Static task
static1
Behavioral task
behavioral1
Sample
ab284f3b47615754b8f502089830c465da6ecfbdc35041e2411949250203326a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
ab284f3b47615754b8f502089830c465da6ecfbdc35041e2411949250203326a.exe
Resource
win10v2004-20220812-en
General
-
Target
ab284f3b47615754b8f502089830c465da6ecfbdc35041e2411949250203326a
-
Size
107KB
-
MD5
9b77980b062c9f50a1e9aaa6b7c4558b
-
SHA1
baa77fac38c9ecca012caffbef8b7b5cae1dc5f7
-
SHA256
ab284f3b47615754b8f502089830c465da6ecfbdc35041e2411949250203326a
-
SHA512
51c0cd46b732ce4eaacf120c18a4121d4975a3575e4419202f226366bceac8c0e1909722f685d6e42ab47a1a1632d21e4dfc246825f92c4c355148f4b989cff7
-
SSDEEP
1536:rnxeX1yCOJWwsgEWrVAENqB2TY+F4eF+8Wh5oBsmSGeGCq:jAX1y3WjgmEN82s+F4evGOV1eGCq
Malware Config
Signatures
Files
-
ab284f3b47615754b8f502089830c465da6ecfbdc35041e2411949250203326a.exe windows x64
698ebcd674607d5baa9696b1aa4b3a54
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
microsoft.applications.telemetry.windows
?AttachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z
?RemoveEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z
?AddEventListener@DebugEventSource@Events@Applications@Microsoft@@UEAAXW4DebugEventType@234@AEAVDebugEventListener@234@@Z
?DispatchEvent@DebugEventSource@Events@Applications@Microsoft@@UEAA_NVDebugEvent@234@@Z
?Release@LogManagerProvider@Events@Applications@Microsoft@@SA?AW4status_t@234@AEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@2@@std@@@Z
??0GUID_t@Events@Applications@Microsoft@@QEAA@AEBU0123@@Z
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@UGUID_t@123@@Z
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@N@Z
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_N@Z
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@I@Z
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@_J@Z
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@H@Z
?DetachEventSource@DebugEventSource@Events@Applications@Microsoft@@UEAA_NAEAV1234@@Z
??0EventProperty@Events@Applications@Microsoft@@QEAA@XZ
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UEventProperty@234@@Z
?SetPolicyBitFlags@EventProperties@Events@Applications@Microsoft@@QEAAX_K@Z
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4PiiKind@234@W4DataCategory@234@@Z
??1EventProperties@Events@Applications@Microsoft@@UEAA@XZ
??0EventProperties@Events@Applications@Microsoft@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??0GUID_t@Events@Applications@Microsoft@@QEAA@U_GUID@@@Z
?Get@LogManagerProvider@Events@Applications@Microsoft@@CAPEAVILogManager@234@AEAV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@VVariant@Events@Applications@Microsoft@@@std@@@2@@std@@AEAW4status_t@234@@Z
??1EventProperty@Events@Applications@Microsoft@@UEAA@XZ
?SetProperty@EventProperties@Events@Applications@Microsoft@@QEAAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@_JW4PiiKind@234@W4DataCategory@234@@Z
??4EventProperty@Events@Applications@Microsoft@@QEAAAEAU0123@PEBD@Z
api-ms-win-core-errorhandling-l1-1-0
RaiseException
api-ms-win-core-realtime-l1-1-0
QueryUnbiasedInterruptTime
api-ms-win-core-com-l1-1-0
CoTaskMemFree
CoCreateFreeThreadedMarshaler
CoTaskMemAlloc
api-ms-win-core-processthreads-l1-1-0
GetCurrentThreadId
TerminateProcess
GetCurrentProcessId
GetCurrentProcess
api-ms-win-core-processthreads-l1-1-3
SetProcessInformation
api-ms-win-core-util-l1-1-0
DecodePointer
api-ms-win-core-synch-l1-1-0
InitializeSRWLock
ReleaseSRWLockExclusive
DeleteCriticalSection
EnterCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSectionEx
LeaveCriticalSection
api-ms-win-core-com-l1-1-1
RoGetAgileReference
api-ms-win-eventing-provider-l1-1-0
EventWriteTransfer
hxoutlookbackground
?HxOutlookBackgroundInitialize@HxOutlook@@YAXAEAUConfig@Telemetry@Hx@@_N@Z
?UseHxOutlookBackgroundAccess@HxOutlook@@YAAEAUIHxOutlookBackgroundAccess@1@XZ
?HxOutlookBackgroundEnsureInitialized@HxOutlook@@YAXXZ
vcruntime140_app
memmove
__std_exception_copy
__std_exception_destroy
__std_terminate
__C_specific_handler
__CxxFrameHandler3
memset
_CxxThrowException
memcmp
memcpy
msvcp140_app
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_BADOFF@std@@3_JB
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Throw_C_error@std@@YAXH@Z
_Mtx_lock
_Mtx_unlock
_Mtx_init_in_situ
_Mtx_destroy_in_situ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uncaught_exceptions@std@@YAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_errno
_exit
exit
_initterm_e
_get_narrow_winmain_command_line
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_initterm
terminate
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
api-ms-win-crt-string-l1-1-0
_wcsicmp
api-ms-win-crt-convert-l1-1-0
wcstoull
api-ms-win-crt-math-l1-1-0
__setusermatherr
pow
api-ms-win-crt-stdio-l1-1-0
__p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-core-synch-l1-2-0
SleepConditionVariableCS
WakeAllConditionVariable
InitializeConditionVariable
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemDirectoryW
GetSystemTimeAsFileTime
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
api-ms-win-core-delayload-l1-1-1
ResolveDelayLoadedAPI
api-ms-win-core-delayload-l1-1-0
DelayLoadFailureHook
api-ms-win-core-string-l1-1-0
CompareStringOrdinal
api-ms-win-core-path-l1-1-0
PathCchAppend
api-ms-win-core-file-l1-1-0
GetFileAttributesW
Sections
.text Size: 61KB - Virtual size: 61KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 35KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.didat Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1024B - Virtual size: 724B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ