Static task
static1
Behavioral task
behavioral1
Sample
1bfeb2192487c9692f81b0ce7ef556dd2f6da9ea819e4745651c63aeb371b38b.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
1bfeb2192487c9692f81b0ce7ef556dd2f6da9ea819e4745651c63aeb371b38b.exe
Resource
win10v2004-20220812-en
General
-
Target
1bfeb2192487c9692f81b0ce7ef556dd2f6da9ea819e4745651c63aeb371b38b
-
Size
238KB
-
MD5
2c2087a24c35d47b9d5cba9f3f578030
-
SHA1
35bb172e6701cea10db78433c57dc4bcaa132e2c
-
SHA256
1bfeb2192487c9692f81b0ce7ef556dd2f6da9ea819e4745651c63aeb371b38b
-
SHA512
6b84f1117f4bd468da42d2269fc632f88c036c0e17a262f2d932354aa49d1a9377c8ad634d34ac273c542e564126c62ea429fc006baf96a4613d78e7695a0868
-
SSDEEP
3072:pdUtINgZ+9SRTwPqjMBK68XVfg43378NU269qlKEadQ21C3mxh6MOSAke8wYfMP:pdUtS9SRTNf5d78NUJqza22LxkZDYfe
Malware Config
Signatures
Files
-
1bfeb2192487c9692f81b0ce7ef556dd2f6da9ea819e4745651c63aeb371b38b.exe windows x86
e4a55984b05457fb453fe0a7750b05b4
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rtm
RtmCloseEnumerationHandle
RtmGetEnumNextHops
RtmReadAddressFamilyConfig
MgmGetMfe
RtmGetExactMatchRoute
RtmLookupIPDestination
RtmBlockDeleteRoutes
RtmGetRoutePointer
RtmCreateRouteEnum
RtmCreateRouteListEnum
RtmGetOpaqueInformationPointer
RtmDeleteRouteList
RtmIsMarkedForChangeNotification
RtmGetFirstRoute
RtmGetEnumRoutes
RtmGetChangedDests
MgmGetNextMfe
MgmReleaseInterfaceOwnership
DestroyTable
RtmReleaseEntityInfo
RtmGetMostSpecificDestination
RtmReleaseNextHops
RtmGetRouteInfo
RtmDeleteRouteTable
RtmIsBestRoute
MgmDeleteGroupMembershipEntry
RtmDeleteEnumHandle
MgmGetNextMfeStats
kernel32
SetTimeZoneInformation
UpdateResourceW
CreateSocketHandle
SetConsoleOS2OemFormat
LoadLibraryW
SetLastError
OpenFileMappingW
GetTimeZoneInformation
CreatePipe
CloseProfileUserMapping
HeapWalk
CreateRemoteThread
GetTickCount
GetConsoleCharType
cmutil
?IsEnabled@CmLogFile@@QAEHXZ
?Stop@CmLogFile@@QAEJXZ
?GetRegPath@CIniA@@QBEPBDXZ
?Generate@CRandom@@QAEHXZ
??1CIniA@@QAE@XZ
??4CIniA@@QAEAAV0@ABV0@@Z
?GetPrimaryFile@CIniW@@QBEPBGXZ
WzToSzWithAlloc
CmLoadSmallIconW
CmBuildFullPathFromRelativeA
?SetRegPath@CIniW@@QAEXPBG@Z
?SetPrimaryRegPath@CIniW@@QAEXPBG@Z
GetOSVersion
?SetPrimaryFile@CIniA@@QAEXPBD@Z
?Init@CmLogFile@@QAEJPAUHINSTANCE__@@HPBD@Z
CmStrrchrW
?SetEntry@CIniW@@QAEXPBG@Z
?Write@CmLogFile@@AAEJPAG@Z
??1CIniW@@QAE@XZ
MakeBold
?GetRegPath@CIniW@@QBEPBGXZ
?CIniA_DeleteEntryFromReg@CIniA@@IBEHPAUHKEY__@@PBD1@Z
??0CIniW@@QAE@PAUHINSTANCE__@@PBG111@Z
?LoadSection@CIniA@@QBEPADPBD@Z
CmLoadSmallIconA
?SetSection@CIniW@@QAEXPBG@Z
hhsetup
?Save@CCollection@@QAEKXZ
?GetLangId@CCollection@@QAEGPBG@Z
?ParseFile@CCollection@@AAEKPBD@Z
?DeleteFolders@CCollection@@AAEXPAPAVCFolder@@@Z
??0CFIFOString@@QAE@XZ
?GetVisableRootFolder@CCollection@@QAEPAVCFolder@@XZ
?FirstLocation@CCollection@@QAEPAVCLocation@@XZ
?SetId@CTitle@@QAEXPBD@Z
?CheckTitleRef@CCollection@@AAEKPBDG@Z
?GetMasterCHM@CCollection@@QAEHPAPADPAG@Z
?GetVolume@CLocation@@QAEPADXZ
?AllocCopyValue@CCollection@@AAEKPAVCParseXML@@PADPAPAD@Z
?SetLanguage@CTitle@@QAEXG@Z
??0CFolder@@QAE@XZ
?GetFindMergedCHMS@CCollection@@QAEHXZ
??1CCollection@@QAE@XZ
?Release@CCollection@@AAEKXZ
?Open@CCollection@@QAEKPBG@Z
?DeleteLocation@CCollection@@AAEKPAVCLocation@@@Z
?SetTitle@CFolder@@QAEXPBD@Z
?GetFirstTitle@CCollection@@QAEPAVCTitle@@XZ
?GetLangId@CCollection@@QAEGPBD@Z
?IncrementRefTitleCount@CCollection@@QAEXXZ
?AddChildFolder@CFolder@@QAEKPAV1@@Z
?GetLanguage@CTitle@@QAEGXZ
??1CFIFOString@@QAE@XZ
?SetParent@CFolder@@QAEXPAV1@@Z
?GetId@CLocation@@QBEPADXZ
??4CFolder@@QAEAAV0@ABV0@@Z
?SetFirstChildFolder@CFolder@@QAEXPAV1@@Z
msdtcprx
ShutDownCM
DTC_XaRollback
DTC_XaPrepare
?RemoveDtc@@YGJPAG00@Z
?GetDtcLogPath@@YGHKPAG@Z
DTC_XaClose
?Create@CNameService@@SGJPAPAV1@@Z
ContactToNameObject
?CreateInstance@CTmProxyCore@@SGJPAPAV1@PAUIUnknown@@@Z
DllGetDTCConnectionManager
DllGetDTCUtilObject
DllGetClassObject
DTC_XaOpen
DTC_XaComplete
?InstallDtcClient@@YGJPAGKK@Z
DTC_XaCommit
DTC_XaEnd
DllRegisterServer
DllGetTransactionManagerCore
DTC_XaForget
DTC_XaStart
DTC_XaRecover
DllUnregisterServer
DllGetDTCProxy
t2embed
_TTEmbedFontFromFileA@52
TTIsEmbeddingEnabled
_TTLoadEmbeddedFont@40
TTDeleteEmbeddedFont
_TTRunValidationTests@8
TTGetEmbeddedFontInfo
_TTGetEmbeddingType@8
_TTIsEmbeddingEnabled@8
TTEmbedFont
TTEnableEmbeddingForFacename
TTRunValidationTestsEx
_TTEnableEmbeddingForFacename@8
_TTDeleteEmbeddedFont@12
TTEmbedFontEx
_TTCharToUnicode@24
TTGetEmbeddingType
_TTIsEmbeddingEnabledForFacename@8
_TTGetEmbeddedFontInfo@28
TTRunValidationTests
TTLoadEmbeddedFont
TTCharToUnicode
TTEmbedFontFromFileA
_TTEmbedFont@44
TTIsEmbeddingEnabledForFacename
Sections
.text Size: 41KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 133KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ