Behavioral task
behavioral1
Sample
2281bd4c68a3f4265e6f4bb2f6bfae1e54d1ecc0c08cdf0915ce2f8c86f1d390.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2281bd4c68a3f4265e6f4bb2f6bfae1e54d1ecc0c08cdf0915ce2f8c86f1d390.exe
Resource
win10v2004-20220901-en
General
-
Target
2281bd4c68a3f4265e6f4bb2f6bfae1e54d1ecc0c08cdf0915ce2f8c86f1d390
-
Size
199KB
-
MD5
0e7691c714e3d7c06477e5cd3804c570
-
SHA1
fefb356c4ee70d903f1ad73b7f14f02fad2a13ae
-
SHA256
2281bd4c68a3f4265e6f4bb2f6bfae1e54d1ecc0c08cdf0915ce2f8c86f1d390
-
SHA512
d327848c9af56b55ffc4b30b26799d140b86f9aa9a1647f6daf012e7c6479c74c2bdf0382a1d99175b4dc3b6975fab8b29d17bee6c4c0a5524e8fa0f95d5ccc6
-
SSDEEP
3072:htmmPwRDGm9Mq3oL/ZgJqD4vnhb885YUFZQvA6uCHHMDsZoKFPpX56BflDD+kKbG:ht2Gmaq3IxgJq8I8Ry/cBtDD+kK
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
2281bd4c68a3f4265e6f4bb2f6bfae1e54d1ecc0c08cdf0915ce2f8c86f1d390.exe windows x86
43790a112a6a896a49a89700d9492f9b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
?terminate@@YAXXZ
_except_handler3
_onexit
__dllonexit
_controlfp
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__initenv
exit
_cexit
_XcptFilter
_exit
_c_exit
printf
puts
??2@YAPAXI@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
_ultoa
_CxxThrowException
__CxxFrameHandler
??3@YAXPAX@Z
kernel32
ReadFile
DisconnectNamedPipe
RaiseException
LoadLibraryA
InterlockedExchange
FreeLibrary
GetProcAddress
WaitForMultipleObjects
OpenProcess
DuplicateHandle
CreateFileA
SetThreadPriority
CreateWaitableTimerA
SetWaitableTimer
CancelWaitableTimer
DeviceIoControl
GetOverlappedResult
CreateThread
ResumeThread
PulseEvent
GetCurrentThreadId
GetProcessHeap
HeapAlloc
lstrcpyA
OpenEventA
lstrcmpiA
FormatMessageA
LocalAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
ResetEvent
GetLastError
lstrlenA
Sleep
CloseHandle
WaitForSingleObject
CreateEventA
ExpandEnvironmentStringsA
GetModuleFileNameA
GetModuleHandleA
WriteFile
LocalFree
ConnectNamedPipe
CreateNamedPipeA
MultiByteToWideChar
GetACP
WideCharToMultiByte
lstrlenW
GetCurrentProcess
SetLastError
ntdll
strpbrk
sprintf
_strnicmp
isgraph
_itoa
Sections
.text Size: 71KB - Virtual size: 70KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 512B - Virtual size: 504B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 18KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE