Static task
static1
Behavioral task
behavioral1
Sample
1c1964e299ed1036036fc0734c6a2426bd963bfa00eb1bf9c6d4e904e697012d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1c1964e299ed1036036fc0734c6a2426bd963bfa00eb1bf9c6d4e904e697012d.exe
Resource
win10v2004-20220901-en
General
-
Target
1c1964e299ed1036036fc0734c6a2426bd963bfa00eb1bf9c6d4e904e697012d
-
Size
872KB
-
MD5
0a794d156ae65833b07d55d30d632dc7
-
SHA1
a914be61edfb873f9a4f3e20fc4ac2af0b9b6a1a
-
SHA256
1c1964e299ed1036036fc0734c6a2426bd963bfa00eb1bf9c6d4e904e697012d
-
SHA512
fae03b3ab02d7882441921df33158fc00ada3ed618badafb8a4e8159ed7bb055c5f12b00864a48d239326452b1144cb0d1ea6fd0619fc13f13d341081692cf43
-
SSDEEP
24576:V4TlqFNf2akJ7JRtyjbPXktALO83BeyUXEeMYk:iANf2FRUst63VgEs
Malware Config
Signatures
Files
-
1c1964e299ed1036036fc0734c6a2426bd963bfa00eb1bf9c6d4e904e697012d.exe windows x86
8601af1b6bba6f01e340c167acd04322
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
resutils
ResUtilVerifyPropertyTable
ResUtilEnumResources
ResUtilGetResourceDependencyByName
ResUtilResourceTypesEqual
ResUtilGetResourceNameDependency
ResUtilSetBinaryValue
ResUtilSetMultiSzValue
ResUtilFindDependentDiskResourceDriveLetter
ResUtilVerifyPrivatePropertyList
ResUtilFindBinaryProperty
ResUtilDupParameterBlock
ResUtilFreeEnvironment
ResUtilSetPropertyTable
ResUtilFindExpandSzProperty
ResUtilSetSzValue
ResUtilGetPropertySize
ResUtilSetResourceServiceEnvironment
ResUtilGetDwordValue
ResUtilEnumResourcesEx
ResUtilSetExpandSzValue
ResUtilExpandEnvironmentStrings
ResUtilPropertyListFromParameterBlock
ResUtilFindSzProperty
ResUtilGetEnvironmentWithNetName
ResUtilAddUnknownProperties
ResUtilGetPrivateProperties
ResUtilGetPropertyFormats
ResUtilFreeParameterBlock
ResUtilSetPropertyTableEx
ResUtilGetSzValue
ResUtilFindExpandedSzProperty
ResUtilSetPropertyParameterBlockEx
ResUtilGetProperty
ResUtilVerifyResourceService
ResUtilStopResourceService
ClusWorkerCreate
netapi32
NetEnumerateTrustedDomains
NetUseEnum
DsRoleGetDcOperationResults
NetLocalGroupDel
NetServiceInstall
NetMessageNameAdd
NetUserDel
DsAddressToSiteNamesExW
NetConfigSet
NetReplSetInfo
NetGroupSetInfo
NetConfigGet
NetServerTransportEnum
NetLocalGroupAddMember
NetpCloseConfigData
NetGroupSetUsers
DsEnumerateDomainTrustsW
NetReplExportDirGetInfo
I_NetServerAuthenticate2
NetGetAnyDCName
NetScheduleJobAdd
NetLocalGroupAddMembers
NetShareDel
NetMessageNameEnum
NetRemoteTOD
NetQueryDisplayInformation
I_NetDatabaseSync
NetDfsRename
I_BrowserSetNetlogonState
NetUserSetGroups
DsRoleDnsNameToFlatName
NetRegisterDomainNameChangeNotification
NetpAssertFailed
I_NetLogonSendToSam
NetpGetConfigValue
RxNetAccessSetInfo
kernel32
GetSystemDefaultLCID
GetACP
QueryInformationJobObject
GetOEMCP
AreFileApisANSI
GetStartupInfoA
PrivMoveFileIdentityW
_lwrite
GetTimeFormatW
DebugActiveProcessStop
GetSystemTimeAdjustment
GetTempPathA
GetConsoleAliasesA
EnumCalendarInfoA
HeapCompact
GetCommandLineA
VirtualAlloc
DeleteTimerQueueTimer
LZClose
CallNamedPipeA
CopyLZFile
WriteConsoleOutputAttribute
GetDiskFreeSpaceW
CreateDirectoryA
GetProcessPriorityBoost
SetCommState
SetComputerNameExA
TryEnterCriticalSection
SetInformationJobObject
GetSystemTime
SetVolumeMountPointW
FindResourceW
GetHandleInformation
SetConsoleCP
QueryDosDeviceW
IsValidCodePage
GetStartupInfoW
GlobalGetAtomNameW
SetConsoleCursorPosition
WaitForSingleObject
WideCharToMultiByte
VirtualQuery
EnumSystemLocalesA
GetEnvironmentStringsW
GlobalFindAtomW
GetFileInformationByHandle
ProcessIdToSessionId
RegisterWaitForSingleObjectEx
GetShortPathNameW
EnumResourceTypesW
GetSystemDirectoryW
lstrcmpiW
SetLastConsoleEventActive
GetConsoleCommandHistoryLengthW
LoadLibraryA
ReleaseMutex
BackupWrite
FindVolumeMountPointClose
GetThreadLocale
CreateToolhelp32Snapshot
GetConsoleHardwareState
GetGeoInfoA
FindNextVolumeA
lstrcmp
SetConsoleNumberOfCommandsA
GetFirmwareEnvironmentVariableA
DeleteFileA
IsProcessInJob
ReplaceFileA
GetFileAttributesA
FindFirstChangeNotificationW
mscms
SelectCMM
SpoolerCopyFileEvent
SetColorProfileElementSize
UninstallColorProfileA
OpenColorProfileW
TranslateColors
InternalGetPS2CSAFromLCS
GetPS2ColorSpaceArray
IsColorProfileValid
InstallColorProfileA
GenerateCopyFilePaths
GetStandardColorSpaceProfileA
ConvertColorNameToIndex
GetColorProfileHeader
SetColorProfileHeader
InternalGetDeviceConfig
SetColorProfileElementReference
InternalGetPS2PreviewCRD
InternalSetDeviceConfig
UnregisterCMMA
TranslateBitmapBits
CreateDeviceLinkProfile
EnumColorProfilesW
GetCountColorProfileElements
GetColorProfileFromHandle
SetColorProfileElement
AssociateColorProfileWithDeviceW
CloseColorProfile
SetStandardColorSpaceProfileW
CreateProfileFromLogColorSpaceA
CheckBitmapBits
CreateColorTransformA
UnregisterCMMW
IsColorProfileTagPresent
RegisterCMMW
GetColorProfileElementTag
CreateProfileFromLogColorSpaceW
EnumColorProfilesA
ConvertIndexToColorName
sqlwoa
_CreateWindowEx@48
_CreateFile@28
_GetTextExtentPoint32@16
_GetModuleFileName@12
_FormatMessage@28
_CreateFont@56
_LoadBitmap@8
_GetComputerName@8
AllocConvertMultiSZNameToA
_GetSaveFileName@4
_DeleteFile@4
_SendMessage@16
_ExtTextOut@32
_GetClassInfo@12
_MessageBox@16
_WinHelp@16
_SetWindowLong@12
newMultiByteFromWideCharSize
_GetTextMetrics@8
_trename
_GetWindowLong@8
_StartDoc@8
_SetDlgItemText@12
newMultiByteFromWideChar
_GetTextExtentPoint@16
_CreateFontIndirect@4
_FindResource@12
_CallWindowProc@20
ConvertMultiSZNameToW
_GetWindowText@12
_tfopen
_CreateDialogIndirectParam@20
_MAKEINTRESOURCE@4
untfs
?ReadNext@NTFS_FRS_STRUCTURE@@QAEEVBIG_INT@@@Z
?Initialize@NTFS_BITMAP_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?GetNextAttributeListEntry@NTFS_ATTRIBUTE_LIST@@QBEPBU_ATTRIBUTE_LIST_ENTRY@@PBU2@@Z
?Initialize@NTFS_ATTRIBUTE@@QAEEPAVLOG_IO_DP_DRIVE@@KPBXKKPBVWSTRING@@G@Z
??1NTFS_UPCASE_FILE@@UAE@XZ
?ComputeDupInfoSignature@NTFS_MFT_INFO@@CGXPAU_DUPLICATED_INFORMATION@@QAE@Z
?Initialize@NTFS_MFT_INFO@@QAEEXZ
?Initialize@NTFS_CLUSTER_RUN@@QAEEPAVMEM@@PAVLOG_IO_DP_DRIVE@@VBIG_INT@@KK@Z
?Write@NTFS_FILE_RECORD_SEGMENT@@UAEEXZ
??0NTFS_ATTRIBUTE_LIST@@QAE@XZ
Format
?Read@NTFS_ATTRIBUTE@@QAEEPAXVBIG_INT@@KPAK@Z
?Initialize@NTFS_BAD_CLUSTER_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
??1NTFS_BAD_CLUSTER_FILE@@UAE@XZ
?SetVolumeFlag@NTFS_SA@@QAEEGPAE@Z
?GetNextAttributeRecord@NTFS_FRS_STRUCTURE@@QAEPAXPBXPAVMESSAGE@@PAE@Z
?QueryFileSizes@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVBIG_INT@@0PAE@Z
?QueryAttributeList@NTFS_FRS_STRUCTURE@@QAEEPAVNTFS_ATTRIBUTE_LIST@@@Z
?Resize@NTFS_ATTRIBUTE@@UAEEVBIG_INT@@PAVNTFS_BITMAP@@@Z
?Initialize@NTFS_MFT_INFO@@QAEEVBIG_INT@@PAVNTFS_UPCASE_TABLE@@EE_K@Z
??0NTFS_UPCASE_TABLE@@QAE@XZ
?QueryAttributeListAttribute@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_ATTRIBUTE@@PAE@Z
??1NTFS_INDEX_TREE@@UAE@XZ
?Flush@NTFS_FILE_RECORD_SEGMENT@@QAEEPAVNTFS_BITMAP@@PAVNTFS_INDEX_TREE@@E@Z
?SafeQueryAttribute@NTFS_FRS_STRUCTURE@@QAEEKPAVNTFS_ATTRIBUTE@@0@Z
?Initialize@NTFS_UPCASE_TABLE@@QAEEPAVNTFS_ATTRIBUTE@@@Z
??1NTFS_ATTRIBUTE_LIST@@UAE@XZ
??1NTFS_CLUSTER_RUN@@UAE@XZ
??0NTFS_ATTRIBUTE_DEFINITION_TABLE@@QAE@XZ
??0NTFS_BAD_CLUSTER_FILE@@QAE@XZ
Chkdsk
?Initialize@NTFS_FILE_RECORD_SEGMENT@@QAEEVBIG_INT@@PAVNTFS_MASTER_FILE_TABLE@@@Z
??1NTFS_REFLECTED_MASTER_FILE_TABLE@@UAE@XZ
??0NTFS_BITMAP_FILE@@QAE@XZ
??0NTFS_MFT_INFO@@QAE@XZ
??1NTFS_SA@@UAE@XZ
?IsDosName@NTFS_SA@@SGEPBU_FILE_NAME@@@Z
?GetNext@NTFS_INDEX_TREE@@QAEPBU_INDEX_ENTRY@@PAKPAEE@Z
??0NTFS_LOG_FILE@@QAE@XZ
?Write@NTFS_FRS_STRUCTURE@@QAEEXZ
?Initialize@NTFS_BOOT_FILE@@QAEEPAVNTFS_MASTER_FILE_TABLE@@@Z
?CreateDataAttribute@NTFS_LOG_FILE@@QAEEVBIG_INT@@KPAVNTFS_BITMAP@@@Z
clusapi
GetClusterGroupKey
GetNodeClusterState
ClusterRegDeleteValue
OpenClusterResource
OpenClusterNetInterface
ResumeClusterNode
GetClusterQuorumResource
CloseClusterNotifyPort
ClusterEnum
OpenClusterGroup
OpenClusterNode
ClusterCloseEnum
SetClusterNetworkPriorityOrder
ClusterResourceCloseEnum
CanResourceBeDependent
ClusterNodeOpenEnum
SetClusterNetworkName
DeleteClusterResource
ClusterGetEnumCount
AddClusterResourceNode
ClusterNodeControl
GetClusterResourceState
CreateClusterNotifyPort
ClusterRegQueryValue
OnlineClusterResource
CloseClusterResource
OfflineClusterResource
GetClusterResourceNetworkName
CloseClusterNetwork
GetClusterNetInterface
ClusterResourceControl
ClusterNetworkOpenEnum
ClusterResourceTypeCloseEnum
GetClusterNodeState
GetClusterFromGroup
GetClusterNetInterfaceKey
ClusterOpenEnum
ClusterGroupCloseEnum
CreateClusterResourceType
user32
DefRawInputProc
DrawFrameControl
UnhookWindowsHookEx
MessageBoxA
ShowWindowAsync
LoadMenuIndirectW
DdeCreateDataHandle
FindWindowExA
GetForegroundWindow
GetScrollInfo
GetDlgItemTextW
DispatchMessageA
ShowStartGlass
AlignRects
DrawAnimatedRects
ChangeDisplaySettingsExW
EndDialog
EnableWindow
GetOpenClipboardWindow
SetClassLongA
EnumWindowStationsW
SetKeyboardState
DrawEdge
ImpersonateDdeClientWindow
RealGetWindowClassW
BroadcastSystemMessageExW
GetInternalWindowPos
msvcrt
_mbsstr
ispunct
_heapadd
_XcptFilter
_chdrive
_stat64
_CIacos
_CIsqrt
feof
strcoll
_wcmdln
_adj_fdiv_m16i
_stricmp
??1bad_typeid@@UAE@XZ
_fcvt
_tzname
?name@type_info@@QBEPBDXZ
_ungetwch
gmtime
_ismbcprint
_c_exit
_getdiskfree
_adj_fdiv_r
__getmainargs
_wutime64
_mbsdec
setvbuf
_CIpow
??0__non_rtti_object@@QAE@PBD@Z
_mbslwr
strncpy
_wcsdup
_mbsncoll
__crtCompareStringW
exit
_lfind
_aexit_rtn
_wsopen
__p___initenv
_ismbbtrail
__p__commode
__set_app_type
__p__tzname
msvcirt
?attach@filebuf@@QAEPAV1@H@Z
??_7streambuf@@6B@
??5istream@@QAEAAV0@AAJ@Z
?snextc@streambuf@@QAEHXZ
??0filebuf@@QAE@ABV0@@Z
??1ofstream@@UAE@XZ
??0stdiobuf@@QAE@ABV0@@Z
??_Gios@@UAEPAXI@Z
??_Gofstream@@UAEPAXI@Z
??_8stdiostream@@7Bistream@@@
??0istrstream@@QAE@PAD@Z
??_8fstream@@7Bistream@@@
?clrlock@ios@@QAAXXZ
??_Eostream@@UAEPAXI@Z
?close@ofstream@@QAEXXZ
??_Efstream@@UAEPAXI@Z
?getline@istream@@QAEAAV1@PADHD@Z
?put@ostream@@QAEAAV1@D@Z
??_Distream_withassign@@QAEXXZ
?close@ifstream@@QAEXXZ
??_Estdiostream@@UAEPAXI@Z
?lock@streambuf@@QAEXXZ
?text@filebuf@@2HB
??0strstreambuf@@QAE@ABV0@@Z
??0logic_error@@QAE@ABQBD@Z
??0fstream@@QAE@H@Z
?write@ostream@@QAEAAV1@PBEH@Z
?precision@ios@@QAEHH@Z
??_Gstdiostream@@UAEPAXI@Z
?pbackfail@streambuf@@UAEHH@Z
??_8istrstream@@7B@
??_Eifstream@@UAEPAXI@Z
?flush@@YAAAVostream@@AAV1@@Z
?str@istrstream@@QAEPADXZ
??4ostream@@IAEAAV0@PAVstreambuf@@@Z
??0ifstream@@QAE@ABV0@@Z
shell32
SHGetMalloc
Sections
.text Size: 334KB - Virtual size: 334KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 187KB - Virtual size: 187KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 346KB - Virtual size: 1.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ