread
GetStringTypeW
GetStringTypeA
InitializeCriticalSectionAndSpinCount
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
CloseHandle
GetProcAddress
TerminateProcess
GetModuleHandleW
WaitForSingleObject
GetLocaleInfoA
CreateFileA
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetHandleCount
GetStartupInfoA
HeapCreate
GetModuleFileNameA
GetFileAttributesW
QueryPerformanceCounter
LoadLibraryA
FlushFileBuffers
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetConsoleCP
LCMapStringW
GetVersionExW
LoadLibraryW
GetStdHandle
MultiByteToWideChar
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetFileType
GetSystemTimeAsFileTime
GetProcessAffinityMask
GetSystemInfo
GlobalMemoryStatus
GetModuleHandleA
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
GetConsoleMode
ResumeThread
SetThreadAffinityMask
ResetEvent
CreateSemaphoreW
ReleaseSemaphore
InitializeCriticalSection
SetFilePointer
SetLastError
WriteFile
GetCurrentProcessId
GetCurrentThreadId
FreeLibrary
GetModuleFileNameW
InterlockedIncrement
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
RtlUnwind
ExitThread
HeapReAlloc
ExitProcess
GetCPInfo
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
HeapSize
SetStdHandle
LCMapStringA
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
CharUpperW
advapi32
EnumServicesStatusExW
RegCloseKey
AdjustTokenPrivileges
RegFlushKey
ControlService
RegisterServiceCtrlHandlerW
UnlockServiceDatabase
RegOpenKeyExW
SetServiceStatus
ChangeServiceConfigW
QueryServiceStatus
StartServiceW
LookupPrivilegeValueW
LockServiceDatabase
SetTokenInformation
CreateProcessAsUserW
RegQueryValueExW
RegCreateKeyExW
OpenServiceW
EnumDependentServicesW
StartServiceCtrlDispatcherW
OpenSCManagerW
DeleteService
OpenProcessToken
CloseServiceHandle
RegSetValueExW
wtsapi32
WTSSendMessageW
WTSQueryUserToken
userenv
CreateEnvironmentBlock
oleaut32
SysAllocString
SysFreeString
SysAllocStringLen
VariantClear
VariantCopy
SysStringLen
Sections
.text Size: - Virtual size: 285KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 55KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 121KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.upx0 Size: - Virtual size: 48KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.upx1 Size: 294KB - Virtual size: 293KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 90KB - Virtual size: 90KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ