Static task
static1
Behavioral task
behavioral1
Sample
e20d1ca2d7b5b613c5b3cb445af9347479c0f4e6395f7e35c8d92c0024767cf3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e20d1ca2d7b5b613c5b3cb445af9347479c0f4e6395f7e35c8d92c0024767cf3.exe
Resource
win10v2004-20220812-en
General
-
Target
e20d1ca2d7b5b613c5b3cb445af9347479c0f4e6395f7e35c8d92c0024767cf3
-
Size
385KB
-
MD5
0016e053b49f5af9f1a044fd0fe57050
-
SHA1
1a4f7e58f2666270c63d198b06e83447568bf9f7
-
SHA256
e20d1ca2d7b5b613c5b3cb445af9347479c0f4e6395f7e35c8d92c0024767cf3
-
SHA512
c42b34778bd5725ab58f2c5fe885bd53d664d5b310502b2f8c76a47685104d4fcf499c4098935a2ecc30b0d6bb65e81ae443b11c676647efc705c6c1c6e2bc58
-
SSDEEP
6144:JVVL1cBJM7vpUWolNwBFz8bEJoP6iR3WlQ6A1XyA5ZOT:gfqpElEw4YVRLf5BZ
Malware Config
Signatures
Files
-
e20d1ca2d7b5b613c5b3cb445af9347479c0f4e6395f7e35c8d92c0024767cf3.exe windows x86
1bae8891b768b7a56fb8240e453f840b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegQueryValueExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegCloseKey
kernel32
ReadFile
GetSystemTime
SystemTimeToFileTime
GetProductInfo
GetLocalTime
CreateDirectoryW
SetFilePointer
WideCharToMultiByte
lstrlenA
WriteFile
CreateEventW
GetModuleFileNameW
SetLastError
MulDiv
GetVersionExW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
HeapAlloc
GetProcessHeap
MultiByteToWideChar
GetTickCount
lstrcmpiW
GetLocaleInfoW
GetUserDefaultUILanguage
lstrlenW
GetLastError
ExpandEnvironmentStringsW
CloseHandle
CreateThread
GetFileAttributesExW
LocalFree
LocalAlloc
GetFileSizeEx
CreateFileW
FreeLibrary
LoadLibraryW
WaitForSingleObject
LoadLibraryExW
GetProcAddress
HeapFree
InterlockedIncrement
InterlockedDecrement
user32
GetParent
GetWindowTextW
DestroyWindow
DefWindowProcW
SetWindowTextW
GetWindowLongW
PostMessageW
EndDialog
DialogBoxParamW
LoadImageW
CreateWindowExW
SendMessageW
PostQuitMessage
SetProcessDPIAware
AllowSetForegroundWindow
GetMessageW
TranslateMessage
MessageBoxW
SetWindowLongW
LoadIconW
ShowWindow
GetWindowPlacement
SetForegroundWindow
FindWindowW
LoadStringW
DispatchMessageW
CallWindowProcW
SystemParametersInfoW
GetDlgItem
ReleaseDC
GetDC
IsProcessDPIAware
msvcrt
_acmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_except_handler4_common
_controlfp
exit
_cexit
__getmainargs
??_U@YAPAXI@Z
_ismbblead
??_V@YAXPAX@Z
wcschr
memcpy
_XcptFilter
_vsnwprintf
??2@YAPAXI@Z
_purecall
memset
??3@YAXPAX@Z
memmove
_exit
ole32
CoInitialize
CoCreateInstance
CoUninitialize
oleaut32
SysFreeString
SysAllocString
SetErrorInfo
VariantClear
LoadTypeLi
LoadRegTypeLi
VariantInit
shlwapi
ord176
ord168
ord199
ord219
ord278
shell32
ShellExecuteW
ShellExecuteExW
uxtheme
SetWindowThemeAttribute
pidgenx
PidGenX
dui70
?Register@HWNDHost@DirectUI@@SGJXZ
?GetFactoryLock@Element@DirectUI@@SGPAU_RTL_CRITICAL_SECTION@@XZ
??0CritSecLock@DirectUI@@QAE@PAU_RTL_CRITICAL_SECTION@@@Z
?ClassExist@ClassInfoBase@DirectUI@@SG_NPAPAUIClassInfo@2@PBQBUPropertyInfo@2@IPAU32@PAUHINSTANCE__@@PBG_N@Z
?Register@ClassInfoBase@DirectUI@@QAEJXZ
??1CritSecLock@DirectUI@@QAE@XZ
??0HWNDHost@DirectUI@@QAE@XZ
?Initialize@ClassInfoBase@DirectUI@@QAEJPAUHINSTANCE__@@PBG_NPBQBUPropertyInfo@2@I@Z
?EraseBkgnd@HWNDHost@DirectUI@@MAE_NPAUHDC__@@PAJ@Z
?SetWindowDirection@HWNDHost@DirectUI@@UAEXPAUHWND__@@@Z
?OnAdjustWindowSize@HWNDHost@DirectUI@@UAEHHHI@Z
?OnWindowStyleChanged@HWNDHost@DirectUI@@UAEXIPBUtagSTYLESTRUCT@@@Z
?OnCtrlThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSinkThemeChanged@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnSysChar@HWNDHost@DirectUI@@UAE_NG@Z
?OnMessage@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?OnNotify@HWNDHost@DirectUI@@UAE_NIIJPAJ@Z
?GetHWND@HWNDHost@DirectUI@@UAEPAUHWND__@@XZ
?HandleUiaEventListener@Element@DirectUI@@UAEXPAUEvent@2@@Z
?HandleUiaPropertyChangingListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@@Z
?HandleUiaPropertyListener@Element@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?HandleUiaDestroyListener@Element@DirectUI@@UAEXXZ
?GetElementProviderImpl@Element@DirectUI@@UAEJPAVInvokeHelper@2@PAPAVElementProvider@2@@Z
?DefaultAction@Element@DirectUI@@UAEJXZ
?GetAccessibleImpl@HWNDHost@DirectUI@@UAEJPAPAUIAccessible@@@Z
?GetKeyFocused@HWNDHost@DirectUI@@UAE_NXZ
?RemoveTooltip@Element@DirectUI@@MAEXPAV12@@Z
?ActivateTooltip@Element@DirectUI@@MAEXPAV12@K@Z
?UpdateTooltip@Element@DirectUI@@MAEXPAV12@@Z
?OnUnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?OnHosted@HWNDHost@DirectUI@@MAEXPAVElement@2@@Z
?_SelfLayoutUpdateDesiredSize@Element@DirectUI@@MAE?AUtagSIZE@@HHPAVSurface@2@@Z
?_SelfLayoutDoLayout@Element@DirectUI@@MAEXHH@Z
?MessageCallback@HWNDHost@DirectUI@@UAEIPAUtagGMSG@@@Z
?SetKeyFocus@HWNDHost@DirectUI@@UAEXXZ
?EnsureVisible@Element@DirectUI@@UAE_NHHHH@Z
?GetAdjacent@Element@DirectUI@@UAEPAV12@PAV12@HPBUNavReference@2@K@Z
?Remove@Element@DirectUI@@UAEJPAPAV12@I@Z
?Insert@Element@DirectUI@@UAEJPAPAV12@II@Z
?Add@Element@DirectUI@@UAEJPAPAV12@I@Z
?GetContentSize@Element@DirectUI@@UAE?AUtagSIZE@@HHPAVSurface@2@@Z
?Paint@HWNDHost@DirectUI@@UAEXPAUHDC__@@PBUtagRECT@@1PAU4@2@Z
?OnEvent@HWNDHost@DirectUI@@UAEXPAUEvent@2@@Z
?OnDestroy@HWNDHost@DirectUI@@UAEXXZ
?OnMouseFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnKeyFocusMoved@Element@DirectUI@@UAEXPAV12@0@Z
?OnInput@HWNDHost@DirectUI@@UAEXPAUInputEvent@2@@Z
?OnGroupChanged@Element@DirectUI@@UAEXH_N@Z
?OnPropertyChanged@Element@DirectUI@@UAEXPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanged@HWNDHost@DirectUI@@UAEXPBUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPAUPropertyInfo@2@HPAVValue@2@1@Z
?OnPropertyChanging@Element@DirectUI@@UAE_NPBUPropertyInfo@2@HPAVValue@2@1@Z
?GetContentStringAsDisplayed@Element@DirectUI@@UAEPBGPAPAVValue@2@@Z
?IsContentProtected@Element@DirectUI@@UAE_NXZ
?IsRTLReading@Element@DirectUI@@UAE_NXZ
??1HWNDHost@DirectUI@@UAE@XZ
?Initialize@HWNDHost@DirectUI@@QAEJIIPAVElement@2@PAK@Z
??1ClassInfoBase@DirectUI@@UAE@XZ
?AssertPIZeroRef@ClassInfoBase@DirectUI@@UBEXXZ
?GetChildren@ClassInfoBase@DirectUI@@UBEHXZ
?RemoveChild@ClassInfoBase@DirectUI@@UAEXXZ
?AddChild@ClassInfoBase@DirectUI@@UAEXXZ
?IsGlobal@ClassInfoBase@DirectUI@@UBE_NXZ
?GetModule@ClassInfoBase@DirectUI@@UBEPAUHINSTANCE__@@XZ
?IsSubclassOf@ClassInfoBase@DirectUI@@UBE_NPAUIClassInfo@2@@Z
?IsValidProperty@ClassInfoBase@DirectUI@@UBE_NPBUPropertyInfo@2@@Z
?GetName@ClassInfoBase@DirectUI@@UBEPBGXZ
?GetGlobalIndex@ClassInfoBase@DirectUI@@UBEIXZ
?GetPICount@ClassInfoBase@DirectUI@@UBEIXZ
?GetByClassIndex@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?EnumPropertyInfo@ClassInfoBase@DirectUI@@UAEPBUPropertyInfo@2@I@Z
?Release@ClassInfoBase@DirectUI@@UAEHXZ
?AddRef@ClassInfoBase@DirectUI@@UAEXXZ
??0ClassInfoBase@DirectUI@@QAE@XZ
?GetClassInfoPtr@HWNDHost@DirectUI@@SGPAUIClassInfo@2@XZ
?FireEvent@Element@DirectUI@@QAEXPAUEvent@2@_N1@Z
?CreateGraphic@Value@DirectUI@@SGPAV12@PAUHICON__@@_N11@Z
?ContentProp@Element@DirectUI@@SGPBUPropertyInfo@2@XZ
?SetValue@Element@DirectUI@@QAEJP6GPBUPropertyInfo@2@XZHPAVValue@2@@Z
?Release@Value@DirectUI@@QAEXXZ
?SetAccName@Element@DirectUI@@QAEJPBG@Z
?SetNotifyHandler@CCBase@DirectUI@@QAEXP6GHIIJPAJPAX@Z1@Z
?IsRTL@Element@DirectUI@@QAE_NXZ
?GetVisible@Element@DirectUI@@QAE_NXZ
?GetEnabled@Element@DirectUI@@QAE_NXZ
?KeyboardNavigate@Element@DirectUI@@SG?AVUID@@XZ
?SetSelected@Element@DirectUI@@QAEJ_N@Z
?RemoveListener@Element@DirectUI@@QAEXPAUIElementListener@2@@Z
?Remove@Element@DirectUI@@QAEJPAV12@@Z
??1NativeHWNDHost@DirectUI@@UAE@XZ
?DestroyWindow@NativeHWNDHost@DirectUI@@QAEXXZ
?OnMessage@NativeHWNDHost@DirectUI@@UAEJIIJPAJ@Z
?StartDefer@Element@DirectUI@@QAEXPAK@Z
?SetEnabled@Element@DirectUI@@QAEJ_N@Z
?Destroy@Element@DirectUI@@QAEJ_N@Z
?GetID@Element@DirectUI@@QAEGXZ
?Click@Button@DirectUI@@SG?AVUID@@XZ
??0NativeHWNDHost@DirectUI@@QAE@XZ
InitThread
UnInitThread
?Initialize@NativeHWNDHost@DirectUI@@QAEJPBG0PAUHWND__@@PAUHICON__@@HHHHHHPAUHINSTANCE__@@I@Z
?Destroy@NativeHWNDHost@DirectUI@@QAEXXZ
?ShowWindow@NativeHWNDHost@DirectUI@@QAEXH@Z
?EndDefer@Element@DirectUI@@QAEXK@Z
?AddListener@Element@DirectUI@@QAEJPAUIElementListener@2@@Z
?SetContentString@Element@DirectUI@@QAEJPBG@Z
?FindDescendent@Element@DirectUI@@QAEPAV12@G@Z
StrToID
?Add@Element@DirectUI@@QAEJPAV12@@Z
??1DUIFactory@DirectUI@@QAE@XZ
?LoadFromResource@DUIFactory@DirectUI@@QAEJPAUHINSTANCE__@@PBG1PAVElement@2@PAKPAPAV42@1@Z
??0DUIFactory@DirectUI@@QAE@PAUHWND__@@@Z
?SetAccessible@Element@DirectUI@@QAEJ_N@Z
?SetVisible@Element@DirectUI@@QAEJ_N@Z
?SetLayout@Element@DirectUI@@QAEJPAVLayout@2@@Z
?Create@BorderLayout@DirectUI@@SGJPAPAVLayout@2@@Z
?Host@NativeHWNDHost@DirectUI@@QAEXPAVElement@2@@Z
?Create@HWNDElement@DirectUI@@SGJPAUHWND__@@_NIPAVElement@2@PAKPAPAV42@@Z
InitProcessPriv
UnInitProcessPriv
?GetHWND@NativeHWNDHost@DirectUI@@QAEPAUHWND__@@XZ
winbrand
BrandingLoadString
slc
SLGetLicensingStatusInformation
SLGetProductSkuInformation
SLClose
SLOpen
SLGetWindowsInformationDWORD
SLGetSLIDList
shdocvw
DllRegisterWindowClasses
urlmon
CoInternetParseUrl
CoInternetSetFeatureEnabled
gdi32
GetDeviceCaps
ntdll
WinSqmAddToStream
WinSqmEndSession
WinSqmIsOptedIn
WinSqmStartSession
WinSqmSetString
WinSqmSetDWORD
Sections
.text Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 1024B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 303KB - Virtual size: 303KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 25KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE