Static task
static1
Behavioral task
behavioral1
Sample
a4c62db88c30b1a2bf219897e7dc462cb1a6a85c29001c1fd1ca4179eab2010a.exe
Resource
win7-20220812-en
General
-
Target
a4c62db88c30b1a2bf219897e7dc462cb1a6a85c29001c1fd1ca4179eab2010a
-
Size
292KB
-
MD5
081e6c144c30aef77d2463ebfd836e20
-
SHA1
524380e2819b7d219ee82c164239f5e1ffdfd117
-
SHA256
a4c62db88c30b1a2bf219897e7dc462cb1a6a85c29001c1fd1ca4179eab2010a
-
SHA512
8ef4c17ece006685a4a53661837066c2f95dbc67b18b020700e87f76be4286603d8284437ab8dfcee8ebe38f9e2d6cf024b8cd9ab8b3168f7c83372d27fbfc98
-
SSDEEP
6144:a09wcemieYRF1yHG6qhij6p6NysQpYo2r3HkS2hiAlpa:hwLtIG6l6pCylpArUphXK
Malware Config
Signatures
Files
-
a4c62db88c30b1a2bf219897e7dc462cb1a6a85c29001c1fd1ca4179eab2010a.exe windows x86
3c200d4d009a8b474ceb98b0aee472fc
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateProcessA
GetStartupInfoA
CreatePipe
GetModuleHandleW
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
ReadFile
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesExW
OutputDebugStringW
IsWow64Process
GetCurrentProcess
CreateThread
GetVersionExW
ProcessIdToSessionId
GetCurrentProcessId
CreateFileA
DeviceIoControl
lstrlenW
GetPrivateProfileStringW
CreateDirectoryW
CreateMutexW
GetLastError
WritePrivateProfileStringW
GetSystemInfo
GlobalMemoryStatusEx
SetEnvironmentVariableA
LoadLibraryA
GetProcAddress
FreeLibrary
WideCharToMultiByte
CreateEventW
WaitForSingleObject
Sleep
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
CloseHandle
GetCommandLineW
MultiByteToWideChar
CompareStringW
WriteConsoleW
CreateFileW
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
GetExitCodeProcess
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
InterlockedIncrement
InterlockedDecrement
InterlockedExchange
InitializeCriticalSection
EncodePointer
DecodePointer
HeapSetInformation
GetStartupInfoW
RtlUnwind
GetSystemTimeAsFileTime
LCMapStringW
GetCPInfo
SetUnhandledExceptionFilter
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapCreate
QueryPerformanceCounter
GetTickCount
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetTimeZoneInformation
GetACP
GetOEMCP
IsValidCodePage
GetStringTypeW
GetLocaleInfoW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
LoadLibraryW
SetFilePointer
ReadProcessMemory
user32
GetSystemMetrics
wsprintfW
shell32
SHGetSpecialFolderPathW
SHGetFolderPathW
ShellExecuteExW
ole32
CoCreateInstance
CoInitializeSecurity
CoInitialize
CoInitializeEx
CoUninitialize
CoSetProxyBlanket
oleaut32
SysAllocString
SysFreeString
VariantInit
VariantClear
advapi32
ImpersonateLoggedOnUser
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA
OpenSCManagerW
OpenServiceW
QueryServiceStatus
RegQueryValueExW
CloseServiceHandle
RegOpenKeyExW
RegNotifyChangeKeyValue
RegCloseKey
GetTokenInformation
OpenProcessToken
EqualSid
IsValidSid
RegOpenCurrentUser
RevertToSelf
shlwapi
PathFileExistsW
PathRemoveFileSpecW
pdh
PdhCollectQueryData
PdhAddCounterW
PdhOpenQueryW
PdhGetFormattedCounterValue
wininet
InternetReadFile
InternetCrackUrlW
InternetAttemptConnect
InternetOpenW
InternetCloseHandle
HttpQueryInfoW
HttpSendRequestW
HttpAddRequestHeadersW
HttpOpenRequestW
InternetConnectW
InternetSetOptionExW
Sections
.text Size: 166KB - Virtual size: 165KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 6KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 75KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE