Static task
static1
Behavioral task
behavioral1
Sample
d6eb1f4eb1870d1c6c2c7f528ab687596ca02bdfe0afb90c5cc022331a6d4ec3.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d6eb1f4eb1870d1c6c2c7f528ab687596ca02bdfe0afb90c5cc022331a6d4ec3.exe
Resource
win10v2004-20220901-en
General
-
Target
d6eb1f4eb1870d1c6c2c7f528ab687596ca02bdfe0afb90c5cc022331a6d4ec3
-
Size
109KB
-
MD5
14c365c431fa827ce19f64001427078a
-
SHA1
41056c3eea5486c7ad0e5c0ee1ed336a429fdecd
-
SHA256
d6eb1f4eb1870d1c6c2c7f528ab687596ca02bdfe0afb90c5cc022331a6d4ec3
-
SHA512
a5103fbab5a0a00a4fadda53e411088b7cf31cdd7ef9a37c29995ef19cc84fa7cda415b0da291b2f21029869754f0bb97fe71ff38e1590b7aaabdf62d1c9052a
-
SSDEEP
3072:Ozbi7CuGbykpVWKaMnItW2DoNRDuUlbjn:n7jDf51tWiojDuUlHn
Malware Config
Signatures
Files
-
d6eb1f4eb1870d1c6c2c7f528ab687596ca02bdfe0afb90c5cc022331a6d4ec3.exe windows x86
69738372ee1ea9b12712f8714a52257a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
RegCreateKeyExW
RegDeleteKeyW
kernel32
CompareStringW
HeapAlloc
LoadLibraryExA
InterlockedCompareExchange
DelayLoadFailureHook
GetCurrentThreadId
CreateThread
DeviceIoControl
RemoveDirectoryW
ExpandEnvironmentStringsW
FindFirstFileW
FindNextFileW
FindClose
GetCurrentDirectoryW
ReadFile
GetDiskFreeSpaceW
ReleaseMutex
lstrlenW
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
InterlockedExchange
GlobalAlloc
GlobalFree
WaitForSingleObject
GetTickCount
GetFullPathNameW
SetCurrentDirectoryW
CreateDirectoryW
SetLastError
GetWindowsDirectoryW
CreateFileW
WriteFile
GetModuleHandleW
GetModuleFileNameW
GetFileAttributesW
CopyFileW
CreateProcessW
GetProcessHeap
HeapFree
LoadLibraryW
GetProcAddress
FreeLibrary
CreateMutexW
CloseHandle
GetExitCodeProcess
GetLastError
SetFileAttributesW
gdi32
CreateFontIndirectW
SelectObject
CreateCompatibleDC
GetObjectW
SetStretchBltMode
SetBrushOrgEx
StretchBlt
DeleteDC
SetTextColor
SetBkMode
GetTextAlign
SetTextAlign
GetStockObject
DeleteObject
user32
SetTimer
WaitMessage
PeekMessageW
LoadCursorFromFileW
LoadCursorW
RegisterClassW
UnregisterClassW
ShowWindow
RegisterHotKey
UpdateWindow
PostThreadMessageW
GetMessageW
DispatchMessageW
SetWindowPos
InvalidateRect
BeginPaint
EndPaint
PostQuitMessage
CreateWindowExW
UnregisterHotKey
DestroyWindow
KillTimer
DefWindowProcW
GetClientRect
DrawTextW
LoadImageW
GetSystemMetrics
FindWindowW
SendMessageW
LoadStringW
MessageBoxW
msvcrt
?terminate@@YAXXZ
memcpy
__set_app_type
_vsnwprintf
wcsrchr
memset
wcschr
wcsstr
__CxxFrameHandler
_initterm
_amsg_exit
__setusermatherr
_controlfp
??1type_info@@UAE@XZ
_wcsnicmp
_CxxThrowException
??3@YAXPAX@Z
__p__fmode
__p__commode
_wcmdln
exit
_XcptFilter
_exit
_cexit
__wgetmainargs
ntdll
RtlNtStatusToDosError
RtlAllocateHeap
RtlFreeHeap
NtSetInformationFile
RtlUnwind
comctl32
ord17
version
GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW
wdscore
WdsGetBlackboardValue
WdsInitializeDataUInt32
WdsFreeData
ConstructPartialMsgVW
WdsSetupLogMessageW
CurrentIP
WdsDestroyBlackboard
WdsCreateBlackboard
WdsTerminate
WdsInitialize
WdsSetBlackboardValue
unbcl
?GetDirectoriesAndFiles@Directory@UnBCL@@SGPAV?$Array@PAVString@UnBCL@@@2@PBVString@2@0W4EnumerationType@12@@Z
??0?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QAE@PAV?$Array@PAVString@UnBCL@@@1@@Z
??C?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@QBEPAV?$Array@PAVString@UnBCL@@@1@XZ
??1?$SmartPtr@V?$Array@PAVString@UnBCL@@@UnBCL@@@UnBCL@@UAE@XZ
??0?$Array@E@UnBCL@@QAE@HH@Z
?GetBuffer@?$Array@E@UnBCL@@UAEPAEH@Z
??_D?$Array@E@UnBCL@@QAEXXZ
??1Win32Exception@UnBCL@@UAE@XZ
??0Win32Exception@UnBCL@@QAE@KPBG@Z
?Compare@String@UnBCL@@SGHPBG0H@Z
?Format@String@UnBCL@@SAPAV12@PBGZZ
?AddRef@Object@UnBCL@@QAEXXZ
?DecRef@Object@UnBCL@@QAEHXZ
?Combine@Path@UnBCL@@SGPAVString@2@PBV32@0@Z
?Exists@Directory@UnBCL@@SGHPBVString@2@@Z
?CreateDir@Directory@UnBCL@@SGPAVDirectoryInfo@2@PBVString@2@@Z
?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEPAVString@2@XZ
?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVString@2@XZ
?get_IsEmpty@String@UnBCL@@QBEHXZ
??1ArgumentException@UnBCL@@UAE@XZ
??0ArgumentException@UnBCL@@QAE@PBG@Z
??1String@UnBCL@@UAE@XZ
??1ArgumentNullException@UnBCL@@UAE@XZ
?Clone@String@UnBCL@@UBEPAVObject@2@XZ
?CompareTo@String@UnBCL@@UBEHPBVObject@2@@Z
?ToString@String@UnBCL@@UBEPAV12@XZ
?GetHashCode@String@UnBCL@@UBEHXZ
?Equals@String@UnBCL@@UBEHPBVObject@2@@Z
?SetMessage@Exception@UnBCL@@MAEXPAVString@2@@Z
?set_HResult@Exception@UnBCL@@MAEXJ@Z
?get_HResult@Exception@UnBCL@@UBEJXZ
?GetBaseException@Exception@UnBCL@@UBEPBV12@XZ
?set_Source@Exception@UnBCL@@UAEXPBVString@2@@Z
?get_Source@Exception@UnBCL@@UBEPBVString@2@XZ
?get_Message@Exception@UnBCL@@UBEPBVString@2@XZ
?get_InnerException@Exception@UnBCL@@UBEPBV12@XZ
?ToString@Exception@UnBCL@@UBEPAVString@2@XZ
??2Object@UnBCL@@SGPAXI@Z
??0ArgumentNullException@UnBCL@@QAE@PBG@Z
??0String@UnBCL@@QAE@PBG@Z
??3Object@UnBCL@@SGXPAX@Z
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@XZ
??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QAE@PAVString@1@@Z
??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QAEAAV01@ABV01@@Z
?FromASCII@String@UnBCL@@SGPAV12@PBD@Z
??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QBEPAVString@1@XZ
?get_CString@String@UnBCL@@QBEPBGXZ
?FormatV@String@UnBCL@@SGPAV12@PBGPAD@Z
?Concat@String@UnBCL@@SGPAV12@PBG00@Z
?Clone@Object@UnBCL@@UBEPAV12@XZ
?CompareTo@Object@UnBCL@@UBEHPBV12@@Z
?GetObjectID@Object@UnBCL@@UBEIXZ
?ToString@Object@UnBCL@@UBEPAVString@2@XZ
?GetType@Object@UnBCL@@UBEPAVType@2@XZ
?GetHashCode@Object@UnBCL@@UBEHXZ
?Equals@Object@UnBCL@@UBEHPBV12@@Z
??1Object@UnBCL@@UAE@XZ
??0Object@UnBCL@@QAE@XZ
??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UAE@XZ
?AddStackTrace@Exception@UnBCL@@QAEXPBD@Z
Sections
.text Size: 62KB - Virtual size: 62KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 28KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ