Behavioral task
behavioral1
Sample
a0facc3fc768a87f3b31f15c6bc44149d5fcd59ee9605953ddea1de1d8abd218.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a0facc3fc768a87f3b31f15c6bc44149d5fcd59ee9605953ddea1de1d8abd218.exe
Resource
win10v2004-20220812-en
General
-
Target
a0facc3fc768a87f3b31f15c6bc44149d5fcd59ee9605953ddea1de1d8abd218
-
Size
121KB
-
MD5
0f19763e1ce9703c2577dab5a778bd8b
-
SHA1
ef2a04ecc0788d824fbbaad4a59741b123ef9d24
-
SHA256
a0facc3fc768a87f3b31f15c6bc44149d5fcd59ee9605953ddea1de1d8abd218
-
SHA512
3ef94a29ddd5a624dac349e117d76fdf7fee2e9ec9ac977d33f4be0d8348b68559e42c95d87d29bef697f40b907e7480f79d3bb4a398a32428bbf1429791916e
-
SSDEEP
1536:tBdzJRQn7Xpo4nV4sn+yBT++LQFto2G9uJLUUqwnX2ChFeeldLZy/O22+93ppfL0:tBWBV4sfBaGQPtbX2ChsYZ+R2+Vfh6
Malware Config
Signatures
-
resource yara_rule sample upx
Files
-
a0facc3fc768a87f3b31f15c6bc44149d5fcd59ee9605953ddea1de1d8abd218.exe windows x86
9d093cc972e78a56ffdd19b3307f29b4
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
lstrcpyA
HeapAlloc
GetProcessHeap
lstrcmpiA
lstrcmpA
lstrcatA
lstrcpynA
GlobalFree
HeapFree
CreateThread
Sleep
ExitThread
InterlockedDecrement
InterlockedIncrement
DeleteFileA
GlobalAlloc
GetFileSize
CreateFileA
GetModuleFileNameA
GetTempFileNameA
GetTempPathA
ReadFile
GetEnvironmentVariableA
GetWindowsDirectoryA
FindClose
LoadLibraryA
FindFirstFileA
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GetDriveTypeA
GetSystemDirectoryA
SetThreadPriority
GetCurrentThread
SetFilePointer
WriteFile
GetSystemTime
WinExec
GetLastError
TerminateThread
ExitProcess
CreateMutexA
GetVersionExA
GlobalMemoryStatus
Module32First
TerminateProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentProcess
GetStartupInfoA
GetProcAddress
WideCharToMultiByte
lstrlenA
CreateProcessA
WaitForSingleObject
CloseHandle
GetTickCount
GetLocalTime
FileTimeToLocalFileTime
FileTimeToSystemTime
FindNextFileA
GetTimeZoneInformation
user32
wsprintfA
wvsprintfA
CharUpperBuffA
CharUpperA
CharLowerA
advapi32
RegCreateKeyExA
RegSetValueExA
RegEnumKeyA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
RegDeleteValueA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegOpenKeyA
shell32
ShellExecuteA
ws2_32
WSAStartup
WSACleanup
connect
inet_addr
gethostbyname
sendto
socket
htons
select
recv
ntohs
closesocket
send
wininet
InternetOpenA
InternetOpenUrlA
InternetReadFile
InternetCloseHandle
msvcrt
??2@YAPAXI@Z
__CxxFrameHandler
rand
srand
strlen
??3@YAXPAX@Z
_purecall
free
malloc
exit
_ftol
strstr
fread
fclose
ftell
fseek
fopen
fwrite
fprintf
sprintf
strncat
strcmp
__dllonexit
_onexit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strtok
toupper
__mb_cur_max
_isctype
_pctype
memcpy
tolower
memset
_vsnprintf
fgets
msvcp60
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@PBD@Z
??6std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHPBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?find_last_of@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDI@Z
?insert@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IABV12@II@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBDABV10@@Z
??0?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@H@Z
??5std@@YAAAV?$basic_istream@DU?$char_traits@D@std@@@0@AAV10@PAD@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??_D?$basic_stringstream@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXXZ
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIABV12@I@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?length@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV?$allocator@D@1@@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
??Hstd@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?endl@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@1@AAV21@@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@IIPBD@Z
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHIIPBD@Z
?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ
??1_Winit@std@@QAE@XZ
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?compare@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEHABV12@@Z
Sections
.text Size: 56KB - Virtual size: 55KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 12KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 20KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE