Static task
static1
Behavioral task
behavioral1
Sample
3c5adffee8eba156a09e81ded1d90cac58a70c32ed0016151a6c631e3cb5233b.exe
Resource
win7-20220812-en
General
-
Target
3c5adffee8eba156a09e81ded1d90cac58a70c32ed0016151a6c631e3cb5233b
-
Size
326KB
-
MD5
0f59de6c619da0a75d3f75e554874440
-
SHA1
c4f6ee8a3408e708672f4e72cacfc3d5b7cee966
-
SHA256
3c5adffee8eba156a09e81ded1d90cac58a70c32ed0016151a6c631e3cb5233b
-
SHA512
5c9b396d93b1ff75bc32d36a227abc4f88f57abd00a9e7f01b0c951d388b6cae9af99de9f46573fc5257a1b0c9c683e21f524d6e58bd41f3bccb15397aa9178a
-
SSDEEP
6144:5fAE7IgeXmFTo50aYDnmOP/ExbrQifkgBM8I7o9r7hIbBqkb4hQlFf:5fAE7IgeWm50bBExbrlo8I7odhIFLJlZ
Malware Config
Signatures
Files
-
3c5adffee8eba156a09e81ded1d90cac58a70c32ed0016151a6c631e3cb5233b.exe windows x86
af8960baa43d994c0ff85d180928f27d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
shell32
ShellExecuteW
SHGetFolderPathW
ord165
ws2_32
getpeername
WSACleanup
WSAStartup
closesocket
WSAAsyncSelect
WSACancelAsyncRequest
getsockname
ntohs
WSAAsyncGetHostByName
connect
htons
send
recv
inet_addr
socket
WSAGetLastError
kernel32
LocalFree
lstrcpyW
GetTempPathW
GetProcAddress
GetModuleHandleW
GetLocalTime
MultiByteToWideChar
CloseHandle
ReadProcessMemory
WriteProcessMemory
VirtualFreeEx
VirtualAllocEx
OpenProcess
WideCharToMultiByte
OutputDebugStringW
RaiseException
FlushInstructionCache
GetCurrentProcess
Sleep
GetCurrentThreadId
OpenMutexW
InitializeCriticalSection
DeleteCriticalSection
InterlockedIncrement
InterlockedDecrement
lstrcmpiW
FreeLibrary
lstrlenW
GetModuleFileNameW
CreateMutexW
IsBadCodePtr
HeapFree
HeapAlloc
HeapDestroy
SetLastError
GetLastError
LockResource
GetVersionExW
GetSystemDirectoryW
FreeResource
GlobalFree
GlobalAlloc
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
LoadResource
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
InterlockedCompareExchange
GetProcessHeap
HeapSize
HeapReAlloc
SizeofResource
GlobalLock
GlobalUnlock
EnterCriticalSection
LeaveCriticalSection
InterlockedExchange
FindResourceExW
FindResourceW
LoadLibraryExW
user32
FindWindowW
CopyRect
SendMessageW
GetWindowThreadProcessId
OffsetRect
ClientToScreen
DestroyWindow
EqualRect
FindWindowExW
MoveWindow
GetWindowRect
GetClientRect
GetDC
ReleaseDC
KillTimer
IsWindow
GetClassInfoExW
LoadCursorW
GetWindow
ShowWindow
SetTimer
PostQuitMessage
SetWindowLongW
PostMessageW
UpdateLayeredWindow
SystemParametersInfoW
DefWindowProcW
CallWindowProcW
GetWindowLongW
RegisterClassExW
CreateWindowExW
InternalGetWindowText
GetDesktopWindow
RegisterClassExA
UnregisterClassW
LoadCursorA
GetClassInfoExA
CharNextW
PeekMessageW
GetMessageW
TranslateMessage
DispatchMessageW
GetCursorPos
ScreenToClient
GetAsyncKeyState
PtInRect
UnregisterClassA
IsIconic
IsRectEmpty
EnumWindows
IsWindowVisible
gdi32
DeleteObject
CreateDIBSection
GetObjectW
SetDIBColorTable
SelectObject
DeleteDC
CreateCompatibleDC
advapi32
EqualSid
RegEnumKeyExW
RegQueryInfoKeyW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
RegSetValueExW
GetNamedSecurityInfoW
GetAclInformation
GetAce
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
CopySid
IsValidSid
GetLengthSid
SetNamedSecurityInfoW
InitializeAcl
AddAce
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CreateStreamOnHGlobal
oleaut32
VarUI4FromStr
RegisterTypeLi
UnRegisterTypeLi
SysStringLen
SysFreeString
msvcp90
?find_first_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?find_last_not_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
?_Unlock@_Mutex@std@@QAEXXZ
?_Lock@_Mutex@std@@QAEXXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
??1strstreambuf@std@@UAE@XZ
??_7?$basic_istream@DU?$char_traits@D@std@@@std@@6B@
??_7ios_base@std@@6B@
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0strstreambuf@std@@QAE@PBDH@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?length@?$char_traits@D@std@@SAIPBD@Z
??_D?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?str@?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z
??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??0?$basic_ostringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBDH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IID@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@AAD@Z
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?unget@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
??$getline@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@D@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@II@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PADH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBD@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
shlwapi
PathIsDirectoryW
PathCombineW
PathAppendW
PathFileExistsW
PathIsSameRootW
gdiplus
GdipGetImagePaletteSize
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipGetImagePixelFormat
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipGetImageGraphicsContext
GdipDrawImageI
GdipCloneImage
GdipCreateFromHDC
GdipDrawImageRectRect
GdiplusShutdown
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdipDeleteGraphics
GdipAlloc
GdipFree
GdipCreateBitmapFromStreamICM
GdiplusStartup
comctl32
InitCommonControlsEx
msvcr90
__set_app_type
??0exception@std@@QAE@ABV01@@Z
_CxxThrowException
??2@YAPAXI@Z
_invalid_parameter_noinfo
??0exception@std@@QAE@XZ
wcsncpy_s
_strnicmp
strlen
atol
strncmp
sscanf
memcmp
sprintf_s
_vswprintf
_ultoa
memcpy_s
_ultow
_ltoa
_ltow
_ui64toa
_ui64tow
_i64toa
_i64tow
sprintf
_wtoi64
_wtol
_atoi64
swscanf
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
?terminate@@YAXXZ
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
memmove_s
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
??1exception@std@@UAE@XZ
wcsstr
vsprintf_s
_vscprintf
_wcsicmp
srand
rand
swprintf_s
_stricmp
vswprintf_s
_vscwprintf
_mktime64
??_V@YAXPAX@Z
_recalloc
calloc
wcscpy_s
memset
_resetstkoflw
memcpy
abs
free
malloc
atoi
_itoa_s
_i64toa_s
_time64
_purecall
wcslen
wcschr
wcscmp
iswspace
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??3@YAXPAX@Z
__CxxFrameHandler3
atl90
ord43
ord44
ord49
ord56
ord68
Sections
.text Size: 114KB - Virtual size: 114KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 3KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 154KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE