Static task
static1
Behavioral task
behavioral1
Sample
50475e542028ac779cb1eacf4c9f49ea7a174ff5d975a6920dc4b71a28dd41ea.exe
Resource
win7-20220901-en
General
-
Target
50475e542028ac779cb1eacf4c9f49ea7a174ff5d975a6920dc4b71a28dd41ea
-
Size
561KB
-
MD5
0ea23ced37d1098c0da58246e17a99c0
-
SHA1
71d25bbf521d2a40a9d8bab71d111f6a3e42c7fb
-
SHA256
50475e542028ac779cb1eacf4c9f49ea7a174ff5d975a6920dc4b71a28dd41ea
-
SHA512
c5e485021d5de26bc1df08cf757347b3a8e9afbfede415c796b236bc42b3b7acc9dee2c1620b7e71ede6b470862dd7b3e043dfff8f3be0055f5aabbe25dd7d0f
-
SSDEEP
12288:6XMybS1Lli/o/kRLRoveIP9lTDKkg30Xaih60sl:2MKWli/o8RRovn9pDKkg3Saiovl
Malware Config
Signatures
Files
-
50475e542028ac779cb1eacf4c9f49ea7a174ff5d975a6920dc4b71a28dd41ea.exe windows x86
ee11fbee0f3b0ac8afa5203fbbdb3686
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
wtsapi32
WTSRegisterSessionNotification
kernel32
Process32First
CreateToolhelp32Snapshot
OutputDebugStringA
OutputDebugStringW
GetLastError
CreateMutexA
GetPrivateProfileStringA
GetModuleFileNameA
GetModuleHandleA
MultiByteToWideChar
WritePrivateProfileStringA
FreeLibrary
lstrlenA
GetProcAddress
LoadLibraryExA
WideCharToMultiByte
SetUnhandledExceptionFilter
WriteFile
CreateFileW
Sleep
CreateProcessA
ReleaseMutex
WaitForSingleObject
CreateThread
LoadLibraryA
CloseHandle
GetLocaleInfoW
ReadFile
GetProcessHeap
SetEndOfFile
GetTimeZoneInformation
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
InterlockedExchange
SetConsoleCtrlHandler
CreateFileA
InitializeCriticalSectionAndSpinCount
FlushFileBuffers
SetStdHandle
HeapReAlloc
VirtualAlloc
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetDateFormatA
GetTimeFormatA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
Process32Next
CompareStringW
CompareStringA
RaiseException
SetFilePointer
FatalAppExitA
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
VirtualFree
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
RtlUnwind
GetSystemTimeAsFileTime
SetEnvironmentVariableA
CreateDirectoryA
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
GetCurrentThread
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapFree
EnterCriticalSection
LeaveCriticalSection
SetHandleCount
GetStdHandle
GetFileType
DeleteCriticalSection
HeapAlloc
LCMapStringA
LCMapStringW
HeapSize
ExitProcess
user32
DialogBoxParamA
UpdateWindow
ShowWindow
DefWindowProcA
EndDialog
PostQuitMessage
DestroyWindow
TranslateAcceleratorA
SendMessageA
IsWindowVisible
PostMessageA
FindWindowA
wsprintfW
LoadAcceleratorsA
GetMessageA
EndPaint
TranslateMessage
DispatchMessageA
LoadIconA
LoadCursorA
RegisterClassExA
LoadStringA
BeginPaint
GetClientRect
DrawTextA
CreateWindowExA
advapi32
RegQueryValueExA
RegCloseKey
RegOpenKeyExA
shell32
SHGetFolderPathA
ShellExecuteA
SHCreateDirectoryExW
winmm
timeGetTime
wininet
InternetReadFile
InternetOpenUrlA
InternetSetOptionA
InternetOpenA
InternetCloseHandle
Sections
.text Size: 222KB - Virtual size: 222KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 37KB - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 212KB - Virtual size: 211KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.erdata Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE