Static task
static1
Behavioral task
behavioral1
Sample
107f85fd4431baa890ef10eaf71256d132347366ea7a1f2d40a07217debfc1e3.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
107f85fd4431baa890ef10eaf71256d132347366ea7a1f2d40a07217debfc1e3.exe
Resource
win10v2004-20220812-en
General
-
Target
107f85fd4431baa890ef10eaf71256d132347366ea7a1f2d40a07217debfc1e3
-
Size
339KB
-
MD5
2052bf45780395467f1dde4aa8798d60
-
SHA1
2388c3cfd0438a2a9244210ea77868914cb11aab
-
SHA256
107f85fd4431baa890ef10eaf71256d132347366ea7a1f2d40a07217debfc1e3
-
SHA512
536dcdf94faced1d33c77e91b95cc2fdd445b1cabfdf0954788f84593db6de52411657759f0d935e39857b8f17d370611674315a78f9518cc38a5c037e2c46f0
-
SSDEEP
6144:HRylI3Y/N09AJskOxxdA2AlhpocyYY46pvUmpfs0QiOqnuzkuZUShErt8:HRylKmN09AJibdZHcyYY46psKpvuztPT
Malware Config
Signatures
Files
-
107f85fd4431baa890ef10eaf71256d132347366ea7a1f2d40a07217debfc1e3.exe windows x86
2a039fa31dc9ca498ef912fdc643ebc2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
InitCommonControlsEx
common
??0CTXBSTR@@QAE@XZ
??0CTXBSTR@@QAE@ABVCTXStringW@@@Z
??1CTXStringA@@QAE@XZ
??H@YA?AVCTXStringW@@ABV0@PB_W@Z
??H@YA?AVCTXStringW@@PB_WABV0@@Z
??0CTXStringW@@QAE@PB_W@Z
?RecordTransBegin@Perf@Util@@YA_JPB_WHH00@Z
??BCTXStringW@@QBEPB_WXZ
?RecordTransEnd@Perf@Util@@YAJ_JPB_WHH11H@Z
??H@YA?AVCTXStringW@@ABV0@0@Z
?Format@CTXStringW@@QAAXPB_WZZ
??0CTXStringW@@QAE@ABV0@@Z
??0CTXStringW@@QAE@ABVCTXBSTR@@@Z
?Format@CTXStringA@@QAAXPBDZZ
??0CTXStringA@@QAE@XZ
??M@YA_NABVCTXStringA@@0@Z
??4CTXStringW@@QAEAAV0@ABV0@@Z
??YCTXStringW@@QAEAAV0@PB_W@Z
?GetString@CTXStringW@@QBEPB_WXZ
??M@YA_NABVCTXStringW@@0@Z
??0CTXStringW@@QAE@PA_W@Z
?Length@CTXBSTR@@QBEIXZ
?GetYear@CTXTime@@QBEHXZ
?GetMonth@CTXTime@@QBEHXZ
?GetDay@CTXTime@@QBEHXZ
??0CTXTime@@QAE@_J@Z
?InitPlatform@CoreCenter@Util@@YAHPA_W@Z
?GetExeDir@Sys@Util@@YA?AVCTXStringW@@XZ
?InitPlatformFileSystem@Boot@Util@@YAHXZ
?InitPlatformI18NConfig@Boot@Util@@YAHXZ
?InitPlatformCoreConfig@Boot@Util@@YAHXZ
??H@YA?AVCTXStringW@@_WABV0@@Z
?GetParentDir@FS@Util@@YA?AVCTXStringW@@V3@@Z
?CreateObjectFromDllFile@Com@Util@@YGJPB_WABU_GUID@@1PAPAXPAUIUnknown@@@Z
?ClearDeadQueue@Misc@Util@@YAXXZ
?OnUninitCom@Misc@Util@@YAXXZ
?OnExitWinMain@Misc@Util@@YAXXZ
?OnExitCoreCenter@Misc@Util@@YAXXZ
?InitPlatformGFConfig@Boot@Util@@YAHXZ
?SetMainAndLogicThreadId@Misc@Util@@YAXKK@Z
?SetInterval@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?SetTimeout@TXTimer@@YAHIPAUITXTimerCallback@@I@Z
?EraseTimerCallback@TXTimer@@YAHPAUITXTimerCallback@@I@Z
??4CTXStringW@@QAEAAV0@PB_W@Z
?Utf8ToWS@Convert@Util@@YA?AVCTXStringW@@PBDH@Z
?GetBSTR@CTXStringW@@QBEPA_WXZ
??0CTXStringW@@QAE@XZ
?TXAssert@@YAHPB_W0H@Z
??0CTXBSTR@@QAE@PB_W@Z
?GetPlatformCore@Core@Util@@YAHPAPAUITXCore@@@Z
??1CTXBSTR@@QAE@XZ
??BCTXBSTR@@QBEPA_WXZ
??ICTXBSTR@@QAEPAPA_WXZ
??1CTXStringW@@QAE@XZ
?IsEmpty@CTXBSTR@@QAEHXZ
?AppendFormat@CTXStringW@@QAAXPB_WZZ
gf
?CreateObject@GF@Util@@YAJABU_GUID@@0PAPAX@Z
?RawCreateGFElementByXtml@GF@Util@@YAJPA_WPAPAUIGFElement@@PAU3@0H@Z
?SetCustomObjectFactory@GF@Util@@YAXP6AHABU_GUID@@0PAPAX@Z@Z
kernel32
GetCurrentThreadId
SetEvent
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
GetLastError
lstrcmpiW
OpenProcess
GetCurrentProcessId
GetStartupInfoW
InterlockedCompareExchange
Sleep
GetProcessHeap
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
HeapDestroy
GetVersionExA
GetThreadLocale
GetLocaleInfoA
GetACP
LoadLibraryA
InterlockedExchange
FreeLibrary
GetProcAddress
LocalAlloc
GetModuleHandleW
GetEnvironmentVariableW
SetEnvironmentVariableW
InitializeCriticalSection
GetCommandLineW
DeleteCriticalSection
GetModuleFileNameW
InterlockedDecrement
InterlockedIncrement
lstrlenW
LeaveCriticalSection
EnterCriticalSection
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
RaiseException
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
user32
SetActiveWindow
UnregisterClassA
SetFocus
MoveWindow
CharNextW
IsWindow
PostMessageW
SendMessageW
PostThreadMessageW
SetWindowLongW
GetWindowRect
SetWindowPos
CallWindowProcW
wsprintfW
SetForegroundWindow
advapi32
RegOpenKeyExW
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegEnumKeyExW
RegDeleteKeyW
shell32
SHGetFileInfoW
ole32
StringFromCLSID
CoTaskMemFree
CoCreateInstance
OleUninitialize
CoUninitialize
CoInitialize
OleInitialize
oleaut32
SysFreeString
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
atl80
ord58
ord64
ord30
ord31
ord32
msvcp80
?assign@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_WI@Z
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPB_WHH@Z
??0?$basic_fstream@DU?$char_traits@D@std@@@std@@QAE@XZ
?open@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXPBDHH@Z
??Bios_base@std@@QBEPAXXZ
?close@?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_fstream@DU?$char_traits@D@std@@@std@@QAEXXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
?c_str@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEPB_WXZ
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
msvcr80
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_invoke_watson
_controlfp_s
_configthreadlocale
??3@YAXPAX@Z
_purecall
_CxxThrowException
swprintf_s
__CxxFrameHandler3
_recalloc
memset
_invalid_parameter_noinfo
??0exception@std@@QAE@ABQBD@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
vswprintf_s
free
??_V@YAXPAX@Z
memcpy
_wtoi
setlocale
mbstowcs
swscanf_s
memcpy_s
malloc
wcscpy_s
wcsncpy_s
memmove_s
strcpy_s
strncpy
?terminate@@YAXXZ
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_except_handler4_common
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
Sections
.text Size: 196KB - Virtual size: 195KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 48KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 4KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 80KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE