Static task
static1
Behavioral task
behavioral1
Sample
a3f5a88a71491e0776289b75524f1ef1c1acd7f0da2e922175eb9129c8b670a4.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a3f5a88a71491e0776289b75524f1ef1c1acd7f0da2e922175eb9129c8b670a4.exe
Resource
win10v2004-20220812-en
General
-
Target
a3f5a88a71491e0776289b75524f1ef1c1acd7f0da2e922175eb9129c8b670a4
-
Size
81KB
-
MD5
122e0fc38ccfc7355d2a5594c1466380
-
SHA1
b9100f72d75198e027d96a47aa1c04c4dab68f74
-
SHA256
a3f5a88a71491e0776289b75524f1ef1c1acd7f0da2e922175eb9129c8b670a4
-
SHA512
f619d9930d0ecdd163244caddabc2f735a7232cba094ce9f051884174069dd5e105c1adbf69604c874167319fb78b52cbf13ce6eb6443f2298925aaa624e167e
-
SSDEEP
1536:SrqIrFYqRTFzETE3AtpuGxrUh1+SQptDr59:SrqIrFYuTlAvvDtf
Malware Config
Signatures
Files
-
a3f5a88a71491e0776289b75524f1ef1c1acd7f0da2e922175eb9129c8b670a4.exe windows x86
9cb7b0ce00d4022b8cdfc046536803d6
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
NdrInterfacePointerUnmarshall
I_RpcBindingToStaticStringBindingW
RpcServerUseProtseqExW
RpcStringBindingParseW
RpcServerUseProtseqIfW
NdrClientInitialize
NdrStubForwardingFunction
RpcSsEnableAllocate
NdrMesTypeDecode
NdrConformantArrayMemorySize
I_RpcDeleteMutex
RpcNsBindingInqEntryNameA
MesDecodeIncrementalHandleCreate
NdrProxySendReceive
NdrSimpleTypeUnmarshall
NdrConformantVaryingStructMarshall
NdrConformantStringBufferSize
NdrClearOutParameters
NdrVaryingArrayUnmarshall
RpcBindingSetAuthInfoA
UuidHash
NdrStubCall2
RpcBindingInqAuthInfoA
I_RpcTransConnectionReallocPacket
NdrByteCountPointerUnmarshall
RpcServerInqDefaultPrincNameW
NdrConformantVaryingArrayMemorySize
NdrFixedArrayBufferSize
I_UuidCreate
RpcEpRegisterW
I_RpcTransIoCancelled
RpcRevertToSelf
NdrServerUnmarshall
NdrAllocate
I_RpcTransDatagramFree
RpcEpRegisterNoReplaceW
RpcMgmtInqStats
NdrOleFree
RpcMgmtEpEltInqBegin
RpcStringFreeA
NdrPointerFree
MesEncodeIncrementalHandleCreate
RpcCancelThreadEx
RpcSmEnableAllocate
NdrRpcSmSetClientToOsf
NdrServerContextMarshall
NdrNonConformantStringBufferSize
I_RpcTransGetThreadEvent
CStdStubBuffer_Invoke
RpcBindingFree
NdrOleAllocate
RpcServerTestCancel
NdrEncapsulatedUnionMarshall
RpcSsDisableAllocate
RpcSmGetThreadHandle
NdrConformantStructUnmarshall
RpcServerUseProtseqW
RpcBindingInqAuthInfoW
NdrEncapsulatedUnionFree
RpcSsSetThreadHandle
NdrCStdStubBuffer2_Release
NdrPointerMemorySize
RpcBindingInqAuthClientW
RpcMgmtEpEltInqNextA
RpcBindingCopy
NdrUserMarshalFree
RpcProtseqVectorFreeA
RpcServerRegisterAuthInfoW
RpcCancelThread
RpcServerListen
I_RpcBindingInqWireIdForSnego
I_RpcTransDatagramAllocate
RpcNetworkIsProtseqValidW
NdrClientInitializeNew
I_RpcRequestMutex
NdrPointerUnmarshall
RpcStringBindingParseA
I_RpcServerRegisterForwardFunction
I_RpcServerUseProtseq2A
RpcServerRegisterAuthInfoA
NdrConformantVaryingArrayFree
NDRCContextUnmarshall
NdrVaryingArrayFree
NdrServerCall
NDRCContextMarshall
RpcSmSwapClientAllocFree
RpcSmSetClientAllocFree
NdrNsGetBuffer
I_RpcBindingInqDynamicEndpointW
TowerExplode
NdrSimpleTypeMarshall
I_RpcServerAllocateIpPort
RpcBindingInqAuthClientExA
NdrProxyGetBuffer
I_RpcServerInqTransportType
RpcBindingSetObject
DceErrorInqTextW
RpcSmClientFree
NdrDllUnregisterProxy
NdrInterfacePointerMarshall
I_RpcTransDatagramAllocate2
MesEncodeFixedBufferHandleCreate
NdrConformantStructFree
NdrUserMarshalUnmarshall
RpcBindingInqAuthInfoExA
NdrMesSimpleTypeAlignSize
RpcServerUseAllProtseqs
NdrDcomAsyncStubCall
RpcMgmtSetServerStackSize
RpcSmFree
RpcServerRegisterIfEx
RpcMgmtInqServerPrincNameW
NdrFixedArrayUnmarshall
RpcBindingSetOption
RpcBindingServerFromClient
NdrXmitOrRepAsUnmarshall
I_RpcFreeBuffer
RpcSsGetThreadHandle
RpcRevertToSelfEx
NdrRpcSsDefaultFree
NdrConformantStringMarshall
NdrMapCommAndFaultStatus
I_RpcSendReceive
RpcBindingSetAuthInfoExW
I_RpcFreePipeBuffer
NdrConformantVaryingStructMemorySize
NdrGetUserMarshalInfo
RpcMgmtInqComTimeout
RpcCertGeneratePrincipalNameW
RpcMgmtIsServerListening
I_RpcPauseExecution
NdrComplexArrayBufferSize
NdrVaryingArrayMemorySize
MesDecodeBufferHandleCreate
RpcRaiseException
NdrFixedArrayMarshall
RpcServerInqDefaultPrincNameA
user32
DlgDirListW
TranslateAcceleratorA
SetDlgItemTextW
DdeQueryConvInfo
SetClassLongA
DialogBoxIndirectParamW
CharUpperBuffA
EndDialog
DialogBoxParamA
CharLowerA
UnionRect
ExcludeUpdateRgn
ExitWindowsEx
CheckDlgButton
ChangeClipboardChain
GetCursorInfo
GetSystemMetrics
SetWindowsHookExA
SetMessageExtraInfo
SendMessageA
VkKeyScanW
resutils
ResUtilStartResourceService
ResUtilGetProperties
ResUtilFindLongProperty
ResUtilGetPropertySize
ResUtilEnumPrivateProperties
ResUtilIsPathValid
ResUtilSetMultiSzValue
ResUtilFindDwordProperty
ResUtilFindDependentDiskResourceDriveLetter
ResUtilResourceTypesEqual
ResUtilSetResourceServiceEnvironment
ResUtilPropertyListFromParameterBlock
ResUtilSetSzValue
ResUtilSetResourceServiceStartParameters
ResUtilGetResourceNameDependency
ResUtilVerifyPrivatePropertyList
ResUtilGetPrivateProperties
ResUtilGetDwordValue
ResUtilVerifyResourceService
ResUtilIsResourceClassEqual
ResUtilGetPropertiesToParameterBlock
ResUtilSetPropertyParameterBlock
ResUtilGetBinaryValue
ResUtilEnumProperties
ResUtilCreateDirectoryTree
ResUtilSetPrivatePropertyList
ResUtilSetDwordValue
ResUtilVerifyPropertyTable
ClusWorkerCreate
ResUtilGetProperty
ResUtilStopResourceService
kernel32
ReplaceFileA
FileTimeToDosDateTime
MulDiv
GetProcAddress
InterlockedDecrement
AssignProcessToJobObject
pdh
PdhGetRawCounterArrayW
PdhGetCounterInfoW
PdhBrowseCountersA
PdhOpenQueryW
PdhGetDllVersion
PdhParseCounterPathA
PdhEnumObjectsW
PdhCollectQueryDataEx
PdhGetDataSourceTimeRangeA
PdhGetDefaultPerfCounterW
PdhMakeCounterPathA
PdhAddCounterW
PdhVbCreateCounterPathList
PdhUpdateLogFileCatalog
PdhSelectDataSourceW
PdhLookupPerfNameByIndexA
PdhVbGetLogFileSize
PdhExpandCounterPathW
PdhVbUpdateLog
PdhParseInstanceNameW
PdhBrowseCountersW
PdhConnectMachineW
PdhOpenLogW
PdhSetDefaultRealTimeDataSource
PdhVbGetDoubleCounterValue
PdhGetCounterInfoA
PdhValidatePathA
PdhExpandWildCardPathA
PdhMakeCounterPathW
PdhLookupPerfIndexByNameW
PdhParseInstanceNameA
PdhVbAddCounter
PdhUpdateLogA
PdhGetFormattedCounterValue
PdhValidatePathW
PdhGetDefaultPerfCounterA
PdhVbIsGoodStatus
PdhEnumObjectItemsW
PdhCloseLog
PdhComputeCounterStatistics
PdhGetFormattedCounterArrayW
comdlg32
ChooseColorA
Sections
.text Size: 43KB - Virtual size: 43KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.xdata Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ