Static task
static1
Behavioral task
behavioral1
Sample
05fe5b8c568c255b7c33e225b2e29035ebe74351d0e2892ad38222eb2dbc9970.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
05fe5b8c568c255b7c33e225b2e29035ebe74351d0e2892ad38222eb2dbc9970.exe
Resource
win10v2004-20220812-en
General
-
Target
05fe5b8c568c255b7c33e225b2e29035ebe74351d0e2892ad38222eb2dbc9970
-
Size
853KB
-
MD5
2240b274d9a10b2a92c70d85f8245933
-
SHA1
04065ec44f1f454a37b8452d7f4e17006709ab22
-
SHA256
05fe5b8c568c255b7c33e225b2e29035ebe74351d0e2892ad38222eb2dbc9970
-
SHA512
41f476c0e712d7907c7f2632b8093faa42844441787aa8b62ce37f156373c9e7d1470e018bcb3a186fc48422930f561e9f14c3305092299abf83da552ac650b8
-
SSDEEP
12288:C33TSMPpwZflpeZpJhfJHjDw8HnwpVq8RHUa0MMU75TTrsf6mZCZ5LURDA+:ETPKpeZ1fVjDw8HsJHP95TnsSdZY
Malware Config
Signatures
Files
-
05fe5b8c568c255b7c33e225b2e29035ebe74351d0e2892ad38222eb2dbc9970.exe windows x86
0a7a8c4c0caf99b9722fb857402553cc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
msvcirt
??4istrstream@@QAEAAV0@ABV0@@Z
?pcount@strstream@@QBEHXZ
??_Distream_withassign@@QAEXXZ
?setmode@ifstream@@QAEHH@Z
?x_curindex@ios@@0HA
??_Gfilebuf@@UAEPAXI@Z
??0ofstream@@QAE@XZ
?out_waiting@streambuf@@QBEHXZ
?sh_write@filebuf@@2HB
??0ostream@@QAE@PAVstreambuf@@@Z
??4istream_withassign@@QAEAAVistream@@ABV1@@Z
?clrlock@streambuf@@QAEXXZ
?iword@ios@@QBEAAJH@Z
??_Gstdiostream@@UAEPAXI@Z
??_Eostream@@UAEPAXI@Z
??6ostream@@QAEAAV0@D@Z
??_7istream@@6B@
??_Eostrstream@@UAEPAXI@Z
?read@istream@@QAEAAV1@PACH@Z
?getline@istream@@QAEAAV1@PAEHD@Z
?get@istream@@QAEAAV1@PAEHD@Z
??_Gstrstream@@UAEPAXI@Z
?str@strstream@@QAEPADXZ
??4iostream@@IAEAAV0@PAVstreambuf@@@Z
?binary@filebuf@@2HB
??6ostream@@QAEAAV0@P6AAAV0@AAV0@@Z@Z
??_Diostream@@QAEXXZ
?lock@ios@@QAAXXZ
??_Efilebuf@@UAEPAXI@Z
??_Estreambuf@@UAEPAXI@Z
?setbuf@filebuf@@UAEPAVstreambuf@@PADH@Z
??5istream@@QAEAAV0@AAM@Z
??_8istrstream@@7B@
??_8ostream_withassign@@7B@
??0strstreambuf@@QAE@H@Z
?put@ostream@@QAEAAV1@C@Z
??0ofstream@@QAE@H@Z
?precision@ios@@QBEHXZ
??0logic_error@@QAE@ABV0@@Z
??0iostream@@IAE@ABV0@@Z
kernel32
HeapLock
GetCommConfig
LocalReAlloc
Process32FirstW
EnumUILanguagesA
GetShortPathNameA
PeekNamedPipe
FormatMessageW
SetConsoleCtrlHandler
CloseConsoleHandle
EraseTape
GetTimeFormatW
FreeUserPhysicalPages
PrivMoveFileIdentityW
LZStart
DeleteTimerQueueTimer
MoveFileWithProgressA
VirtualAlloc
GetConsoleAliasA
CallNamedPipeW
EnterCriticalSection
GetNextVDMCommand
ExitProcess
LoadLibraryExA
GetStartupInfoA
GetWindowsDirectoryW
CreateTapePartition
RestoreLastError
TermsrvAppInstallMode
TlsAlloc
GetConsoleCommandHistoryLengthW
DeleteCriticalSection
FindNextVolumeMountPointA
LeaveCriticalSection
ReadFile
CreateJobSet
HeapWalk
LoadLibraryA
GetThreadPriorityBoost
GetConsoleAliasExesLengthA
expsrv
EbGetErrorInfo
__vbaInStr
EbGetHandleOfExecutingProject
rtcSpaceBstr
__vbaVarLike
__vbaUI1Sgn
rtcGetErl
__vbaVargUnkAddref
__vbaVarTstGt
__vbaR8IntI4
rtcLenCharVar
rtcSetFileAttr
__vbaVargObj
rtcDoEvents
__vbaVarTstNe
__vbaStrCy
rtcRightVar
__vbaCastObjVar
__vbaFpR8
__vbaUI1I2
rtcSpaceVar
__vbaLenBstrB
rtcGetHourOfDay
rtcDeleteSetting
__vbaEraseNoPop
__vbaR8Str
rtcAnsiValueBstr
rtcVarFromVar
msvcrt40
fwprintf
wcscmp
?get@istream@@QAEAAV1@AAVstreambuf@@D@Z
_beginthread
??0stdiostream@@QAE@ABV0@@Z
?setb@streambuf@@IAEXPAD0H@Z
_mktemp
??_Gstrstream@@UAEPAXI@Z
_pgmptr
fputws
?pword@ios@@QBEAAPAXH@Z
_ismbcdigit
??_Eofstream@@UAEPAXI@Z
wcspbrk
?cin@@3Vistream_withassign@@A
_mbctolower
?setmode@filebuf@@QAEHH@Z
??_Gifstream@@UAEPAXI@Z
_wfindfirst
_ismbbkpunct
??_7ostream@@6B@
??0exception@@QAE@ABQBD@Z
?bad@ios@@QBEHXZ
_wgetdcwd
_waccess
?epptr@streambuf@@IBEPADXZ
??1strstream@@UAE@XZ
iswupper
_longjmpex
_execlpe
?tellp@ostream@@QAEJXZ
?sunk_with_stdio@ios@@0HA
??6ostream@@QAEAAV0@H@Z
_CIatan2
wcstod
wcstoul
_outp
msvcp60
?_Isinf@?$_Ctr@O@std@@SA_NO@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?positive_sign@?$_Mpunct@D@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAPAX@Z
??0ios_base@std@@IAE@XZ
?_Init@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@IAEXABV_Locinfo@2@@Z
?id@?$num_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?eq@?$char_traits@D@std@@SA_NABD0@Z
?underflow@?$basic_stringbuf@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@MAEGXZ
?exp@?$_Ctr@O@std@@SAOO@Z
?cos@?$_Ctr@O@std@@SAOO@Z
??0?$moneypunct@G$0A@@std@@QAE@ABV_Locinfo@1@I@Z
??0?$complex@N@std@@QAE@ABV?$complex@M@1@@Z
?quiet_NaN@?$numeric_limits@E@std@@SAEXZ
?quiet_NaN@?$numeric_limits@H@std@@SAHXZ
?sinh@std@@YA?AV?$complex@M@1@ABV21@@Z
??0?$messages@G@std@@QAE@I@Z
?seekpos@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?clear@ios_base@std@@QAEXF@Z
?do_compare@?$collate@D@std@@MBEHPBD000@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z
?write@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@PBGH@Z
?denorm_min@?$numeric_limits@G@std@@SAGXZ
??0?$messages@D@std@@QAE@I@Z
?compare@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEHIIABV12@@Z
??4?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??_D?$basic_stringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?do_date_order@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@MBEHXZ
?seekp@?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?find_first_of@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIGI@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PAG0IG@Z
?_Makpat@?$_Mpunct@G@std@@AAEXAAUpattern@money_base@2@DDD@Z
?id@?$codecvt@GDH@std@@2V0locale@2@A
?do_falsename@?$numpunct@G@std@@MBE?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@2@XZ
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Clocptr@_Locimp@locale@std@@0PAV123@A
?eq_int_type@?$char_traits@D@std@@SA_NABH0@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
?sync@?$basic_filebuf@DU?$char_traits@D@std@@@std@@MAEHXZ
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$complex@N@0@@Z
??1?$money_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@UAE@XZ
advapi32
AccessCheckByTypeResultList
CredDeleteW
CryptSetProviderA
RegConnectRegistryA
SystemFunction022
RegEnumKeyA
LookupPrivilegeValueA
AddAuditAccessObjectAce
GetUserNameW
BuildTrusteeWithObjectsAndNameW
CredFree
SetNamedSecurityInfoW
QueryRecoveryAgentsOnEncryptedFile
SetSecurityDescriptorGroup
GetTrusteeNameA
SetSecurityDescriptorRMControl
GetManagedApplications
WmiFileHandleToInstanceNameA
MD5Update
QueryServiceObjectSecurity
MakeAbsoluteSD2
CredReadDomainCredentialsA
GetAclInformation
SetNamedSecurityInfoA
RemoveUsersFromEncryptedFile
LsaCreateTrustedDomain
GetAce
LsaGetSystemAccessAccount
SaferRecordEventLogEntry
LsaSetTrustedDomainInfoByName
EqualSid
AddAce
BuildTrusteeWithObjectsAndSidW
CryptHashSessionKey
CryptContextAddRef
RegisterEventSourceA
CreatePrivateObjectSecurity
SaferiIsExecutableFileType
GetSecurityInfoExW
CredIsMarshaledCredentialW
SaferGetPolicyInformation
Sections
.text Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 231KB - Virtual size: 230KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 556KB - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ