Behavioral task
behavioral1
Sample
57218246927b1767ce62f6b55ab89586786bdd00929ce853a96a15f323e18c26.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
57218246927b1767ce62f6b55ab89586786bdd00929ce853a96a15f323e18c26.exe
Resource
win10v2004-20220812-en
General
-
Target
57218246927b1767ce62f6b55ab89586786bdd00929ce853a96a15f323e18c26
-
Size
119KB
-
MD5
0827bf4710bfd3b138bad2e50b130fcc
-
SHA1
cb267ac71fb3bd89cd060635e8da02e38db16003
-
SHA256
57218246927b1767ce62f6b55ab89586786bdd00929ce853a96a15f323e18c26
-
SHA512
b4e99d30fab9c80ccf1aebd1fb85db5ba14d527fc45d695d33da66e0a2e8b0cab65cd004c7e1a6a3383077bbf33189077024d92f236738fc69d27986b82075d6
-
SSDEEP
3072:/WZqDVmYAFXkdJN85iZjLyVkJEZ0AzYP09HRU:eILAFXkdX85iZnyVkHAkP09xU
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
57218246927b1767ce62f6b55ab89586786bdd00929ce853a96a15f323e18c26.exe windows x86
aa87eacb0fde38399883a81cae940f63
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_stricmp
strstr
sprintf
wcscpy
exit
_wcsicmp
_c_exit
_exit
_XcptFilter
_cexit
__winitenv
__wgetmainargs
_initterm
printf
advapi32
RegCloseKey
RegQueryValueExA
RegOpenKeyExW
kernel32
GetModuleFileNameW
GetWindowsDirectoryW
GetCurrentProcessId
ProcessIdToSessionId
LoadLibraryW
GetProcAddress
WideCharToMultiByte
MultiByteToWideChar
ExpandEnvironmentStringsW
GetLastError
GetModuleHandleW
LocalAlloc
LocalFree
VirtualAlloc
VirtualFree
FreeLibrary
GetModuleHandleA
ntdll
NtOpenFile
NtClose
DbgPrint
NtQuerySystemInformation
RtlInitUnicodeString
rasapi32
RasGetAutodialParamW
RasGetAutodialAddressW
RasEnumAutodialAddressesW
rasdlg
RasAutodialQueryDlgW
RasPhonebookDlgW
RasDialDlgW
shlwapi
StrCatW
tapi32
lineShutdown
lineInitialize
lineGetTranslateCapsW
ws2_32
WSAStartup
Sections
.text Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 644B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.UPX0 Size: 108KB - Virtual size: 260KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE