Behavioral task
behavioral1
Sample
e2f2e0b862d782da1a95efb6c67987be6e67f8ce7c9d7e2bce78532cca3826a0.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e2f2e0b862d782da1a95efb6c67987be6e67f8ce7c9d7e2bce78532cca3826a0.exe
Resource
win10v2004-20220901-en
General
-
Target
e2f2e0b862d782da1a95efb6c67987be6e67f8ce7c9d7e2bce78532cca3826a0
-
Size
188KB
-
MD5
09edec670fdc9283f5d250f4538d92a0
-
SHA1
36815943453c577b8009dc417031082cace7183f
-
SHA256
e2f2e0b862d782da1a95efb6c67987be6e67f8ce7c9d7e2bce78532cca3826a0
-
SHA512
6db7a6fcee8a3bb4fad4855894138cbb1bd57fd25acbc893520d6fda58297f082b4177e4bda0d46ec541904c079860fc54f989899eaaa95fb34a8679f4ab92ae
-
SSDEEP
3072:2Bs7Vhr4Dii5yeZtlfXZRCTAVu7JuwwOqY/d/AAnCY78lMrXWeZ+6z2c0Uv:zfr4Dz5ftlPrQz7JPwOzd/jb/0Uv
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
e2f2e0b862d782da1a95efb6c67987be6e67f8ce7c9d7e2bce78532cca3826a0.exe windows x86
8b794180d93bf54b224d5d44239ada54
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegEnumValueA
RegQueryInfoKeyA
CopySid
GetLengthSid
IsValidSid
LookupAccountNameA
GetUserNameA
StartServiceCtrlDispatcherA
ChangeServiceConfig2A
CloseServiceHandle
CreateServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
DeleteService
QueryServiceStatus
ControlService
OpenServiceA
RegDeleteValueA
StartServiceA
RegisterServiceCtrlHandlerExA
SetServiceStatus
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA
RegCreateKeyExA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RegSetValueExW
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyExW
kernel32
GetModuleHandleA
SetConsoleCtrlHandler
LocalFree
FormatMessageA
GlobalFree
GlobalAlloc
GetStdHandle
AllocConsole
CallNamedPipeA
CloseHandle
WaitForSingleObject
WaitForMultipleObjects
ResetEvent
CreateThread
CreateEventA
SetEvent
DisconnectNamedPipe
FlushFileBuffers
WriteFile
ReadFile
ConnectNamedPipe
CreateNamedPipeA
ExitThread
LoadLibraryA
FreeLibrary
CreateFileA
DeviceIoControl
SetLastError
GetProcAddress
GetModuleFileNameA
GetVersionExA
GetLastError
OutputDebugStringA
Sleep
LocalAlloc
user32
wsprintfA
DestroyWindow
DefWindowProcA
CreateWindowExA
RegisterClassA
RegisterDeviceNotificationA
PostMessageA
UnregisterDeviceNotification
ole32
CoInitialize
CoCreateInstance
CoUninitialize
setupapi
SetupDiGetClassDevsA
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
CM_Locate_DevNodeA
CM_Reenumerate_DevNode
SetupDiGetClassDevsExA
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyA
SetupDiOpenDevRegKey
SetupDiEnumDeviceInfo
dsound
ord1
msvcrt
sscanf
__set_app_type
__p__fmode
_controlfp
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_onexit
free
malloc
calloc
_mbscmp
isalnum
isspace
sprintf
isalpha
_mbsnbcpy
_ftol
_CIasin
strtod
_CIpow
_CIacos
_mbslwr
_mbsicmp
__CxxFrameHandler
??3@YAXPAX@Z
_purecall
??2@YAPAXI@Z
printf
_mbslen
_fdopen
_open_osfhandle
setvbuf
_iob
wcsncmp
wcslen
_XcptFilter
_strdup
memset
wcscpy
_wcsicmp
wcscat
strcpy
strcat
_mbsnbicmp
??1type_info@@UAE@XZ
_except_handler3
?terminate@@YAXXZ
_exit
__dllonexit
winmm
mixerMessage
mixerGetNumDevs
Sections
.text Size: 56KB - Virtual size: 52KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 104KB - Virtual size: 252KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE