Static task
static1
Behavioral task
behavioral1
Sample
90ee3039b608224cca6a5ca422979c277266747737ff7f6b9d0160f6994c754f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
90ee3039b608224cca6a5ca422979c277266747737ff7f6b9d0160f6994c754f.exe
Resource
win10v2004-20220812-en
General
-
Target
90ee3039b608224cca6a5ca422979c277266747737ff7f6b9d0160f6994c754f
-
Size
509KB
-
MD5
0de81d17ea7bfed02daa89aaffe2805c
-
SHA1
7331e2c0f48a75b2de3c9910b7134dad760bec9a
-
SHA256
90ee3039b608224cca6a5ca422979c277266747737ff7f6b9d0160f6994c754f
-
SHA512
0395940e624f6814401be392c3da5ab5a6412452b8f723a00f73457e095ca29b30634f537bcb389c70622efa8c93762a07b18479d10e2627bc5db10fb6bc4512
-
SSDEEP
6144:TTgPyeBUnG2Z3UiFGcbMrZoz0eMsfNY2F9LIOvBSaOWWWWWWWWWWWWWWWWWWWWWy:XgPyesG2BUiGZcSLAkY2eG
Malware Config
Signatures
Files
-
90ee3039b608224cca6a5ca422979c277266747737ff7f6b9d0160f6994c754f.exe windows x86
ff90c3c39a9874646b0cfb0463129d6b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
rpcrt4
NdrConformantStringUnmarshall
RpcServerUnregisterIf
RpcServerListen
RpcServerRegisterIf2
RpcServerUseProtseqEpA
RpcRaiseException
NdrConvert
NdrServerInitializeNew
NdrPointerUnmarshall
NdrConformantArrayUnmarshall
setupapi
InstallHinfSectionW
mfc80u
ord265
ord1176
ord3789
ord4347
ord2788
ord6282
ord1172
ord5316
ord6293
ord5327
ord3249
ord3224
ord4232
ord2083
ord5867
ord658
ord3645
ord6086
ord1556
ord1634
ord2364
ord1572
ord3286
ord6116
ord715
ord416
ord4098
ord651
ord5869
ord2081
ord2159
ord1628
ord1549
ord4230
ord3208
ord2155
ord5829
ord2460
ord642
ord1785
ord4008
ord4032
ord3824
ord3327
ord4475
ord2239
ord2832
ord5562
ord5209
ord5226
ord4562
ord3942
ord5222
ord5220
ord2925
ord1911
ord266
ord5378
ord6215
ord5096
ord1007
ord4535
ord3800
ord3677
ord5579
ord2009
ord2054
ord4320
ord6274
ord566
ord3795
ord757
ord6272
ord1908
ord2867
ord2876
ord2151
ord2444
ord2260
ord762
ord764
ord2651
ord2640
ord1608
ord5609
ord2534
ord1611
ord3198
ord2856
ord1353
ord5908
ord3435
ord2708
ord6720
ord4301
ord2829
ord2725
ord1542
ord605
ord2531
ord1661
ord5196
ord1178
ord1182
ord572
ord3157
ord2985
ord709
ord501
ord774
ord1662
ord1590
ord1198
ord2011
ord1646
ord4574
ord1271
ord1647
ord4884
ord1955
ord5178
ord5171
ord3678
ord4119
ord777
ord2361
ord6033
ord326
ord5723
ord5727
ord2086
ord5638
ord1582
ord6721
ord5911
ord1393
ord4234
ord5210
ord2648
ord4255
ord3311
ord2366
ord741
ord4882
ord3940
ord2527
ord1392
ord3712
ord4238
ord3713
ord5148
ord3703
ord1899
ord2638
ord5067
ord3943
ord6271
ord4480
ord4179
ord4256
ord2362
ord3204
ord5199
ord5633
ord283
ord1270
ord3397
ord4716
ord602
ord4276
ord280
ord347
ord1591
ord2311
ord5956
ord5231
ord5229
ord920
ord925
ord929
ord927
ord1118
ord931
ord1894
ord2384
ord2404
ord3756
ord2388
ord2394
ord2392
ord1058
ord3635
ord2390
ord2407
ord577
ord2402
ord2386
ord2409
ord293
ord354
ord2397
ord2379
ord2381
ord1925
ord2399
ord2169
ord2163
ord6063
ord1513
ord6273
ord2310
ord3796
ord4026
ord6275
ord776
ord3339
ord4961
ord1079
ord3826
ord3155
msvcr80
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
_CxxThrowException
__set_app_type
_unlock
__dllonexit
_crt_debugger_hook
_lock
_XcptFilter
_exit
_cexit
__wgetmainargs
_amsg_exit
bsearch
memcpy
memset
wcsncmp
_vsnwprintf
_stricmp
_beginthreadex
wcstoul
_errno
strncpy_s
_vsnwprintf_s
_wcsnicmp
_wcsicmp
wcscat_s
wcsrchr
wcsncpy_s
wcschr
wcsstr
_wcsupr_s
wcscpy_s
memcpy_s
_wsplitpath_s
malloc
_purecall
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
free
_invalid_parameter_noinfo
calloc
??0exception@std@@QAE@XZ
memmove_s
_onexit
_decode_pointer
?terminate@@YAXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
?_type_info_dtor_internal_method@type_info@@QAEXXZ
exit
_recalloc
??1exception@std@@UAE@XZ
_wtoi
_ultow_s
__CxxFrameHandler3
_encode_pointer
kernel32
ReleaseMutex
CreateMutexW
WideCharToMultiByte
GetPrivateProfileStringW
GetPrivateProfileIntW
WritePrivateProfileStringW
GetLocalTime
LocalAlloc
SetCurrentDirectoryW
OutputDebugStringW
SetLastError
lstrcmpW
CopyFileW
SetFileAttributesW
MoveFileExW
lstrlenW
GetTickCount
TerminateProcess
CreateFileW
GetShortPathNameW
GetDriveTypeW
CloseHandle
FindClose
FindNextFileW
FindFirstFileW
GetCurrentProcess
LocalFree
WaitForSingleObject
LoadLibraryW
GetProcAddress
GetModuleFileNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateDirectoryW
GetFileAttributesW
FreeLibrary
Sleep
DeleteFileW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
lstrlenA
GetLastError
MultiByteToWideChar
lstrcpyW
GetThreadLocale
GetDriveTypeA
LoadResource
FindResourceExW
LoadLibraryExW
MapViewOfFile
CreateFileMappingW
GetLocaleInfoW
UnmapViewOfFile
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
FindResourceW
SearchPathW
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoW
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
UnhandledExceptionFilter
IsDebuggerPresent
GetVersionExW
SetThreadPriority
GetCurrentThreadId
ResumeThread
GetCurrentProcessId
lstrcpynW
GetACP
GetLocaleInfoA
GetVersionExA
GetExitCodeThread
user32
PtInRect
GetWindowLongW
IsIconic
FindWindowW
SetTimer
KillTimer
ScreenToClient
GetCursorPos
ExitWindowsEx
PostMessageW
SetCursor
UpdateWindow
DrawStateW
GetSystemMetrics
DrawFocusRect
DestroyCursor
FrameRect
FillRect
GetSysColor
GetParent
GetWindowRect
SendMessageW
EnableWindow
GetClientRect
DrawMenuBar
InvalidateRect
EnableMenuItem
GetSystemMenu
LoadBitmapW
LoadIconW
RedrawWindow
SetActiveWindow
gdi32
GetObjectW
GetTextExtentPoint32W
CreateFontIndirectW
StretchBlt
CreateCompatibleDC
GetCurrentObject
advapi32
OpenServiceW
OpenSCManagerW
InitializeSecurityDescriptor
MakeAbsoluteSD
GetSecurityDescriptorControl
GetSidSubAuthority
GetSecurityDescriptorLength
InitializeSid
MakeSelfRelativeSD
GetSidLengthRequired
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
IsValidSid
GetLengthSid
GetAclInformation
AddAce
InitializeAcl
RegCreateKeyExW
RegEnumKeyExW
RegFlushKey
RegDeleteValueW
RegDeleteKeyW
RegEnumValueW
RegSetValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
CopySid
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
StartServiceW
ControlService
QueryServiceStatus
CloseServiceHandle
shell32
SHGetSpecialFolderPathW
comctl32
_TrackMouseEvent
InitCommonControlsEx
shlwapi
StrToIntW
PathFindFileNameA
msvcp80
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NPB_WABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?rfind@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??$?9_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_WABV10@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
Sections
.text Size: 196KB - Virtual size: 192KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 188KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE