??4_Init_locks@std@@QAEAAV01@ABV01@@Z
Static task
static1
Behavioral task
behavioral1
Sample
164ef96396cd526c73ed93f7f6ad759e893fe8894fa24e4c2478a9cd4522aab2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
164ef96396cd526c73ed93f7f6ad759e893fe8894fa24e4c2478a9cd4522aab2.exe
Resource
win10v2004-20220812-en
General
-
Target
164ef96396cd526c73ed93f7f6ad759e893fe8894fa24e4c2478a9cd4522aab2
-
Size
582KB
-
MD5
19ede5258c1b3853e9099896972d5320
-
SHA1
943daae0080bb5b9e3569a802b7cd76d82401c34
-
SHA256
164ef96396cd526c73ed93f7f6ad759e893fe8894fa24e4c2478a9cd4522aab2
-
SHA512
8a005cfbc3e63cd2d08fe0fe771a9581e978c937c1175e0f9dd906799bf62055409b3c52b676887d4a5893afdd72f9231fbaec0af55f48a14c1779bde2d10b8d
-
SSDEEP
12288:yyB/aBs+396HL0on+Q7sryHcGccpccUccL7cc2ccOcc9cc4VcbcoHcIyccGccpc6:laPon+QQryHcGccpccUccL7cc2ccOccT
Malware Config
Signatures
Files
-
164ef96396cd526c73ed93f7f6ad759e893fe8894fa24e4c2478a9cd4522aab2.exe windows x86
bfb561c4204ce72ed1e9098705fa64c2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
basedll
?IsFileExist@FileMisc@Base@@YAHPB_W@Z
utilsdll
?GetCrashCatcher@CrashCatcher@Utils@@YAPAVICrashCatcher@12@XZ
?GetSoftID@Misc@Utils@@YAIXZ
?GetInstallVer@Misc@Utils@@YAHPADK@Z
reportdll
GetReportMgr
kernel32
GlobalFree
CreateEventW
GetTempPathW
Sleep
WideCharToMultiByte
CreateFileW
Process32NextW
CreateDirectoryW
GetProcAddress
GetFileAttributesW
MoveFileW
CreateToolhelp32Snapshot
Process32FirstW
LoadLibraryW
FlushInstructionCache
MulDiv
HeapSize
HeapReAlloc
HeapDestroy
GetModuleFileNameW
TlsFree
GetLastError
InterlockedIncrement
DeleteCriticalSection
CreateEventA
LeaveCriticalSection
SetEvent
InterlockedExchangeAdd
CreateMutexW
InterlockedExchange
FindResourceExW
LockResource
WriteFile
GetLocalTime
IsBadReadPtr
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetStartupInfoW
CreateWaitableTimerA
SystemTimeToFileTime
GetTickCount
ResumeThread
ResetEvent
OpenEventA
GetCurrentProcessId
ReleaseSemaphore
GetSystemTimeAsFileTime
FormatMessageA
LocalFree
GetThreadLocale
GetLocaleInfoA
GetACP
VirtualAlloc
VirtualFree
IsProcessorFeaturePresent
LoadLibraryA
GetVersionExA
FreeResource
lstrcpynW
GlobalUnlock
GlobalAlloc
EnterCriticalSection
CloseHandle
TlsAlloc
PostQueuedCompletionStatus
InterlockedDecrement
WaitForMultipleObjects
QueueUserAPC
InterlockedCompareExchange
GetProcessHeap
LoadResource
GetModuleHandleW
SetWaitableTimer
TlsSetValue
HeapAlloc
LoadLibraryExW
FindResourceW
GetCurrentProcess
SetLastError
lstrlenW
HeapFree
lstrcmpiW
TlsGetValue
GlobalLock
WaitForSingleObject
GetQueuedCompletionStatus
FreeLibrary
CreateIoCompletionPort
RaiseException
InitializeCriticalSection
GetCurrentThreadId
MultiByteToWideChar
SizeofResource
lstrcmpW
InitializeCriticalSectionAndSpinCount
TerminateThread
user32
GetClientRect
GetFocus
LoadCursorW
CharNextW
DispatchMessageW
DestroyWindow
BeginPaint
PostMessageW
CreateAcceleratorTableW
GetDesktopWindow
GetDlgItem
ScreenToClient
ReleaseCapture
UnregisterClassA
FillRect
ReleaseDC
SetWindowTextW
ClientToScreen
IsChild
GetClassNameW
GetSysColor
RedrawWindow
SetFocus
SetWindowPos
CallWindowProcW
MoveWindow
GetWindow
DefWindowProcW
IsWindow
GetWindowTextLengthW
CreateWindowExW
PeekMessageW
GetClassInfoExW
RegisterClassExW
GetMenu
GetMonitorInfoW
LoadImageW
MonitorFromWindow
IsWindowEnabled
GetSystemMetrics
UpdateWindow
GetWindowRect
InflateRect
ShowWindow
CreateDialogParamW
AdjustWindowRectEx
GetCapture
OffsetRect
SetWindowRgn
PtInRect
DrawFocusRect
DrawEdge
TranslateMessage
GetDlgCtrlID
SystemParametersInfoW
SetForegroundWindow
TrackPopupMenu
GetSubMenu
LoadMenuW
GetMessageW
GetParent
DestroyAcceleratorTable
SetWindowLongW
EndPaint
InvalidateRgn
SetCapture
GetWindowLongW
SendMessageW
GetWindowTextW
GetDC
InvalidateRect
RegisterWindowMessageW
GetCursorPos
SetTimer
KillTimer
DestroyMenu
gdi32
SetViewportOrgEx
RoundRect
CreateFontIndirectW
GetTextExtentPoint32W
SetTextColor
MoveToEx
CreateRoundRectRgn
StretchBlt
TextOutW
GetDIBColorTable
SetBkMode
Rectangle
GetObjectW
GetStockObject
CreateCompatibleDC
CreateSolidBrush
DeleteDC
SelectObject
CreateCompatibleBitmap
BitBlt
GetDeviceCaps
DeleteObject
CreateDIBSection
SetDIBColorTable
CreatePen
advapi32
RegDeleteKeyW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegCloseKey
shell32
Shell_NotifyIconW
ShellExecuteExW
ole32
IIDFromString
CoInitializeEx
OleInitialize
CoCreateInstance
CoGetInterfaceAndReleaseStream
OleUninitialize
CoTaskMemAlloc
CoInitialize
CoTaskMemRealloc
CoTaskMemFree
StringFromGUID2
CoMarshalInterThreadInterfaceInStream
CoFreeLibrary
OleLockRunning
CLSIDFromString
CoGetClassObject
CoUninitialize
CreateStreamOnHGlobal
CLSIDFromProgID
CoLoadLibrary
oleaut32
LoadRegTypeLi
VariantClear
OleCreateFontIndirect
LoadTypeLi
SysStringLen
SysStringByteLen
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
VarUI4FromStr
SysFreeString
VariantInit
comctl32
ImageList_Destroy
_TrackMouseEvent
ImageList_GetIconSize
ImageList_Draw
ImageList_Add
ImageList_Create
InitCommonControlsEx
msimg32
AlphaBlend
TransparentBlt
gdiplus
GdipCloneImage
GdipCreateFontFamilyFromName
GdipDeleteGraphics
GdipFree
GdipDrawImageRectI
GdipAlloc
GdipGetGenericFontFamilySansSerif
GdipGetLogFontW
GdipLoadImageFromFile
GdipDisposeImage
GdipCreateFont
GdiplusShutdown
GdipDeleteFont
GdipBitmapUnlockBits
GdipGetImagePaletteSize
GdipCreateBitmapFromScan0
GdipDrawImageI
GdipGetImagePalette
GdipCreateBitmapFromStream
GdipGetImageHeight
GdipGetImageWidth
GdipBitmapLockBits
GdipGetImagePixelFormat
GdiplusStartup
GdipDeleteFontFamily
GdipGetImageGraphicsContext
GdipCreateFromHDC
msvcp80
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIABV12@@Z
??$?M_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?clear@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@II@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@0@Z
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?rbegin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$reverse_iterator@V?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@2@XZ
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIPB_W@Z
?erase@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@V32@@Z
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
?clear@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?begin@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?end@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE?AV?$_String_iterator@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@2@XZ
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIABV12@I@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
?find_last_of@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEI_WI@Z
?swap@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXAAV12@@Z
?substr@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBE?AV12@II@Z
?resize@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?resize@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?replace@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@IIABV12@@Z
?reserve@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEXI@Z
?push_back@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEX_W@Z
?at@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEAB_WI@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@PB_W@Z
??$?H_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@ABV10@0@Z
?npos@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@2IB
??Y?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@_W@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@ABV12@@Z
?append@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV12@PB_W@Z
?find@?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QBEIPB_WI@Z
??$?8_WU?$char_traits@_W@std@@V?$allocator@_W@1@@std@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@0@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@PB_W@Z
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@ABV01@@Z
??4?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAEAAV01@PB_W@Z
??1?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
ws2_32
WSAStartup
WSACleanup
msvcr80
_purecall
??_V@YAXPAX@Z
?what@exception@std@@UBEPBDXZ
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
_itoa
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
memcpy_s
malloc
_invalid_parameter_noinfo
swprintf_s
free
_recalloc
wcsncpy_s
memmove_s
wcscpy_s
_resetstkoflw
swscanf
srand
rand
_time64
printf
_vscwprintf_p
_vswprintf_p
_vsprintf_p
_vscprintf_p
_vscwprintf
_waccess
vswprintf_s
_wsplitpath_s
wcsncat_s
strncpy_s
_wcsicmp
wcschr
sprintf
_wtoi
_wsplitpath
tolower
__CxxFrameHandler3
_snprintf
fflush
fprintf
__iob_func
_CxxThrowException
memcpy
memset
strerror
_gmtime64
_beginthreadex
?terminate@@YAXXZ
_snwprintf
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_amsg_exit
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_wcmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler4_common
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_invoke_watson
_controlfp_s
_unlock
??2@YAPAXI@Z
??0exception@std@@QAE@ABV01@@Z
??3@YAXPAX@Z
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
wininet
InternetConnectW
HttpSendRequestW
HttpQueryInfoW
InternetCloseHandle
InternetCrackUrlW
InternetOpenW
InternetReadFile
HttpOpenRequestW
sensapi
IsNetworkAlive
Exports
Exports
Sections
.text Size: 364KB - Virtual size: 360KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 92KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 4KB - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 100KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE