Static task
static1
Behavioral task
behavioral1
Sample
8042a0f01111a942ba0dec7ba720572ef00c2c3d19222e7cc5a692cd63881bbc.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8042a0f01111a942ba0dec7ba720572ef00c2c3d19222e7cc5a692cd63881bbc.exe
Resource
win10v2004-20220812-en
General
-
Target
8042a0f01111a942ba0dec7ba720572ef00c2c3d19222e7cc5a692cd63881bbc
-
Size
346KB
-
MD5
03cdc78297fe73ffb1f6c33c92f33290
-
SHA1
d6fc45402d897d2e52a012c4e85f381c83040e21
-
SHA256
8042a0f01111a942ba0dec7ba720572ef00c2c3d19222e7cc5a692cd63881bbc
-
SHA512
923f1d7493ac6460bd8c0ebdcd1ff98b8c048ff7e2f5c7692c5a723a33b7cedd68004e7e772e5baff72d1feb58bdcd78be37c6491d9181934d98e1fbb9176f07
-
SSDEEP
6144:HtpUeG1HPZRRYBmH436DCVyTBqFtfGJOENMcDN7Y7t7q9zW94kJYYFPwp2I:HfGfYBmHEkCVyTsFkTMcp7YJe9uRdI
Malware Config
Signatures
Files
-
8042a0f01111a942ba0dec7ba720572ef00c2c3d19222e7cc5a692cd63881bbc.exe windows x86
4b9f98c3cc39d350cf2d92c792f53ef4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
dbghelp
SymGetModuleInfoW
SymLoadModule
SymInitialize
SymSetOptions
SymCleanup
wininet
InternetOpenA
InternetCloseHandle
InternetReadFile
HttpSendRequestA
HttpOpenRequestA
InternetConnectA
InternetOpenUrlA
psapi
GetModuleFileNameExW
GetModuleFileNameExA
comctl32
ImageList_Create
ImageList_ReplaceIcon
InitCommonControlsEx
tinyxml
?ToDocument@TiXmlDocument@@UAEPAV1@XZ
?ToDocument@TiXmlDocument@@UBEPBV1@XZ
?ToElement@TiXmlNode@@UAEPAVTiXmlElement@@XZ
?ToElement@TiXmlNode@@UBEPBVTiXmlElement@@XZ
?ToComment@TiXmlNode@@UAEPAVTiXmlComment@@XZ
?ToComment@TiXmlNode@@UBEPBVTiXmlComment@@XZ
?ToUnknown@TiXmlNode@@UBEPBVTiXmlUnknown@@XZ
?ToText@TiXmlNode@@UAEPAVTiXmlText@@XZ
??0TiXmlDocument@@QAE@XZ
?ToText@TiXmlNode@@UBEPBVTiXmlText@@XZ
?ToDeclaration@TiXmlNode@@UAEPAVTiXmlDeclaration@@XZ
?RootElement@TiXmlDocument@@QAEPAVTiXmlElement@@XZ
?ToDeclaration@TiXmlNode@@UBEPBVTiXmlDeclaration@@XZ
?Clone@TiXmlDocument@@MBEPAVTiXmlNode@@XZ
?FirstChildElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?Accept@TiXmlDocument@@UBE_NPAVTiXmlVisitor@@@Z
?Value@TiXmlNode@@QBEPBDXZ
?NextSiblingElement@TiXmlNode@@QAEPAVTiXmlElement@@XZ
?GetText@TiXmlElement@@QBEPBDXZ
??1TiXmlDocument@@UAE@XZ
?Print@TiXmlDocument@@UBEXPAU_iobuf@@H@Z
?Parse@TiXmlDocument@@UAEPBDPBDPAVTiXmlParsingData@@W4TiXmlEncoding@@@Z
?LoadFile@TiXmlDocument@@QAE_NPB_WW4TiXmlEncoding@@@Z
?Attribute@TiXmlElement@@QBEPBDPBD@Z
?ToUnknown@TiXmlNode@@UAEPAVTiXmlUnknown@@XZ
kernel32
HeapDestroy
HeapReAlloc
GetVersionExA
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
InterlockedCompareExchange
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapSize
DeviceIoControl
GetSystemTimeAsFileTime
GetCurrentProcess
GetProcessTimes
QueryPerformanceCounter
LeaveCriticalSection
GetCommandLineW
InitializeCriticalSection
MoveFileW
VirtualQuery
SetFileAttributesW
VirtualAlloc
GetCurrentThreadId
GetModuleHandleW
HeapAlloc
GetProcessHeap
VirtualProtect
CloseHandle
HeapFree
GetTickCount
SetCurrentDirectoryW
lstrcatW
DeleteFileW
CopyFileW
LoadLibraryW
FindFirstFileW
GetExitCodeProcess
FindNextFileW
VirtualQueryEx
TerminateProcess
FindClose
CreateFileA
SetEvent
lstrcpyW
WaitForSingleObject
CreateProcessW
SizeofResource
LockResource
LoadResource
FreeLibrary
FindResourceExW
OpenThread
ReadProcessMemory
FindResourceW
WriteProcessMemory
CreateThread
OpenProcess
GetLastError
lstrlenW
MultiByteToWideChar
GlobalAlloc
GlobalLock
IsDBCSLeadByte
GlobalUnlock
GlobalFree
InterlockedIncrement
InterlockedDecrement
Sleep
WideCharToMultiByte
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
FreeResource
CreateEventW
ResumeThread
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
WriteFile
DeleteCriticalSection
RaiseException
GetTempPathW
WritePrivateProfileStringW
CreateDirectoryW
GetVersionExW
ReadFile
SetFilePointer
GetProcAddress
GetFileSize
GetModuleFileNameW
GetPrivateProfileSectionW
GetSystemDefaultLCID
GetPrivateProfileIntW
GetThreadSelectorEntry
VirtualFree
GetFileAttributesW
GetCurrentProcessId
EnterCriticalSection
user32
GetClassInfoExW
DefWindowProcW
IsWindow
DestroyMenu
TrackPopupMenu
GetWindowThreadProcessId
GetMenuItemCount
CreatePopupMenu
ReleaseDC
ClientToScreen
KillTimer
BeginPaint
GetSysColorBrush
GetKeyState
RegisterClassExW
GetWindow
CloseClipboard
EnableWindow
SetClipboardData
SendDlgItemMessageW
GetWindowTextW
EmptyClipboard
SetTimer
GetWindowTextLengthW
OpenClipboard
RegisterClipboardFormatW
CallWindowProcW
InvalidateRect
MapDialogRect
GetWindowRect
MapWindowPoints
DrawTextW
GetDC
SetWindowLongW
EndPaint
GetDesktopWindow
PostMessageW
EndDialog
DrawIconEx
GetDlgItem
GetClientRect
ShowWindow
LoadImageW
SetWindowPos
SetWindowTextW
SendMessageW
LoadIconW
CreateWindowExW
DestroyWindow
UnregisterClassA
SetDlgItemTextW
DialogBoxParamW
gdi32
SetTextColor
SetBkMode
CreateFontW
DeleteObject
SelectObject
GetStockObject
advapi32
RegQueryValueExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
shell32
ord155
SHBindToParent
SHGetDesktopFolder
ShellExecuteW
SHGetFileInfoW
SHGetSpecialFolderPathW
ShellExecuteExW
ole32
CreateStreamOnHGlobal
DoDragDrop
OleUninitialize
OleInitialize
oleaut32
SysStringLen
SysFreeString
SysAllocStringByteLen
SysStringByteLen
SysAllocString
gdiplus
GdipLoadImageFromStreamICM
GdipImageSelectActiveFrame
GdipGetPropertyItem
GdipAlloc
GdipFree
GdiplusShutdown
GdiplusStartup
GdipCreateFromHDC
GdipGetPropertyItemSize
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDeleteGraphics
GdipDisposeImage
GdipCloneImage
GdipDrawImageRectI
GdipGetImageHeight
GdipGetImageWidth
shlwapi
PathFileExistsW
msvcp80
??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
??A?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAA_WI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ID@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
msvcr80
wcschr
_wcslwr_s
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
_mbschr
wcsrchr
memset
wcscmp
??_V@YAXPAX@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBD@Z
??2@YAPAXI@Z
_mbslwr_s
_mbsstr
_snprintf
srand
wcslen
memcpy_s
_purecall
memmove_s
??3@YAXPAX@Z
_vscwprintf
_mbscmp
vswprintf_s
_vscprintf
vsprintf_s
free
__argc
__wargv
wcsncmp
swscanf
_invalid_parameter_noinfo
malloc
memcpy
??0exception@std@@QAE@XZ
_time32
strlen
_wcsicmp
memcmp
iswspace
strcmp
strtoul
fseek
ftell
fwrite
fclose
fprintf
_lock
wcscpy
_encode_pointer
__dllonexit
_unlock
wcscat
_wfopen
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
strncpy_s
tolower
sprintf_s
isalnum
_wtoi
_time64
memmove
wcsncpy
iswalnum
iswalpha
iswdigit
_gmtime32
_snwprintf
fread
wcscat_s
wcscpy_s
strchr
strncmp
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_beginthreadex
wcsstr
towlower
strrchr
atoi
isspace
__CxxFrameHandler3
_mbsicmp
_CxxThrowException
wtsapi32
WTSQuerySessionInformationW
WTSFreeMemory
crypt32
CertGetNameStringW
wintrust
WTHelperGetProvCertFromChain
WTHelperProvDataFromStateData
WinVerifyTrust
WTHelperGetProvSignerFromChain
iphlpapi
GetAdaptersAddresses
GetAdaptersInfo
netapi32
Netbios
Sections
.text Size: 132KB - Virtual size: 130KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 64KB - Virtual size: 61KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 136KB - Virtual size: 136KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE